<a id="peering-overview"></a>

<a id="cloud-networking-peering-aws"></a>

# Use AWS VPC Peering with Confluent Cloud

AWS VPC peering enables you to route traffic using private IPv4 addresses
between your AWS virtual private cloud (VPC) and Confluent Cloud. Your VPC can
communicate with Confluent Cloud as if they are within the same network.

Confluent Cloud is available through [AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-g5ujul6iovvcy?trk=14575e70-1766-4f20-8083-0c2757a1ec75&sc_channel=el)
or [directly from Confluent](https://www.confluent.io/get-started/).

For more information about VPC peering with AWS, see  [Introduction to Amazon
VPC](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Introduction.html).

The following features are supported when you set up a VPC peering connection
between AWS VPC and Confluent Cloud:

* [Managed connectors](../../connectors/overview.md#kafka-connect-cloud) created in a VPC-peered
  cluster can access data sources and sinks hosted in all peered VPCs, if the
  firewall rules allow connector traffic to and from the peered VPCs.
* [Fetch from Follower](../fetch-from-follower.md#fetch-from-follower-aws) is a cost optimization
  feature that allows clients to consume from the nearest follower, instead of
  the leader.

The high-level workflow to set up a VPC peering connection to Confluent Cloud:

1. Identify a Confluent Cloud network you want to use, or [set up a new Confluent Cloud
   network](../ccloud-network/aws.md#create-ccloud-network-aws).
2. [In Confluent Cloud, create a VPC peering connection](#aws-peering-create-connection).
3. [In AWS, accept the peering request](#aws-peering-accept-connection).
4. [In AWS, add the new connection to the route table](#aws-peering-add-to-route-table).
5. To support outbound connections from Confluent Cloud, [set up DNS forwarding in
   Confluent Cloud](../aws-dns-forwarding.md#dns-forwarding-aws-peering).

## Requirements and considerations

* A [Confluent Cloud network](../overview.md#ccloud-network-overview) of the
  “VPC Peering” type and the “AWS” provider.

  Pay special attention that the CIDR blocks you select satisfy the requirements
  described in [Confluent Cloud network CIDR blocks and block size for peering and Transit Gateway](../ccloud-network/aws.md#cidr-block-size).
* All AWS availability zones, except `use1-az3` in the `us-east-1`
  region, are supported.
* Transitive VPC peering is not supported.

  If you peer Network A to  Network B, and peer Network B to Confluent Cloud,
  applications running in  Network A will not be able to access Confluent Cloud.
  Although they don’t provide transitive  routing, shared AWS VPCs can be
  leveraged to enable Confluent Cloud  connectivity. For more information, see  [AWS
  Working with Shared VPCs](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-sharing.html).

  To  achieve transitivity, you can link an AWS Transit Gateway to a Confluent Cloud
  cluster in AWS.
* You can have multiple VPC peering connections. For information about limits,
  see [Network quotas in Confluent Cloud](../../quotas/service-quotas.md#ccloud-resource-limits-network).
* You can colocate multiple Confluent Cloud Dedicated clusters in the same Confluent Cloud network, but
  this is limited by the expected number and size of the clusters. The
  applicable limits are specified in [Networks](../../quotas/service-quotas.md#ccloud-resource-limits-network).
* Cross-region peering is not supported through the Confluent Cloud Console. Contact
  Confluent Support to see if your regions are supported and to request
  configuration.
* You might need to increase your route quota when you use VPC peering because
  the Confluent Cloud and AWS routes are shared.
* If you have custom DNS, your DNS servers must be able to access the
  authoritative DNS servers for Confluent Cloud, which are hosted by Confluent
  on the internet.
* Access to Confluent Cloud serverless products

  Connections established for use with Dedicated Kafka clusters may also
  be used to connect to some serverless products. For service-specific
  information, see:
  * [Flink](../../flink/concepts/flink-private-networking.md#flink-sql-private-networking)
  * [Schema Registry](../../sr/fundamentals/sr-private-link.md#sr-ccloud-private-link)

## Create a VPC peering connection

This section describes how to create an AWS VPC peering connection to a
Confluent Cloud network.

<a id="aws-peering-create-connection"></a>

### Step 1: Create a VPC peering connection in Confluent Cloud

You need to gather the following information from the [Amazon VPC Console](https://console.aws.amazon.com/vpc/):

* The AWS account ID associated with the VPC you are peering to Confluent Cloud network.
* The AWS VPC ID you are peering with Confluent Cloud network.
* The CIDR block of the AWS VPC you are peering with the Confluent Cloud network.

Follow the steps below to create a VPC peering connection in Confluent Cloud.

### Confluent Cloud Console

1. In the **Network Management** tab of the desired Confluent Cloud environment,
   click the **For dedicated cluster** tab.
2. Click the Confluent Cloud network to which you want to add the peering connection.
3. In the **Ingress connections** tab, click **+ VPC Peering**.
4. Specify the following field values.
   * **Name**: The name of this connection.
   * **AWS Account Number**: The AWS account ID associated with the VPC
     you are peering to Confluent Cloud network.
   * **AWS VPC ID**: The AWS VPC ID you are peering with Confluent Cloud network.
   * **AWS VPC CIDR**: The CIDR block of the AWS VPC you are peering with
     the Confluent Cloud network.
5. Click **Add**.

   Peering connection provisioning will take a few minutes to complete.
   Your peering connection status will transition from “Provisioning” to
   “Waiting for connection” in the Confluent Cloud Console.

### Confluent REST API

A peering connection must be created from your VPC to the Confluent Cloud network in order
to access Confluent Cloud clusters and services in the Confluent Cloud network.

**REST request**

```text
POST https://api.confluent.cloud/networking/v1/peerings
```

**REST authentication**

See [Authentication](https://docs.confluent.io/cloud/current/api.html/#authentication).

**REST request body**

```json
{
  "spec":{
   "display_name":"<connection name>",
   "cloud":{
        "kind":"AwsPeering",
        "account":"<AWS account ID>",
        "vpc":"<AWS VPC ID>",
        "routes":[
           "<AWS VPC CIDR>"
        ],
        "customer_region":"<AWS VPC region>"
     },
     "environment":{
        "id":"<environment id>"
     },
     "network":{
        "id":"<Confluent Cloud networkd id>"
     }
  }
}
```

* `routes`: The CIDR blocks of the VPC you are peering with the Confluent Cloud
  network. This is used by Confluent Cloud network to route traffic back to your
  network. The CIDR block must be a private range and cannot overlap with
  the Confluent Cloud CIDR block.

### Confluent CLI

Use the [confluent network peering create](https://docs.confluent.io/confluent-cli/current/command-reference/overview.html)
Confluent CLI command to create a peering connection:

```bash
confluent network peering create aws-peering <flags>
```

The following command-specific flags are supported:

* `--network`: Required. Confluent Cloud network ID.
* `--cloud`: Required. The cloud provider. Set to `aws`.
* `--cloud-account`: Required. AWS account ID associated with the VPC
  that you are peering with Confluent Cloud network.
* `--virtual-network`: Required. AWS VPC ID that you are peering with
  Confluent Cloud network.
* `--customer-region`: Cloud region ID of the AWS VPC that you are
  peering with Confluent Cloud network.
* `--aws-routes`: Required. A comma-separated list of CIDR blocks of
  the AWS VPC that you are peering with Confluent Cloud network.

  The CIDR blocks cannot not be identical and not completely within the
  Confluent Cloud network CIDRs.

You can specify additional optional CLI flags described in the
[Confluent CLI command reference](https://docs.confluent.io/confluent-cli/current/command-reference/overview.html),
such as `--environment`.

The following is an example Confluent CLI command to create a VPC
peering:

```bash
confluent network peering create aws-peering \
  --network n-123456 \
  --cloud aws \
  --cloud-account 123456789012 \
  --virtual-network vpc-1234567890abcdef0 \
  --aws-routes 172.31.0.0/16,10.108.16.0/21
```

### Terraform

Use the [confluent_peering](https://registry.terraform.io/providers/confluentinc/confluent/latest/docs/resources/confluent_peering)
Confluent Terraform Provider resource to create a peering connection.

See Terraform configuration examples for creating an AWS peering
connection using Terraform:

* [Peering with ACLS](https://github.com/confluentinc/terraform-provider-confluent/tree/master/examples/configurations/dedicated-vpc-peering-aws-kafka-acls)
* [Peering with RBAC](https://github.com/confluentinc/terraform-provider-confluent/tree/master/examples/configurations/dedicated-vpc-peering-aws-kafka-rbac)
* [Peering with /27 CIDR](https://github.com/confluentinc/terraform-provider-confluent/tree/master/examples/configurations/dedicated-vpc-peering-v2-aws-kafka-acls)

<a id="aws-peering-accept-connection"></a>

### Step 2: Accept the peering connection request in AWS

When the connection status is “Waiting for connection” in the  Confluent Cloud Console,
go to the  [Amazon VPC Console](https://console.aws.amazon.com/vpc/) and
accept  the peering request.

You have seven days to accept the request before it
expires. For details on accepting peering connections, refer to  [Create and
accept VPC peering connections in Amazon Virtual Private Cloud](https://docs.aws.amazon.com/vpc/latest/peering/create-vpc-peering-connection.html#accept-vpc-peering-connection)
in the AWS documentation.

If your request has expired, contact Confluent to resend the request.  After you
have accepted the peering request, the status of the peering  connection will
change to “Ready”.

1. In the [Amazon VPC Console](https://console.aws.amazon.com/vpc/), click
   **Peering connections** in the navigation pane.
2. Select the pending VPC peering connection (the status is **Pending acceptance**).

   If there is no pending VPC peering connection, verify that you selected the
   Region of the accepter VPC.
3. Click **Actions**, and click **Accept request**.
4. When prompted for confirmation, choose **Accept request**.

   Save the connection id. The value is prefixed with  `pcx-`. You need to
   input this value in the [next step](#aws-peering-add-to-route-table)
   when you add the connection to the route table.

When the connection request is accepted, the connection status becomes “Ready”
in the Confluent Cloud Console.

<a id="aws-peering-add-to-route-table"></a>

### Step 3: Add the new connection to the route table in AWS

Add the new peering connection that you accepted in
[Step 2: Accept the peering connection request in AWS](#aws-peering-accept-connection), to the route table for your VPC. For
details on updating route tables, see the [AWS documentation](https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-routing.html).

For the routing to become effective, the route table must be associated with
subnet(s).

1. Go to the [Amazon VPC Console](https://console.aws.amazon.com/vpc/), and click **Route Tables**.
2. Select the route table for your VPC and click **Edit routes**.
3. Click **Add route**, and specify the following.

   Add routes for all three /27 CIDR blocks to all your VPC route tables,
   not just the zone-aligned routes.
   * **Destination**: Specify the Confluent Cloud network VPC CIDR block.

     You can find the Confluent Cloud network VPC CIDR blocks in the **Network Overview** of your
     Confluent Cloud network, in the **Confluent Cloud CIDR** field.
   * **Target**:
     1. Select **Peering connection**.
     2. Specify the Peering connection ID of the new connection you accepted in
        [Step 2: Accept the peering connection request in AWS](#aws-peering-accept-connection). The value is prefixed with
        `pcx-`.
4. Click **Save changes**.
5. Update the network ACLs on your VPCs.

   If required, update the security group rules that are associated with your
   EC2 instance to ensure that traffic can flow between your VPCs and the
   Confluent Cloud network.

<a id="dns-resolution-aws-peering"></a>

## DNS resolution

Confluent Cloud hosts and manages the DNS records for endpoints which use AWS VPC peering connectivity. In order for your Kafka clients to resolve these DNS names, they must be able to resolve records from public DNS servers.

Confluent does not provide a supported private DNS solution for the clusters that use AWS VPC peering.

To resolve private hostnames for outbound connections from Confluent Cloud, such as
fully managed connectors that need to access data in your VPC, see
[Configure DNS forwarding on AWS](../aws-dns-forwarding.md#dns-forwarding-aws).

## Next steps

Try [Confluent Cloud on AWS Marketplace](https://aws.amazon.com/marketplace/pp/prodview-g5ujul6iovvcy?trk=14575e70-1766-4f20-8083-0c2757a1ec75&sc_channel=el)
with $1000 of free usage for 30 days, and pay as you go. No credit card is
required.