# VPC Peering > Depth-first rabbithole dossier for VPC Peering; source-anchored research pack. Parent: [MongoDB Atlas AWS Networking](https://llms-explorer.com/tree/mongodb-atlas-aws-networking/) · 4 facets · 45 facts · page: https://llms-explorer.com/tree/vpc-peering/ ## Structure and components - [high] VPCs are intransitive, allowing you to only expose those components of your application that need access to Atlas. Sources: https://www.mongodb.com/docs/atlas/architecture/current/network-security.md, https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#patterns` ## How it works - [low] VPC peering connects customer VPCs to an Atlas VPC to route traffic privately, isolating data flow from the public Internet. Sources: https://www.mongodb.com/docs/atlas/architecture/current/network-security.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] For AWS deployments, Atlas also creates a VPC when you create a VPC peering connection to an AWS VPC, in the same region as the peered VPC. Sources: https://www.mongodb.com/docs/atlas/reference/faq/networking.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] When a cross-account or inter-region VPC Peering Connection is created, a VPC Peering Connection resource is automatically created in the accepter's account. Sources: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/vpc_peering_connection_accepter.html.markdown — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] A container is not created when you first create a project but when you first perform an action that needs a VPC, such as creating a cluster or a peering connection, if a container does not yet exist. Sources: https://github.com/mongodb/terraform-provider-mongodbatlas/issues/684 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] Atlas creates a VPC when you deploy the first M10+ dedicated paid cluster to a given provider and region. Sources: https://www.mongodb.com/docs/atlas/reference/faq/networking.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` ## Problems, failure modes and limitations - [low] To modify the CIDR block, the target project cannot have M10 or greater clusters with nodes in the target region, cloud backup snapshots stored in the target region, or other VPC peering connections. Sources: https://www.mongodb.com/docs/atlas/manage-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] You cannot have more than one VPC peering connection between two VPCs at the same time. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [high] The Atlas VPC CIDR block must not overlap with the CIDR block of any VPC intended for peering, and you cannot create connections between VPCs with matching or overlapping IPv4 or IPv6 CIDR blocks. Sources: https://www.mongodb.com/docs/atlas/architecture/current/network-security.md, https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html, https://www.mongodb.com/docs/atlas/security-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [high] Use only RFC 1918 private addresses for peering networks; if the IPv4 CIDR block falls outside RFC 1918 ranges, private DNS hostnames cannot be resolved to private IP addresses. Sources: https://www.mongodb.com/docs/atlas/security-vpc-peering.md, https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] You cannot connect to or query the Amazon DNS server in a peer VPC. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] If VPC A has an internet gateway, resources in VPC B cannot use the internet gateway in VPC A to access the internet. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] If VPC A has a VPN connection to a corporate network, resources in VPC B cannot use the VPN connection to communicate with the corporate network. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] If VPC A has a gateway endpoint that provides connectivity to Amazon S3 to private subnets in VPC A, resources in VPC B cannot use the gateway endpoint to access Amazon S3. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` ## Facts and statements - [medium] Free clusters (formerly M0) and Flex clusters do not support VPC peering. Sources: https://www.mongodb.com/docs/atlas/security-vpc-peering.md, https://www.mongodb.com/docs/atlas/manage-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] Atlas creates a VPC for the Atlas project in your chosen region if that region has no M10 or greater clusters or VPC peering connections. Sources: https://www.mongodb.com/docs/atlas/manage-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] The MTU for inter-region VPC peering connections is 8500 bytes. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] For jumbo frames, the Maximum Transmission Unit (MTU) between VPC peering connections within the same Region is 9001 bytes. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [high] If no action is taken on the VPC peering request, it expires after 7 days. Sources: https://www.mongodb.com/docs/atlas/manage-vpc-peering.md, https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] The failed VPC peering connection remains visible to the requester for 2 hours. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] The expired VPC peering connection remains visible to both VPC owners for 2 days. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] The rejected VPC peering connection remains visible to the owner of the requester VPC for 2 days, and visible to the owner of the accepter VPC for 2 hours. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] Unicast reverse path forwarding in VPC peering connections is not supported. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] The owner of each VPC in the VPC peering connection must manually add a route to one or more of their VPC route tables that points to the IP address range of the other VPC. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] For inter-Region VPC peering connections, you must enable DNS resolution support for the peering connection to resolve private DNS hostnames of the peered VPC to private IP addresses, even if the IPv4 CIDR for the VPC falls into the RFC 1918 private ranges. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] VPCs from different regions can be routed to one another using either Transit Gateways or VPC Peering. Sources: https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-access-to-vpc-private-endpoints.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#patterns` - [low] In an example, an Amazon EC2 instance in the us-west-1 Region uses the PHZ to get the private IP address of the endpoint in the us-west-2 Region and route traffic to the us-west-2 Region VPC over Transit Gateway peering or VPC peering. Sources: https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/centralized-access-to-vpc-private-endpoints.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#patterns` - [low] Removing an aws_vpc_peering_connection_accepter resource from your configuration removes it from the statefile and management but does not destroy the VPC Peering Connection. Sources: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/vpc_peering_connection_accepter.html.markdown — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#antipatterns` - [low] Only VPC owners can work with (describe, create, accept, reject, modify, or delete) peering connections. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] If both VPCs are in the same Region, you can reference a security group from the peer VPC as a source or destination for inbound or outbound rules in your security group. Sources: https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-basics.html — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [medium] Atlas maps VPCs one-to-one to Atlas projects, and an Atlas project is associated with a region-specific VPC. Sources: https://www.mongodb.com/docs/atlas/architecture/current/network-security.md, https://www.mongodb.com/docs/atlas/reference/faq/networking.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] To use a different VPC on customer cloud infrastructure accounts, you must use MongoDB Cloud Manager or Ops Manager. Sources: https://www.mongodb.com/docs/atlas/reference/faq/networking.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] For Google Cloud, Atlas uses the specified CIDR block for all other network peering connections in the project, and by default the Atlas CIDR block must be at least an /18. Sources: https://www.mongodb.com/docs/atlas/manage-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] Atlas locks the CIDR value for a given region if an M10 or greater cluster or a network peering connection already exists in that region. Sources: https://www.mongodb.com/docs/atlas/manage-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] A project with an Atlas VPC CIDR block of /18 is limited to approximately 80 three-node replica sets per Google Cloud region. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/manage-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] Atlas limits the number of MongoDB nodes per network peering connection based on the CIDR block and the region selected for the project. Sources: https://www.mongodb.com/docs/atlas/manage-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [medium] An Atlas project can have a maximum total of 50 peering connections, of which a maximum of 25 can be pending. (verified as of 2026-10-15) Sources: https://www.mongodb.com/docs/atlas/security-vpc-peering.md, https://www.mongodb.com/docs/atlas/manage-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [medium] Atlas does not support network peering between clusters deployed in a single region on different cloud providers. Sources: https://www.mongodb.com/docs/atlas/security-vpc-peering.md, https://www.mongodb.com/docs/atlas/manage-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] In AWS, the standard connection string usually works over peering, and the -pri string is optional unless you use custom DNS. Sources: https://www.mongodb.com/docs/atlas/security-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] In Azure and Google Cloud, use the Private IP for Peering connection string. Sources: https://www.mongodb.com/docs/atlas/security-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [medium] AWS and Azure require peering for each Atlas region involved, while Google Cloud uses global VPCs and needs only one peering connection. Sources: https://www.mongodb.com/docs/atlas/security-vpc-peering.md, https://www.mongodb.com/docs/atlas/manage-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] Atlas deployments in multiple regions must have a peering connection for each Atlas region. Sources: https://www.mongodb.com/docs/atlas/manage-vpc-peering.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] For multi-region clusters, Atlas creates one VPC per region if there is not already a VPC for that region. Sources: https://www.mongodb.com/docs/atlas/reference/faq/networking.md — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] A container is another name for a VPC or the equivalent term for that cloud provider. Sources: https://github.com/mongodb/terraform-provider-mongodbatlas/issues/684 — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` - [low] The auto_accept argument is optional and determines whether to accept the peering request, defaulting to false. Sources: https://github.com/hashicorp/terraform-provider-aws/blob/main/website/docs/r/vpc_peering_connection_accepter.html.markdown — source: `~/.global-ai-hub/research/.pipeline/mongodb-2026-10-14/frb/vpc-peering-5dfdd54117/rabbithole-synthesis.md#core` ## Related concepts - Peering — is a part of VPC Peering - VPC — is a part of VPC Peering