Skip to content
AWS NFW Walkthrough

Auckland

Progress checklist

Overview

Section titled “Overview”

There is no second apply. The stack under ap-southeast-2/hub-peering already accepted peering on the Auckland TGW, wrote the remote Syd spoke route, associated lab.demo to the Akl spoke, and set DHCP.

Validate this Region after Sydney, then Hub peering → Validate.

Same diagram as the Sydney page, on purpose — same stack. This page reads the right-hand column, which the Sydney apply already created. Icons from aws-icons.
One hub-peering stack, both sides of the peer The Terraform stack at environment/sandbox/ap-southeast-2/hub-peering creates a single TGW peering attachment that exists in both Regions, shown as a band spanning them. Under it, ap-southeast-2 Sydney is the requester and ap-southeast-6 Auckland is the accepter. Each Region gets the same three things: the peer associated to its no_inspection route table along with static routes to the other Region's spoke CIDRs, the lab.demo private zone associated to its spoke VPC with an A record, and a DHCP option set carrying the lab.demo search domain. There is no second apply in Auckland. Terraform stack ap-southeast-2/ hub-peering one apply, both sides enable_prod_workloads true → prod A records after NFW attach re-apply peering to move the peer onto each hub's inspection RT TGW peering attachment tgw-attach-… one id, queried in both Regions ap-southeast-2 · Sydney requester no_inspection RT tgw-rtb-… peer association + static routes to Akl: 10.254.1.0/24 10.254.2.0/24 private zone lab.demo syd-dev.lab.demo → spoke VPC DHCP option set domain-name = lab.demo search domain ap-southeast-6 · Auckland accepter no_inspection RT tgw-rtb-… peer association + static routes to Syd: 10.255.1.0/24 10.255.2.0/24 private zone lab.demo akl-dev.lab.demo → spoke VPC DHCP option set domain-name = lab.demo search domain Peer sits on no_inspection in both Regions — passthrough mesh until Network Firewall is attached.

Validate

Section titled “Validate”

  1. Load IDs from the shared stack (still under the Sydney path):

    Terminal window
    export AWS_PROFILE=YOUR_HUB_PROFILE
    cd environment/sandbox/ap-southeast-2/hub-peering
    PEER=$(terraform output -raw peering_attachment_id)

  2. Auckland attachment state and RT association (no_inspection while NFW off):

    Terminal window
    AKL_NO=$(cd ../../ap-southeast-6/hub && terraform output -raw no_inspection_route_table_id)
    

    aws ec2 describe-transit-gateway-attachments \
      --region ap-southeast-6 \
      --transit-gateway-attachment-ids "$PEER" \
      --query 'TransitGatewayAttachments[0].{State:State,Assoc:Association.TransitGatewayRouteTableId}' \
      --output table
    

    echo "expect Assoc == $AKL_NO (passthrough)"
    --------------------------------------------
    |     DescribeTransitGatewayAttachments    |
    +----------------------------+-------------+
    |            Assoc           |    State    |
    +----------------------------+-------------+
    |  tgw-rtb-0de1397f3982b6434 |  available  |
    +----------------------------+-------------+
    expect Assoc == tgw-rtb-0de1397f3982b6434 (passthrough)

  3. Static routes to Sydney spokes via the peer (Akl no-inspection RT):

    Terminal window
    AKL_NO=$(cd ../../ap-southeast-6/hub && terraform output -raw no_inspection_route_table_id)
    

    aws ec2 search-transit-gateway-routes \
      --region ap-southeast-6 \
      --transit-gateway-route-table-id "$AKL_NO" \
      --filters "Name=route-search.subnet-of-match,Values=10.255.0.0/16" \
      --query 'Routes[].{Dest:DestinationCidrBlock,Attach:TransitGatewayAttachments[0].TransitGatewayAttachmentId,State:State}' \
      --output table
    -------------------------------------------------------------
    |                SearchTransitGatewayRoutes                 |
    +-------------------------------+-----------------+---------+
    |            Attach             |      Dest       |  State  |
    +-------------------------------+-----------------+---------+
    |  tgw-attach-0ef352cc0c6405026 |  10.255.1.0/24  |  active |
    |  tgw-attach-0ef352cc0c6405026 |  10.255.2.0/24  |  active |
    +-------------------------------+-----------------+---------+

  4. akl-dev.lab.demo A record matches the Auckland host IP:

    Terminal window
    AKL_IP=$(cd ../../ap-southeast-6/workload-dev && terraform output -raw test_host_private_ip)
    ZONE=$(aws route53 list-hosted-zones-by-name --dns-name lab.demo. \
      --query 'HostedZones[?Config.PrivateZone==`true`].Id' --output text | sed 's|/hostedzone/||' | head -1)
    

    aws route53 list-resource-record-sets \
      --hosted-zone-id "$ZONE" \
      --query "ResourceRecordSets[?Name=='akl-dev.lab.demo.'].[Name,ResourceRecords[0].Value]" \
      --output text
    

    echo "expect A == $AKL_IP"
    akl-dev.lab.demo.  10.254.1.31
    expect A == 10.254.1.31

  5. Private zone associated to the Auckland spoke VPC:

    Terminal window
    export AWS_PROFILE=YOUR_DEV_WORKLOAD_PROFILE
    AKL_VPC=$(cd ../../ap-southeast-6/workload-dev && terraform output -raw vpc_id)
    

    aws route53 list-hosted-zones-by-vpc \
      --vpc-id "$AKL_VPC" \
      --vpc-region ap-southeast-6 \
      --query 'HostedZoneSummaries[?Name==`lab.demo.`].Name' \
      --output text
    lab.demo.

  6. Auckland spoke DHCP search domain:

    Terminal window
    DHCP=$(aws ec2 describe-vpcs --region ap-southeast-6 --vpc-ids "$AKL_VPC" \
      --query 'Vpcs[0].DhcpOptionsId' --output text)
    

    aws ec2 describe-dhcp-options --region ap-southeast-6 --dhcp-options-ids "$DHCP" \
      --query 'DhcpOptions[0].DhcpConfigurations[?Key==`domain-name` || Key==`domain-name-servers`]' \
      --output json
    [
        {
            "Key": "domain-name",
            "Values": [{ "Value": "lab.demo" }]
        },
        {
            "Key": "domain-name-servers",
            "Values": [{ "Value": "AmazonProvidedDNS" }]
        }
    ]

Next

Section titled “Next”

Validate