How Do eu-central-1 EC2 Instances Connect to a us-east-1 Database?
A company hosts its website on Amazon EC2 instances in the us-east-1 Region. The company is preparing to extend its website into the eu-central-1 Region, but the database must remain only in us-east-1. After deployment, the EC2 instances in eu-central-1 are unable to connect to the database in us-east-1. What is the MOST operationally efficient solution that will resolve this connectivity issue?
Community Insight
The question tests cross-Region VPC connectivity and security group rule direction; the trap is assuming a security group can be referenced across Regions or that the database's outbound rule controls client access.
Cross-Region VPC peering is the most operationally efficient way to connect the eu-central-1 EC2 instances to the us-east-1 database when the database security group allows inbound traffic from the instances' private IP range. This page confirms A and explains why security group references and VPN-based options do not resolve the issue correctly.
Many learners pick B because they want to reference the eu-central-1 instances' security group, but the database needs an inbound rule, and cross-Region security group referencing is not supported over VPC peering.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Cross-Region VPC peering provides direct private routing between the us-east-1 VPC containing the database and the eu-central-1 VPC containing the EC2 instances. Because the database must remain in us-east-1, its security group must explicitly allow inbound connections from the eu-central-1 instance private IP range. This is the most operationally efficient fix because it avoids VPN tunnel management while restoring database connectivity. Security group referencing cannot be used across Regions, so adding the private IP range is the workable security-group control in option A.Why the Other Options Are Wrong
Option B places the rule on the database security group's outbound side, but outbound rules control traffic leaving the database, not client connections arriving at it; it also relies on an unsupported cross-Region security group reference. Option C uses a VPN connection and then applies the source range to an outbound rule, which is both the wrong rule direction and more operationally heavy than peering. Option D uses a VPN connection and attempts to reference the eu-central-1 instances' security group inbound on the database security group, but cross-Region security group referencing does not work and the VPN adds unnecessary overhead. Peering is the lower-friction cross-Region connection for this database-access requirement.Community Comment Notes
The available community feedback is Bad_Mat's comment, which selected A and repeated "Create a VPC peering connection between the two Regions." That aligns with the technically correct path because peering provides the direct cross-Region connection and the database security group must admit the source private CIDR. No commenter argued for B, C, or D, so the community input does not contradict this analysis.Official Reference
Exam Strategy
When a database stays in one Region and clients move to another, eliminate VPN options first because peering is usually the more operationally efficient private connection. Then check the security group direction: the database needs an inbound rule, and cross-Region security group referencing is not supported, so a private CIDR range is the practical source.
Frequently Asked Questions
Why can't I reference the eu-central-1 security group in the database security group inbound rule?
Security group referencing does not work across Regions, so the database's inbound rule must use the eu-central-1 VPC or instance private CIDR instead.
Why is a VPN connection less efficient than VPC peering here?
A VPN adds tunnel and gateway management overhead, while VPC peering gives direct private routing between the two VPCs for this cross-Region database connection.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →