hub
This component is responsible for provisioning an AWS Transit Gateway hub
that acts as a centralized gateway for connecting VPCs from other spoke
accounts.
Usage
Stack Level: Regional
Basic Usage with tgw/spoke
Here's an example snippet for how to configure and use this component:
components:
terraform:
tgw/hub/defaults:
metadata:
type: abstract
component: tgw/hub
vars:
enabled: true
name: tgw-hub
expose_eks_sg: false
tags:
Team: sre
Service: tgw-hub
tgw/hub:
metadata:
inherits:
- tgw/hub/defaults
component: tgw/hub
vars:
connections:
- account:
tenant: core
stage: network
vpc_component_names:
- vpc-dev
- account:
tenant: core
stage: artifacts
- account:
tenant: core
stage: auto
eks_component_names:
- eks/cluster
- account:
tenant: plat
stage: dev
vpc_component_names:
- vpc
- vpc/data/1
eks_component_names:
- eks/cluster
- account:
tenant: plat
stage: staging
vpc_component_names:
- vpc
- vpc/data/1
eks_component_names:
- eks/cluster
- account:
tenant: plat
stage: prod
vpc_component_names:
- vpc
- vpc/data/1
eks_component_names:
- eks/cluster
To provision the Transit Gateway and all related resources, run the following commands:
atmos terraform plan tgw/hub -s <tenant>-<environment>-network
atmos terraform apply tgw/hub -s <tenant>-<environment>-network
Alternate Usage with tgw/attachment
, tgw/routes
, and vpc/routes
Components Overview
tgw/hub
: Creates the Transit Gateway in the network accounttgw/attachment
: Creates and manages Transit Gateway VPC attachments in connected accountstgw/hub-connection
: Creates the Transit Gateway peering connection between twotgw/hub
deploymentstgw/routes
: Manages Transit Gateway route tables in the network accountvpc-routes
(vpc/routes/private
): Configures VPC route tables in connected accounts to route traffic through the Transit Gateway (Note: This component lives outside thetgw/
directory since it's not specific to Transit Gateway)
Architecture
The Transit Gateway components work together in the following way:
- Transit Gateway is created in the network account (
tgw/hub
) - VPCs in other accounts attach to the Transit Gateway (
tgw/attachment
) - Route tables in connected VPCs direct traffic across accounts (
vpc-routes
) - Transit Gateway route tables control routing between attachments (
tgw/routes
)
Deployment Steps
1. Deploy Transit Gateway Hub
First, create the Transit Gateway in the network account.
Leave var.connections
empty. With this refactor, the tgw/hub
component is only responsible for creating the Transit Gateway and its route tables. We do not need to fetch and store outputs for the connected components anymore.
components:
terraform:
tgw/hub:
vars:
connections: []
2. Deploy VPC Attachments
Important: Deploy attachments in connected accounts first, before deploying attachments in the network account.
Connected Account Attachments
components:
terraform:
tgw/attachment:
vars:
transit_gateway_id: !terraform.output tgw/hub core-use1-network transit_gateway_id
transit_gateway_route_table_id: !terraform.output tgw/hub core-use1-network transit_gateway_route_table_id
create_transit_gateway_route_table_association: false
Network Account Attachment
components:
terraform:
tgw/attachment:
vars:
transit_gateway_id: !terraform.output tgw/hub core-use1-network transit_gateway_id
transit_gateway_route_table_id: !terraform.output tgw/hub core-use1-network transit_gateway_route_table_id
# Route table associations are required so that route tables can propagate their routes to other route tables.
# Set the following to true in the same account where the Transit Gateway and its route tables are deployed
create_transit_gateway_route_table_association: true
# Associate connected accounts with the Transit Gateway route table
additional_associations:
- attachment_id: !terraform.output tgw/attachment core-use1-auto transit_gateway_vpc_attachment_id
route_table_id: !terraform.output tgw/hub transit_gateway_route_table_id
- attachment_id: !terraform.output tgw/attachment plat-use1-dev transit_gateway_vpc_attachment_id
route_table_id: !terraform.output tgw/hub transit_gateway_route_table_id
3. Configure VPC Routes
Configure routes in all connected VPCs.
components:
terraform:
vpc/routes/private:
metadata:
component: vpc-routes
vars:
route_table_ids: !terraform.output vpc private_route_table_ids
routes:
# Route to network account
- destination:
cidr_block: !terraform.output vpc core-use1-network vpc_cidr
target:
type: transit_gateway_id
value: !terraform.output tgw/hub core-use1-network transit_gateway_id
# Route to core-auto account, if necessary
- destination:
cidr_block: !terraform.output vpc core-use1-auto vpc_cidr
target:
type: transit_gateway_id
value: !terraform.output tgw/hub core-use1-network transit_gateway_id
Configure routes in the Network Account VPCs.
components:
terraform:
vpc/routes/private:
vars:
route_table_ids: !terraform.output vpc private_route_table_ids
routes:
# Routes to connected accounts
- destination:
cidr_block: !terraform.output vpc core-use1-auto vpc_cidr
target:
type: transit_gateway_id
value: !terraform.output tgw/hub transit_gateway_id
- destination:
cidr_block: !terraform.output vpc plat-use1-dev vpc_cidr
target:
type: transit_gateway_id
value: !terraform.output tgw/hub transit_gateway_id
4. Deploy Transit Gateway Route Table Routes
Deploy the tgw/routes
component in the network account to create route tables and routes.
components:
terraform:
tgw/routes:
vars:
transit_gateway_route_table_id: !terraform.output tgw/hub transit_gateway_route_table_id
# Use propagated routes to route through VPC attachments
propagated_routes:
# Route to this account
- attachment_id: !terraform.output tgw/attachment core-use1-network transit_gateway_attachment_id
# Route to any connected account
- attachment_id: !terraform.output tgw/attachment core-use1-auto transit_gateway_attachment_id
- attachment_id: !terraform.output tgw/attachment plat-use1-dev transit_gateway_attachment_id
Variables
Required Variables
Optional Variables
account_map_environment_name
(string
) optionalThe name of the environment where
account_map
is provisionedDefault value:
"gbl"
account_map_stage_name
(string
) optionalThe name of the stage where
account_map
is provisionedDefault value:
"root"
account_map_tenant_name
(string
) optionalThe name of the tenant where
account_map
is provisioned.If the
tenant
label is not used, leave this asnull
.Default value:
null
allow_external_principals
(bool
) optionalSet true to allow the TGW to be RAM shared with external principals specified in ram_principals
Default value:
false
connections
optionalA list of objects to define each TGW connections.
By default, each connection will look for only the default
vpc
component.Type:
list(object({
account = object({
stage = string
environment = optional(string, "")
tenant = optional(string, "")
})
vpc_component_names = optional(list(string), ["vpc"])
eks_component_names = optional(list(string), [])
}))Default value:
[ ]
expose_eks_sg
(bool
) optionalSet true to allow EKS clusters to accept traffic from source accounts
Default value:
true
ram_principals
(list(string)
) optionalA list of AWS account IDs to share the TGW with outside the organization
Default value:
[ ]
Context Variables
The following variables are defined in the context.tf
file of this module and part of the terraform-null-label pattern.
context.tf
file of this module and part of the terraform-null-label pattern.Outputs
eks
Accounts with EKS and EKSs information
tgw_config
Transit Gateway config
transit_gateway_arn
Transit Gateway ARN
transit_gateway_id
Transit Gateway ID
transit_gateway_route_table_id
Transit Gateway route table ID
vpcs
Accounts with VPC and VPCs information
Dependencies
Requirements
terraform
, version:>= 1.0.0
aws
, version:>= 4.1
Modules
Name | Version | Source | Description |
---|---|---|---|
account_map | 1.8.0 | cloudposse/stack-config/yaml//modules/remote-state | n/a |
eks | 1.8.0 | cloudposse/stack-config/yaml//modules/remote-state | n/a |
iam_roles | latest | ../../account-map/modules/iam-roles | n/a |
tgw_hub | 0.11.0 | cloudposse/transit-gateway/aws | n/a |
this | 0.25.0 | cloudposse/label/null | n/a |
vpc | 1.8.0 | cloudposse/stack-config/yaml//modules/remote-state | n/a |