Measured Topology of Five Cross-Org VPC Paths

Measured Topology of Five Cross-Org VPC Paths An architecture diagram generated by Archify. EC2 c7g.large (client) · ORG A · VPC A 10.100.0.0/24 · ORG A account EC2 c7g.large (client) ORG A · VPC A 10.100.0.0/24 VPC Peering · ② p50 0.048 ms · Architecture component VPC Peering ② p50 0.048 ms Shared TGW (via RAM) · ① p50 0.619 ms · Architecture component Shared TGW (via RAM) ① p50 0.619 ms PrivateLink → NLB · ③ p50 0.961 ms · TCP passthrough · Architecture component PrivateLink → NLB ③ p50 0.961 ms · TCP passthrough TGW Peering (A ↔ B) · ④ p50 0.599 ms · Architecture component TGW Peering (A ↔ B) ④ p50 0.599 ms VPC Lattice (L7 proxy) · ⑤ p50 1.635 ms · Architecture component VPC Lattice (L7 proxy) ⑤ p50 1.635 ms EC2 responder (nginx 200) · ORG B · VPC B 10.200.0.0/24 · ORG B account (GPU) EC2 responder (nginx 200) ORG B · VPC B 10.200.0.0/24 ORG A account ORG B account (GPU)

Measurement design

  • • TCP_RR persistent p50, 1,500 samples per path, M1-M7 round-robin interleaved over 5 rounds
  • • Both accounts pinned to apne2-az1, c7g.large (no burstable), a single EC2 responder serving a fixed nginx 200
  • • Three ENIs on the responder separate per-path subnets and return routes, removing route swaps

p50 by path (2026-09-01, ap-northeast-2)

  • • ① Shared TGW (RAM): EC2 → TGW-A → responder · 0.619 ms (ICMP 0.535)
  • • ② VPC Peering: EC2 → PCX → responder · 0.048 ms — identical to the M1=0.049 baseline
  • • ③ PrivateLink: EC2 → endpoint → NLB → responder · 0.961 ms
  • • ④ TGW Peering: EC2 → TGW-A → TGW-B → responder · 0.599 ms (ICMP 0.912)
  • • ⑤ VPC Lattice: EC2 → service network → responder · 1.635 ms

Verdict

  • • A TGW hop costs 0.4-0.6 ms, an NLB hop adds 0.4-0.6 ms, and the PrivateLink ENI overhead is +0.04 ms, effectively zero
  • • Normalizing every path behind an NLB: Peering+NLB 0.62 ≈ PrivateLink 0.66 < TGW+NLB 1.27-1.43 < Lattice 1.68 ms
  • • No path is blocked by the organization boundary; the boundary shows up only as an explicit step: name the account ID, then have the receiver accept