0

I wanted to create a VPN for 3 different AWS accounts. All these 3 accounts are running different application but for the same client, as a service provider, we want to set up a VPN connection to these environments so that we can access the environment from our premises.

I came to know that Transit VPC can be used across different regions and/or different accounts. If transit VPC is the solution for this requirement could you let me know how do we integrate the same to the existing environment?

If not what can we do to achieve this requirement?

DJo
  • 2,133
  • 4
  • 30
  • 46
kavya sudeep
  • 43
  • 3

1 Answers1

1

You have two options (I am assuming site-to-site always on VPNs and not client-to-site):

1) Setup Direct Connect. The three AWS accounts can share one Direct Connect setup. This is the best solution but is expensive.

2) Setup three VPNs from the customer's site. Most enterprise class routers can handle this with ease. This is cheaper as it uses the Internet for connectivity.

In all cases, make sure that the VPCs do not have overlapping CIDR blocks.

If you also need VPC <-> VPC networking add VPC Peering for those routes. VPC Peering is not transitive so you cannot route traffic thru a VPC (just between). You will need on VPC Peering connection for each pair of VPCs that want to network with each other. This can quickly become a spider's web.

Make sure that you work with someone that is very experienced with routers. It is easy to make routing configuration mistakes that will direct Internet traffic thru the VPNs to AWS and you will be billed for Internet traffic.

John Hanley
  • 74,467
  • 6
  • 95
  • 159
  • thanks for the update John.... the second option we had in mind earlier but dropped it because of some constraints.. the 1st option of direct connect should be good... let me just do some r&d on that... thanks for the quick help :) – kavya sudeep Sep 07 '18 at 05:20
  • Direct Connect cannot be used for different accounts... it can be used within an account across different regions. – kavya sudeep Sep 07 '18 at 06:08
  • @kavyasudeep - Direct Connect supports multiple accounts: https://aws.amazon.com/blogs/aws/aws-direct-connect-more-connection-speeds-new-console-multiple-accounts/ – John Hanley Sep 07 '18 at 15:29