VPC security
Exposing an application to other VPCs
Section titled “Exposing an application to other VPCs”Three options, in increasing order of how little you give away.
Publish it on the internet. Everything in the public subnet becomes reachable from everywhere, and there is a great deal more to get right: TLS, authentication, rate limiting, WAF rules, DDoS protection. Appropriate for a genuinely public service, and a poor way to let one internal system talk to another.
Peer the VPCs. Straightforward for two or three, and the consumer can reach anything the route tables and security groups allow — which is the whole VPC, not just the one application. Every additional VPC needs another peering connection, and peering is not transitive, so the connection count grows as n(n−1)/2. If a VPC hosts several applications with different audiences, peering exposes all of them to each audience.
Publish the one service with AWS PrivateLink. Put the application behind a Network Load Balancer, create an endpoint service, and let consumers create interface endpoints. The consumer reaches that service and nothing else. Address ranges may overlap. Scales to thousands of consumers, and each connection is accepted individually.
For a single application consumed by other teams or other companies, PrivateLink is the right default. Peering is for joining networks that genuinely need to be joined. See AWS PrivateLink and PrivateLink for a SaaS provider.
VPC peering does not use a virtual private gateway
Section titled “VPC peering does not use a virtual private gateway”A common misconception. VPC peering creates a direct connection between two VPCs using AWS’s own network fabric. There is no gateway resource, no appliance and no bandwidth tier.
A peering connection is made of:
- the peering connection resource itself,
pcx-… - route table entries on both sides directing traffic through it
- the underlying AWS network fabric
- security groups and network ACLs, which still apply
A virtual private gateway is a different thing entirely, used for Site-to-Site VPN connections, Direct Connect private virtual interfaces and (historically) as a Direct Connect gateway association target. It connects a VPC to a network outside AWS.
| VPC peering | Virtual private gateway | |
|---|---|---|
| Connects | VPC to VPC, inside AWS | VPC to an external network |
| Implemented by | AWS network fabric | An AWS-managed gateway endpoint |
| Route table target | pcx-… | vgw-… |
| Bandwidth | No configured limit | Bounded by the VPN or circuit |
The peering connection shows up in a route table as though it were an interface, but it is software-defined networking rather than a gateway appliance in the path.