Lecture 55: Hands On: VPC Peering across AWS regions
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：16:22
- 来源：Udemy Lecture 26073714
- Slide 数量：16
- 画面切换：00:11、02:17、03:03、03:15、03:53、04:23、04:39、06:43、07:40、09:50、11:07、12:28、13:53、14:33、15:41
扫描说明
逐条检查了 Udemy 页面中的 323 条 Transcript cue，并对全长 16:22 的视频画面进行扫描。讲师在拓扑图、步骤清单和控制台之间多次切换；按实际时间顺序及每次操作目标，共划分出 16 个 Slide / 实操小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. 跨区域 VPC Peering 实验导论
时间范围：00:00–00:11
总结 / Summary
中文
本实验在 Mumbai 与 N. Virginia 两个 AWS 区域（Region）之间建立 VPC 对等连接（VPC Peering），并验证两端 EC2 能通过私有 IP 通信。
English
This lab establishes VPC Peering between VPCs in the Mumbai and N. Virginia AWS Regions and verifies private-IP communication between EC2 instances.
Transcript
00:00 Hello and welcome to this lecture.
00:01 So as I said, we'll be now setting up the VPC peering
00:04 between two VPCs,
00:06 and if you want, you can also do an exercise on your own
00:09 by following the steps that have given.
2. 实验拓扑、CIDR 与 Requester/Acceptor
时间范围：00:11–02:17
总结 / Summary
中文
VPC-A 位于 Mumbai，CIDR 为 10.10.0.0/16，包含公有 EC2-A；VPC-B 位于 N. Virginia，CIDR 为 10.20.0.0/16，包含私有 EC2-B。非重叠 CIDR 满足 Peering 要求。创建连接的一方是请求方 VPC（Requester VPC），另一方必须作为接受方 VPC（Acceptor VPC）显式批准请求。
English
VPC-A is in Mumbai with CIDR 10.10.0.0/16 and public EC2-A, while VPC-B is in N. Virginia with CIDR 10.20.0.0/16 and private EC2-B. The CIDRs do not overlap. One side creates the peering request as the requester VPC, and the acceptor VPC must explicitly approve it.
Transcript
00:11 So in this set of what we are going to do is,
00:13 we should have two VPCs.
00:15 Now I have created this two VPCs into different AWS regions
00:20 as you can see, first VPC will be in Mumbai,
00:22 another one in North Virginia region.
00:25 And what we want to do is,
00:26 to establish the VPC peering connection
00:28 and then make sure the traffic from VPC A goes
00:32 through a VPC peering connection to the VPC B.
00:35 And for that, we have two EC2 instances in both the VPCs.
00:38 And then what we'll test is from instance A
00:40 we can reach to instance B, through the peering connection.
00:44 Now, in order to make sure it is going through VPC
00:48 peering connection, the instance B in a VPC B
00:49 we'll make it private EC2 instance,
00:51 so that there is no other way
00:53 that anyone can reach to that instance from outside.
00:56 Now instance A is launched as a public subnet
00:59 because we want to log in to that instance,
01:01 and from there we should be able
01:02 to test the connection to instance B.
01:04 But in ideal world maybe even this subnet could be private,
01:08 and then you should have some other mechanism
01:10 to get to this instance maybe you have some jump post
01:12 and from there you can get into instance A,
01:14 and from there you can get to instance B
01:16 through peering connection.
01:18 But we are keeping this setup quite simple.
01:21 IP address range, I have selected 10.10.0.0/16
01:25 for VPC A, and 10.20.0.0/16 for VPC B
01:30 of course, because I want non-overlapping CIDR
01:33 that's the limitation with VPC peering connection.
01:36 So let's do that,
01:37 I have just given the steps in the next slide
01:41 what we'll ultimately do is to set up
01:43 the peering connection between these two VPC.
01:46 And now, while you do that set up,
01:48 one of the VPC is requester VPC,
01:51 and another one is the acceptor VPC.
01:53 And it could be anywhere round.
01:55 So this would be a requester VPC,
01:57 and this would be acceptor VPC.
01:59 Now why this, because, no one should be able to send
02:02 or setup a peering connection between with your VPC,
02:06 unless you grant that, right?
02:08 And that's where this acceptor
02:10 and requester concept is there.
02:12 You should approve that request
02:13 and then only the connection will establish.
3. 实验步骤：两端网络与实例准备
时间范围：02:17–03:03
总结 / Summary
中文
VPC-A 需要互联网网关（Internet Gateway）、公有子网、默认互联网路由和可从讲师 IP SSH 的 EC2-A；VPC-B 只创建私有子网与 EC2-B，不配置 IGW。EC2-B 的安全组将只允许来自 VPC-A CIDR 的 SSH 和 ICMP。
English
VPC-A requires an Internet Gateway, public subnet, default internet route, and EC2-A reachable by SSH from the instructor's IP. VPC-B contains only a private subnet and EC2-B with no IGW. EC2-B's Security Group allows SSH and ICMP only from the VPC-A CIDR.
Transcript
02:17 Okay, so steps are fairly simple,
02:20 we'll create VPC in Mumbai region,
02:22 and we will create a public subnet inside that VPC-A.
02:27 And then we'll launch a public EC2 instance in VPC-A.
02:30 We'll open port 22 because we want to connect that over SSH
02:34 from my laptop
02:36 and that's it about a setup in VPC-A.
02:39 Similarly, we'll create a VPC-B in North Virginia
02:42 with different CIDR range,
02:44 and this time we'll create a private subnet in VPC-B.
02:48 Then we'll launch a private EC2 instance, in VPC-B,
02:52 and we will open maybe port 22 and ICMP traffic
02:56 for the CIDR range of VPC-A.
02:59 This is because, if you look at this diagram,
4. 拓扑复查：限制 EC2-B 的来源范围
时间范围：03:03–03:15
总结 / Summary
中文
由于 EC2-B 只应接收来自 VPC-A 的流量，其安全组（Security Group）来源使用 10.10.0.0/16，而不是开放到互联网。这样既满足测试需要，也保持最小权限。
English
Because EC2-B should receive traffic only from VPC-A, its Security Group source is 10.10.0.0/16 rather than the internet, satisfying the test while preserving least privilege.
Transcript
03:03 this instance will be receiving traffic only from this VPC.
03:08 So you can open those ports in security group
03:11 for the CIDR range of VPC-A.
5. 步骤复查：创建 Peering 并更新双方 Routes
时间范围：03:15–03:53
总结 / Summary
中文
VPC-A 作为请求方（requester），VPC-B 作为接受方（acceptor）。连接进入 Active 状态后，必须修改双方路由表（Route Table），分别把对端 CIDR 指向 VPC Peering Connection。
English
VPC-A acts as requester and VPC-B as acceptor. After the connection becomes Active, both route tables must be updated so each peer CIDR points to the VPC Peering connection.
Transcript
03:15 And that's where you would have to open that
03:17 in the security group.
03:19 Now, once you do that, most important thing
03:22 is to create a VPC peering connection.
03:24 Now, as I said, one of the VPC will be requester
03:28 and other one will be acceptor.
03:30 So in this case, VPC-A will be acceptor
03:31 and VPC-B will be...
03:34 Sorry, VPC-A will be requester
03:38 and VPC-B will be the acceptor VPC.
03:40 Once you set up the VPC peering connection,
03:43 you have to modify the routes in both route tables
03:46 on both sides of the VPC peering connection.
03:49 What that mean, here for the public subnet route table
6. 拓扑复查：双向路由是可达性的必要条件
时间范围：03:53–04:23
总结 / Summary
中文
Peering 不是自动路由传播机制。VPC-A 公有子网路由表必须包含到 10.20.0.0/16 的 Peering 路由，VPC-B 私有子网路由表必须包含到 10.10.0.0/16 的返回路由，否则单向或双向流量都无法完成。
English
Peering does not automatically propagate routes. VPC-A's public-subnet route table needs a route to 10.20.0.0/16 through the peering connection, and VPC-B's private-subnet route table needs the return route to 10.10.0.0/16.
Transcript
03:53 you need to modify the route table, and tell it that
03:57 if the traffic is going to VPC-B,
04:00 it has to flow through the VPC peering connection.
04:02 And same here as well.
04:04 The private subnet we route table should have that entry
04:09 which says if the traffic is going to, or coming from VPC-A,
04:12 it has to flow through the VPC peering connection.
04:16 That is the most important thing
04:17 and typically people forget about that, but remember that.
04:21 And once this is done,
7. 完整执行清单与连通性验证
时间范围：04:23–04:39
总结 / Summary
中文
资源、Peering 接受和双方路由配置完成后，从 EC2-A 登录并使用 ping 或 SSH 访问 EC2-B 私有 IP。该测试能证明流量确实经过跨区域 Peering，而非互联网路径。
English
After resources, peering acceptance, and routes on both sides are complete, the lab logs into EC2-A and uses ping or SSH against EC2-B's private IP. This proves that traffic traverses inter-Region peering rather than the internet.
Transcript
04:23 we are good on the networking side of it
04:25 and then we'll just log into EC2 instance A,
04:28 and from there, we'll check the connectivity to B
04:31 by doing maybe a SSH or pink.
04:34 So I hope that it's clear
04:35 and let's try to do that on our own.
8. 实操：在 Mumbai 构建 VPC-A 公有网络
时间范围：04:39–06:43
总结 / Summary
中文
在 Mumbai 创建 VPC-A（10.10.0.0/16）、IGW、公有子网（10.10.0.0/24）和专用路由表。路由表加入 0.0.0.0/0 指向 IGW，并显式关联公有子网，使其具备互联网入口。
English
In Mumbai, the instructor creates VPC-A (10.10.0.0/16), an IGW, a public subnet (10.10.0.0/24), and a dedicated route table. The route table receives a 0.0.0.0/0 route to the IGW and is explicitly associated with the subnet.
Transcript
04:39 So I'm in Mumbai region,
04:41 and I'm just going to create my VPC
04:43 I will call it VPC-A
04:45 and I will give some address range, 10.10.0.0/16
04:52 most of the things I'm keeping it as default.
04:56 The next thing as you understand,
04:57 we need to create internet gateway.
05:00 So I'll just create internet gateway with similar name
05:04 I'll call it a VPC-A-IGW.
05:08 Now in your case, your UI might look different
05:10 because AWs has changed the UIs,
05:13 but ultimately steps are same.
05:16 So I'm attaching internet gateway to my VPC,
05:20 these are the steps we have always been doing
05:22 nothing special about it.
05:23 Next we want to create public subnet in VPC-A,
05:27 select create that, let's select my VPC, VPC-A,
05:32 and the subnet name is public subnet.
05:39 Or give it a name so that we can identify it well.
05:43 And the CIDR block, we can say 10.10.0.0/24
05:48 and AZ, we can select that AZ 1a.
05:52 That's it, let's create a sub-net,
05:55 also we create our own route table as you understand,
05:59 that's better rather than using the main route table.
06:02 So let's create a corresponding route table,
06:05 and that's a public route table for VPC-A.
06:09 Let's create that, and once we create a route table,
06:13 we need to add a route for internet
06:15 to make that subnet as public.
06:18 So we'll say if the traffic is for the internet,
06:21 it has to flow to the internet gateway,
06:24 and then you have to save the routes.
06:27 Next thing don't forget about this
06:29 you have to associate this route table with your subnet.
06:32 Otherwise it is by default not associated with any subnet.
06:37 So we are just saving that.
06:38 Now, if you look at this architecture
06:40 that we just talked about,
9. 实操：启动公有 EC2-A
时间范围：06:43–07:40
总结 / Summary
中文
EC2-A 使用 Amazon Linux，放入 VPC-A 公有子网并启用公网 IP。新安全组（Security Group）只允许从讲师当前 IP 访问 SSH，实例用于作为跨区域测试的跳板端点。
English
EC2-A uses Amazon Linux, is placed in VPC-A's public subnet, and receives a public IP. A new Security Group allows SSH only from the instructor's current IP, making the instance the jump endpoint for the inter-Region test.
Transcript
06:43 we are almost done here
06:45 next thing we need to launch when you see EC2 instance
06:47 in this VPC, so let's do that.
06:49 So this is an EC2 for Mumbai region
06:53 I'm just going to launch a default,
06:56 Amazon Linux T2 micro instance.
06:59 Now, this is the step where we select our VPC
07:02 and we'll select a subnet make sure this EC2
07:05 has a public IP address,
07:07 so enable this if you see that as disabled by default.
07:10 And next, we are keeping most of the things as default.
07:15 I'm adding a tag to my EC2 instance, as EC2-A
07:20 and in the security group,
07:21 I'll be creating a new security group, say for EC2-A
07:26 and this will be just SSH from my IP address.
07:30 That's it.
07:31 Review and launch, and then I can select any SSH key pair
07:36 that I have, and that's it.
10. 实操：在 N. Virginia 构建 VPC-B 私有网络
时间范围：07:40–09:50
总结 / Summary
中文
在 N. Virginia 创建 VPC-B（10.20.0.0/16）、私有子网（10.20.0.0/24）和私有路由表。该 VPC 不创建 IGW，路由表只有本地路由并关联私有子网，因此其中实例不能直接访问互联网。
English
In N. Virginia, the instructor creates VPC-B (10.20.0.0/16), a private subnet (10.20.0.0/24), and a private route table. No IGW is created; the route table initially contains only the local route and is associated with the private subnet.
Transcript
07:40 Okay, so my first VPC has been set up.
07:44 You can see whatever is mentioned here, I have done that.
07:47 Now let's set up another VPC in North Virginia region
07:51 and create one private subnet and launch one
07:53 private EC2 instance.
07:55 So I'm in now not Virginia region
07:58 I'm just going to create a new VPC here,
08:00 now don't get confused the other VPC that you saw here,
08:03 VPC-A, is not the one that we just created,
08:06 let me delete it maybe to avoid the confusion.
08:14 Okay, so there are no VPCs here, is just the default one.
08:17 So let's create a new VPC, let's call it a VPC-B
08:21 and address I said it should not be overlapping,
08:24 with the Mumbai VPC.
08:26 So I'm just using 10.20.0.0/16, and creating a VPC.
08:31 Now here, I'm not really going to create internet gateway
08:34 because I don't want to create public subnet.
08:37 So I'm just going directly to the subnets
08:40 and I'll be creating a private subnet this time in VPC-B
08:45 and the subset name will be VPC-B private.
08:52 I can select any AZ,
08:54 I will give the address range 10.20.0.0/24,
08:59 that should be good.
09:01 And then creating a subnet.
09:03 Next of course, it's creating a route table
09:06 so I'm just doing that.
09:10 I'll create a new route table,
09:11 I will call it VPC-B, drive route table and creating that.
09:20 Once you create a route table,
09:21 of course you don't need to actually modify any routes
09:26 because there is just one default route as of now.
09:29 We want to just use as it is
09:31 there is no public route to internet,
09:33 because it's a private route table,
09:35 but make sure you associate this route table
09:37 with your subnets that you created, right?
09:40 And that's what we are doing.
09:42 Okay, so we are good with the networking setup
09:45 next, we want to launch an instance in this VPC,
11. 实操：启动私有 EC2-B 并限制 Security Group
时间范围：09:50–11:07
总结 / Summary
中文
EC2-B 放入 VPC-B 私有子网，不分配公网 IP。其安全组仅允许来自 VPC-A CIDR 10.10.0.0/16 的 SSH 和 ICMP，从而允许 Peering 测试流量但不开放公网访问。
English
EC2-B is launched in VPC-B's private subnet without a public IP. Its Security Group permits SSH and ICMP only from VPC-A's CIDR, 10.10.0.0/16, enabling the peering test without public exposure.
Transcript
09:50 so let's do that.
09:51 I'm just launching one instance.
09:55 Now this instance again is a private,
09:57 there is no connectivity to the internet,
10:01 so I'm gonna be selecting Amazon Linux
10:03 and most of the settings, I'll be taking as default.
10:11 Make sure you use the right VPC
10:12 and there' just one subnet
10:14 it will be populated automatically.
10:16 I don't want to give public IP, even if I give,
10:19 that does not make any sense because it's a private subnet.
10:22 And then I'll go ahead and add the tag,
10:27 I will call this instance as EC2-B
10:31 and the security group, this is important
10:34 because, you need to now look at this architecture
10:37 and see what should be the security group
10:39 of this instance B.
10:41 As I said it should allow the traffic from VPC-A CIDR range.
10:46 And as of now, what we want to allow is,
10:50 10.10.0.0/16 which is VPC-A,
10:55 and I also want to allow ICMP for the same range, that's it.
11:02 And launch this instance, and you're good with this setup.
12. 实操：建立 Peering 前验证 Ping 失败
时间范围：11:07–12:28
总结 / Summary
中文
讲师先通过公网 SSH 登录 EC2-A，再 ping EC2-B 的私有 IP。由于两个 VPC 此时完全隔离，测试超时，形成配置 Peering 前的基线。
English
The instructor first connects to EC2-A over public SSH and pings EC2-B's private IP. Because the VPCs are still isolated, the test times out, establishing the pre-peering baseline.
Transcript
11:07 So it will take some time for instances to be launched,
11:10 but I'm done with the network setup,
11:12 next, what I'm to do is to actually
11:15 create a peering connection between these two.
11:17 Now, as of now, these instances are isolated, right?
11:20 They're not instances, and we VPCs are isolated
11:23 there is no connection between these two
11:24 that means from instance A,
11:25 you can never reach to instance B.
11:27 Now let's try that and see if that's the case
11:30 and that's obvious, but let's just look that.
11:34 For this I need to get a private IP address of instance B,
11:38 which is this, I need to now log into instance A
11:42 and try to ping to this IP address and see if I can,
11:46 reach to this two instance.
11:47 I should not be because of course
11:48 I don't have any connectivity as of now.
11:51 So let's connect to instance A what a SSH.
11:53 And then from there, let's try to connect to EC2 instance B,
11:56 and without VPC peering, we'll see that we can't connect.
11:59 So I'm just grabbing the public IP of EC2 instance A,
12:02 I'm just going into my PuTTy
12:05 and I will be loading my SSH key,
12:08 and then I'll make sure that I can't connect
12:12 to EC2 instance B from there.
12:15 So that's it.
12:16 And then let's look at the EC2-B private IP address
12:20 and just let's try to ping.
12:23 And of course I can't,
12:24 because there is no network connectivity.
12:26 So now the important part,
13. 实操：创建并接受跨区域 Peering Request
时间范围：12:28–13:53
总结 / Summary
中文
在 Mumbai 从 VPC-A 创建 Peering，请求目标选择同一账户的 N. Virginia 区域与 VPC-B ID。请求进入 Pending acceptance 后，在 N. Virginia 控制台由 VPC-B 接受，使连接变为 Active。跨账户时还需提供对方 AWS 账户 ID。
English
From Mumbai, VPC-A creates a peering request targeting VPC-B in N. Virginia within the same account. VPC-B accepts the Pending acceptance request in the N. Virginia console, making the connection Active. Cross-account peering would additionally require the peer AWS account ID.
Transcript
12:28 let's try to create a VPC peering connection
12:32 from VPC-A to VPC-B.
12:35 So let's do that, let's create a peering connection
12:39 and the name is VPC-A to VPC-B,
12:43 the requester is my VPC-A,
12:46 and the other VPC is in same AWS account.
12:50 So I don't have to change that, but understand that
12:53 when the other VPC is in your customer's account
12:56 or someone else account,
12:58 then you'd have to give that VPCs account ID,
13:02 or account number.
13:03 And similarly for the region now,
13:06 the other VPC is in North Virginia,
13:08 so I'm just selecting that.
13:10 And then the VPC ID we need from the acceptor side.
13:13 So I'm just getting the VPC ID from North Virginia VPC.
13:19 So yeah, so this is a VPC and let's copy the VPC ID.
13:26 That's it, I think that's what we wanted to do,
13:29 and now the VPC connection is being set up.
13:33 So this is pending acceptance, as I said, in another VPC,
13:38 you have to accept that.
13:40 So let's go to the North Virginia console,
13:43 and now if you come here for the peering connection,
13:45 it will show you that this is pending for acceptance,
13:49 let's go there and accept the request.
14. Peering 已 Active 但缺少 Routes，Ping 仍失败
时间范围：13:53–14:33
总结 / Summary
中文
连接进入 Active 只表示双方已同意建立 Peering，不会自动修改路由。此时再次 ping 仍失败，说明控制面连接与可用数据路径是两个不同条件。
English
An Active status means that both sides accepted the peering relationship, but it does not modify routes automatically. The repeated ping still fails, demonstrating that control-plane peering and a usable data path are separate conditions.
Transcript
13:53 Okay, so bearing connection has been established,
13:56 and it is in active state,
13:58 you can see that.
13:59 That means peering has been set up,
14:01 but does that mean I can connect to instance B
14:04 from instance A?
14:06 So I'm just doing the ping again,
14:09 still I cannot.
14:10 And in instance, of course, the reason is because,
14:13 even though I do have the connectivity,
14:15 I haven't modified the routes on both the side of the VPC.
14:19 So if you see our architecture again,
14:22 we need to modify the public subnet route table here
14:25 and the private subnet route table here
14:27 and add the entry for peering connection.
14:32 So let's do that.
15. 实操：在双方 Route Tables 加入 Peer CIDR
时间范围：14:33–15:41
总结 / Summary
中文
Mumbai 的 VPC-A 路由表加入 10.20.0.0/16 指向 Peering Connection；N. Virginia 的 VPC-B 路由表加入 10.10.0.0/16 指向同一连接。两条路由共同构成请求与返回流量的双向路径。
English
VPC-A's route table in Mumbai receives a route for 10.20.0.0/16 through the peering connection, while VPC-B's route table in N. Virginia receives the reciprocal route for 10.10.0.0/16. Together they form the forward and return paths.
Transcript
14:33 I'm into again, back to the Mumbai region,
14:36 and let me go to the route table,
14:37 which I have attached to a public subnet here.
14:41 And there is a route we had created for internet,
14:45 but this time let's add a route and say,
14:47 if traffic is going to the VPC-B,
14:52 then it has to go through the peering connection,
14:55 which it populates automatically and save the routes.
14:59 Does that solve the problem alone?
15:02 It does not, because you have to do the same thing
15:06 on the other side of the network.
15:07 Now I'm into the VPC console of North Virginia,
15:12 we had a subnet and then we had a route table
15:14 which we had created, which is this.
15:17 And it had just one local route which comes by default.
15:21 Now I'm editing this and this time I'm saying if the traffic
15:25 is going to, or coming from VPC-A,
15:29 with this CIDR idea range,
15:31 then it has to also go to the peering connection
15:35 and it is here and save the routes.
16. 验证跨区域私网连通并清理资源
时间范围：15:41–16:22
总结 / Summary
中文
双方路由完成后，EC2-A 对 EC2-B 私有 IP 的 ping 成功，证明跨区域 VPC Peering 数据路径可用。实验结束后应删除 EC2、Peering Connection 和其他资源，避免持续费用。
English
After both routes are configured, EC2-A successfully pings EC2-B's private IP, proving that the inter-Region VPC Peering data path works. The EC2 instances, peering connection, and other lab resources should be removed afterward to avoid ongoing charges.
Transcript
15:41 Now, our setup is ideally complete.
15:44 Now, if you go here and just say ping,
15:47 you can see traffic started flowing
15:50 and that's complete our flow of VPC peering connection.
15:55 So just look at the video again, if you got confused,
15:58 what else are steps we followed, and why we did that,
16:01 and then you should also be able
16:03 to set up this peering connection.
16:05 Now, after you tried this as an exercise,
16:07 make sure you delete all the components they are EC2
16:09 machines and peering connection, which has a running cost
16:13 so make sure you delete everything after your exercise.
16:17 So I hope you are able to do that, and thank you.
整讲总结 / Overall Summary
中文
跨区域 VPC 对等连接（VPC Peering）的完整链路包含：非重叠 CIDR、Requester 发起、Acceptor 接受、双方路由表加入对端 CIDR，以及安全组（Security Group）允许流量。仅有 Active Peering 并不能通信；路由和返回路径缺一不可。本实验用先失败、后成功的 ping 明确验证了这些条件。
English
A complete inter-Region VPC Peering path requires non-overlapping CIDRs, a requester and accepting peer, routes to the peer CIDR in both route tables, and Security Groups that permit the traffic. An Active peering connection alone is not enough; forward and return routing are both mandatory. The lab verifies these conditions with a failed ping before routing and a successful ping afterward.
返回顶部 ↑