Scenario Lab · 3 of 10

Cross-region VPC peering (Virginia ↔ Mumbai)

US aur India ke do VPCs private network pe jodo, latency naapo, aur inter-region limits samjho.

⏱ 1.5 hours

📶 Intermediate

💰 Cost: ~$0.05 + tiny data transfer

🧰 Skills: Inter-region peering, multi-region CLI, latency, cross-region SG rules

0 / 0 checks done

Scenario

Company ka main platform us-east-1 (N. Virginia) mein chalta hai. Lekin data residency ke niyamon ki wajah se Indian customers ke data ke liye ek nayi service ap-south-1 (Mumbai) mein chalani hai. US wale backend ko Mumbai wali service se private network pe baat karni hai. Management do sawal poochhta hai: "latency kitni hogi, aur data transfer ka kharcha kitna aayega?" Tumhe yeh network banana hai aur numbers ke saath jawab dena hai.

PL-065 course se — console preview

Peering request/accept ka console — yahan region alag-alag honge.

us-east-1 ap-south-1 ┌─── east-vpc 10.70.0.0/16 ───┐ inter-region ┌─── mumbai-vpc 10.80.0.0/16 ───┐ │ [east EC2] │◄══ VPC peering ═══►│ [mumbai EC2 : web :8080] │ │ route 10.80.0.0/16 → pcx │ (AWS backbone) │ route 10.70.0.0/16 → pcx │ └──────────────────────────────┘ └────────────────────────────────┘ Route 53 private zone "global.internal" → associated with both VPCs (both regions)

Requirements — solution tabhi complete jab yeh sab sach ho

Do alag regions mein do VPCs banani hain, aur unke CIDRs overlap nahi hone chahiye.
East instance se Mumbai instance ke private IP pe ping aur HTTP (port 8080), dono chalne chahiye.
mumbai-api.global.internal naam East VPC se resolve hona chahiye.
Tumhare notes mein latency ke numbers (ping ka average aur HTTP ka samay) aur 100 GB per month ke data transfer ke kharche ka ek line mein hisaab hona chahiye.

Hints (sirf zaroorat ho toh)

Har AWS CLI command ko sahi region batana zaroori hai, jaise --region ap-south-1. AMI IDs har region mein alag hoti hain, isliye har region ki AMI ID SSM parameter se nikaalo.
Inter-region peering mein request --peer-region ke saath bheji jaati hai, aur use peer region mein accept kiya jaata hai.
Cross-region peering mein security group rule mein peer VPC ka SG source nahi banaya ja sakta, isliye CIDR use karo.
IAM global service hai, isliye deepdive-ec2-role dono regions mein chalega.

Guided solution dekho (pehle khud try karo!)

Dono regions mein VPC + instance

Pehle kaam ka folder banta hai aur Mumbai server ke liye web-userdata.sh likhi jaati hai. Yeh server pe ek chhota web server port 8080 pe chalati hai, jo "Hello from Mumbai" wala page dikhata hai. East server ko kuch nahi chalana, isliye uske liye khaali user-data file banti hai.

Phir mkvpc function banaya jaata hai, jo diye gaye region mein saara kaam karta hai. Woh us region ki AMI ID nikaalta hai; VPC, subnet, internet gateway aur route table banata hai; aur ek SG banata hai jo sirf doosri VPC ke CIDR se ping (ICMP) aur port 8080 allow karta hai. Aakhir mein woh instance launch karke uske IDs variables mein rakh deta hai.

Function ek baar us-east-1 ke liye aur ek baar ap-south-1 ke liye chalta hai. Uske baad Mumbai instance ke chalu hone ka intezaar karke uska private IP nikaala jaata hai.

export TYPE=t3.micro
mkdir -p ~/deepdive/scn3 && cd ~/deepdive/scn3
cat > web-userdata.sh <<'EOF'
#!/bin/bash
mkdir -p /opt/www
echo "Hello from Mumbai ($(hostname))" > /opt/www/index.html
cat > /etc/systemd/system/web.service <<'UNIT'
[Unit]
Description=tiny web
[Service]
ExecStart=/usr/bin/python3 -m http.server 8080 --directory /opt/www
Restart=always
[Install]
WantedBy=multi-user.target
UNIT
systemctl daemon-reload && systemctl enable --now web
EOF
echo '#!/bin/bash' > empty.sh

mkvpc() {   # name region cidr subnet peer-cidr userdata
  local R=$2 AMI VPC SUB IGW RT SG IID
  AMI=$(aws ssm get-parameter --region $R --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text)
  VPC=$(aws ec2 create-vpc --region $R --cidr-block $3 --tag-specifications "ResourceType=vpc,Tags=[{Key=Name,Value=$1},{Key=Project,Value=deepdive-scn3}]" --query Vpc.VpcId --output text)
  AZ=$(aws ec2 describe-availability-zones --region $R --query 'AvailabilityZones[0].ZoneName' --output text)
  SUB=$(aws ec2 create-subnet --region $R --vpc-id $VPC --cidr-block $4 --availability-zone $AZ --query Subnet.SubnetId --output text)
  aws ec2 modify-subnet-attribute --region $R --subnet-id $SUB --map-public-ip-on-launch
  IGW=$(aws ec2 create-internet-gateway --region $R --query InternetGateway.InternetGatewayId --output text)
  aws ec2 attach-internet-gateway --region $R --internet-gateway-id $IGW --vpc-id $VPC
  RT=$(aws ec2 create-route-table --region $R --vpc-id $VPC --query RouteTable.RouteTableId --output text)
  aws ec2 create-route --region $R --route-table-id $RT --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW >/dev/null
  aws ec2 associate-route-table --region $R --route-table-id $RT --subnet-id $SUB >/dev/null
  SG=$(aws ec2 create-security-group --region $R --group-name $1-sg --description "$1" --vpc-id $VPC --query GroupId --output text)
  aws ec2 authorize-security-group-ingress --region $R --group-id $SG \
    --ip-permissions "IpProtocol=icmp,FromPort=-1,ToPort=-1,IpRanges=[{CidrIp=$5}]" "IpProtocol=tcp,FromPort=8080,ToPort=8080,IpRanges=[{CidrIp=$5}]" >/dev/null
  IID=$(aws ec2 run-instances --region $R --image-id $AMI --instance-type $TYPE --subnet-id $SUB --security-group-ids $SG \
    --iam-instance-profile Name=deepdive-ec2-role --user-data file://$6 \
    --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=$1-host},{Key=Project,Value=deepdive-scn3}]" \
    --query 'Instances[0].InstanceId' --output text)
  eval "${1}_VPC=$VPC ${1}_RT=$RT ${1}_SG=$SG ${1}_IID=$IID"
  echo "$1 ($R): vpc=$VPC instance=$IID"
}
mkvpc east   us-east-1  10.70.0.0/16 10.70.1.0/24 10.80.0.0/16 empty.sh
mkvpc mumbai ap-south-1 10.80.0.0/16 10.80.1.0/24 10.70.0.0/16 web-userdata.sh
aws ec2 wait instance-running --region ap-south-1 --instance-ids $mumbai_IID
MUM_IP=$(aws ec2 describe-instances --region ap-south-1 --instance-ids $mumbai_IID --query 'Reservations[0].Instances[0].PrivateIpAddress' --output text)
echo "Mumbai private IP: $MUM_IP"

Inter-region peering: request (Virginia) → accept (Mumbai)

Yeh block Virginia ki East VPC se Mumbai ki VPC tak peering ki request bhejta hai; --peer-region batata hai ki doosri VPC kis region mein hai. Phir Mumbai region mein request ke dikhne ka intezaar kiya jaata hai aur use wahin accept kiya jaata hai. 10 second ruk ke dono regions ki route tables mein doosri VPC ke CIDR ka peering route joda jaata hai, aur aakhir mein peering ka status dikhaya jaata hai, jo active hona chahiye.

PCX=$(aws ec2 create-vpc-peering-connection --region us-east-1 --vpc-id $east_VPC \
  --peer-vpc-id $mumbai_VPC --peer-region ap-south-1 \
  --query VpcPeeringConnection.VpcPeeringConnectionId --output text); echo $PCX
aws ec2 wait vpc-peering-connection-exists --region ap-south-1 --vpc-peering-connection-ids $PCX
aws ec2 accept-vpc-peering-connection --region ap-south-1 --vpc-peering-connection-id $PCX >/dev/null
sleep 10
aws ec2 create-route --region us-east-1  --route-table-id $east_RT   --destination-cidr-block 10.80.0.0/16 --vpc-peering-connection-id $PCX >/dev/null
aws ec2 create-route --region ap-south-1 --route-table-id $mumbai_RT --destination-cidr-block 10.70.0.0/16 --vpc-peering-connection-id $PCX >/dev/null
aws ec2 describe-vpc-peering-connections --region us-east-1 --vpc-peering-connection-ids $PCX --query 'VpcPeeringConnections[0].Status.Code'

🖱 Console se bhi ho sakta hai

Region selector us-east-1 pe rakho → Peering connections → Create → Local VPC east, "Another region" chuno → ap-south-1 → VPC ID mumbai wala daalo (dropdown nahi milega, ID paste karna padega) → Create.
Region selector ap-south-1 pe switch karo → Peering connections mein pending request dikhega → Accept.
Dono regions mein apni route table mein doosre CIDR → target peering connection.

PL-065 course se — asli console reference

Wahi peering flow, bas requester aur accepter alag-alag region (us-east-1 aur ap-south-1) mein honge.

Cross-region SG reference try karo (fail hona chahiye)

Yeh command jaan-boojh ke Mumbai SG mein ek aisa rule jodne ki koshish karti hai jiska source Virginia wala East SG ho:

aws ec2 authorize-security-group-ingress --region ap-south-1 --group-id $mumbai_SG \
  --ip-permissions "IpProtocol=tcp,FromPort=22,ToPort=22,UserIdGroupPairs=[{GroupId=$east_SG,VpcPeeringConnectionId=$PCX}]"

Isme error aana chahiye, kyunki doosre region ki VPC ke SG ko source nahi banaya ja sakta. Isiliye Step 1 mein CIDR (10.70.0.0/16) use kiya gaya tha. Agar kabhi AWS yeh support kar de aur command chal jaaye, toh rule ko turant hata dena, kyunki port 22 ki koi zaroorat nahi hai.

Ek private DNS zone, do regions ki VPCs

Pehli command global.internal naam ka private hosted zone East VPC ke saath banati hai. Doosri command usi zone ko Mumbai region ki VPC se bhi jodti hai; Route 53 global service hai, isliye ek zone alag-alag regions ki VPCs se jud sakta hai. Teesri command mumbai-api.global.internal naam ka A record banati hai, jo Mumbai server ke private IP ki taraf hai.

ZONE=$(aws route53 create-hosted-zone --name global.internal --caller-reference scn3-$(date +%s) \
  --vpc VPCRegion=us-east-1,VPCId=$east_VPC --hosted-zone-config PrivateZone=true \
  --query HostedZone.Id --output text | cut -d/ -f3)
aws route53 associate-vpc-with-hosted-zone --hosted-zone-id $ZONE --vpc VPCRegion=ap-south-1,VPCId=$mumbai_VPC
aws route53 change-resource-record-sets --hosted-zone-id $ZONE --change-batch "{\"Changes\":[{\"Action\":\"UPSERT\",\"ResourceRecordSet\":{\"Name\":\"mumbai-api.global.internal\",\"Type\":\"A\",\"TTL\":60,\"ResourceRecords\":[{\"Value\":\"$MUM_IP\"}]}}]}"

✓ Verification tests

Latency naapo

Console ko us-east-1 pe rakho aur Session Manager se east-host mein jao. Neeche ki pehli command 10 pings ka average samay batati hai (angle brackets mein Mumbai ka private IP daalo). Doosri command naam se web page laati hai. Teesri command paanch baar request bhej ke har baar connection banne ka samay aur kul samay dikhati hai:

ping -c 10 <MUM_IP> | tail -1                                     # rtt avg ~180-220 ms
curl -s http://mumbai-api.global.internal:8080/                   # Hello from Mumbai
for i in 1 2 3 4 5; do curl -s -o /dev/null -w "%{time_connect}s connect, %{time_total}s total\n" http://mumbai-api.global.internal:8080/; done

In numbers ko compare karo. Ek hi AZ ke do instances ke beech ping lagbhag 0.1–0.5 ms hota hai, do AZs ke beech lagbhag 1 ms, aur Virginia se Mumbai tak lagbhag 200 ms, kyunki data ko fiber mein lagbhag 13,000 km jaana padta hai aur roshni ki speed ki bhi seema hai. Har HTTP request mein kam se kam ek extra round trip (TCP handshake) lagta hai. Isiliye bahut saari chhoti-chhoti calls karne wali cross-region APIs dheemi hoti hain, aur unke liye batching, async kaam aur caching use karni chahiye.

Acceptance criteria (verify)

Ping aur HTTP, dono private IP aur naam pe chale, aur tumne average latency note kar li.
Tum samjha sakte ho ki time_connect lagbhag ek round trip (RTT) ke barabar kyun hai.

Cost ka hisaab likho

Inter-region data transfer ka kharcha lagbhag $0.02 per GB hai, jo har us direction pe lagta hai jisme data region se bahar jaata hai. Exact rate region pair ke hisaab se AWS ke pricing page pe check karo. Is hisaab se 100 GB per month ka kharcha lagbhag $2 per month hoga. Same region aur same AZ ke andar peering traffic muft hai, jabki alag AZs ke beech lagbhag $0.01 per GB har direction mein lagta hai. Peering connection ka apna koi hourly charge nahi hota, jabki Transit Gateway ka hota hai.

Acceptance criteria (verify)

Tumhare notes mein latency ke numbers, 100 GB per month ke kharche ka andaaza, aur "cross-region calls kab avoid karni chahiye" likha hai.

Break & Fix

Mumbai ki route table se 10.70.0.0/16 wala route hatao; ab ping fail hoga. Phir Mumbai SG se ICMP wala rule hatao aur route wapas laga do; ab ping phir fail hoga, lekin HTTP chalega. Har baar V1 ki commands chala ke khud tay karo ki problem route ki hai ya firewall ki.

Challenge — no steps given

Mumbai mein ek S3 bucket banao aur East instance se usme data likho, pehle internet ya NAT ke raaste (public endpoint se). Phir socho ki kya East VPC ka S3 gateway endpoint Mumbai wale bucket ke kaam aayega. (Jawab hai nahi, kyunki gateway endpoints sirf usi region ke liye kaam karte hain.) Cross-region private access ke liye aur kya options hain, yeh bhi pata karo.

🧹 Cleanup (dono regions!)

Yeh commands DNS record delete karti hain, zone se Mumbai VPC ko alag karke zone delete karti hain, dono regions ke instances terminate karti hain, aur peering delete karti hain:

aws route53 change-resource-record-sets --hosted-zone-id $ZONE --change-batch "{\"Changes\":[{\"Action\":\"DELETE\",\"ResourceRecordSet\":{\"Name\":\"mumbai-api.global.internal\",\"Type\":\"A\",\"TTL\":60,\"ResourceRecords\":[{\"Value\":\"$MUM_IP\"}]}}]}"
aws route53 disassociate-vpc-from-hosted-zone --hosted-zone-id $ZONE --vpc VPCRegion=ap-south-1,VPCId=$mumbai_VPC
aws route53 delete-hosted-zone --id $ZONE
aws ec2 terminate-instances --region us-east-1  --instance-ids $east_IID >/dev/null
aws ec2 terminate-instances --region ap-south-1 --instance-ids $mumbai_IID >/dev/null
aws ec2 delete-vpc-peering-connection --region us-east-1 --vpc-peering-connection-id $PCX

Phir console mein dono regions mein jaake east aur mumbai VPCs delete karo. Region selector ko ap-south-1 pe switch karna mat bhoolna.

← PreviousScenario 2: Do VPCs ki baat-cheet: peering + private DNS Next →Scenario 4: Overlapping CIDRs? PrivateLink se service share karo