Skip to main content
In this lesson we’ll explain VPC peering: what it is, when to use it, how it’s configured, and important limitations to be aware of. VPC peering lets two Virtual Private Clouds (VPCs) communicate privately using AWS’s network backbone once routing and security are configured. Before diving in, let’s review a key default behavior — resources in one VPC cannot communicate with resources in another VPC unless you explicitly enable connectivity. A VPC is a network boundary that isolates instances in different VPCs.
A slide titled "VPC Behavior" showing two Virtual Private Cloud boxes, each containing a compute instance icon. A line between them is crossed out, illustrating that a VPC acts as a network boundary preventing direct traffic.
What is VPC peering?
  • A VPC peering connection is a private network connection between two VPCs. After establishing the peering and updating route tables and security controls, instances in the peered VPCs can exchange traffic over private IP addresses.
  • VPC peering traffic stays within the AWS global backbone (unless crossing regions, in which case cross-region charges apply).
VPC peering supports:
  • VPCs in the same AWS account.
  • VPCs across different AWS accounts.
  • VPCs in the same region or in different regions (cross-region peering).
A simple diagram showing VPC Peering between two AWS accounts, each containing a Virtual Private Cloud (VPC). Each VPC has compute resources (EC2 icons) and they are connected by a central peering link.
Pricing overview
  • There is no additional charge to create or accept a VPC peering connection.
  • Data transfer charges apply for traffic traversing the peering connection. Rates depend on whether traffic stays in the same Availability Zone, crosses AZs, or crosses regions. Cross-region VPC peering incurs inter-region transfer charges.
Useful links: Pricing at-a-glance:
A slide titled "VPC Peering Pricing" with two points: no cost to create a VPC peering connection, and data transfer within an Availability Zone via VPC peering is free.
How to configure VPC peering (high level)
  1. Create and accept the peering connection
  • Initiator: One VPC owner requests a peering connection to the target VPC. If both VPCs are in the same account, you request a peering to your other VPC.
  • Acceptance: The owner of the target VPC accepts the request. After acceptance, the peering connection is in the active state.
  • Important: VPC CIDR ranges must not overlap. AWS will reject peering requests between VPCs with overlapping IP ranges.
  1. Update route tables (required)
  • Creating the peering connection does not automatically add routes. You must add routes on both sides to direct traffic destined for the other VPC to the peering connection.
  • Example:
    • VPC-1 CIDR: 10.1.0.0/16
    • VPC-2 CIDR: 10.2.0.0/16
  • Add a route in VPC-1’s route table:
    • Destination: 10.2.0.0/16
    • Target: pcx-0123456789abcdef0 (peering connection ID)
  • Add the reciprocal route in VPC-2’s route table:
    • Destination: 10.1.0.0/16
    • Target: pcx-0123456789abcdef0
Example AWS CLI command to add a route:
  1. Configure security groups and network ACLs
  • Security groups and NACLs are enforced for traffic between peered VPCs.
  • Security groups cannot reference security groups in another VPC. To allow cross-VPC traffic, allow the peer’s CIDR range in security group rules (or use other methods such as AWS PrivateLink or Transit Gateway for more complex setups).
  • Verify both inbound and outbound rules, and any applicable NACLs, on both sides.
Remember: creating the peering connection is only half the work — you must update route tables and security rules on both sides to allow traffic to flow.
Transitive peering — what is NOT supported
  • AWS does not support transitive routing for VPC peering. If VPC-1 peers with VPC-2, and VPC-2 peers with VPC-3, VPC-1 cannot reach VPC-3 through VPC-2 using the peering connections.
  • For multi-VPC connectivity where transit routing is required, consider using AWS Transit Gateway or a hub-and-spoke design.
Transitive peering is not supported. Each pair of VPCs that must communicate needs a direct peering connection or a Transit Gateway-based solution.
A diagram titled "VPC Peering" showing three virtual private cloud boxes labeled VPC 1, VPC 2, and VPC 3 with arrows indicating connections between them and a circled X on the direct link between VPC 1 and VPC 3.
Quick summary (VPC peering checklist)
  • Ensure VPC CIDR ranges do not overlap.
  • Create the peering request and accept it from the target account/VPC.
  • Add routes in both VPC route tables pointing to the peering connection ID.
  • Update security groups and NACLs to allow cross-VPC traffic (use CIDR ranges as security groups cannot reference groups in another VPC).
  • Verify data transfer costs (cross-AZ and cross-region charges may apply).
  • For transitive requirements or many VPCs, evaluate AWS Transit Gateway instead of many peering connections.
Further reading and references

Watch Video