VPC Peering: Connection, Routing, and When to Use Transit Gateway

VPC peering is a networking connection between two VPCs that enables private IP routing between them, per the AWS VPC docs. It’s non-transitive - if VPC A peers with B, and B peers with C, A cannot reach C. The team with 2-3 VPCs uses peering. The team with many VPCs (5+) uses Transit Gateway to avoid N² peering connections.

Table of contents

• The peering connection
• Routing
• Non-transitivity
• Inter-region peering
• Cross-account peering
• DNS resolution
• When to use Transit Gateway instead
• FAQ

The peering connection

# Create a peering connection from VPC-A to VPC-B
aws ec2 create-vpc-peering-connection \
  --vpc-id vpc-aaaa \
  --peer-vpc-id vpc-bbbb \
  --peer-region us-east-1

# Accept from VPC-B side
aws ec2 accept-vpc-peering-connection --vpc-peering-connection-id pcx-xxxxx

After both sides accept, the connection is active. The team that creates peering connections has 1-2 minute setup time.

Routing

Peering doesn’t auto-add routes. Update route tables:

# In VPC-A's route table, route 10.1.0.0/16 to pcx-xxxxx
aws ec2 create-route \
  --route-table-id rtb-aaaa \
  --destination-cidr-block 10.1.0.0/16 \
  --vpc-peering-connection-id pcx-xxxxx

The team that forgets to add routes has a peering connection that’s active but doesn’t route traffic.

Non-transitivity

If VPC-A peers VPC-B, and VPC-B peers VPC-C, VPC-A cannot reach VPC-C through the transitive chain. Each pair needs a direct peering.

3 VPCs: 3 peering connections. 4 VPCs: 6 peering connections. 10 VPCs: 45 peering connections (N²).

The team that has many VPCs hits the non-transitive limit. Transit Gateway solves this.

Inter-region peering

VPC peering across regions works:

aws ec2 create-vpc-peering-connection \
  --vpc-id vpc-aaaa --peer-vpc-id vpc-bbbb \
  --peer-region us-west-2

Inter-region peering has data transfer cost ($0.02-0.09/GB). The team that uses inter-region peering for DR accepts the data cost.

Cross-account peering

VPCs in different AWS accounts can peer. Both account owners must accept the connection from their respective sides. The team that uses cross-account peering for multi-account setups has explicit trust boundaries.

DNS resolution

By default, instances in VPC-A see VPC-B’s private IPs as their EC2 public IPs. To use private IPs:

# Modify peering attributes
aws ec2 modify-vpc-peering-connection-options \
  --vpc-peering-connection-id pcx-xxxxx \
  --options "DnsResolution={\"Dns64\":\"enabled\"}"

Or set accepter-dns-resolution on the accepter side.

When to use Transit Gateway instead

The team that has 5+ VPCs uses Transit Gateway:

• Transitive routing (A -> TGW -> B -> TGW -> C all work).
• Centralized egress/ingress.
• Simpler routing management.
• $0.05/hour per attachment ($36/mo per VPC).

The team that uses Transit Gateway accepts the cost for simplified topology.

FAQ

How much does VPC peering cost?

Free for the connection itself. Data transfer: $0.01/GB within AZ, $0.02/GB cross-AZ, $0.02-0.09/GB cross-region. The team that has heavy cross-VPC traffic sees significant transfer costs.

Can VPCs in different accounts peer?

Yes - cross-account peering works. Both account owners accept the connection from their sides.

What’s the difference between VPC peering and Transit Gateway?

Peering: point-to-point, non-transitive, free per connection. Transit Gateway: hub-and-spoke, transitive, $0.05/hour per attachment. The team with 2-3 VPCs uses peering; the team with 5+ uses TGW.

Can I peer across AWS regions?

Yes - inter-region peering works. Same data transfer cost model, but with the higher cross-region rate.

Does VPC peering support transitive routing?

No - VPC peering is non-transitive. Use Transit Gateway for transitive routing across many VPCs.

If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.

Useful related references:

• Services/Introduction