Virtual Private Cloud:VPC peering connection

Connect three VPCs

When configuring routes for VPC peering, you have the following options:

• Set the destination CIDR block to the peer VPC's CIDR block. This allows all instances in both VPCs to communicate with each other and simplifies management.

• Configure more specific routes by setting the destination CIDR block to a vSwitch's CIDR block in the peer VPC or the IP address of a specific instance. This enhances security but requires you to manually update the route table when new instances need to communicate.

For example, routes in VPC1 point to the CIDR block of vSwitch 3 in VPC2 and the ECS instance ECS04 in VPC3. Therefore, resources in VPC1 can only communicate privately with resources in vSwitch 3 and ECS04. In contrast, routes in VPC2 and VPC3 point to their peer VPCs' CIDR blocks, allowing full communication between their resources.

Migrate from CEN to a VPC peering connection

Switch private network communication between two VPCs from Cloud Enterprise Network (CEN) to a VPC peering connection. Use this example when only pairwise connectivity between the two VPCs is required and you want a simpler topology at a lower cost. In a cross-account scenario, each account performs the operations for its own VPC.

Connect multiple VPCs to a central VPC

For example, branch VPCs can access services deployed in the central VPC, but the branch VPCs cannot communicate with each other. Typical scenarios include:

• Multi-department isolation: VPCs for different business departments cannot communicate with each other but must access shared services in the central VPC.

• Multi-user isolation: Services are deployed in a dedicated VPC for multiple users. The VPC of each user can communicate with the service VPC, but the VPCs of different users cannot communicate with each other.

Condition Key

During authorization, RAM looks up the resource directory of the peer account based on AcceptingAliUid (when creating a peering connection) or RequestingAliUid (when accepting a peering connection), and injects the following Condition Keys into the authorization context for matching against conditions in your custom policy.

Usage constraints:

Only vpc:CreateVpcPeerConnection and vpc:AcceptVpcPeerConnection inject the above Condition Keys. Other operations on peering connections, such as query, modify, and delete, are not affected.

When a request is denied by the policy, the error code Forbidden.NoPermission is returned with NoPermissionType set to ExplicitDeny. You can use the RequestId to trace the policy match in ActionTrail.

Select a restriction policy

When configuring policies, replace the resource directory ID, path, or account ID in the examples with the actual values for your organization. You can find the resource directory ID and path in the Resource Management console.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "vpc:CreateVpcPeerConnection",
        "vpc:AcceptVpcPeerConnection"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "acs:TargetRDId": ["rd-xxxxxx"]
        }
      }
    }
  ]
}

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "vpc:CreateVpcPeerConnection",
        "vpc:AcceptVpcPeerConnection"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotLike": {
          "acs:TargetRDPath": ["rd-xxxxxx/r-xxxxxx/fd-xxxxxx/*"]
        }
      }
    }
  ]
}

Create and attach the policy

Are cross-border peering connections supported?

Yes. Both non-cross-border and cross-border connectivity are supported.

• Non-cross-border: Connects two regions in the Chinese mainland, or two regions outside the Chinese mainland.

• Cross-border: Connects a region in the Chinese mainland to a region outside the Chinese mainland.Ensure that your account has completed business identity verification.

Cannot select the target VPC

Ensure that the selected region and account match the Region and Owner of the target VPC.

The requester region is displayed at the top of the page, and the current account is the requester. You specify the accepter account and region when you create the peering connection.

ECS with Docker communication failure

If your routing and security group configurations are correct, the issue is likely a conflict between the CIDR block of the Docker network interface and the destination CIDR block. Run ip addr to check whether the Docker network interface address conflicts with the destination CIDR block.

If a conflict exists, follow these steps to modify the Docker CIDR block.

• Stopping the Docker service or modifying its CIDR block interrupts your workloads. We recommend that you perform this operation during off-peak hours.

• When you modify the Docker CIDR block, ensure that it is compatible with the networking settings of any existing containers and applications to avoid potential connectivity issues.

1. Run sudo systemctl stop docker to stop the Docker service.

2. Run sudo vim /etc/docker/daemon.json to edit the Docker configuration file. Add the following content to the file and save your changes:

   The Docker configuration file is typically located at /etc/docker/daemon.json or /etc/docker/daemon.conf. The exact filename may vary.

   {
       "bip":"new Docker CIDR block"
   }

3. Run sudo systemctl start docker to start the Docker service and apply the changes.

RAM user receives a CDT permission error when creating a VPC peering connection

A RAM user has been granted the AliyunVPCFullAccess permission but receives an error indicating that the cdt:GetCdtServiceStatus permission is missing when creating a VPC peering connection. This occurs because VPC peering connections depend on the Cloud Data Transfer (CDT) service and require calls to CDT-related APIs. VPC permissions alone are insufficient.

Grant the RAM user one of the following permissions:

• AliyunCDTFullAccess: Full access to CDT.

• AliyunCDTReadOnlyAccess: Read-only access to CDT. This is suitable if the RAM user only needs to create peering connections and does not need to manage CDT resources.

Does a VPC peering connection affect public network access?

No. A VPC peering connection only adds private route entries and does not modify the default route. Public network traffic continues to be forwarded through existing NAT gateways, Elastic IP addresses, and other public routes.

Limitations

• You cannot create a VPC peering connection in the following scenarios:

  • The two VPCs belong to accounts on different Alibaba Cloud sites, for example, an account on the Alibaba Cloud China site and an account on the Alibaba Cloud International site.

• A VPC peering connection does not support transitive routing.

  For example, if VPC 1 is connected to VPC 2 and VPC 3 through separate VPC peering connections, VPC 2 and VPC 3 cannot communicate with each other through VPC 1.

  To enable communication between VPC 2 and VPC 3, you must create a separate peering connection between them and configure bidirectional routes.

  

• When a VPC is shared across multiple accounts, only the resource owner can create, modify, or delete a VPC peering connection. Resource users cannot perform these actions.

Billing

Intra-region VPC peering connections are free of charge, regardless of whether the VPCs belong to the same or different accounts.

For inter-region VPC peering connections, Cloud Data Transfer (CDT) charges a data transfer fee based on outbound traffic.

• The unit price is determined by the region pair and link type. Platinum and Gold link types are available, which offer different service levels.

• The billing cycle is hourly. If you switch the link type within a billing cycle, the rate for the higher service level applies for that entire cycle.

VPC peering connection lifecycle

After a requester sends a creation request, a VPC peering connection transitions through several states.

If you create a same-account VPC peering connection, the system automatically initiates and accepts the request, and the connection becomes Activated.

Supported regions

Quotas