Question

A company has three VPCs: VPC-A (10.0.0.0/16), VPC-B (10.1.0.0/16), and VPC-C (10.2.0.0/16). A network engineer creates a VPC peering connection between VPC-A and VPC-B, and another between VPC-B and VPC-C. Route tables in all VPCs have been updated to point to the respective peering connections. Instances in VPC-A can reach instances in VPC-B, and instances in VPC-B can reach instances in VPC-C, but instances in VPC-A cannot reach instances in VPC-C. What is the cause and the most appropriate fix?

Accepted Answer

VPC peering is non-transitive; create a direct peering connection between VPC-A and VPC-C (or use a Transit Gateway) and add the corresponding routes.

Answer

The route tables in VPC-B are missing a route for 10.2.0.0/16; add a route in VPC-B pointing 10.2.0.0/16 to the VPC-A/VPC-C peering to enable transit.

Answer

Peering connections require security group referencing across VPCs; add VPC-C's CIDR to VPC-A's security group inbound rules to allow the transitive path.

Answer

Enable route propagation on VPC-B's peering connection so it advertises VPC-A and VPC-C routes to each other automatically.