VPC Peering, Transit Gateway and Endpoints

What it is

Real environments use many VPCs, and they must talk to each other and to AWS services without crossing the public internet. AWS gives you several options, and the exam is about picking the right one for the size and shape of the design.

The options are VPC peering, AWS Transit Gateway, gateway endpoints, interface endpoints and PrivateLink.

How it works

VPC peering

A peering connection links two VPCs, in the same or different accounts and Regions. Traffic stays on the AWS network and uses private IP addresses.

• The CIDR blocks must not overlap.
• Peering is not transitive. If A peers with B and B peers with C, A cannot reach C through B.
• You must add routes in both VPCs' route tables that point to the peering connection.
• Security groups and network ACLs must allow the traffic.
• One side requests, the other accepts.

Peering is simple and cheap for a few VPCs, but the number of connections grows quickly as VPCs are added.

Transit Gateway

AWS Transit Gateway is a regional hub. You attach VPCs, VPN connections, Direct Connect gateways and other transit gateways (peering) to it, and it routes between them. Because every attachment connects to the hub, routing is transitive.

Transit gateway route tables control which attachments can talk to which. You can separate production from development by using different route tables. Each VPC subnet that needs the hub also needs a route to the transit gateway in its own route table.

Gateway endpoints

A gateway endpoint gives private access to Amazon S3 and Amazon DynamoDB only. It is a target in route tables, using a prefix list for the service, and there is no charge for the endpoint itself.

# AWS CLI: create a gateway endpoint for S3
aws ec2 create-vpc-endpoint \
  --vpc-id vpc-0123456789abcdef0 \
  --service-name com.amazonaws.us-east-1.s3 \
  --route-table-ids rtb-0priv1

Traffic from private subnets to S3 then stays on the AWS network and does not use a NAT gateway. An endpoint policy can limit which buckets are reachable.

Interface endpoints and PrivateLink

An interface endpoint puts an elastic network interface with a private IP address in your subnet. It uses AWS PrivateLink and works for many AWS services, such as Systems Manager, Secrets Manager and CloudWatch, and for services offered by other accounts. Private DNS can make the normal service name resolve to the endpoint's private address.

Interface endpoints cost per hour and per gigabyte of data. They use security groups, so you control who can reach them.

Exposing your own service

With PrivateLink, a service provider puts a Network Load Balancer in front of the service and publishes an endpoint service. Consumers create an interface endpoint to it. Traffic is one way, from consumer to provider, and the VPC ranges may overlap, because no routing between the VPCs is needed.

Choosing

• Two VPCs that need full connectivity: peering.
• Many VPCs, on premises links, and central control: Transit Gateway.
• Private access to S3 or DynamoDB at lowest cost: gateway endpoint.
• Private access to other AWS services, or to one service in another VPC: interface endpoint and PrivateLink.
• Overlapping CIDR ranges with a need to share one service: PrivateLink.