Cross-Account VPC Peering for High Availability

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources. Design highly available and/or fault-tolerant architectures.

Short answer

A Set up a VPC peering connection between VPC-A and VPC-B to provide a scalable, highly available, and secure private network link without single points of failure.

Question

An application running on an Amazon EC2 instance in VPC-A needs to access files in another EC2 instance in VPC-B. Both VPCs are in separate AWS accounts. The network administrator needs to design a solution to configure secure access to EC2 instance in VPC-B from VPC-A. The connectivity should not have a single point of failure or bandwidth concerns.
Which solution will meet these requirements?
  1. Set up a VPC peering connection between VPC-A and VPC-B. Correct Answer
  2. Set up VPC gateway endpoints for the EC2 instance running in VPC-B.
  3. Attach a virtual private gateway to VPC-B and set up routing from VPC-A.
  4. Create a private virtual interface (VIF) for the EC2 instance running in VPC-B and add appropriate routes from VPC-A.

Key Takeaways

The question tests the ability to distinguish between peering (infrastructure-based) and gateway/VPN solutions (appliance-based) regarding high availability and bandwidth constraints.

To connect EC2 instances across separate AWS accounts securely without single points of failure, use VPC peering. This guide explains why peering is superior to gateways or VPNs for this scenario.

Common mistake: Choosing VPC Gateway Endpoints (B) because they sound more secure, but they only support S3 and DynamoDB, not EC2 traffic.

Expert Analysis

VPC Peering Eliminates Single Points of Failure

VPC peering connects two VPCs using the existing AWS infrastructure, functioning as a private network link without requiring gateways or physical hardware. This design ensures there is no single point of failure and avoids bandwidth bottlenecks associated with managed appliances. As noted in community comments, this approach allows direct communication between EC2 instances across different AWS accounts using private IPs.

Why Other Options Fail the Constraints

Option B is invalid because VPC gateway endpoints are restricted to S3 and DynamoDB; they cannot be used for EC2 instance-to-instance connectivity. Option C introduces a virtual private gateway and VPN connection, which creates a single point of failure at the customer gateway and limits bandwidth based on the tunnel capacity. Similarly, Option D relies on Direct Connect, which involves physical colocation and specific bandwidth tiers that do not fit the "no bandwidth concerns" requirement for simple VPC-to-VPC access.

The Trap: Overthinking Security

Candidates often choose Option B thinking it provides better isolation than peering. While endpoints offer high security for data services, they are architecturally incorrect here. Peering is the only solution that meets the strict HA and scalability constraints while allowing secure cross-account EC2 communication.

Official Reference

https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question mentions 'no single point of failure' or 'bandwidth concerns' regarding VPC connectivity, immediately rule out options involving gateways, VPNs, or NAT devices. These appliances introduce potential bottlenecks and failure points. Look for solutions that leverage native AWS infrastructure, such as VPC peering or Transit Gateway, which scale automatically.

Frequently Asked Questions

Can VPC peering be used between VPCs in different regions?

Yes, inter-region VPC peering is supported. It allows resources in VPCs located in different AWS regions to communicate privately.

Why can't I use a VPC endpoint for EC2-to-EC2 traffic?

VPC Endpoint Gateways are strictly designed for Amazon S3 and DynamoDB. They cannot route general EC2 instance traffic.

More SAA-C03 FAQ →

Community Votes

A
93%
B
7%

93% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 22 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 22

  1. cookieMr 👍 20 Answered A
    A VPC peering connection allows secure communication between instances in different VPCs using private IP addresses without the need for internet gateways, VPN connections, or NAT devices. By setting it up, the application running in VPC-A can directly access the EC2 in VPC-B without going through the public internet or any single point of failure. B is incorrect because VPC gateway endpoints are used for accessing S3 or DynamoDB from a VPC without going over the internet. They are not designed for establishing connectivity between EC2 instances in different VPCs. C is incorrect because it would require configuring a VPN connection between the VPCs. This would introduce additional complexity and potential single points of failure. D is incorrect because creating a private VIF and adding routes would be applicable for establishing a direct connection between on-premises infrastructure and VPC-B using Direct Connect, but it is not suitable for the scenario of communication between EC2 instances in separate VPCs within different AWS accounts.
  2. pentium75 👍 5 Answered A
    B is wrong because "VPC gateway endpoint" is for S3 or DynamoDB, not EC2 C is overkill, would require a second gateway in VPC-A, not be HA and have limited bandwidth D is wrong because VIF is for Direct Connect, has nothing to do with VPC-to-VPC communication
  3. michellemeloc 👍 5 Answered A
    "You can create a VPC peering connection between your own VPCs, or with a VPC in another AWS account." https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html
  4. waiyiu9981 👍 5 Answered A
    a public discussion thread on this question
  5. JayBee65 👍 4
    Your logic is correct but security is not a requirement here - the requirements are "The connectivity should not have a single point of failure or bandwidth concerns." A VPC gateway endpoint" would form a single point of failure, so B is incorrect, (and C and D are incorrect for the same reason, they create single points of failure).
Show 17 more comments
  1. im6h 👍 4
    No, VPC Peering can use across account. https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html
  2. PDR 👍 3 Answered A
    correct answer is A and as mentioned by JayBee65 below, key reason being that solution should not have a single point of failure and bandwidth restrictions the following paragraph is taken from the AWS docs page linked below that backs this up "AWS uses the existing infrastructure of a VPC to create a VPC peering connection; it is neither a gateway nor a VPN connection, and does not rely on a separate piece of physical hardware. There is no single point of failure for communication or a bandwidth bottleneck." https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html
  3. Faridtnx 👍 3 Answered A
    You can create a VPC peering connection between your own VPCs, or with a VPC in another AWS account. Peering within the same AZ is free of charge.
  4. mhmt4438 👍 3 Answered A
    Correct answer is A
  5. Ruffyit 👍 2
    AWS uses the existing infrastructure of a VPC to create a VPC peering connection; it is neither a gateway nor a VPN connection, and does not rely on a separate piece of physical hardware. There is no single point of failure for communication or a bandwidth bottleneck. https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html
  6. Aninina 👍 2 Answered A
    VPC peering allows resources in different VPCs to communicate with each other as if they were within the same network. This solution would establish a direct network route between VPC-A and VPC-B, eliminating the need for a single point of failure or bandwidth concerns.
  7. LuckyAro 👍 2 Answered B
    A VPC endpoint gateway to the EC2 Instance is more specific and more secure than forming a VPC peering that exposes the whole of the VPC infrastructure just for one connection.
  8. lostmagnet001 👍 2 Answered A
    I get a little confused about B and A but, because, with a VPC endpoint in B it will work too access from A.
  9. pentium75 👍 2
    B is about a Gateway endpoint, which can be used to connect to S3 or DynamoDB, NOT to another EC2 instance.
  10. Guru4Cloud 👍 2 Answered A
    A. Set up a VPC peering connection between VPC-A and VPC-B
  11. GPFT 👍 2
    vpc gw endpoint just dynamo and s3
  12. omoakin 👍 2
    DDDDDDDDDDDDDD
  13. drgabelive 👍 1 Answered A
    VPC peering creates a private network connection between two VPCs, even when those VPCs belong to different AWS accounts. Understand the problem The company has two VPCs in separate AWS accounts. - VPC-A: Contains the EC2 instance that needs to access files. - VPC-B: Contains the EC2 instance that stores the files. - The connection must be secure. - It must not have a single point of failure. - It must not have bandwidth concerns. The company needs private network connectivity between the two VPCs.
  14. MNotABot 👍 1
    https://www.bing.com/search?pglt=41&q=can+we+do+VPC+peering+across+AWS+accounts&cvid=48a8ceecc85a429c9ddd698b01055890&aqs=edge..69i57j0l8j69i11004.10897j0j1&FORM=ANNAB1&PC=LCTS
  15. omoakin 👍 1
    This is the only viable solution Create a private virtual interface (VIF) for the EC2 instance running in VPC-B and add appropriate routes from VPC-A
  16. satyaammm 👍 1 Answered A
    VPC peering is the most suitable here.
  17. Anmol_1010 👍 1
    D, VPC PEERINGVIS IN SAME ACCOUNT

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Scheduled scaling for a predictable morning EC2 traffic spike

S-grade

Improving RDS Performance with Provisioned IOPS SSD

S-grade

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide