VPC A is peered with VPC B, and VPC B is separately peered with VPC C. An engineer expects instances in VPC A to now be able to reach instances in VPC C through VPC B. The connection fails. Why?
- VPC peering connections are not transitive; A must be peered directly with C
- The CIDR blocks of A and C must be identical for this to work
- Peering connections expire after 24 hours unless renewed
- VPC B must enable a NAT gateway to forward traffic between A and C
Correct answer: A. VPC peering connections are not transitive; A must be peered directly with C
VPC peering works strictly point-to-point: each connection only carries traffic between the two specific VPCs it links, and AWS does not route traffic across a chain of peering connections on your behalf. To let A reach C, the engineer must create a separate, direct peering connection between A and C, or replace the arrangement with a Transit Gateway, which does support transitive routing among its attachments. Option B is false; peering only requires non-overlapping CIDR blocks between the two peered VPCs, not identical ones — identical CIDRs would in fact make peering impossible to establish at all. Option C is invented; peering connections do not expire on any timer and remain active until deleted. Option D is wrong because NAT gateways translate addresses for internet-bound traffic and play no role whatsoever in routing between two peered VPCs.
Source: AWS VPC Peering docs: VPC peering connections — limitations (non-transitive)