# VPC Peering Connection

> VPC Network Peering costs nothing to establish (the connection itself has no meter), while traffic crossing it bills at internal egress rates, and stale peerings widen the attack surface. ZopNight inventories every peering via Cloud Asset Inventory to map cross-project traffic paths in topology.

Source: https://zop.dev/integrations/gcp/gcp-vpc-peering
Updated: 2026-08-19

---

VPC Network Peering connects two VPC networks so they exchange traffic over private IPs. Peering itself is free, but cross-network egress bills at internal rates and stale peerings widen the attack surface.

## Free to peer, metered to talk

Establishing a peering costs nothing and keeping one costs nothing, because Google attaches no meter to the connection. The billing happens to the traffic: packets crossing a peering pay standard internal rates, so same-zone exchanges are free while cross-zone and cross-region flows bill like any other internal egress. The peering changes the path, not the price. What it does change decisively is reachability, which is why a peering's real cost is measured in exposure rather than dollars.

## Mapping cross-project paths through peerings

ZopDev inventories peering connections via Cloud Asset Inventory to map cross-project traffic paths in topology. A peering is frequently the only artifact connecting two projects owned by different teams, so the row itself is valuable evidence: it explains why traffic appears in one project's bill that originated in another's, and it makes shared-services architectures legible. There is nothing to schedule: no compute, no meter, no stop verb. Coverage here is inventory and hygiene, not automation.

## When an old peering becomes a liability

Peerings rot in predictable ways. The partner-project peering that survived the partnership: the far network still reaches yours long after the collaboration ended. The migration bridge left standing after the migration finished, connecting a legacy network nobody audits to a production one everybody depends on. And transitive-topology confusion: peering is non-transitive by design, so teams sometimes stack additional peerings to route around that constraint, producing a mesh in which working out what can reach what takes an afternoon.

## Confirming peering state in the console

Google Cloud console → VPC network → VPC network peering lists each connection with its peer network, project, state, and exchanged-routes configuration. An entry whose state is anything other than Active, or whose peer project nobody present can name, is a cleanup candidate.