How to use VPC Peering cross-accounts in AWS CDK in Python between two different VPC Networks between AWS Accounts

VPC Peering is a quick way to connect to different VPC networks, you can use it with two different VPC Networks on a single account read how to use VPC Peering with two different VPC networks on a single AWS account from my other article if you need the basic understanding for how VPC Peering is working, in this article, you will learn how to use VPC Peering between two different AWS Accounts and how you connect the VPC Networks together.

Basic settings file

We need to define different settings for cross-using our VPC Peering between two AWS accounts, fill this setting file out and be sure you did not replace the data you can’t before the stacks are deployed success.

We are using 10.21.x.x for our VPC Network one and we are using 10.22.x.x for our VPC Network two, this will make sure we can use VPC Peering correctly.

VPC Network One — Primary

First, we need to create our network for our primary account, the account we want to connect to, in this case, you will start creating a VPC Network a d create an IAM Role there allowed our second AWS Account to assume the role and create the peering connection between our two AWS Accounts.

VPC Network

The VPC Network there will be created is created with public and private NAT subnets, we are allowed only to spin a single NAT Gateway up.

Peering role

It's required to create a new IAM Role there can be assumed from our second AWS Account so it's allowed to create the right VPC Peering between our two AWS Account’s VPC Network.

VPC Network Two — Second

In VPC Network Two we will create a VPC Network, after it's created we will try to set up the peering connection and after our VPC Peering is successfully created we will add it to the routing table for our subnet to be sure traffic from our VPC Network One can be routed into our network.

Be sure you have added the VPC Network One — VPC ID into the settings.py file else its will not working and the peering will not be created.

VPC Network

We are doing the same as we did on the VPC Network One by creating a VPC Network with public and private NAT subnets, after that, we defined it with a max 1 NAT gateway running on this VPC Network.

VPC Peering

In our VPC Peering, we set up the connection settings to explain our AWS Account it should create a Peering connection based on peer_vpc_id, peer_owner_id, peer_region, peer_role, and our AWS Account VPC ID for our Network.

Subnet route table

When the VPC Peering is created we need to allow traffic incoming from our peering network to be accepted, it's happening by adding the IP CIDR block in the routing table for the subnets

Route table in VPC Network One

If we want to connect from our VPC Network One to our VPC Network Two we need to create the rules inside the route table for our VPC Network’s subnet as we did for our VPC Network Two, so that's what we gonna do in this last section.

Route table

We are using our VPC CIDR block for VPC Network Two to allow incoming traffic from that VPC Network like de did on VPC Network One.

Download prototype source code from GitHub

The full prototype source code can be found on my GitHub account, you can download it and play around with it, it’s fully free and I hope you enjoy the code and it learns something new about how to use AWS CDK with Python.