Skip to content
AWS NFW Walkthrough

Validate

Progress checklist

Overview

Section titled “Overview”

Joint gate after each Region’s hub-peering checks. Requires enable_prod_workloads=true (all four A records). Then Prove mesh before attaching NFW.

Four assertions, one per step below. Icons from aws-icons.
The four things the hub-peering gate asserts A rail across the top shows the order: Sydney checks, Auckland checks, this peering gate, then Prove mesh. Below are four assertions. First, a single peering attachment id reports available in both ap-southeast-2 and ap-southeast-6. Second, the peer association on both sides is still the no_inspection route table, because Network Firewall is not attached yet. Third, all four A records in lab.demo match the live host IPs, which requires enable_prod_workloads true. Fourth, the peering stack's spoke CIDR lists equal the local_spoke_cidrs output from each hub. Sydney checks Auckland checks peering gate — here Prove mesh One attachment, two Regions tgw-attach-0ef352cc0c6405026 ap-southeast-2 available ap-southeast-6 available Peer still on no_inspection NFW not attached, so the peer is passthrough syd tgw-rtb-00be3893a2741a265 = no_inspection akl tgw-rtb-0de1397f3982b6434 = no_inspection Four A records in lab.demo needs enable_prod_workloads = true syd-dev 10.255.1.58 akl-dev 10.254.1.31 syd-prod 10.255.2.69 akl-prod 10.254.2.22 CIDR lists match the hubs the same two lists the hub gate mirrored syd_spoke_cidrs = syd hub local akl_spoke_cidrs = akl hub local All four are control plane. Cross-Region curl and dig come next in Prove mesh — still without Network Firewall.

Compare

Section titled “Compare”

  1. Dump stack outputs:

    Terminal window
    cd environment/sandbox/ap-southeast-2/hub-peering
    echo "=== hub-peering ==="
    terraform output -raw peering_attachment_id
    terraform output -raw dns_zone_name
    terraform output -raw syd_dev_hostname
    terraform output -raw akl_dev_hostname
    terraform output -raw syd_prod_hostname
    terraform output -raw akl_prod_hostname
    terraform output syd_spoke_cidrs
    terraform output akl_spoke_cidrs
    === hub-peering ===
    tgw-attach-0ef352cc0c6405026
    lab.demo
    syd-dev.lab.demo
    akl-dev.lab.demo
    syd-prod.lab.demo
    akl-prod.lab.demo
    tolist([
      "10.255.1.0/24",
      "10.255.2.0/24",
    ])
    tolist([
      "10.254.1.0/24",
      "10.254.2.0/24",
    ])

  2. Assert spoke CIDR lists still mirror the hubs:

    Terminal window
    SYD_LOCAL=$(cd ../hub && terraform output -json local_spoke_cidrs)
    AKL_LOCAL=$(cd ../../ap-southeast-6/hub && terraform output -json local_spoke_cidrs)
    SYD_PEER=$(terraform output -json syd_spoke_cidrs)
    AKL_PEER=$(terraform output -json akl_spoke_cidrs)
    

    test "$SYD_LOCAL" = "$SYD_PEER" && test "$AKL_LOCAL" = "$AKL_PEER" \
      && echo "peering spoke CIDRs match hubs OK" \
      || echo "peering spoke CIDRs do NOT match hubs"
    peering spoke CIDRs match hubs OK

  3. All four A records vs live host IPs:

    Terminal window
    export AWS_PROFILE=YOUR_DEV_WORKLOAD_PROFILE
    SYD_DEV_IP=$(cd ../workload-dev && terraform output -raw test_host_private_ip)
    AKL_DEV_IP=$(cd ../../ap-southeast-6/workload-dev && terraform output -raw test_host_private_ip)
    SYD_PROD_IP=$(cd ../workload-prod && terraform output -raw test_host_private_ip)
    AKL_PROD_IP=$(cd ../../ap-southeast-6/workload-prod && terraform output -raw test_host_private_ip)
    ZONE=$(aws route53 list-hosted-zones-by-name --dns-name lab.demo. \
      --query 'HostedZones[?Config.PrivateZone==`true`].Id' --output text | sed 's|/hostedzone/||' | head -1)
    

    aws route53 list-resource-record-sets \
      --hosted-zone-id "$ZONE" \
      --query "ResourceRecordSets[?Type=='A'].[Name,ResourceRecords[0].Value]" \
      --output text
    

    echo "expect syd-dev=$SYD_DEV_IP akl-dev=$AKL_DEV_IP syd-prod=$SYD_PROD_IP akl-prod=$AKL_PROD_IP"
    akl-dev.lab.demo.  10.254.1.31
    akl-prod.lab.demo.  10.254.2.22
    syd-dev.lab.demo.  10.255.1.58
    syd-prod.lab.demo.  10.255.2.69
    expect syd-dev=10.255.1.58 akl-dev=10.254.1.31 syd-prod=10.255.2.69 akl-prod=10.254.2.22

  4. Peering available in both Regions:

    Terminal window
    export AWS_PROFILE=YOUR_HUB_PROFILE
    PEER=$(terraform output -raw peering_attachment_id)
    

    aws ec2 describe-transit-gateway-attachments --region ap-southeast-2 \
      --transit-gateway-attachment-ids "$PEER" \
      --query 'TransitGatewayAttachments[0].State' --output text
    

    aws ec2 describe-transit-gateway-attachments --region ap-southeast-6 \
      --transit-gateway-attachment-ids "$PEER" \
      --query 'TransitGatewayAttachments[0].State' --output text
    available
    available

  5. Peer assoc is no_inspection on both sides (NFW not attached yet):

    Terminal window
    PEER=$(terraform output -raw peering_attachment_id)
    SYD_NO=$(cd ../hub && terraform output -raw no_inspection_route_table_id)
    AKL_NO=$(cd ../../ap-southeast-6/hub && terraform output -raw no_inspection_route_table_id)
    SYD_ASSOC=$(aws ec2 describe-transit-gateway-attachments --region ap-southeast-2 \
      --transit-gateway-attachment-ids "$PEER" \
      --query 'TransitGatewayAttachments[0].Association.TransitGatewayRouteTableId' --output text)
    AKL_ASSOC=$(aws ec2 describe-transit-gateway-attachments --region ap-southeast-6 \
      --transit-gateway-attachment-ids "$PEER" \
      --query 'TransitGatewayAttachments[0].Association.TransitGatewayRouteTableId' --output text)
    

    echo "syd assoc=$SYD_ASSOC (expect no_insp=$SYD_NO)"
    echo "akl assoc=$AKL_ASSOC (expect no_insp=$AKL_NO)"
    syd assoc=tgw-rtb-00be3893a2741a265 (expect no_insp=tgw-rtb-00be3893a2741a265)
    akl assoc=tgw-rtb-0de1397f3982b6434 (expect no_insp=tgw-rtb-0de1397f3982b6434)

Next

Section titled “Next”

Prove mesh