Skip to content
AWS NFW Walkthrough

Prerequisites

Progress checklist

Overview

Section titled “Overview”

Terraform lives in jajera/aws-nfw-lab. This walkthrough is docs only.

Three accounts, three profiles, two Regions. Every profile is used in both Regions, and hub-peering is the one stack that exists in Sydney only:

The two prerequisites that bite are along the bottom: Organizations RAM sharing, and Region opt-in for ap-southeast-6. Icons from aws-icons.
Which profile drives which stacks, in which Region Three rows. Each row starts with an AWS CLI profile placeholder, points at the account it authenticates to, then shows the stacks that account applies in ap-southeast-2 Sydney and in ap-southeast-6 Auckland. The hub profile drives the hub stack in both Regions plus the hub-peering stack, which exists only in ap-southeast-2. The dev profile drives workload-dev in both Regions and the prod profile drives workload-prod in both Regions. Every profile has to reach both Regions, and ap-southeast-6 may need Region opt-in. AWS CLI profile Account ap-southeast-2 ap-southeast-6 YOUR_HUB_PROFILE both hubs + peering Hub account TGW · inspection VPC · NFW RAM-shares TGW out hub hub-peering peering lives here only hub no peering stack YOUR_DEV_WORKLOAD_PROFILE dev stacks + SSM on dev hosts Dev workload account dev spoke + demo host accepts the RAM share workload-dev 10.255.1.0/24 workload-dev 10.254.1.0/24 YOUR_PROD_WORKLOAD_PROFILE prod stacks + SSM on prod hosts Prod workload account prod spoke + demo host accepts the RAM share workload-prod 10.255.2.0/24 workload-prod 10.254.2.0/24 Same Organization: enable RAM resource sharing, or the hub → workload TGW shares fail. Every profile must reach both Regions — ap-southeast-6 may need Region opt-in first.

Need permission for TGW, Network Firewall, RAM, EC2, SSM, Route 53 private zones.

Clone the lab

Section titled “Clone the lab”
Terminal window
git clone https://github.com/jajera/aws-nfw-lab.git
cd aws-nfw-lab

Terraform

Section titled “Terraform”
Terminal window
brew install terraform
terraform version
Tool Version Notes
Terraform >= 1.16
AWS provider ~> 6.64 pinned in each stack
jq any several walkthrough checks parse JSON output

AWS CLI and profiles

Section titled “AWS CLI and profiles”
Terminal window
aws --version
aws sts get-caller-identity --profile YOUR_HUB_PROFILE
aws sts get-caller-identity --profile YOUR_DEV_WORKLOAD_PROFILE
aws sts get-caller-identity --profile YOUR_PROD_WORKLOAD_PROFILE
Doc placeholder Used for
YOUR_HUB_PROFILE Both hubs + hub-peering
YOUR_DEV_WORKLOAD_PROFILE workload-dev stacks + SSM on dev hosts
YOUR_PROD_WORKLOAD_PROFILE workload-prod stacks + SSM on prod hosts

Confirm each profile can call both ap-southeast-2 and ap-southeast-6 (Auckland may need opt-in).

Org RAM

Section titled “Org RAM”

Same Organization: enable resource sharing with AWS Organizations so hub→workload TGW RAM shares succeed.

tfvars

Section titled “tfvars”

Every stack:

Terminal window
cp terraform.tfvars.example terraform.tfvars
# set profiles + account IDs — do not commit terraform.tfvars

Hub stacks need both workload account IDs in workload_account_ids.

Teaching path

Section titled “Teaching path”
Same rail as Architecture. Teardown follows Validate. Icons from aws-icons.
Build order and the two staged Network Firewall flags Eight stages left to right: hubs, dev workloads, prod workloads, hub peering, prove mesh, Network Firewall deny, Network Firewall allow, validate. Underneath, three phases show the hub flags. Mesh covers the first five stages with enable_network_firewall false and firewall_rules_enabled false. Deny covers the sixth stage with enable_network_firewall true and firewall_rules_enabled false. Allow covers the last two stages with both flags true. Build order mesh first, firewall last 1 2 3 4 5 6 7 8 Hubs TGW + insp VPC Workloads dev spoke + host Workloads prod spoke + host Hub peering re-apply after prod Prove mesh ping · curl · dig NFW deny default drop NFW allow PASS rule groups Validate alert + flow logs Mesh — TGW only enable_network_firewall = false firewall_rules_enabled = false Deny nfw = true rules = false Allow nfw = true rules = true

Full terraform apply + vars. Prefer not -target. Teardown is the last page.

Next

Section titled “Next”

Sydney hub