Are you looking to learn about AWS VPC peering? Well, if so, this video is for you. Please
subscribe and hit the bell to be informed of new cloud computing training videos every
Wednesday.
Hi, my name is Michael Gibbs, and I'm the founder and CEO of GoCloud Architects, and
we're an organization dedicated to providing high-quality cloud computing education. And
today we're going to be discussing VPC peering, and then we're also going to talk about how
to optimize VPC peering in the AWS environment.
First, what is VPC peering? Well, if you understand that you have your own VPC, which is kind
of a cross between your own virtual private cloud ... a cross between a virtual private
network and a virtual private data center. And I like to think of a VPC as a virtual
private data center, because if it was just a VPN, it would be network, but here you're
going to have, your servers, your low balancers, all of your tech is going to be inside of
your VPC, so that's your basically virtual data center inside of the AWS shared cloud
environment.
Now, let's say you want to connect to another organization that has a VPC through the AWS
environment. Well, there's really two ways you could do this. You could go to the internet
on both sides and you could create an IP sec tunnel between both sides and send all your
traffic through the internet, and then back into your peer. This works, it works perfectly,
but here's the thing. Your internet connectivity in the AWS environment is limited, and not
only is your internet connectivity limited, if you leave the AWS network to traverse the
internet backbone, it might take 10 internet service providers for you to reach the other
side. And you just can't guarantee internet performance.
Whatever happens on the internet happens on the internet. You can guarantee your one-gig
connection to the internet, but once it leaves your internet service provider, you don't
even know what's going to happen to it because routing constantly changes on the internet.
Whereas if you could do this on the AWS high-speed network, basically, and you could create like
a private wire between them, even if it would be a logical wire, you could route all your
traffic over the AWS network and have access to their high-performance backbone. And AWS
can guarantee the performance of their backbone because they built it and they manage it,
and it's all under their own autonomy.
VPC peering is a way to connect two VPCs together to share information. Maybe your organization
and a partner organization, or maybe your organization bought another company and they're
both on the AWS cloud, and so they can put them all in a single corporate environment.
They're going to do VPC peering between them. You may hear me talk about BGP peering, because
many of these concepts that we'll talk about all come out of the BGP routing world.
The next thing that we're going to talk about is something straight out of the iBGP protocol
for those of us with routing backgrounds. When you have VPCs, VPCs do not provide transit
to other VPCs. So let's say you have an environment. We've got VPC A here, VPC B here, and VPC
C here, and you have VPC peering set up between A and B, and B and C. A will be able to talk
to B, and C will be able to talk to B, but A will not be able to talk to C through B.
And the reason is, is these VPCs are not transitive.
We hear this come up all the time. We see AWS-certified solution, architect students
understand that VPC pairing isn't transitive because they've seen it on a practice test
somewhere, but they don't know what that means, so that's exactly what it means. Now, with
VPC peering, your communication is going to go over that AWS high-performance backbone,
and it's going to use a private IP addressing space. And your inner region VPC peering traffic
is going to be encrypted, so you've got secure high-performance connectivity with the VPC
peering.
And as you can see in this diagram, basically we have two VPCs and they're peering across
the AWS backbone. And let's talk about the two types of architectures that you would
build in a VPC peering environment. You would have something called hub and spoke and fully
meshed. And we're going to start with hub and spoke. A hub and spoke environment is
going to be a place where you've got a centralized location, and you can see that in this graphic,
and multiple remote locations, and they're all going to connect to each ... they're all
going to connect to the central location, and the central location is going to have
all the information and be able to communicate with those remote locations.
And let's talk about when this would be perfect. Let's say for an example you are a manufacturer
of products, and you have 10 different manufacturing partners along the way. You could set up your
hub and spoke VPC environment. You could VPC-peer with all of your 10 people, and you'll be
able to speak to all the 10 people, but the other 10 organizations will not be able to
talk to each other through your network. And would you really want to be the internet service
provider and the network service provider for all of your partner organizations while
you're paying for the traffic? You don't want to pay for their traffic, so that's the reason
why VPC peering is non transitive.
So because VPC pairing is not transitive, if every VPC needs to talk to each other,
and in many cases they don't, but if they do, you're going to have to do something called
fully mesh them. So as you can see in this graphic here, you have an environment where
we have three VPCs and they all have a connection to each other, and that's how you get around
them being non transitive, everybody talks to everybody. Works great, but here's where
it's going to break.
I mean, mathematically, it's not going to break, but here's where it's going to break
in practicality. In this environment, as you can see, we have three VPCs, which need three
connections. Great. As we grow the number of VPCs, those number of connections are going
to go up exponentially. So to put it into this case, if we have the three VPCs, we need
three connections.
Now let's say we have 10 VPCs that we're trying to peer. With these 10 VPCs we're trying to
peer, we're going to need a lot more than 10 connections. And the formula to figure
that out is actually going to be N times N minus one, divided by two. So let's say we
have 10 VPCs, we're going to take 10 times 10 minus one, which would give you 90, and
then we're going to divide that by two. So you're going to have 45 connections for just
10 VPCs that need to peer with each other.
And now, imagine 50 VPCs, 100 VPCs. It can become problematic very fast. So there is
an AWS solution to work around this, and that's called Cloud Hub. And for those of us that
come from a BGP perspective, and we think of iBGP that has this complex of fully-meshed
iBGP peers, and then we move to the route reflector environment where we could create
a hub and spoke environment and therefore that spoke would enable transitive routing,
then this is going to feel familiar.
As you can see in this diagram here, we have Cloud Hub and everybody connects to the central
hub and they can actually talk to each other through the central hub. So Cloud Hub is basically
a way to create a hub and spoke environment and break the rules of VPC peering by enabling
transitive routing. But by doing this, you're creating an environment that you're choosing
to do it, as opposed to it happening automatically. So there you know. Now you know about VPC
peering, you know about fully meshed BPC peering, hub-and-spoke VPC peering, and how to work
around the non-transitive rules with AWS Cloud Hub.
Thank you so much for watching this video. Please download our free AWS-certified solution
architect associate ebook. You can get it completely free, the link is in the description
below. And please join one of our free Monday, at 2:00 PM Eastern Time, Zoom meeting sessions
for the AWS-certified solution architect associate exam, where we invite you to ask any questions
that are certification related.
They can be about valid exams, though we will never go over any kind of proprietary questions
that they might ask, though, because I mean we're ... But we will answer any questions.
"Do you know the difference between a security group and a NACL? Do you have any test preparation
strategies?" We'll happily go over all of this. This is completely free and we do it
every Monday. So please, take advantage of some of these services if you're working on
your AWS-certified solution architect associate. Thank you so much for watching, we'll see
on a new video next Wednesday.