Skip to content
AWS NFW Walkthrough

Auckland

Progress checklist

Overview

Section titled “Overview”

Prod spoke 10.254.2.0/24 in ap-southeast-6. Same local validation as Sydney prod. Auckland omits ec2messages by design (post-2024 Regions use ssmmessages only); spokes set ssm + ssmmessages.

environment/sandbox/ap-southeast-6/workload-prod
  → spoke 10.254.2.0/24 · attach · demo host
  → validate local only

Apply

Section titled “Apply”

  1. Apply:

    Terminal window
    cd environment/sandbox/ap-southeast-6/workload-prod
    cp terraform.tfvars.example terraform.tfvars
    terraform init
    terraform apply
    Apply complete! Resources: … added, 0 changed, 0 destroyed.

  2. Capture outputs:

    Terminal window
    export AWS_PROFILE=YOUR_PROD_WORKLOAD_PROFILE
    AKL_PROD_ID=$(terraform output -raw test_host_instance_id)
    AKL_PROD_ATT=$(terraform output -raw attachment_id)
    AKL_PROD_IP=$(terraform output -raw test_host_private_ip)
    echo "$AKL_PROD_ID $AKL_PROD_ATT $AKL_PROD_IP"
    i-072c72766be1110b3 tgw-attach-05443fc9e10463933 10.254.2.22

Validate (local)

Section titled “Validate (local)”

  1. Attachment available and SSM Online (same commands as Sydney prod, region ap-southeast-6).

  2. Local HTTP + dnsmasq:

    Terminal window
    aws ssm send-command --region ap-southeast-6 \
      --instance-ids "$AKL_PROD_ID" \
      --document-name AWS-RunShellScript \
      --parameters "commands=[\"curl -sS -m 5 http://127.0.0.1/; systemctl is-active nginx dnsmasq; dig +short @$AKL_PROD_IP lab.demo\"]" \
      --query 'Command.CommandId' --output text
    <html><body><h1>aws-nfw-lab</h1><p>demo http</p></body></html>
    active
    active
    10.254.2.22

Next

Section titled “Next”

Validate