VPC Peering, VPC Endpoints and troubleshooting

VPC Peering

Peering connects two VPCs directly so they can talk over private IPs. Inter-region peering travels over the AWS backbone and is encrypted.

The flow: VPC A sends a request → VPC B accepts it → add routes on both sides (other side's CIDR → pcx-xxxx) → open SG/NACL for the other side's CIDR.

Three things to remember: - The two VPCs' CIDRs must not overlap (10.0.0.0/16 and 10.0.0.0/16 can't be peered). - Peering is non-transitive: A–B and B–C doesn't mean A can reach C. You need an extra A–C peering (or a Transit Gateway when you have many VPCs). - Routes on only one side → packets go out but never come back.

VPC Endpoint for S3

Use a Gateway Endpoint: AWS adds a route pl-xxxx (S3 prefix list) → vpce-xxxx to the route tables you choose. Traffic never leaves the AWS network, needs no IGW/NAT, and is free. Gateway endpoints exist only for S3 and DynamoDB; other services use an Interface Endpoint (an ENI with a private IP, billed).

flowchart LR
  subgraph A["VPC A 10.0.0.0/16"]
    EA[EC2 private]
    GW[(Gateway endpoint S3)]
  end
  subgraph B["VPC B 10.1.0.0/16"]
    EB[EC2]
  end
  subgraph C["VPC C 10.2.0.0/16"]
    EC[EC2]
  end
  EA <-- "pcx A-B" --> EB
  EB <-- "pcx B-C" --> EC
  EA -. "can't reach C (non-transitive)" .-x EC
  EA --> GW --> S3[(Amazon S3)]
  %% step EA: The private instance in VPC A talks to VPC B over the peering connection.
  %% step EB: VPC B is peered with both A and C.
  %% step EC: But A cannot reach C through B, because peering is not transitive.
  %% step GW: A gateway endpoint gives the private instance a route to S3 without a NAT or IGW.
  %% step S3: S3 traffic stays on the AWS network and costs nothing extra.

Troubleshooting in order

Work from the outside in: 1. Is the peering/endpoint active/available? 2. Route tables of the correct subnet, on both sides. 3. NACLs in both directions — remember ephemeral ports. 4. Security Group allows the other VPC's CIDR on the right port. 5. OS firewall — is the service actually listening?

Tools: ping, traceroute, VPC Flow Logs (REJECT = blocked by an SG/NACL).

Common commands