Okay, so let's understand
the important points with respect
to VPC peering and VPC endpoints.
And these are important for the exam.
So VPC peering does not support transitive routing.
So if VPC is connected to B and B is connected to C,
that does not mean you can go from A to C.
Also you cannot access the peered VPC, IGW,
or NAT way through the other VPC.
Now, VPC peering allows using the security group
as a source for inbound rules from other VPC.
We haven't seen that as a demo or an exercise,
but what essentially it means like if you have two VPCs
and say VPC A and B, and in VPC B,
if you have EC2 instance and you want to add
a security group rule for that EC2 instance,
you can refer the security group of VPC A.
So you don't have to put a CIDR of VPCA to white list that,
instead you can use a security group of VPCA directly.
You can have maximum 125 VPC peering connection.
That's a current limit, and this may change.
Typically, there won't be a question on these numbers
because these numbers always change.
But as of now, that's a limitation.
Now VPC gateway endpoint enables the private connection
to S3 or DynamoDB in the same AWS region
without you requiring to have IGW or NAT gateways.
So if the question is about accessing privately
S3 or DynamoDB from your VPC,
the answer should be VPC gateway.
If it talks about private connection to other AWS services,
the answer will be VPC interface endpoint
powered by private link.
To route traffic through the gateway endpoint,
you should modify the route table of the subnet,
and as you understood for S3
we had used the prefix list of the S3,
and that was a destination
and the target was VPC gateway endpoint.
Now gateway endpoint is not accessible
over the Direct Connect or VPN or VPC peering connection.
And essentially that, because there is no ENI
into your VPC for gateway endpoint,
but that's not the case when you use interface endpoint,
because there is ENI and you can access
the interface endpoint over these remote networks.
So VPC interface endpoint creates an ENI
into your subnet that we know,
interface endpoint also receives
the regional and zonal DNS names
using which you can access the endpoint services.
You can also use Route53 private hosted zone
to use your custom domain name,
and you can create an Alias record to your interface DNS.
So you can create say myapp.example.com,
private hosted zone,
and then create an Alias record
to your zonal or regional DNS name,
and then you can access your endpoints
using that domain name as well.
Now interface endpoint can be accessed over Direct Connect
or AWS managed VPN or a VPC peering connection
and we had seen that in one of the lecture.
And then traffic originates from the resources
in a VPC consumer side of the VPC,
and the service VPC will only respond to that traffic,
the endpoint service cannot initiate the request.
So it's a one way traffic initiation
for your interface or a gateway endpoint.
So that's it about this lecture.
We understood VPC peering and VPC endpoints.
And given a scenario,
you should be able to pick the right answer.
And with that, we conclude this section,
and I'm sure you now feel much more comfortable
choosing right answer for this topic.
So congratulations and stay tuned, thank you.