Comparison
Security groupvsVPC peering
Security group
the port is open in the application and the connection still hangs, because a rule two layers below never allowed it.
A stateful firewall attached to cloud resources, allowing traffic by port, protocol and source. It is the layer people forget when debugging connectivity, because it fails by dropping rather than refusing, so the symptom is a timeout with nothing in any log. Referencing other groups rather than address ranges is what keeps the rules meaningful as instances come and go.
Full entry →VPC peering
two private networks can address each other directly without going near the internet, and neither one's address ranges may overlap.
A direct private connection between two virtual networks, so workloads reach each other over internal addresses. It is the standard way to connect environments, accounts and partners without public exposure, and it is not transitive: peering A to B and B to C does not connect A to C. Overlapping address ranges make it impossible outright, which is why address planning is a decision you make once and regret slowly.
Full entry →