# Configure Virtual Private Cloud (VPC) Peering with AWS

ScyllaDB Cloud allows you to connect your application’s private network
directly to the ScyllaDB clusters’ private network by using AWS VPC peering.
By following this guide, you will better secure your customer’s data and make
sure all traffic between Scylla’s cluster and the application layer is being
done via a private network and never traverses the public internet.

For more information on AWS VPC peering and its security advantages, see the
[AWS documentation](https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html).

If you are running ScyllaDB Cloud on GCP, refer to [Configure Virtual Private Cloud (VPC) Peering with GCP](https://cloud.docs.scylladb.com/stable/cluster-connections/vpc-peering/gcp-vpc-peering.md).

## Setup AWS VPC Peering

**Procedure**

1. When creating a cluster, select  the **Pivate Connection** option
   under **Network Types**.

   <a id="aws-vpc-create-cluster-cidr"></a>

   In the **CIDR for ScyllaDB Cloud Network** field, you can specify the
   private network block for the cluster (in CIDR format). The default is
   172.31.0.0/24. The allowed CIDR blocks are all ranges from RFC 1918:
   > * 10.0.0.0/8
   > * 172.16.0.0/12 – with the exception of 172.17.0.0/16 (reserved for
   >   the ScyllaDB Cloud infrastructure).
   > * 192.168.0.0/16
2. Once the cluster is created, click **Setup VPC Peering**. This opens
   a wizard. The first stage is **Step 1. Request**.
3. In the **AWS Details** section, fill in the VPC peering information needed
   giving the details of your AWS console.

   Include the following details, and click **Submit VPC Peering Request** when done.
   * **Data Center** - The name of the data center for the ScyllaDB cluster.
   * **AWS Account ID** - The account ID number for the Private Network you
     plan to peer in AWS. To find your account ID, from your AWS console,
     navigate to **support> support center**.
   * **VPC ID** - The application **VPC ID** which you plan to peer with.
   * **VPC Network** - The IPv4 CIDR blocks used by your application in this VPC.
     > * Your VPC can use private IPv4 ranges (RFC 1918), shared address space
     >   (100.64.0.0/10), or public IPv4 ranges supported by AWS.
     > * Enter only ranges configured in the VPC you are peering. ScyllaDB Cloud
     >   adds routes for the ranges you enter, so incorrect ranges can interrupt
     >   access to external services.
     > * The blocks must not overlap any network in your ScyllaDB cluster, including
     >   the [block you’ve set when creating the cluster](#aws-vpc-create-cluster-cidr).
     > * Your own VPC may use 172.17.0.0/16 as long as it does not overlap any
     >   cluster network. AWS recommends avoiding this range where possible
     >   because services such as Cloud9 and SageMaker can use it internally; see
     >   [AWS IPv4 CIDR considerations](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-cidr-blocks.html).
     > * CIDRs must not overlap with 0.0.0.0/8, 127.0.0.0/8, 169.254.0.0/16,
     >   224.0.0.0/4, or 255.255.255.255/32.
     > * If there are multiple CIDR blocks in your VPC, list them all separated by commas.
   * **VPC Region** - Select the region your VPC is set in.

   If you select **Add your VPC network addresses to the cluster’s allowed
   address list**, new firewall rules normally require a /16 or more specific
   prefix.
4. You will see the next phase in the wizard **Step 2. Accept**. The page named
   **Setting up VPC Peering** is a customized page based on your AWS VPC
   details and the ScyllaDB Cloud information you already entered. Follow
   **each step** on this page. Make sure to copy/paste the **Peering Connection
   ID** where indicated.

   Alternatively, you can use the AWS CLI to complete the peering (using
   the peering connection ID you copied):
   ```console
   aws ec2 accept-vpc-peering-connection --vpc-peering-connection-id pcx-XXXXXXXXXXXXXXXXXX
   ```

   When all steps have been completed, click **Connect**. This brings you to
   **Step 3. Route**.
5. The next phase in the wizard is **Step 3. Route**. The page named **VPC
   Peering Route Configuration** is a customized page with VPC peering route
   configuration. Follow **each step** on this page. Make sure you use the
   specific **VPC ID** and **CIDR Block**, as they are based on your settings.

   Alternatively, you can use the AWS CLI for every route table you wish to
   connect:
   ```console
   aws ec2 create-route --route-table-id rtb-XXXXXXXXXXXXXXXXXX --vpc-peering-connection-id pcx-XXXXXXXXXXXXXXXXXX --destination-cidr-block 172.31.0.0/24
   ```

   The above example assumes your cluster was created with the default CIDR
   (172.31.0.0/24).
   If you set a different CIDR during cluster creation, make sure you modify
   the command accordingly.

   Once you have successfully tested and confirmed connectivity, click **Done**.