Skip to content
AWS NFW Walkthrough

Validate

Progress checklist

Overview

Section titled “Overview”

Joint gate after each Region’s prod local checks. Then re-apply hub-peering so prod CIDRs and syd-prod / akl-prod DNS are published.

  Workloads (prod) Sydney  → local HTTP + DNS
  Workloads (prod) Auckland → local HTTP + DNS
            → Workloads (prod) Validate (here)
            → hub-peering enable_prod_workloads=true
            → Prove mesh (include prod) / NFW chapter

Compare

Section titled “Compare”

  1. Side-by-side outputs:

    Terminal window
    ( cd environment/sandbox/ap-southeast-2/workload-prod && \
      echo "=== Sydney prod ===" && terraform output -raw vpc_cidr && \
      terraform output -raw test_host_private_ip && \
      terraform output -raw test_host_instance_id )
    ( cd environment/sandbox/ap-southeast-6/workload-prod && \
      echo "=== Auckland prod ===" && terraform output -raw vpc_cidr && \
      terraform output -raw test_host_private_ip && \
      terraform output -raw test_host_instance_id )
    === Sydney prod ===
    10.255.2.0/24
    10.255.2.69
    i-01780abcba294ad2f
    === Auckland prod ===
    10.254.2.0/24
    10.254.2.22
    i-072c72766be1110b3

  2. Re-check SSM Online on both:

    Terminal window
    export AWS_PROFILE=YOUR_PROD_WORKLOAD_PROFILE
    SYD_PROD_ID=$(cd environment/sandbox/ap-southeast-2/workload-prod && terraform output -raw test_host_instance_id)
    AKL_PROD_ID=$(cd environment/sandbox/ap-southeast-6/workload-prod && terraform output -raw test_host_instance_id)
    

    aws ssm describe-instance-information --region ap-southeast-2 \
      --filters "Key=InstanceIds,Values=$SYD_PROD_ID" \
      --query 'InstanceInformationList[0].PingStatus' --output text
    

    aws ssm describe-instance-information --region ap-southeast-6 \
      --filters "Key=InstanceIds,Values=$AKL_PROD_ID" \
      --query 'InstanceInformationList[0].PingStatus' --output text
    Online
    Online

  3. Publish prod into peering / DNS:

    Terminal window
    cd environment/sandbox/ap-southeast-2/hub-peering
    # persist in terraform.tfvars: enable_prod_workloads = true
    terraform apply -var='enable_prod_workloads=true'

  4. Optional — same-Region dev ↔ prod (Sydney), before or after NFW:

    Terminal window
    export AWS_PROFILE=YOUR_DEV_WORKLOAD_PROFILE
    SYD_DEV_ID=$(cd environment/sandbox/ap-southeast-2/workload-dev && terraform output -raw test_host_instance_id)
    SYD_PROD_IP=$(cd environment/sandbox/ap-southeast-2/workload-prod && terraform output -raw test_host_private_ip)
    

    aws ssm send-command --region ap-southeast-2 --instance-ids "$SYD_DEV_ID" \
      --document-name AWS-RunShellScript \
      --parameters 'commands=["ping -c3 '"$SYD_PROD_IP"'; curl -sS -m 5 http://'"$SYD_PROD_IP"'/"]' \
      --query 'Command.CommandId' --output text

    Expect: ICMP replies and the demo HTML from 10.255.2.69.

Next

Section titled “Next”

Prove mesh