How can I access resources in a peered VPC over site to site VPN?

Question

Hi, I have a peering connection setup between VPC A and VPC B. And I've also setup a site to site VPN connection to VPC A. How can I access the resources in VPC B through the site to site VPN connection?

Steve Kinsman · Accepted Answer

The short answer is you can't because VPC peering doesn't support transitive routing.  The rule for transitive routing is that the traffic must either originate or terminate on a network interface in the VPC. This is why VPC Peering isn't transitive - no network interface is involved, so no route table.  Also this is why Transit Gateway is transitive as its attachment points in a VPC use network interfaces.

The usual approach is for your site-to-site VPN to have VIFs to each VPC, or better still, to use Transit Gateway.

Another workaround is using a proxy instance to put a network interface into that VPC you want to transit through. See for example the standard "Transit VPC" Strategy that was more commonly used before Transit Gateway came along.

How can I access resources in a peered VPC over site to site VPN?

Relevant content