Sydney

Progress checklist

Hubs include prod account in workload_account_ids / RAM
syd-prod apply succeeded
Spoke attachment available; SSM Online
Local HTTP (nginx) works
Local DNS (dnsmasq) works

Overview

Prod spoke 10.255.2.0/24 in the prod workload account, TGW attach to syd-hub, demo EC2 with nginx + dnsmasq. Same local checks as Workloads (dev) → Sydney.

Apply after hubs share the TGW with the prod account. Inter-Region / cross-account mesh checks wait for hub-peering with enable_prod_workloads=true.

environment/sandbox/ap-southeast-2/workload-prod
  → spoke 10.255.2.0/24 · attach · demo host
  → validate local only

Apply

Apply:

cd environment/sandbox/ap-southeast-2/workload-prod
cp terraform.tfvars.example terraform.tfvars   # prod workload + hub profiles
terraform init
terraform apply

Apply complete! Resources: … added, 0 changed, 0 destroyed.

Capture outputs:

export AWS_PROFILE=YOUR_PROD_WORKLOAD_PROFILE
SYD_PROD_ID=$(terraform output -raw test_host_instance_id)
SYD_PROD_ATT=$(terraform output -raw attachment_id)
SYD_PROD_IP=$(terraform output -raw test_host_private_ip)
echo "$SYD_PROD_ID $SYD_PROD_ATT $SYD_PROD_IP"

i-01780abcba294ad2f tgw-attach-01126c4a9dfe84f48 10.255.2.69

Validate (local)

Spoke attachment + SSM:

aws ec2 describe-transit-gateway-vpc-attachments \
  --region ap-southeast-2 \
  --transit-gateway-attachment-ids "$SYD_PROD_ATT" \
  --query 'TransitGatewayVpcAttachments[0].State' --output text

aws ssm describe-instance-information \
  --region ap-southeast-2 \
  --filters "Key=InstanceIds,Values=$SYD_PROD_ID" \
  --query 'InstanceInformationList[0].PingStatus' --output text

available
Online

Local HTTP (nginx):

aws ssm send-command --region ap-southeast-2 \
  --instance-ids "$SYD_PROD_ID" \
  --document-name AWS-RunShellScript \
  --parameters "commands=[\"curl -sS -m 5 http://127.0.0.1/; echo; curl -sS -m 5 http://$SYD_PROD_IP/; echo; systemctl is-active nginx\"]" \
  --query 'Command.CommandId' --output text

<html><body><h1>aws-nfw-lab</h1><p>demo http</p></body></html>
active

Local DNS (dnsmasq on this host):

aws ssm send-command --region ap-southeast-2 \
  --instance-ids "$SYD_PROD_ID" \
  --document-name AWS-RunShellScript \
  --parameters "commands=[\"systemctl is-active dnsmasq; dig +short @$SYD_PROD_IP lab.demo; dig +short @$SYD_PROD_IP syd-prod.lab.demo\"]" \
  --query 'Command.CommandId' --output text

active
10.255.2.69
10.255.2.69

Auckland