Skip to content
AWS NFW Walkthrough

Auckland

Progress checklist

Overview

Section titled “Overview”

Same shape as Sydney in Auckland: TGW ASN 65002, inspection VPC 10.254.0.0/24, dual route tables, RAM to dev + prod. NFW stays off.

Identical layout to Sydney, only the Region, ASN and CIDR change. Compare against the Sydney diagram rather than re-reading it. Icons from aws-icons.
What the Auckland hub stack creates, before Network Firewall The Terraform stack at environment/sandbox/ap-southeast-6/hub, with both firewall flags false, creates a Transit Gateway with ASN 65002, an inspection VPC 10.254.0.0/24 with an available VPC attachment, and a RAM share to the dev and prod accounts. Network Firewall is drawn faded and dashed because the flags are false. Two TGW route tables exist: the no-inspection table, which is also what spoke_association_route_table_id resolves to while the firewall is off, and the inspection table, which is created now but has no spokes associated yet. Terraform stack ap-southeast-6/hub flags held false for now: enable_network_firewall firewall_rules_enabled workload_account_ids = [dev, prod] ap-southeast-6 · Auckland akl-hub account Transit Gateway ASN 65002 inspection VPC · 10.254.0.0/24 VPC attachment available Network Firewall not yet — flags false RAM share ACTIVE, to dev + prod TGW route tables no_inspection tgw-rtb-0de1397f3982b6434 spoke_association_route_table_id resolves to this same id while the firewall is off inspection tgw-rtb-088d989b87ff8da52 created now, nothing associated yet — spokes move here when NFW is attached

Apply

Section titled “Apply”

  1. Configure and apply:

    Terminal window
    cd environment/sandbox/ap-southeast-6/hub
    cp terraform.tfvars.example terraform.tfvars
    # hub_profile, workload_account_ids = [dev, prod]
    # enable_network_firewall = false
    # firewall_rules_enabled  = false
    terraform init
    terraform apply

  2. Capture outputs:

    Terminal window
    export AWS_PROFILE=YOUR_HUB_PROFILE
    AKL_TGW=$(terraform output -raw transit_gateway_id)
    terraform output -raw transit_gateway_id
    terraform output -raw inspection_vpc_id
    terraform output -raw inspection_vpc_cidr
    terraform output -raw inspection_attachment_id
    terraform output -raw enable_network_firewall
    terraform output -raw firewall_rules_enabled
    terraform output -raw spoke_association_route_table_id
    terraform output -raw no_inspection_route_table_id
    terraform output -raw inspection_route_table_id
    tgw-04db3776f3a795ce7
    vpc-0ad3fed6c0393729a
    10.254.0.0/24
    tgw-attach-0d4c6c5cb225f6768
    false
    false
    tgw-rtb-0de1397f3982b6434   # spoke_association == no_inspection
    tgw-rtb-0de1397f3982b6434
    tgw-rtb-088d989b87ff8da52

Validate

Section titled “Validate”

  1. Transit Gateway:

    Terminal window
    aws ec2 describe-transit-gateways \
      --region ap-southeast-6 \
      --transit-gateway-ids "$AKL_TGW" \
      --query 'TransitGateways[0].{State:State,Asn:Options.AmazonSideAsn}' \
      --output table
    |  Asn   |    State    |
    |  65002 |  available  |

  2. Inspection VPC attachment:

    Terminal window
    ATT=$(terraform output -raw inspection_attachment_id)
    aws ec2 describe-transit-gateway-vpc-attachments \
      --region ap-southeast-6 \
      --transit-gateway-attachment-ids "$ATT" \
      --query 'TransitGatewayVpcAttachments[0].{Id:TransitGatewayAttachmentId,State:State,Vpc:VpcId}' \
      --output table
    |  tgw-attach-0d4c6c5cb225f6768 |  available |  vpc-0ad3fed6c0393729a |

  3. NFW not attached:

    Terminal window
    terraform output -raw enable_network_firewall
    terraform output -raw firewall_arn
    false

  4. RAM share:

    Terminal window
    aws ram get-resource-shares \
      --region ap-southeast-6 \
      --resource-owner SELF \
      --query 'resourceShares[?contains(name, `nfw-lab`)].[name,status]' \
      --output table
    |  nfw-lab-akl-tgw-share    |  ACTIVE    |

Next

Section titled “Next”

Validate