Question

A company has three VPCs: VPC-A (10.0.0.0/16), VPC-B (10.1.0.0/16), and VPC-C (10.2.0.0/16). VPC-A is peered with VPC-B, and VPC-B is peered with VPC-C. Route tables and security groups have been configured to allow traffic between the directly peered VPCs, and instances in VPC-A can reach instances in VPC-B, and VPC-B can reach VPC-C. However, an application server in VPC-A cannot connect to a database in VPC-C. What is the most likely cause of this connectivity failure?

Accepted Answer

VPC peering connections are not transitive, so traffic cannot flow from VPC-A to VPC-C through VPC-B.

Answer

The security group on the VPC-C database is missing an inbound rule for the VPC-A CIDR range.

Answer

The route table in VPC-B does not have a route entry pointing VPC-A traffic to VPC-C.

Answer

VPC-A and VPC-C have overlapping CIDR blocks, which prevents peering traffic from being routed.