I have an AWS Lightsail instance (deployed in AWS Managed VPC) that I want to connect to my Mongo ATLAS (deployed in Mongo Managed VPC).

I was able to connect my AWS Services (Lambda, API Gateway) to ATLAS internally, without going through the internet.

I have a peering connection from ATLAS to AWS (New VPC without internet) I have a peering connection from Lightsail to AWS (default VPC)

I need to be able to route the connection from Lightsail to ATLAS.

I created a peering connection between my "New VPC" and "default VPC", and updated the routing table. But still, the lightsail tries to go through the internet. It gets connected only when I whitelist the lightsail public IP.

Peering Default VPC Route Table AWS New VPC Route Table

  • Is Lightsail using an IP address or DNS name to connect? If the latter, what does it resolve to? – kenlukas Sep 17 '18 at 14:19
  • Just checking if you found my answer informative, if you needed any further clarification? – Alex Moore Sep 19 '18 at 7:10
  • @kenlukas, We're using the host connection string given by ATLAS, which contains the domain name. I think it resolves to the public IP of the ATLAS instance – Dushyant Bangal Sep 22 '18 at 7:01
  • @AlexMoore, I've marked it as helpful, but I'm gonna keep the question open in case someone has a way to do it. – Dushyant Bangal Sep 22 '18 at 7:02
  • 1
    @Tim, thats what I thought, but someone from Mongo ATLAS said that VPC peering will result into "same region" data charges, else it will be "over the internet". May I'll just look at the billing for a few days. – Dushyant Bangal Sep 24 '18 at 11:18

You have two challenges here.

  1. Lightsail currently only supports peering to the Default VPC, although it doesn't make it super clear, you can read it here

  2. You cannot natively do transitive peering, that is route from the Lightsail VPC to your Default VPC and then onwards to Atlas. See more information on this here.

Your primary option really is to connect publically, which if you are using TLS/SSL and restricting based on IP isn't too bad. Although granted it isn't as good as a fully private connection.

There is an option to deploy your own routing appliance into the default VPC to make it a 'Transit VPC' and handle routing yourself between the different peering links, but the overhead/complexity of managing that arrangement might not be worth it. More details on such topologies can be found here.

  • Transit VPC is likely far too complex and expensive for a system this simple. PrivateLInk or an additional VPC peer would be a better option. – Tim Sep 20 '18 at 4:51
  • Absolutely, except I don't believe Atlas provides a PrivateLink solution today, although if that is wrong let me know and I'll update. Can you clarify what you mean by additional VP.C Peer? – Alex Moore Sep 20 '18 at 6:16
  • I hadn't read the question carefully enough, plus I know AWS but not Lightsail. The question isn't as clear as it could be, but I first look at peering Lightsail directly with Atlas. If that's not possible I'd just use the public endpoint, I'm fairly sure based on a recent call with an AWS networking specialist the traffic will stay within the AWS internal network and you'll be charged internal rates - assuming same region. – Tim Sep 20 '18 at 7:47
  • Exactly. Even the lightsail docs aren't 100% explicit about the peering limitations, you have to read between the lines a bit. – Alex Moore Sep 20 '18 at 19:46
  • @Tim basically I want the communication to happen in the same region instead of over the internet. I think Lightsail is managed by a different entity, so they need to use peering connections to connect to your AWS services, unlike EC2 which you can directly add to your VPC. Can you please tell me if and how it can be possible by public endpoint? – Dushyant Bangal Sep 22 '18 at 7:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.