Symmetric and Asymmetric flow

Before picking a solution to interconnect services across different VPCs, you must consider your data connection requirements. There are two types of connectivity patterns between a set of network resources.

Image
Image

Connecting services hosted in different AWS accounts

The type of connectivity your services require influences how you can connect services in different VPCs.

  1. VPC Peering (including TGW) or VPC Sharing
  2. AWS PrivateLink

🛟VPC Peering

When services have to consume other services running in different VPCs, requiring symmetric flow, VPC peering is the easiest way to provide interconnectivity.

Image

🚉 AWS Transit Gateway

AWS Transit Gateway (TGW) is another option to connect VPCs wherever services need to interconnect with symmetric flow.

Image

Are there reasons for not using TGW?

The good ole’ VPC peering still has some tricks up its sleeve that TGW hasn’t mastered yet. Here are a few reasons TGW may not be the right choice for you:

  • **Lower cost ** — With VPC peering you only pay for data transfer charges. Transit Gateway has an hourly charge per attachment in addition to the data transfer fees. For example, in US-East-1:
Image
  • No bandwidth limits — With Transit Gateway, Maximum bandwidth (burst) per Availability Zone per VPC connection is 50 Gbps. VPC peering has no aggregate bandwidth. Individual instance network performance limits and flow limits (10 Gbps within a placement group and 5 Gbps otherwise) apply to both options. Only VPC peering supports placement groups.
  • Latency — Unlike VPC peering, Transit Gateway is an additional hop between VPCs.
  • Security Groups compatibility — Security groups referencing works with intra-Region VPC peering.

🫱🏽‍🫲🏼Amazon VPC Sharing

Here’s a third way to provide symmetric flow: share a VPC with multiple AWS accounts.

  • Simplified design — no complexity around inter-VPC connectivity
  • Fewer managed VPCs
  • Segregation of duties between network teams and application owners
  • Better IPv4 address utilization
  • Lower costs — no data transfer charges between instances belonging to different accounts within the same Availability Zone

🎯AWS PrivateLink

Are you itching to know the options if you need asymmetric flow connectivity? No. Let me tell you anyway. 😄

Image

Symmetric flow with PrivateLink

If you choose to interconnect services using PrivateLink, you can still provide support for symmetric flow You’d have to add another PrivateLink to support connections originating from the opposite end.

Image

Cost comparison

I researched PrivateLink pricing and failed to come up with a fair comparison with Transit Gateway. Unfortunately, there are too many vectors to provide a generalized price comparison. I recommend involving an AWS Solutions Architect for a detailed analysis.

Conclusion

AWS provides many methods to connect services running in different VPCs. This post reviews the options available for EKS customers.

Image

Further Reading

AWS Whitepaper: Securely Access Services Over AWS PrivateLink

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
Re Alvarez Parmar

Re Alvarez Parmar

I am writer, coder, reader, and father of three. I write about Cloud, Kubernetes, containers, productivity, and psychology.