VPC Peering and Transit Gateway

A hand-drawn animated video with a voice and subtitles. Every fact in it comes from official AWS documentation on docs.aws.amazon.com (listed at the end).

TL;DR

A VPC peering connection joins two VPCs so they can send traffic using private IP addresses, as if they were one network. It works with another AWS account and across Regions.
One owner requests, the other accepts. Then both owners add a route to the other VPC's address block. Security groups must also allow the traffic.
Peering will not work if the two address blocks overlap, and it is not transitive: B cannot reach C through A.
Connecting many VPCs with peering needs a lane for every pair: 7 VPCs need 21, 100 need 4,950.
A transit gateway is a central hub in one Region. Each VPC (or office network) connects to it once, as an attachment, and the hub's route table moves traffic between them.

0:00

Video file: aws-understand/06-networking/23-vpc-peering-and-transit-gateway/video.mp4

The ideas

01The picture, part by part

Same city picture as the earlier videos AWS docs

AWS word	In the picture	What AWS docs say
`VPC`	Gated society	A virtual network for your AWS account, logically isolated (kept apart) from other virtual networks.
VPC peering connection	A private lane between two societies	A connection between two VPCs that lets you route traffic between them using private IP addresses.
Route table	A list of directions	A set of rules, called routes, that decide where network traffic from your VPC goes.
Security group	Guard at the flat door	Its rules must not block traffic to and from the peer VPC.
Transit gateway	A central bus station	A network transit hub that connects VPCs and on-premises (your own office) networks. It acts as a Regional virtual router.
Attachment	A road from a society to the bus station	Something connected to a transit gateway: a VPC, a VPN connection, a Direct Connect gateway, or a peering with another transit gateway.

Source: userguide/how-it-works.html, peering/what-is-vpc-peering.html, peering/vpc-peering-basics.html, tgw/what-is-transit-gateway.html

02How peering works

Request, accept, then routes on both sides AWS docs

Step	Who	What happens
1. Request	Owner of the requester VPC	Sends a request to the owner of the accepter VPC. The status is `pending-acceptance`. If nobody acts, it expires after 7 days.
2. Accept	Owner of the accepter VPC	Accepts the request. The connection becomes `active`.
3. Routes	Both owners	Each adds a route: destination = the other VPC's address block (CIDR), target = the peering connection (for example `pcx-11112222`).
4. Security groups	Both owners, if needed	Update rules so traffic to and from the peer VPC is not blocked.

Other facts from the docs: the other VPC can be your own, in another AWS account, or in another Region. AWS builds peering on the existing VPC network. It is "neither a gateway nor a VPN connection", and it does not use a separate piece of hardware, so there is "no single point of failure for communication or a bandwidth bottleneck".

In everyday words

Building the lane is not enough. Each society must also put up a sign that says "for that society's house numbers, take this lane". Without the sign on both sides, letters do not use the lane.

Source: peering/what-is-vpc-peering.html, peering/vpc-peering-basics.html (steps and lifecycle), peering/vpc-peering-routing.html

03Peering rules

The limits interviewers ask about AWS docs

Rule	What AWS docs say	Example
No overlapping address blocks	You cannot create a peering connection between VPCs with matching or overlapping CIDR blocks.	`10.0.0.0/16` and `10.0.128.0/17`: No
Not transitive	If A is peered with B and with C, you cannot route traffic from B to C through A. Make a direct B to C connection.	B to A to C: No
No borrowing gateways	If A has an internet gateway, resources in B cannot use it to reach the internet. The same goes for A's NAT device, VPN or Direct Connect.	B out through A's gate: No
One at a time	You cannot have more than one peering connection between the same two VPCs at the same time.	Two lanes A to B: No

Source: peering/vpc-peering-basics.html ("VPC peering limitations")

04Many VPCs: a messy web

Every pair needs its own connection AWS docs + AWS whitepaper

VPCs, all talking to each other	Peering connections needed	Source
7	21	Full-mesh example table in `peering-configurations-full-access.html`
100	4,950	Formula `n(n-1)/2` in the AWS whitepaper page `vpc-peering.html`

The AWS whitepaper says: "A large number of connections can be difficult to manage and scale."

Source: peering/peering-configurations-full-access.html, AWS whitepaper building-scalable-secure-multi-vpc-network-infrastructure/vpc-peering.html

05Transit gateway

One hub per Region, two kinds of route tables AWS docs

Idea	What AWS docs say
What it is	A network transit hub that connects VPCs and on-premises networks. It acts as a Regional virtual router.
Attachments	You can attach VPCs, VPN connections, Direct Connect gateways, peering connections with other transit gateways, and more.
Hub route table	Each attachment is associated with exactly one transit gateway route table.
Propagation	For a VPC attachment, the VPC's CIDR blocks are propagated (added automatically) to the transit gateway route table.
Your VPC's route table	When you attach a VPC, you must still add a route in your subnet route table so traffic goes to the transit gateway.

In everyday words

Every society builds one road to the bus station. The bus station has its own board of directions. Each society still puts up a sign: "for the other societies, go to the bus station".

Source: tgw/what-is-transit-gateway.html, tgw/how-transit-gateways-work.html ("Example architecture diagram", "Routing"), userguide/how-it-works.html

06Which one to pick

Only what AWS writes AWS docs + AWS whitepaper

Point	VPC peering	Transit gateway
Cost	No charge to create. You pay for data that crosses Availability Zones or Regions.	You pay every hour for each attachment, plus for the traffic it processes.
Best fit (AWS whitepaper)	Fewer than 10 VPCs. Lowest overall cost and highest aggregate (combined) performance.	Can connect thousands of VPCs, with all routing in one place.
Passing through	No (not transitive)	Yes, every attachment can reach the others through the hub, if the route tables allow it.

Source: peering/what-is-vpc-peering.html ("Pricing"), tgw/what-is-transit-gateway.html ("Pricing"), tgw/how-transit-gateways-work.html, AWS whitepaper pages vpc-peering.html and transit-gateway.html

Reference

—Sources

What	Where (official AWS docs)
What is VPC peering, pricing	vpc/latest/peering/what-is-vpc-peering.html
Peering steps, lifecycle, limitations	vpc/latest/peering/vpc-peering-basics.html
Route tables for peering	vpc/latest/peering/vpc-peering-routing.html
Full mesh of 7 VPCs	vpc/latest/peering/peering-configurations-full-access.html
What is a transit gateway, concepts, pricing	vpc/latest/tgw/what-is-transit-gateway.html
How transit gateways work, routing	vpc/latest/tgw/how-transit-gateways-work.html
How Amazon VPC works (route tables, connect VPCs)	vpc/latest/userguide/how-it-works.html
AWS whitepaper: VPC peering at scale	whitepapers/.../vpc-peering.html
AWS whitepaper: Transit Gateway	whitepapers/.../transit-gateway.html