# VPC peering with Atlas (AWS)
Traffic between your VPC and Atlas stays private. Do the steps in order; each one depends on the last.
## Steps
1. Atlas UI: Security, Network Access, Peering, Add Peering Connection. Enter your AWS account ID, VPC ID, VPC CIDR, and region. Atlas creates the peering request.
2. Accept it in AWS (VPC console, Peering Connections, Accept). Note the peering connection ID.
3. Route tables: in your VPC route table, add a route for the Atlas CIDR block pointing at the peering connection. Without this, packets have no path.
4. Security groups: allow outbound to the Atlas CIDR on 27017 from your app security group.
5. Atlas IP access list: add your VPC CIDR block so Atlas accepts the traffic.
6. Connect with the standard connection string and the private hosts; verify DNS resolves inside the VPC.
## Rules
- CIDR blocks must not overlap between your VPC and Atlas. Pick the Atlas CIDR at cluster creation with peering in mind; changing it later is painful.
- Peering is regional: the Atlas region and your VPC region should match, or you pay cross-region and add latency.
- One peering per VPC pair. Do not stack multiple peerings and wonder why routing is weird.
## Verify
From an EC2 instance in the VPC, `mongosh` with the private connection string connects, and the Atlas metrics show the connection. Then remove any public IP access list entries you no longer need.