Understanding VPC Peering Routing Failures

A common topic in the AWS SAA-C03 exam is troubleshooting connectivity between two Virtual Private Clouds (VPCs). VPC Peering allows private IP routing between networks, but common misconfigurations can cause packet drops.

1. Overlapping CIDR Blocks

VPC Peering cannot be established if both VPCs share overlapping IP ranges (e.g., both using 10.0.0.0/16). Ensure non-overlapping CIDRs during architecture planning.

2. Missing Route Table Entries

After creating a VPC Peering Connection (pcx-12345678), you must manually update the route tables in both subnets:

# Route Table VPC A (10.1.0.0/16)
Destination: 10.2.0.0/16 -> Target: pcx-12345678

# Route Table VPC B (10.2.0.0/16)
Destination: 10.1.0.0/16 -> Target: pcx-12345678

3. Security Group & NACL Constraints

Ensure that Security Groups in VPC B explicitly allow incoming traffic on required ports (e.g., Port 443 or 3306) from VPC A CIDR block (10.1.0.0/16).

4. Transitive Routing Limitation

VPC Peering does NOT support transitive routing. If VPC A is peered with VPC B, and VPC B is peered with VPC C, VPC A cannot communicate directly with VPC C. Use AWS Transit Gateway to solve this topology.