Question

A company operates three VPCs: a shared-services VPC (containing DNS and Active Directory), and two application VPCs (App-A and App-B). They currently have VPC peering connections from Shared-Services to App-A and from Shared-Services to App-B. Developers report that instances in App-A cannot reach instances in App-B, even though both can reach Shared-Services. The security team wants a scalable connectivity model that also allows centralized traffic inspection between all VPCs in the future. What is the correct explanation and recommended solution?

Accepted Answer

VPC peering is not transitive, so App-A cannot route to App-B through Shared-Services; migrate to a Transit Gateway with route tables that can direct inter-VPC traffic through a centralized inspection VPC.

Answer

The peering connections are missing security group references; add reciprocal security group rules between App-A and App-B to enable the transitive path through Shared-Services.

Answer

Peering supports transitive routing but requires enabling DNS resolution on both connections; enable 'Allow DNS resolution from peer VPC' on all peering connections.

Answer

Create a direct VPC peering connection between App-A and App-B and rely on Shared-Services as a NAT hop for inspection, since peering can chain through an intermediate VPC.