A private instance in one VPC cannot reach a database subnet in a peered VPC. The peering connection is active, and only the instance side route table sends the database CIDR through that connection. What should be added?
Select an answer to reveal the explanation.
Short Explanation
A peering connection is a road with two gates, and you opened only one of them. The instance route sends traffic into the peer, and the database route table still has no way to send replies back. A second peering link does not fix a missing return route, and peering does not copy routes for you.
Full Explanation
VPC peering forwards traffic only when the route table on each side sends the far CIDR to the peering connection. The instance side already has that route, so packets can leave. The database subnet route table has no route back to the instance subnet, so replies are dropped. Adding that return route through the same peering connection completes the path. A second peering connection is unnecessary. One active peering link carries traffic in both directions once both route tables point at it. A NAT gateway gives a private subnet a path to the internet. It does not insert a return route into the other VPC, and it is not how peering replies travel. Peering is not transitive, and it does not copy a route from one route table into the other. Each route table is configured on its own, even when only two VPCs are involved. Caveat: after the return route exists, the database security group still has to allow the instance, and the network ACLs have to allow both directions because they are stateless. Operational check: from the instance, open the database port and confirm the connection completes, then confirm the database subnet route table shows the instance CIDR via the peering connection.