VPC peering scenarios
There are a number of reasons you might need to set up a VPC peering connection between your VPCs, or between a VPC that you own and a VPC in a different Amazon account. The following scenarios can help you determine which configuration is best suited to your networking requirements.
Scenarios
Peering two or more VPCs to provide full access to resources
In this scenario, you have two or more VPCs that you want to peer to enable full sharing of resources between all VPCs. The following are some examples:
-
Your company has a VPC for the finance department, and another VPC for the accounting department. The finance department requires access to all resources that are in the accounting department, and the accounting department requires access to all resources in the finance department.
-
Your company has multiple IT departments, each with their own VPC. Some VPCs are located within the same Amazon account, and others in a different Amazon account. You want to peer together all VPCs to enable the IT departments to have full access to each others' resources.
For more information about how to set up the VPC peering connection configuration and route tables for this scenario, see the following documentation:
For more information about creating and working with VPC peering connections in the Amazon VPC console, see Work with VPC peering connections.
Peering to one VPC to access centralized resources
In this scenario, you have a central VPC that contains resources that you want to share with other VPCs. Your central VPC may require full or partial access to the peer VPCs, and similarly, the peer VPCs may require full or partial access to the central VPC. The following are some examples:
-
Your company's IT department has a VPC for file sharing. You want to peer other VPCs to that central VPC, however, you do not want the other VPCs to send traffic to each other.
-
Your company has a VPC that you want to share with your customers. Each customer can create a VPC peering connection with your VPC, however, your customers cannot route traffic to other VPCs that are peered to yours, nor are they aware of the other customers' routes.
-
You have a central VPC that is used for Active Directory services. Specific instances in peer VPCs send requests to the Active Directory servers and require full access to the central VPC. The central VPC does not require full access to the peer VPCs; it only needs to route response traffic to the specific instances.
For more information about creating and working with VPC peering connections in the Amazon VPC console, see Work with VPC peering connections.