AWS, Azure & GCP · Cloud across providers
How does VPC peering work and when should you use it?
Short answer
Peering connects two VPCs with a direct private route, but it is non-transitive and requires non-overlapping CIDRs. For many networks, a hub-and-spoke transit gateway or shared VPC scales better than a full mesh of peering links.
Peering creates a private connection between two virtual networks. Traffic stays on the provider backbone, and each side must add routes and allow the traffic in its security controls. It is simple for a small number of networks and becomes difficult as the number grows.
Properties
- Non-transitive: if A peers with B and B with C, A cannot reach C through B
- CIDRs must not overlap, or routing is ambiguous
- Works across accounts and sometimes across regions, depending on provider
- A full mesh grows quadratically, which becomes hard to manage and audit
- DNS resolution and security groups must be configured separately
aws ec2 create-route --route-table-id rtb-123 --destination-cidr-block 10.1.0.0/16 --vpc-peering-connection-id pcx-123A transit gateway or hub-and-spoke topology centralises connectivity and routing policy. It costs more per attachment and adds a shared dependency, but it scales to many VPCs and simplifies hybrid connections. Shared VPC models are another option when one network must be centrally controlled.
Follow-ups you should expect
Interviewers use these to check whether the first answer was understanding or memorisation.
- 1Why is peering non-transitive?
- 2When would you choose a transit gateway over full-mesh peering?
- 3How do overlapping CIDRs affect peering?
- 4What security controls are still needed after peering?
Say it in the interview
Peering gives two VPCs a direct private route, but it is non-transitive and the CIDRs cannot overlap. That works for a few networks, but a full mesh grows quickly and becomes hard to audit. For many VPCs or hybrid connectivity I prefer a hub-and-spoke transit gateway, and I still add route segmentation, security groups and flow logs because peering is connectivity, not a security boundary.
Use this as a model, not a script. Saying it in your own words is what makes it survive follow-up pressure.
Related questions
Reading is step one
Now say it out loud.
Understanding an answer and delivering it under pressure are different skills. Rehearse this topic in a live AWS, Azure & GCP mock interview and get scored feedback on depth, clarity and confidence.