Guide

Linux and networking

Connecting VPCs and private endpoints

VPC peering links two networks, a transit hub links many, and PrivateLink publishes one service. Endpoints keep traffic to cloud APIs off NAT and the internet.

21 of 162 · 2 min read

Sooner or later one VPC must talk to another VPC, to your office network, or to a SaaS provider privately. There are several ways to connect them. Each one fits a different shape of network.

Peering is not transitive

VPC peering is a direct link between two VPCs. Its most important rule is that it is non-transitive. If A peers with B, and B peers with C, A still cannot reach C through B. The peering routes do not chain, and the CIDR ranges must not overlap.

Peering is simple and cheap for two or three networks. It becomes a problem at scale. Full-mesh peering for 20 VPCs needs 20 × 19 ÷ 2 = 190 peerings. A Transit Gateway (AWS) or a hub network (GCP patterns) gives each VPC one attachment to a central hub, so 20 VPCs need 20 attachments.

Publishing one service

PrivateLink (AWS) and Private Service Connect (GCP) expose one service through a private endpoint in the consumer's VPC. The consumer gets a network interface in its own subnet. The two networks never merge, so their address ranges can overlap. This suits a SaaS provider or a shared internal API.

Site-to-Site VPN runs over the internet, encrypted. It suits modest bandwidth and early hybrid setups. Direct Connect and Cloud Interconnect are dedicated circuits for steady, high-volume traffic. Encrypt sensitive traffic on them as well.

Trade-off

Peer two or three VPCs. Use a transit hub when you have many networks or on-prem links. Use PrivateLink when you want to publish one service without sharing a whole network.

Endpoints keep cloud APIs off NAT

Cloud APIs such as S3, ECR and Secrets Manager can be reached through the internet, but that costs NAT charges and depends on the NAT gateway. An endpoint keeps the traffic inside the provider's network.

  • Gateway endpoints (S3 and DynamoDB on AWS) are route-table entries. They have no hourly charge.
  • Interface endpoints create a network interface in your subnet. Use them for most other AWS APIs.

Google's equivalents are Private Google Access and Private Service Connect. Pulling container images through NAT is a common reason bills rise.

Common mistakes

  • Overlapping ranges. Peering fails, and routes blackhole traffic.
  • Hand-building a mesh of peerings. Use a transit hub before the count gets large.
  • Sending ECR and S3 traffic through NAT. An endpoint is cheaper and stays off the internet path.

Check yourself

  1. VPC A peers with B, and B peers with C. Can A reach C through B? Answer: No. Peering is non-transitive, so you need a direct peering or a transit hub.
  2. How many peerings does a full mesh of 20 VPCs need? Answer: 190, from 20 × 19 ÷ 2. A transit hub needs 20 attachments instead.

Key takeaways

  • Peering is point to point and non-transitive, and it needs non-overlapping ranges.
  • A transit hub scales to many networks and to on-prem links.
  • PrivateLink publishes a single service without merging networks.
  • Gateway and interface endpoints keep cloud API traffic off NAT.

Further learning

Next, when a connection fails, work through the steps in order: debugging connectivity.

Cloud networking and VPCs

VPCs, subnets, routing, NAT, security groups and private connectivity in AWS and GCP, plus a three-AZ reference architecture and how to debug when A cannot reach B.

Infrastructure as code with Terraform

Declaring infrastructure in code — providers, state, plans, modules, environments and the habits that keep apply safe.

Secrets management and encryption

Keeping credentials out of code and data safe at rest and in transit with KMS, Vault and envelope encryption — plus how to catch leaks before they become incidents.