Question

A company operates 40 AWS accounts, each with its own VPC using the overlapping CIDR block 10.0.0.0/16. Following an acquisition, the networking team must allow application servers in a new centralized services VPC (172.16.0.0/16) to reach a specific set of workloads in each of the 40 overlapping VPCs, without re-IPing any existing VPCs. All connectivity must be routable and support hundreds of ongoing TCP sessions. Which design meets these requirements?

Accepted Answer

In each of the 40 VPCs, place the target workloads behind a Network Load Balancer and expose them via PrivateLink endpoint services; create interface VPC endpoints in the services VPC to consume each service.

Answer

Attach all 40 VPCs and the services VPC to a Transit Gateway and add static routes for 10.0.0.0/16 pointing to each VPC attachment.

Answer

Create VPC peering connections between the services VPC and each of the 40 VPCs, then add specific /32 host routes to avoid the overlapping ranges.

Answer

Use a Transit Gateway with separate route tables per VPC and NAT the overlapping traffic using the Transit Gateway's built-in NAT capability.