VPC Peering

Scenario

Your company recently acquired a business as part of its expansion into Southeast Asia. While your production environment runs in Mumbai (ap-south-1), the acquired company’s workloads remain in Singapore (ap-southeast-1).

As the migration will take time, both environments must temporarily coexist. During this period, applications in Mumbai need to communicate securely with services in Singapore over private IP addresses without traversing the public internet.

Your task is to establish an Inter-Region VPC Peering connection between the Mumbai and Singapore VPCs.

Architecture Overview

Lab Note: In a real-world acquisition, each environment would typically reside in a separate AWS account. To keep this lab simple, both VPCs are created in the same AWS account. The configuration is nearly identical, with the only additional step in a cross-account deployment being that the peer account must accept the peering request.

Lab Setup

Before starting this project, ensure the following resources are already provisioned:

• One Amazon VPC in Asia Pacific (Mumbai) (ap-south-1)
• One Amazon VPC in Asia Pacific (Singapore) (ap-southeast-1)
• At least one subnet in each VPC
• One Amazon EC2 instance running in each VPC
• Security groups that allow SSH and ICMP traffic

Implementation

1. Review the Mumbai VPC configuration.

2. Review the Singapore VPC configuration.

3. Navigate to VPC → Peering Connections.

4. Click Create Peering Connection.

5. Configure the peering request.

Select your Local VPC. Since this lab uses a single AWS account, choose My Account. For a cross-account deployment, select Another Account and provide the peer AWS Account ID. Configure the remaining settings and click Create Peering Connection.

6. Accept the peering request.

Switch to the Singapore (ap-southeast-1) Region. Under Peering Connections, you’ll see the request in a Pending Acceptance state.

Click Accept Request.

7. Update the Route Tables

Although the peering connection has been established, traffic cannot flow until the route tables are updated. Each subnet uses its associated route table to determine where traffic is forwarded.

Add a route for the peer VPC CIDR block and use the VPC Peering Connection as the target.

Mumbai Route Table

Update the route table associated with the subnet containing the EC2 instance that needs to communicate with the Singapore VPC.

Add the Singapore VPC CIDR block and select the VPC Peering Connection as the target.

8. Singapore Route Table

Similarly, update the route table associated with the subnet containing the EC2 instance in Singapore.

Add the Mumbai VPC CIDR block and use the VPC Peering Connection as the target.

Validation

Allow ICMP (or SSH) traffic between the EC2 instances for connectivity testing.

Mumbai EC2

Private IP: 10.0.3.114

Singapore EC2

Private IP: 172.31.42.196

From the Mumbai EC2 instance, ping the Singapore EC2 instance using its private IP address.

If the ping succeeds, the Inter-Region VPC Peering connection has been configured successfully.

Wohhooo!🎉 The setup is now completed. This setup enables secure, low-latency communication over the AWS global network without exposing traffic to the public internet.