Amazon VPC private connectivity options: VPC Peering vs Transit Gateway vs PrivateLink

In the world of cloud computing, ensuring secure and efficient communication between various resources is paramount. Amazon Web Services (AWS) offers several options for private connectivity within and between Virtual Private Clouds (VPCs). This article explores three primary methods: VPC Peering, Transit Gateway, and AWS PrivateLink. Each method has its unique features, benefits, and use cases, making it essential to understand their differences to choose the right solution for your needs.

VPC Peering

VPC Peering allows you to connect two VPCs privately using AWS’s network, making them behave as if they were in the same network. This connection can be established between VPCs in the same AWS region or across different regions. Additionally, VPC Peering supports connections between VPCs owned by different AWS accounts.

Key Features of VPC Peering

• Private Connectivity: Enables private communication between VPCs.
• Cross-Region and Cross-Account: Supports VPCs in different regions and accounts.
• Non-Overlapping CIDRs: VPCs must have non-overlapping CIDR blocks.
• Route Table Updates: Requires updating route tables in each VPC’s subnets to ensure instances can communicate.

VPC Peering Limitations

• CIDR Overlap: VPCs must not have overlapping CIDR blocks.
• Non-Transitive: VPC Peering connections are not transitive; each VPC that needs to communicate must have a direct peering connection.
• Single Connection per VPC Pair: Only one VPC peering connection can be established between two VPCs.
• Connection Limit: Maximum of 125 VPC peering connections per VPC.

Invalid Scenarios for VPC Peering

• VPN or Direct Connect connection to on-premises network.
• Internet access through a peered VPC’s internet gateway.
• Internet access through a peered VPC’s NAT Gateway.
• Access to S3/DynamoDB through a VPC Gateway endpoint.

---

Transit Gateway

Transit Gateway allows customers to interconnect thousands of VPCs and on-premises networks in a hub-and-spoke model. It simplifies network management by centralizing connectivity.

Key Features of Transit Gateway

• Attachments: Supports attachments for VPCs, peering connections with other Transit Gateways, VPNs, Direct Connect Gateways, and third-party network appliances.
• Features: Includes multicast support, MTU, appliance mode, AZ consideration, and TGW Sharing.
• Architectures: Supports architectures like centralized traffic inspection, centralized egress and shared services.

Why Use Transit Gateway?

• Scalability: Supports up to 5000 attachments.
• Hybrid Connectivity: Enables hybrid connectivity via VPN and Direct Connect.
• Simplified Management: Reduces complexity in managing multiple VPC connections.

VPC Peering Connection with Multiple VPCs

When multiple VPCs need to communicate with each other using peering, you must create a full mesh of peering connections. This quickly becomes complex as the number of VPCs grows.

Transit Gateway with Multiple VPCs

A Transit Gateway acts as a central router for all connected VPCs, drastically simplifying connectivity management. Each VPC only needs a single attachment to the TGW.

Transit Gateway with On-Premises Connection

Transit Gateway integrates with AWS Site-to-Site VPN and AWS Direct Connect Gateway to extend your private network into AWS securely.

Transit Gateway Peering Across AWS Regions

Transit Gateway supports inter-region peering, allowing you to build a global private network between AWS regions without exposing traffic to the internet.

Important Considerations for Transit Gateway

• DNS Resolution: Supports DNS resolution for all VPCs attached to the TGW.
• RAM Sharing: Can be shared using Resource Access Manager (RAM) across AWS accounts.
• Billing: Billed per hour, per attachment, with data processing charges.
• Bandwidth: Supports up to 50 Gbps total VPN bandwidth with ECMP.
• MTU: Supports an MTU of 8500 bytes for traffic between VPCs and 1500 bytes for VPN connections.

VPC Peering vs Transit Gateway

Feature	VPC Peering	Transit Gateway
Architecture	One-to-One connection – Full Mesh	Hub and Spoke with multiple attachments
Hybrid Connectivity	Not supported	Supported via VPN and Direct Connect
Complexity	Simple for fewer VPCs, Complex as number increases	Simple for any number of VPCs and hybrid network connectivity
Scale	125 peering connections per VPC	5000 attachments per TGW
Latency	Lowest	Additional Hop
Bandwidth	No limit	50 Gbps per attachment
Security Group Reference	Supported	Supported (Inbound rules only)
Subnet Connectivity	For all subnets across AZs	Only subnets within the same AZ in which TGW attachment is created
Transitive Routing	Not supported	Supported
TCO	Lowest – Only Data transfer cost	Per attachment cost + Data transfer cost

---

AWS PrivateLink

AWS PrivateLink, in conjunction with VPC endpoints, enables secure and private connections between your VPC and supported AWS services, including those hosted by other AWS customers or partners.

Why Use VPC Endpoints?

• Private Communication: Enables secure communication between your VPC and AWS services without using the internet.
• Reduced Attack Surface: Removes the need for Internet Gateways, NAT devices, or VPNs, minimizing exposure.
• Broad Service Support: Works with AWS native services, partner services, and those hosted by other AWS customers.

Without VPC Endpoints and PrivateLink

Without PrivateLink, your traffic to AWS services travels over the public internet, even though both resources reside in AWS. This introduces additional latency, security exposure, and reliance on internet routing.

With VPC Endpoints and PrivateLink

With PrivateLink, your VPC connects privately to AWS or third-party services via local ENIs (Elastic Network Interfaces), ensuring traffic stays within the AWS network backbone.

VPC Endpoints and PrivateLink Overview

• Provide private network connectivity between VPCs and AWS services.
• Eliminate the need for Internet Gateways or NAT Gateways.
• Endpoints are redundant, horizontally scaled, and highly available.
• Gateway Endpoint: Access Amazon S3 and DynamoDB only.
• Interface Endpoint: Access services across accounts or other VPCs.
• Other endpoint types: Gateway Load Balancer, Resource, and Service-Network.

VPC Endpoints Powered by PrivateLink

• Interface Endpoint: For accessing services deployed in other VPCs and AWS accounts.
• Resource Endpoint: For specific resources.
• Service-Network Endpoint: For service networks.
• Support for IPv4 and IPv6: NAT and UDP traffic support.

Important Considerations for VPC PrivateLink

• Local IP Addresses: VPC endpoints create local IP addresses using ENI.
• Overlapping CIDR Support: Can connect services inside VPCs with overlapping CIDR blocks.
• High Availability: Create VPC endpoints across multiple Availability Zones.
• Security Groups: Uses Security Groups – inbound rules.
• Traffic Support: Supports IPv4 and IPv6 traffic over TCP and UDP.
• Access from Other Networks: Can be accessed from other networks like Peered VPCs, Transit Gateway, VPN, or Direct Connect.

VPC communication with overlapping CIDRs

PrivateLink enables communication between VPCs that use overlapping CIDR blocks without requiring routing changes.

VPC endpoint with security group

PrivateLink endpoints are associated with ENIs and protected by security group inbound rules for controlled access.

Access from Other Networks

PrivateLink endpoints can be accessed from external networks such as Peered VPCs, Transit Gateway, VPN, and Direct Connect.

AWS PrivateLink vs VPC Peering

• VPC Peering: Useful for many resources communicating between peered VPCs.
• PrivateLink: Ideal for allowing access to a single application hosted in your VPC without peering the VPCs.
• CIDR Overlap: VPC peering cannot be created with overlapping CIDRs, but PrivateLink supports it.
• Connection Limits: Maximum of 125 peering connections; no limit on PrivateLink connections.
• Traffic Origin: VPC peering enables bidirectional traffic origin; PrivateLink allows only the consumer to originate traffic.

Conclusion

Choosing the right private connectivity option in AWS depends on your specific requirements, including the number of VPCs, the need for hybrid connectivity, and the complexity of your network architecture. VPC Peering is ideal for simple, direct connections between a limited number of VPCs. Transit Gateway offers scalability and simplified management for larger, more complex networks. AWS PrivateLink provides secure, private connections to AWS services and other VPCs, especially useful for specific application access without full VPC peering. Understanding these options helps you design a robust, secure, and efficient network architecture on AWS.