VPC peering connections let you privately access MaxCompute services in one region from a VPC in another region.
Business scenario
In a multi-region data architecture, application servers in one region (Region A) may need to access data in a MaxCompute project in another region (Region B). Typical scenarios include cross-region data migration (such as Spark + open storage mode), remote data analytics, and building a unified data mid-end. Direct public network access may introduce latency and security risks. This solution addresses these issues by establishing a private cross-region communication channel.
Solution architecture
Establish a VPC peering connection between two VPCs in different regions and create a VPC endpoint for MaxCompute in the destination region. The following diagram illustrates a MaxCompute cross-region data link:
Create a VPC peering connection between Singapore and Germany, and access the Storage API through the VPC endpoint in Singapore: service.ap-southeast-1-vpc.maxcompute.aliyun-inc.com.
-
Establish a cross-region connection: Create a VPC peering connection instance between the source VPC (Region A) and the destination VPC (Region B).
-
Configure bidirectional routing: Add route entries in both VPC route tables that point to the peer VPC’s CIDR block, with the next hop set to the VPC peering connection instance. This enables mutual communication between the two VPCs.
-
Expose private services: In the destination VPC (Region B), create a VPC endpoint for MaxCompute. This endpoint generates a private domain name and IP address for MaxCompute, allowing direct access from within the VPC.
-
Enable private network access: ECS instances in the source VPC (Region A) access the MaxCompute VPC endpoint in the destination VPC (Region B) through the established peering connection, enabling private access to MaxCompute services.
Procedure
This example uses a VPC peering connection between Singapore and Germany.
Step 1: Create a VPC peering connection
-
Log in to the Virtual Private Cloud console.
-
In the navigation pane on the left, choose VPC Peering Connection. In the top-left corner, select a region.
In this example, select Singapore.
-
Click Create VPC Peering Connection.
-
On the Create VPC Peering Connection page, configure the connection information as described in the following table.
The CIDR blocks of the source and destination VPCs must not be identical. For example, both cannot be
192.168.0.0/16.Parameter name
Required
Description
Name
Optional
Enter a custom name, such as
test-vpc-connect.VPC Resource Group
Optional
Select an existing resource group.
Requester VPC
Required
Select an existing VPC instance.
Accepter account type
Optional
-
Same-account
-
Cross-account: Enter the accepter Alibaba Cloud account UID.
Accepter region type
Optional
-
Intra-region
-
Cross-regional: Inter-region VPC peering connections incur inter-region data transfer fees. Different link types provide varying levels of traffic transmission quality. For pricing details, see inter-region data transfer.
Link Type
Required
Gold or Platinum.
Accepter Region
Required
In this example, select Germany (Frankfurt). Adjust the accepter region based on your actual needs.
Accepter VPC
Required
Select an existing VPC instance.
Add route to peer VPC CIDR
Optional
-
If selected, the system automatically adds routes to the primary IPv4 CIDR block of the peer VPC in both VPC system route tables. To add routes for other CIDR blocks, configure them separately after creation.
-
If a route with the same CIDR block already exists in the VPC system route table, route addition fails. After creation, verify the route entry list.
Tag Key
Optional
Enter a custom tag key.
Tag Value
Optional
Enter a custom tag value.
-
Step 2: Configure peering network route entries
-
In the navigation pane on the left, choose VPC Peering Connection. In the top-left corner, select a region.
You can now view the VPC peering connection created in the previous step.
-
Use the command line to query the endpoint IP addresses.
-- MaxCompute source VPC endpoint nslookup service.ap-southeast-1-vpc.maxcompute.aliyun-inc.com -- MaxCompute source VPC tunnel endpoint nslookup dt.ap-southeast-1-vpc.maxcompute.aliyun-inc.com -- MaxCompute dedicated VPC tunnel endpoint nslookup dt-exclusive.ap-southeast-1-vpc.maxcompute.aliyun-inc.com -
On the VPC Peering Connection page, find the peering connection you want to manage. In the Actions column for the accepter side, click Configure route.
-
In the Configure accepter route dialog box, enter the following information:
Parameter name
Required
Description
Name
Optional
Enter 1 to 128 characters. The name cannot start with http:// or https://.
Accepter route table
Required
Select an existing route table or create a new one.
Destination CIDR Block
Required
Enter the IP address of the source VPC endpoint obtained from the query.
Next Hop
Required
Automatically generated.
-
In the navigation pane on the left, choose VPC Peering Connection. In the top-left corner, select a region.
Click the name of the target peering connection to view its details.
Click the Route Entry List tab to view the configured route entries.
References
For more information about Alibaba Cloud VPC interconnectivity, see VPC interconnect.