Skip to content
AWS NFW Walkthrough

Auckland

Progress checklist

Overview

Section titled “Overview”

Same deny attach as Sydney, then re-apply environment/sandbox/ap-southeast-2/hub-peering so the peer moves onto each hub’s inspection RT (double-inspect).

enable_network_firewall = true
firewall_rules_enabled  = false

Apply

Section titled “Apply”

  1. Apply Akl hub:

    Terminal window
    cd environment/sandbox/ap-southeast-6/hub
    terraform apply

  2. Capture outputs:

    Terminal window
    export AWS_PROFILE=YOUR_HUB_PROFILE
    terraform output -raw enable_network_firewall
    terraform output -raw firewall_rules_enabled
    terraform output -raw firewall_arn
    terraform output -raw spoke_association_route_table_id
    terraform output -raw inspection_route_table_id
    terraform output -raw no_inspection_route_table_id
    terraform output -json firewall_endpoint_ids
    true
    false
    arn:aws:network-firewall:ap-southeast-6:241533147323:firewall/nfw-lab-akl
    tgw-rtb-088d989b87ff8da52
    tgw-rtb-088d989b87ff8da52
    tgw-rtb-0de1397f3982b6434
    {
      "ap-southeast-6a": "vpce-0fa4b27f7781529a8"
    }

  3. Firewall READY:

    Terminal window
    export AWS_PROFILE=YOUR_HUB_PROFILE
    FW=$(terraform output -raw firewall_arn)
    aws network-firewall describe-firewall --region ap-southeast-6 \
      --firewall-arn "$FW" --query 'FirewallStatus.Status' --output text
    READY

  4. Hairpin:

    Terminal window
    export AWS_PROFILE=YOUR_HUB_PROFILE
    EP=$(terraform output -json firewall_endpoint_ids | jq -r 'to_entries[0].value')
    aws ec2 describe-route-tables --region ap-southeast-6 \
      --filters "Name=tag:Name,Values=*insp-tgw-rt" \
      --query "RouteTables[].Routes[?VpcEndpointId=='$EP'].[DestinationCidrBlock,VpcEndpointId]" \
      --output text
    0.0.0.0/0  vpce-0fa4b27f7781529a8

  5. Move Akl spokes onto inspection:

    Terminal window
    cd ../workload-dev && terraform apply
    cd ../workload-prod && terraform apply

  6. Confirm both spoke associations:

    Terminal window
    export AWS_PROFILE=YOUR_HUB_PROFILE
    INSP=$(cd ../hub && terraform output -raw inspection_route_table_id)
    DEV=$(cd ../workload-dev && terraform output -raw attachment_id)
    PROD=$(cd ../workload-prod && terraform output -raw attachment_id)
    

    DEV_ASSOC=$(aws ec2 describe-transit-gateway-attachments --region ap-southeast-6 \
      --transit-gateway-attachment-ids "$DEV" \
      --query 'TransitGatewayAttachments[0].Association.TransitGatewayRouteTableId' \
      --output text)
    PROD_ASSOC=$(aws ec2 describe-transit-gateway-attachments --region ap-southeast-6 \
      --transit-gateway-attachment-ids "$PROD" \
      --query 'TransitGatewayAttachments[0].Association.TransitGatewayRouteTableId' \
      --output text)
    

    echo "dev=$DEV_ASSOC insp=$INSP"
    echo "prod=$PROD_ASSOC insp=$INSP"
    dev=tgw-rtb-088d989b87ff8da52 insp=tgw-rtb-088d989b87ff8da52
    prod=tgw-rtb-088d989b87ff8da52 insp=tgw-rtb-088d989b87ff8da52

  7. Re-apply hub-peering:

    Terminal window
    cd ../../ap-southeast-2/hub-peering
    terraform apply

  8. Peer association = inspection on both Regions:

    Terminal window
    export AWS_PROFILE=YOUR_HUB_PROFILE
    PEER=$(terraform output -raw peering_attachment_id)
    SYD_INSP=$(cd ../hub && terraform output -raw inspection_route_table_id)
    AKL_INSP=$(cd ../../ap-southeast-6/hub && terraform output -raw inspection_route_table_id)
    

    SYD_ASSOC=$(aws ec2 describe-transit-gateway-attachments --region ap-southeast-2 \
      --transit-gateway-attachment-ids "$PEER" \
      --query 'TransitGatewayAttachments[0].Association.TransitGatewayRouteTableId' \
      --output text)
    AKL_ASSOC=$(aws ec2 describe-transit-gateway-attachments --region ap-southeast-6 \
      --transit-gateway-attachment-ids "$PEER" \
      --query 'TransitGatewayAttachments[0].Association.TransitGatewayRouteTableId' \
      --output text)
    

    echo "syd peer=$SYD_ASSOC insp=$SYD_INSP"
    echo "akl peer=$AKL_ASSOC insp=$AKL_INSP"
    syd peer=tgw-rtb-09996f46ffff7d5c6 insp=tgw-rtb-09996f46ffff7d5c6
    akl peer=tgw-rtb-088d989b87ff8da52 insp=tgw-rtb-088d989b87ff8da52

  9. No stateful PASS groups on the Akl policy:

    Terminal window
    export AWS_PROFILE=YOUR_HUB_PROFILE
    cd ../../ap-southeast-6/hub
    FW=$(terraform output -raw firewall_arn)
    POL=$(aws network-firewall describe-firewall --region ap-southeast-6 \
      --firewall-arn "$FW" --query Firewall.FirewallPolicyArn --output text)
    aws network-firewall describe-firewall-policy --region ap-southeast-6 \
      --firewall-policy-arn "$POL" \
      --query 'FirewallPolicy.StatefulRuleGroupReferences' --output json
    null

Next

Section titled “Next”

Deny