TransWikia.com

Unable to connect to remote service using AWS VPC Peering

DevOps Asked on December 9, 2021

I have a question regarding some AWS infra I’m trying to build. Due to legacy constraints, I have a service running in a remote VPC that I need to access, and I have a new service I’m developing in another VPC. the reason the 2 VPCs are separate is because the newer VPC is managed by Terraform and I am planning to migrate all the services into Terraform but it’s going to take a long time, so for the present time I want to connect the 2 VPCs using AWS VPC Peering (I own both VPCs and both services, I can control anything in this infrastructure, except for the remote service code and deployment details which is a black box).

The remote service I believe is deployed as a single EC2 instance, the new service is deployed using ECS Fargate with an ALB on top. There are 3 security groups involved; the remote instance security group, the ECS security group, and the ALB security group.

I looked at the documentation here as well as a bunch of related pages, and did the appropriate steps. In particular, I did:

  • Create the VPC Peering connection
  • Accept the peering connection
  • Add entries to both VPC routing tables where the destination is the other VPC’s CIDR block and the destination is the ID of the peering connection
  • Add a TCP exception to the remote service security group to allow incoming traffic from the ECS security group (by security group ID), and vice-versa
  • Check my Network ACL to make sure I have an Allow rule to accept traffic

For some reason, when I try to make my request over the peering connection, the request gets thrown into the void and never returns. It’s not logged on the remote server meaning that I don’t think it ever arrives. I spun up an EC2 instance inside the ECS security group and tried to call the remote resource manually (using curl) and that didn’t work either.

I’ve followed all the guides I could find and can’t figure this out, but I’m a newbie to AWS so maybe there’s something I missed. Does anyone have any other ideas? Thanks.

One Answer

How are you trying to connect to the remote service? - IP address, default internal/external DNS name or custom DNS name private/public hosted zone? Please compare the output of nslookup to the remote service in both the VPCs. If the IPs resolving are different, the traffic is trying to go through the public internet and not the peering connection.

It would most probably be the need to either share the private hosted zone with the peered VPC or share internal hostnames across the peering connection

Answered by Mikhail Advani on December 9, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP