VPC Peering: Connect Private Networks Securely
VPC peering connects two virtual networks as if they were one, letting them talk over private IPs. Use it to share files or access resources between VPCs across accounts or regions without going over the public internet.
Why it exists
Virtual Private Clouds (VPCs) are logically isolated by design. However, real systems often need to share data or services between these isolated networks. VPC peering was created to connect them privately and securely, without exposing traffic to the public internet or managing complex hardware.
The mental model
Think of VPC peering as a secure, private corridor connecting two separate office buildings (VPCs). People (instances) inside can walk between buildings as if they were one big campus, using internal room numbers (private IPs), without ever stepping outside onto the public street. The connection is direct and point-to-point.
How it works
AWS uses its existing, internal network infrastructure to create a direct one-to-one connection between two VPCs. It is not a gateway or a VPN, so it has no single point of failure or bandwidth bottleneck. Instances in either VPC communicate using their private IP addresses as if they were on the same network. All traffic between regions is automatically encrypted and stays on the AWS global backbone, never traversing the public internet.
When to use it
Use VPC peering when you need to facilitate data transfer between a small number of VPCs. This is common for sharing resources across different AWS accounts, allowing one application to access a database in another VPC, or replicating data to another region for geographic redundancy.
When not to use it
Avoid VPC peering for complex network topologies. The connections are not transitive: if VPC A is peered with VPC B, and VPC B is peered with VPC C, VPC A cannot communicate with VPC C through B. You would need a separate, direct peering connection between A and C. This becomes unmanageable as the number of VPCs grows.
One canonical example
You run a production application in one VPC and a shared analytics service in a separate VPC, managed by a different team in another AWS account. By peering the two VPCs, your application instances can directly and privately query the analytics service using its private IP address, without either service being exposed to the public internet.
Interview question
Which statement accurately describes a fundamental limitation of VPC peering?
- a.It necessitates traffic to pass over the public internet when connecting VPCs in different regions.
- b.It restricts connections to VPCs within the same AWS account and geographical region.
- c.It does not support transitive routing, meaning communication cannot pass through an intermediate peered VPC.Correct
- d.It introduces a single point of failure and potential bandwidth bottlenecks between connected VPCs.
Why? this is the answer
The card explicitly states that VPC peering connections are not transitive, meaning communication cannot pass through an intermediate VPC. This is a critical limitation for complex network designs. The other options contradict the card's description of VPC peering's security, reliability, and cross-account/region capabilities.
Just read this? Test yourself on what you have been reading.
Read the original → docs.aws.amazon.com
You just looked this up. Could you explain it out loud?
That is the part interviews actually test. Tezvyn takes questions like this one and gives you what the interviewer is really checking, the answer that lands, and the mistake that ends the conversation, in the four minutes before your next meeting.
The iPhone app is on the way
We are building it. Until it lands, nothing here is held back from you: every interview card, your saved cards, streaks and the job board all work in Safari, plus hundreds of free practice quizzes of thirty questions each. Sign in and it all carries over to the app the day it arrives.
Want it as an icon? Tap Share at the bottom of Safari, then Add to Home Screen. It opens full screen and the cards you have read stay available offline.
We are hiring for this. Open roles that interview on aws — each one lists the topics its interview covers.
See open roles