Sydney

Progress checklist

• tfvars: hub profile + both workload account IDs; NFW flags false
• terraform apply succeeded
• Sydney TGW available, ASN 65001
• Inspection VPC + attachment available
• spoke_association = no_inspection; firewall_arn null
• Sydney RAM share ACTIVE

Overview

syd-hub owns the Sydney Transit Gateway, inspection VPC (10.255.0.0/24), inspection / no-inspection route tables, and the RAM share spokes use.

Network Firewall is off. Mesh first; NFW is Network Firewall → Sydney.

Both route tables exist from the start. While the firewall is off, spoke_association resolves to the no_inspection table — which is why two of the outputs below share one id. Icons from aws-icons.

Close

Validate this Region, then Auckland, then Hubs → Validate.

Apply

1. Configure and apply:

   cd environment/sandbox/ap-southeast-2/hub
   cp terraform.tfvars.example terraform.tfvars
   # hub_profile, workload_account_ids = [dev, prod]
   # leave:
   #   enable_network_firewall = false
   #   firewall_rules_enabled  = false
   terraform init
   terraform apply

2. Capture outputs:

   export AWS_PROFILE=YOUR_HUB_PROFILE
   SYD_TGW=$(terraform output -raw transit_gateway_id)
   terraform output -raw transit_gateway_id
   terraform output -raw inspection_vpc_id
   terraform output -raw inspection_vpc_cidr
   terraform output -raw inspection_attachment_id
   terraform output -raw enable_network_firewall
   terraform output -raw firewall_rules_enabled
   terraform output -raw spoke_association_route_table_id
   terraform output -raw no_inspection_route_table_id
   terraform output -raw inspection_route_table_id

   tgw-04fc7f3ccf224fdf2
   vpc-04a40ca73a73d91ef
   10.255.0.0/24
   tgw-attach-023a756ffaa0fd02a
   false
   false
   tgw-rtb-00be3893a2741a265   # spoke_association == no_inspection
   tgw-rtb-00be3893a2741a265
   tgw-rtb-09996f46ffff7d5c6   # inspection exists; unused by spokes yet

Note

Full terraform apply with vars — not -target.

Validate

1. Transit Gateway state and ASN:

   aws ec2 describe-transit-gateways \
     --region ap-southeast-2 \
     --transit-gateway-ids "$SYD_TGW" \
     --query 'TransitGateways[0].{State:State,Asn:Options.AmazonSideAsn}' \
     --output table

   |  Asn   |    State    |
   |  65001 |  available  |

2. Inspection VPC attachment:

   ATT=$(terraform output -raw inspection_attachment_id)
   aws ec2 describe-transit-gateway-vpc-attachments \
     --region ap-southeast-2 \
     --transit-gateway-attachment-ids "$ATT" \
     --query 'TransitGatewayVpcAttachments[0].{Id:TransitGatewayAttachmentId,State:State,Vpc:VpcId}' \
     --output table

   |  tgw-attach-023a756ffaa0fd02a |  available |  vpc-04a40ca73a73d91ef |

3. NFW not attached:

   terraform output -raw enable_network_firewall
   terraform output -raw firewall_arn

   false

   (firewall_arn is empty / null.)

4. RAM share:

   aws ram get-resource-shares \
     --region ap-southeast-2 \
     --resource-owner SELF \
     --query 'resourceShares[?contains(name, `nfw-lab`)].[name,status]' \
     --output table

   |  nfw-lab-syd-tgw-share    |  ACTIVE    |

Next

Auckland