Help Center/ Cloud Connect/ Best Practices/ Connecting VPCs in the Same Region But in Different Accounts/ Using a Cloud Connection to Connect VPCs in the Same Region But Different Accounts

Updated on 2025-05-30 GMT+08:00

View PDF

Using a Cloud Connection to Connect VPCs in the Same Region But Different Accounts

You can connect the VPCs in the same region but in different accounts using a cloud connection.

For details about the regions where cloud connections are available, see Region Availability.

Solution Architecture

A company has two Huawei accounts (accounts A and B). Each account has a VPC in CN East-Shanghai1.

To connect the two VPCs in different accounts, the company needs to create a cloud connection and load the VPCs to the cloud connection.

Figure 1 Connecting VPCs in the same region but different accounts

Network and Resource Planning

To use a cloud connection to connect VPCs in the same region but in different accounts, you need to:

Plan CIDR blocks for VPCs and subnets.
Plan the quantity, names, and main parameters of cloud resources, including VPCs and ECSs.

Network Planning

Figure 2 and Table 1 show the network planning and description for communication between VPCs in the same region but in different accounts.

Figure 2 Networking planning for communication between VPCs in the same region but in different accounts

**Table 1** Networking planning description
Resource	Description
VPC	The CIDR blocks of the VPCs to be connected cannot overlap with each other. Overlapping VPC CIDR blocks will cause route conflicts. If the VPCs have overlapping CIDR blocks, you need to modify the CIDR blocks. Each VPC comes with a default route table that has the default IPv4 local route, which enables subnets in a VPC to communicate with each other.
ECS	The two ECSs are in different VPCs. If the ECSs are in different security groups, add rules to the security groups to allow access to each other.

Resource Planning

The VPCs and ECSs must be in the same region, but they can be in different AZs.

The following resource details are only for your reference. You can modify them if needed.

Table 2 describes the two VPCs in detail. Their CIDR blocks cannot overlap with each other.

**Table 2** VPC details
VPC	VPC CIDR Block	Subnet Name	Subnet CIDR Block	Route Table
VPC-A	192.168.0.0/16	Subnet-A	192.168.1.0/24	Default route table
VPC-B	172.16.0.0/16	Subnet-B	172.16.1.0/24	Default route table

Table 3 describes the two ECSs in detail, with each ECS in a VPC.

**Table 3** ECS details
ECS Name	Image	VPC	Subnet Name	Security Group	Private IP Address
ECS-A01	Public image: Huawei Cloud EulerOS 2.0 Standard Edition	VPC-A	Subnet-A	Sg-A (general-purpose web server)	192.168.1.154
ECS-B01	Public image: Huawei Cloud EulerOS 2.0 Standard Edition	VPC-B	Subnet-B	Sg-B (general-purpose web server)	172.16.1.104

Procedure

**Table 4** Communication between VPCs in the same region but in different accounts
Procedure	What to Do
Preparations	Before using cloud services, sign up for a HUAWEI ID, enable Huawei Cloud services, complete real-name authentication, and top up your account.
Step 1: Create a Cloud Connection	Create a cloud connection in account A to load VPCs.
Step 2: (Optional) Create VPCs and ECSs	Create VPCs and ECSs in the same region in accounts A and B. If you already have VPCs and ECSs, skip this step.
Step 3: Request Permission to Use the VPC in Another Account	Grant account A the permission to load VPC-B in account B to the cloud connection of account A.
Step 4: Load Network Instances	Load VPC-A and VPC-B to the cloud connection created in account A.

Preparations

Before creating a cloud connection, you need to:

Sign up for a HUAWEI ID, enable Huawei Cloud services, and complete real-name authentication.
If you already have a HUAWEI ID, skip this part. If you do not have a HUAWEI ID, perform the following operations to create one:
1. Sign up for a HUAWEI ID and enable Huawei Cloud services.
2. Complete real-name authentication.
Top up your account.
Ensure that your account has sufficient balance. For details about how to top up an account, see Topping up an Account.

Step 1: Create a Cloud Connection

Create a cloud connection and name it cc-test in account A.

Go to the Cloud Connections page.
In the upper right corner of the page, click Create Cloud Connection.

Configure the parameters based on Table 5.

Figure 3 Creating a cloud connection

**Table 5** Parameters for creating a cloud connection
Parameter	Description	Example Value
Name	Specifies the cloud connection name. The name can contain 1 to 64 characters. Only letters, digits, underscores (_), hyphens (-), and periods (.) are allowed.	cc-test
Enterprise Project	Specifies an enterprise project by which cloud resources and members are centrally managed.	default
Scenario	VPC: VPCs or virtual gateways can use this cloud connection.	VPC
Tag	Specifies the tag to identify the cloud connection. A tag consists of a key and a value. You can add up to 20 tags to a cloud connection. NOTE: If a predefined tag has been created on TMS, you can directly select the corresponding tag key and value. For details about predefined tags, see Predefined Tags.	-
Description	Provides supplementary information about the cloud connection. The description can contain no more than 255 characters.	-

Click OK.

Step 2: (Optional) Create VPCs and ECSs

Perform the following operations to create VPCs and ECSs. If you already have VPCs and ECSs, skip this step.

Constraints

The CIDR blocks of the VPCs to be connected cannot overlap with each other.
Overlapping VPC CIDR blocks will cause route conflicts. If the VPCs have overlapping CIDR blocks, you need to modify the CIDR blocks.
In this example, the two ECSs are in different security groups. You need to add rules to the security groups to allow access to each other. For details, see Adding a Security Group Rule.

Procedure

Create two VPCs with subnets.
For details, see Creating a VPC.

For the details about VPCs and subnets in this example, see Table 2.
Create two ECSs.
For details, see Purchasing a Custom ECS.

For details about the ECSs in this example, see Table 3.

Step 3: Request Permission to Use the VPC in Another Account

If the VPC in your account (account A) needs to communicate with that in another account (account B), ask account B to grant you (account A) the permission to load their VPC to your cloud connection.

In this example, log in to the console as account B and take the following steps to grant account A the permission to load account B's VPC to account A's cloud connection:

Go to the Cross-Account Authorization page.
On the Network Instances Authorized by Me tab, click Authorize Network Instance.

Configure the parameters based on Table 6.

Figure 4 Cross-account authorization

**Table 6** Parameters for cross-account authorization
Parameter	Description	Example Value
Region	Specifies the region where the VPC is located.	CN East-Shanghai1
VPC	Specifies the VPC to be loaded to the cloud connection in the peer account.	VPC-B
Peer Account ID	Specifies the ID of the peer account.	ID of account A
Peer Cloud Connection ID	Specifies the ID of the peer cloud connection that the VPC is to be loaded to.	ID of cloud connection cc-test created in account A
Remarks	Provides supplementary information about cross-account authorization.	-

Click OK. Account A can access the resources in VPC-B of account B.

Step 4: Load Network Instances

Load the VPCs that need to communicate with each other to the cloud connection you have created.

In this example, log in to the console as account A and take the following steps to load VPC-A and VPC-B to cloud connection cc-test:

Load VPC-A in account A to cc-test.

Go to the Cloud Connections page.
Click the name of the cloud connection to go to the Basic Information tab.
Click the Network Instances tab.
Click Load Network Instance.

Configure the parameters based on Table 7 and click OK.

Figure 5 Loading VPC-A in account A

**Table 7** Parameters for loading network instances in the same account as the cloud connection
Parameter	Description	Example Value
Account	Specifies the account that provides the network instance.	Current account
Region	Specifies the region where the VPC you want to load is located.	CN East-Shanghai1
Instance Type	Specifies the type of the network instance that needs to be loaded to the cloud connection. There are two options: VPC Virtual gateway	VPC
VPC	Specifies the VPC you want to load to the cloud connection. This parameter is mandatory if you have set Instance Type to VPC.	VPC-A
VPC CIDR Block	Specifies the subnets in the VPC and custom CIDR blocks. If you have set Instance Type to VPC, you need to configure the following two parameters: Subnet Other CIDR Block: Add one or more custom CIDR blocks as needed.	Subnet-A
Remarks	Provides supplementary information about the network instance.	-

Load VPC-B in account B to cc-test.

Go to the Cloud Connections page.
Click the name of the cloud connection to go to the Basic Information tab.
Click the Network Instances tab.

Click Load Network Instance. In the displayed dialog, select Peer account.

Configure the parameters based on Table 8 and click OK.

**Table 8** Parameters for loading a network instance in a different account from the cloud connection
Parameter	Description	Example Value
Account	Specifies the account that provides the network instance.	Peer account
Peer Account ID	Specifies the ID of the peer account.	ID of account B
Region	Specifies the region where the VPC you want to load is located.	CN East-Shanghai1
Peer Project ID	Specifies the project ID of the VPC in the peer account.	Project ID of account B
Instance Type	Specifies the type of the network instance that needs to be loaded to the cloud connection.	VPC
Peer VPC	Specifies the VPC to be loaded.	ID of VPC-B
VPC CIDR Block	Specifies the CIDR block of the VPC that you want to load to the cloud connection.	Subnet-B
Remarks	Provides supplementary information about the network instance.	-