Sydney

Progress checklist

Overview

Spoke 10.255.1.0/24 in the workload account, TGW attach to syd-hub, and a demo EC2 with nginx :80 and dnsmasq :53 (small on-prem DNS/HTTP stand-in — validate with curl / dig, nothing fancy).

Validate locally here (HTTP + DNS on this host). Inter-Region checks wait until Prove mesh then Network Firewall.

environment/sandbox/ap-southeast-2/workload-dev
  → spoke · attach · demo host (nginx + dnsmasq)
  → validate local only

Apply

Apply:

cd environment/sandbox/ap-southeast-2/workload-dev
cp terraform.tfvars.example terraform.tfvars   # workload + hub profiles
terraform init
terraform apply

Apply complete! Resources: … added, 0 changed, 0 destroyed.

Capture outputs:

export AWS_PROFILE=YOUR_WORKLOAD_PROFILE
SYD_ID=$(terraform output -raw test_host_instance_id)
SYD_ATT=$(terraform output -raw attachment_id)
SYD_IP=$(terraform output -raw test_host_private_ip)
echo "$SYD_ID $SYD_ATT $SYD_IP"

i-09c779c39f05e1547 tgw-attach-0f2cffbb9fc980160 10.255.1.58

Validate (local)

Spoke attachment + SSM:

aws ec2 describe-transit-gateway-vpc-attachments \
  --region ap-southeast-2 \
  --transit-gateway-attachment-ids "$SYD_ATT" \
  --query 'TransitGatewayVpcAttachments[0].State' --output text

aws ssm describe-instance-information \
  --region ap-southeast-2 \
  --filters "Key=InstanceIds,Values=$SYD_ID" \
  --query 'InstanceInformationList[0].PingStatus' --output text

available
Online

Local HTTP (nginx):

aws ssm send-command --region ap-southeast-2 \
  --instance-ids "$SYD_ID" \
  --document-name AWS-RunShellScript \
  --parameters "commands=[\"curl -sS -m 5 http://127.0.0.1/; echo; curl -sS -m 5 http://$SYD_IP/; echo; systemctl is-active nginx\"]" \
  --query 'Command.CommandId' --output text
# then get-command-invocation …

<html><body><h1>aws-nfw-lab</h1><p>demo http</p></body></html>
<html><body><h1>aws-nfw-lab</h1><p>demo http</p></body></html>
active

Local DNS (dnsmasq on this host):

aws ssm send-command --region ap-southeast-2 \
  --instance-ids "$SYD_ID" \
  --document-name AWS-RunShellScript \
  --parameters "commands=[\"systemctl is-active dnsmasq; dig +short @$SYD_IP lab.demo; dig +short @$SYD_IP syd-dev.lab.demo\"]" \
  --query 'Command.CommandId' --output text

active
10.255.1.58
10.255.1.58

Auckland