A company has two VPCs peered across two different AWS Regions via an active VPC peering connection. An engineer tries to add an inbound security group rule in the first VPC that references the security group ID of an instance in the second VPC — the same pattern they already use successfully for VPCs peered within a single Region. What happens?
- It works identically to the same-Region case, because VPC peering fully supports security group referencing regardless of whether the peered VPCs are in the same or different Regions
- It fails to reference the peer security group; AWS does not support referencing a security group across a VPC peering connection when the peered VPCs are in different Regions, so the engineer must reference the peer VPC's CIDR block instead
- It works, but only for outbound rules; inbound rules can never reference a security group across any VPC peering connection, same-Region or cross-Region
- It fails because VPC peering itself does not support connections between VPCs in different Regions at all
Why B? And why not the others?
Correct answer: B. It fails to reference the peer security group; AWS does not support referencing a security group across a VPC peering connection when the peered VPCs are in different Regions, so the engineer must reference the peer VPC's CIDR block instead
AWS explicitly documents that you cannot reference the security group of a peer VPC that's in a different Region; for cross-Region VPC peering connections, the workaround is to use the peer VPC's CIDR block as the rule's source or destination instead of a security group ID. This is a real, exam-relevant gap between same-Region and cross-Region peering behavior. The 'works identically' option is wrong because it ignores this documented limitation — same-Region peering does support security group referencing, but cross-Region peering does not, so the two cases are not identical. The 'outbound only' option is wrong because the limitation has nothing to do with rule direction; same-Region peering supports security group referencing for both inbound and outbound rules, and the cross-Region restriction likewise applies to both directions, not selectively to inbound rules. The 'peering doesn't support different Regions at all' option is wrong because inter-Region VPC peering is a fully supported AWS feature for routing traffic between VPCs in different Regions — the restriction is specifically on security-group-ID referencing, not on the peering connection's ability to exist or carry traffic.
Source: AWS VPC Peering Guide: 'Update your security groups to reference peer security groups' — 'You can't reference the security group of a peer VPC that's in a different Region. Instead, use the CIDR block of the peer VPC.'