AWS Transit Gateway scenario with Terraform

This project gives an example of the usage of the recently (november 2018) announced AWS Transit Gateway product. That component provides a way to interconnect multiple VPCs in a hub-spoke topology.

The Transit Gateway is meant to superseed the more complex and expensive Transit VPC technology. This is a didactic example to showcase how a Transit VPC should be configured to achieve a non-trivial (full mesh) scenario. I hope it can be helpful.

Architecture

A Transit Gateway relies on Route Tables. By default, a new Route Table is created in the Transit Gateway, which populates with the routing info toward every VPC attached to the gateway (the full mesh scenario) The Terraform code in this project demonstrates a more complex scenario in which traffic is isolated based on the environment. Four VPCs are created, with two subnets each (in separate AZs):

VPC-1: in the 'dev' environment
VPC-2: in the 'dev' environment
VPC-3: in the 'shared' environment
VPC-4: in the 'prod' environment

Let's assume the 'shared' environment will host shared components, such as proxy services, tools, ... Here are the rules we want our Transit Gateway to implement:

The shared VPC can access dev and prod VPCs.
The dev VPCs can access each other, and the shared VPC
The prod VPCs can only access the shared VPC

To enable such a scenario, three Route Tables are created in the Transit Gateway, one per environment. Which means both dev VPCs attach to the same Route Table, whereas the shared and prod VPCs each attach to their respective Route Table. Each VPC gets a t2.micro Ubuntu instance to validate the network connectivity over ssh and ICMP (ping). The instance in the 'shared' is assigned a public IP so a VPN connection isn't needed. Adding the necessary Terraform resources to establish a VPN connection could be an extension of this project.

The thick green links on the diagram represents the authorized traffic through the gateway.

Prerequisites

An AWS account
Terraform

Usage

Change ACCESS_KEY and SECRET_KEY values in Variables.tf
Change the public_key value to a keypair you own
Deploy the setup with:

$ terraform init
$ terraform plan
$ terraform apply

The public IP of the instance in the 'shared' VPC is printed when deployment ends
ssh on this instance

$ ssh -i your_private_key ubuntu@$PUBLIC_IP

Check you can ping and ssh any other instance in the other VPCs
Also check that, from a dev instance (1 & 2) you cannot reach the prod instance (4) and vice-versa.
Delete all resources

$ terraform destroy

License

tbugfinder/terraform-aws-transit-gateway

ErrorLooks like something went wrong!

About

Resources

License

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Languages

Error
Looks like something went wrong!

Packages