Skip to content
AWS NFW Walkthrough

Demo roles

Accounts

Section titled “Accounts”

Three AWS accounts (one hub, two workloads):

Every account spans both Regions. Workloads only ever attach to their own Region's hub. Icons from aws-icons.
Who owns what, per account and per Region A matrix with three rows and two columns. Rows are the hub account, the dev workload account and the prod workload account. Columns are ap-southeast-2 Sydney and ap-southeast-6 Auckland. Each hub cell holds a Transit Gateway, Network Firewall and Resource Access Manager share, plus the inspection VPC CIDR and the Region ASN. Each dev and prod cell holds a spoke VPC, a demo host, its CIDR and its lab.demo name. The two hub cells are joined by Transit Gateway peering. Arrows show the hub RAM share reaching both workload rows in each Region. ap-southeast-2 · Sydney ap-southeast-6 · Auckland Hub account owns TGW, NFW, RAM share TGW NFW RAM 10.255.0.0/24 inspection VPC ASN 65001 TGW NFW RAM 10.254.0.0/24 inspection VPC ASN 65002 TGW peering Dev account dev spoke + demo host dev spoke VPC demo host 10.255.1.0/24 syd-dev.lab.demo dev spoke VPC demo host 10.254.1.0/24 akl-dev.lab.demo Prod account prod spoke + demo host prod spoke VPC demo host 10.255.2.0/24 syd-prod.lab.demo prod spoke VPC demo host 10.254.2.0/24 akl-prod.lab.demo RAM RAM
Role Region Account Owns
syd-hub / akl-hub ap-southeast-2 / ap-southeast-6 Hub TGW, inspection VPC, NFW (staged), RAM share
syd-dev / akl-dev same Dev Dev spoke + demo host
syd-prod / akl-prod same Prod Prod spoke + demo host

Hub-to-hub is TGW peering. Workload-to-hub is RAM share of the regional TGW, then VPC attachment accepted in the hub account. Workloads never attach to the remote Region’s TGW. With NFW on, cross-Region east-west is double-inspected (both hubs); same-Region stays on the local hub only — see Inspection model.

Profiles

Section titled “Profiles”

Provider profile names are not hard-coded in Terraform defaults. Copy each stack terraform.tfvars.example → terraform.tfvars and set:

Stack Profiles / IDs
*/hub Hub profile; workload_account_ids = dev and prod account IDs
*/workload-dev Dev workload profile + hub profile
*/workload-prod Prod workload profile + hub profile
hub-peering Hub + dev (+ prod profiles when enable_prod_workloads=true)

Keep real profile names in local tfvars only (gitignored). Docs use YOUR_HUB_PROFILE, YOUR_DEV_WORKLOAD_PROFILE, YOUR_PROD_WORKLOAD_PROFILE.

Layout

Section titled “Layout”
environment/sandbox/
  ap-southeast-2/hub
  ap-southeast-2/workload-dev
  ap-southeast-2/workload-prod
  ap-southeast-2/hub-peering
  ap-southeast-6/hub
  ap-southeast-6/workload-dev
  ap-southeast-6/workload-prod

Cross-stack wiring uses terraform_remote_state against sibling terraform.tfstate files under those paths.