Direct Connect gateway multi-account support #8100

ewbankkit · 2019-03-27T22:41:37Z

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Direct Connect gateway multi-account support announced.

ewbankkit · 2019-03-27T22:42:47Z

Direct Connect gateway enables you to establish connectivity between your on-premise networks and Amazon Virtual Private Clouds (VPCs) in any commercial AWS Region (except in China) using AWS Direct Connect connections at any AWS Direct Connect location. This release enables multi-account support for Direct Connect gateway, with multi-account support for Direct Connect gateway, you can associate up to ten VPCs from any AWS account with a Direct Connect gateway. The AWS accounts owning VPCs and the Direct Connect gateway must belong to the same AWS payer account ID. This release also enables Direct Connect Gateway owners to allocate allowed prefixes from each associated VPCs.

heycasey · 2019-03-29T20:56:57Z

Looks like the functionality that needs to be added is VGW Association Proposal creation and acceptance. The creation also allows specifying which prefixes to advertise, and the prefixes cannot be modified after the Proposal is accepted. https://docs.aws.amazon.com/directconnect/latest/UserGuide/multi-account-associate-vgw.html

ewbankkit · 2019-04-04T21:25:02Z

The aws_dx_gateway_association resource enhancement for allowed prefixes has its own issue: #8199.

bflad · 2019-04-15T18:57:13Z

Starting implementation of the following new resources to handle the cross-account pieces. 👍

aws_dx_gateway_association_proposal
aws_dx_gateway_association_proposal_accepter

Reference: #8100 Output from acceptance testing: ``` --- PASS: TestAccAwsDxGateway_basic (32.10s) ```

Reference: #8100 Output from acceptance testing: ``` --- PASS: TestAccDataSourceAwsDxGateway_Basic (36.63s) ```

Reference: #8100 Output from acceptance testing: ``` --- PASS: TestAccAwsDxGatewayAssociationProposal_disappears (56.84s) --- PASS: TestAccAwsDxGatewayAssociationProposal_basic (58.66s) --- PASS: TestAccAwsDxGatewayAssociationProposal_AllowedPrefixes (76.24s) ```

…ay_association_proposal resource Reference: #8100

bflad · 2019-04-16T01:45:05Z

First half of support submitted: #8320

The second half will likely be based off #8199 (either accepting new proposal_id and vpn_gateway_owner_account_id arguments in the existing aws_dx_gateway_association resource or reusing some of the updated handling in a new aws_dx_gateway_association_proposal_accepter resource).

bflad · 2019-04-25T00:01:48Z

The first half of this support has been merged with the below:

New Resource: aws_dx_gateway_association_proposal
data-source/aws_dx_gateway: Add owner_account_id attribute
resource/aws_dx_gateway: Add owner_account_id attribute

@ewbankkit has offered development support for the second half of this (accepting proposals) later this week (#8320 (comment)). Thanks, @ewbankkit! 😄 Please do reach out if you have any questions or do not have time to complete this.

ewbankkit · 2019-04-26T18:54:08Z

OK, now I've started to implement the acceptance half of this and once the proposal is accepted a Direct Connect Gateway Association is created.
The association is visible from both accounts (creator and accepter) so I think I'll change tack here and take the approach of adding vpn_gateway_owner_account_id and proposal_id to the aws_dx_gateway_association resource.

noah-mercado · 2019-04-26T19:46:25Z

So @ewbankkit per your last comment what would the workflow for this look like? An aws_dx_gateway_association_proposal resource happens in Account A, Account B which houses the DX gateway receives the proposal and a aws_dx_gateway_association_proposal_accepter resource is deployed to accept, then back in Account A a aws_dx_gateway_association resource needs to deploy using the proposal_id as an attribute?

ewbankkit · 2019-04-26T20:03:06Z

@noah-mercado I've changed my mind again 😄, third time lucky.

I'm now leaning towards a new resource aws_dx_cross_account_gateway_association which does the proposal acceptance and assumes responsibility for the underlying AWS DX gateway association resource created once the proposal is accepted. The existing aws_dx_gateway_association resource would remain untouched and be used to manage single account gateway associations.

The workflow would be (based on this diagram):

Account Z

Create aws_dx_gateway

Account A

Create aws_vpc
Create aws_aws_vpn_gateway
Create aws_dx_gateway_association_proposal using the VGW ID and DXGW ID plus Account Z's ID

Account Z

Create aws_dx_cross_account_gateway_association using the ProposalID and Account A's ID

noah-mercado · 2019-04-26T20:10:57Z

@ewbankkit Awesome :) . I definitely like that implementation a lot better. The async pattern of propose -> accept -> associate cross accounts could have gotten funky

ewbankkit · 2019-04-26T20:40:06Z

Proposed documentation:

Resource: aws_dx_cross_account_gateway_association

Associates a Direct Connect Gateway with a VGW in another AWS Account. For single account associations, see the aws_dx_gateway_association resource.

To create a cross-account association, create an aws_dx_gateway_association_proposal resource
in the AWS account that owns the VGW and then accept the proposal in the AWS account that owns the Direct Connect Gateway
by creating an aws_dx_cross_account_gateway_association resource.

Example Usage

provider "aws" {
  # Creator's credentials.
}

provider "aws" {
  alias = "accepter"

  # Accepter's credentials.
}

# Creator's side of the proposal.
data "aws_caller_identity" "creator" {}

resource "aws_vpc" "example" {
  cidr_block = "10.255.255.0/28"
}

resource "aws_vpn_gateway" "example" {
  vpc_id = "${aws_vpc.example.id}"
}

resource "aws_dx_gateway_association_proposal" "example" {
  dx_gateway_id               = "${aws_dx_gateway.example.id}"
  dx_gateway_owner_account_id = "${aws_dx_gateway.example.owner_account_id}"
  vpn_gateway_id              = "${aws_vpn_gateway.example.id}"
}

# Accepter's side of the proposal.
resource "aws_dx_gateway" "example" {
  provider = "aws.accepter"

  name            = "example"
  amazon_side_asn = "64512"
}

resource "aws_dx_cross_account_gateway_association" "example" {
  provider = "aws.accepter"

  proposal_id                  = "${aws_dx_gateway_association_proposal.example.id}"
  dx_gateway_id                = "${aws_dx_gateway.example.id}"
  vpn_gateway_owner_account_id = "${data.aws_caller_identity.creator.account_id}"
}

Argument Reference

The following arguments are supported:

dx_gateway_id - (Required) The ID of the Direct Connect gateway.
proposal_id - (Required) The ID of the Direct Connect gateway association proposal.
vpn_gateway_owner_account_id - (Required) The ID of the AWS account that owns the VGW with which to associate the gateway.
allowed_prefixes - (Optional) VPC prefixes (CIDRs) to advertise to the Direct Connect gateway. Defaults to the CIDR block of the VPC associated with the Virtual Gateway. To enable drift detection, must be configured.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

id - The ID of the Direct Connect gateway association resource.
dx_gateway_association_id - The ID of the Direct Connect gateway association.
vpn_gateway_id - The ID of the VGW with which the gateway is associated.

ewbankkit · 2019-05-09T14:02:01Z

After a (hopefully) final round of mind-changing after starting the work to support transit gateways in the aws_dx_gateway_association resource, this functionality will be implemented in #8528 via changes to the aws_dx_gateway_association resource rather than creating a new aws_dx_cross_account_gateway_association resource.

Example Usage

provider "aws" {
  # Creator's credentials.
}

provider "aws" {
  alias = "accepter"

  # Accepter's credentials.
}

# Creator's side of the proposal.
data "aws_caller_identity" "creator" {}

resource "aws_vpc" "example" {
  cidr_block = "10.255.255.0/28"
}

resource "aws_vpn_gateway" "example" {
  vpc_id = "${aws_vpc.example.id}"
}

resource "aws_dx_gateway_association_proposal" "example" {
  dx_gateway_id               = "${aws_dx_gateway.example.id}"
  dx_gateway_owner_account_id = "${aws_dx_gateway.example.owner_account_id}"
  associated_gateway_id       = "${aws_vpn_gateway.example.id}"
}

# Accepter's side of the proposal.
resource "aws_dx_gateway" "example" {
  provider = "aws.accepter"

  name            = "example"
  amazon_side_asn = "64512"
}

resource "aws_dx_gateway_association" "example" {
  provider = "aws.accepter"

  proposal_id                         = "${aws_dx_gateway_association_proposal.example.id}"
  dx_gateway_id                       = "${aws_dx_gateway.example.id}"
  associated_gateway_owner_account_id = "${data.aws_caller_identity.creator.account_id}"
}

bflad · 2019-05-24T11:23:33Z

The second half of this support (accepting proposals) has been released in version 2.12.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

ghost · 2020-03-29T17:58:27Z

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

ewbankkit added the enhancement Requests to existing resources that expand the functionality or scope. label Mar 27, 2019

ewbankkit mentioned this issue Apr 4, 2019

r/aws_dx_gateway_association: Allowed prefix support #8199

Closed

bflad added the service/directconnect Issues and PRs that pertain to the directconnect service. label Apr 10, 2019

bflad added a commit that referenced this issue Apr 16, 2019

resource/aws_dx_gateway: Add owner_account_id attribute

91d106f

Reference: #8100 Output from acceptance testing: ``` --- PASS: TestAccAwsDxGateway_basic (32.10s) ```

bflad added a commit that referenced this issue Apr 16, 2019

data-source/aws_dx_gateway: Add owner_account_id attribute

55af48d

Reference: #8100 Output from acceptance testing: ``` --- PASS: TestAccDataSourceAwsDxGateway_Basic (36.63s) ```

bflad added a commit that referenced this issue Apr 16, 2019

docs/resource/aws_dx_gateway_association: Cross link new aws_dx_gatew…

6b82e24

…ay_association_proposal resource Reference: #8100

bflad mentioned this issue Apr 16, 2019

service/directconnect: First half of support for Gateway Association Proposals #8320

Merged

ewbankkit mentioned this issue Apr 26, 2019

[WIP] Second half of support for Gateway Association Proposals #8455

Closed

ewbankkit mentioned this issue May 9, 2019

r/aws_dx_gateway_association: Update for transit gateway support plus the second half (cross-account proposal acceptance) of support for Gateway Association Proposals #8528

Merged

nywilken closed this as completed in #8528 May 24, 2019

bflad added this to the v2.12.0 milestone May 24, 2019

ghost locked and limited conversation to collaborators Mar 29, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Direct Connect gateway multi-account support #8100

Direct Connect gateway multi-account support #8100

ewbankkit commented Mar 27, 2019

ewbankkit commented Mar 27, 2019 •

edited

Loading

heycasey commented Mar 29, 2019 •

edited

Loading

ewbankkit commented Apr 4, 2019

bflad commented Apr 15, 2019

bflad commented Apr 16, 2019

bflad commented Apr 25, 2019

ewbankkit commented Apr 26, 2019

noah-mercado commented Apr 26, 2019

ewbankkit commented Apr 26, 2019 •

edited

Loading

noah-mercado commented Apr 26, 2019

ewbankkit commented Apr 26, 2019

ewbankkit commented May 9, 2019

bflad commented May 24, 2019

ghost commented Mar 29, 2020

Direct Connect gateway multi-account support #8100

Direct Connect gateway multi-account support #8100

Comments

ewbankkit commented Mar 27, 2019

Community Note

ewbankkit commented Mar 27, 2019 • edited Loading

heycasey commented Mar 29, 2019 • edited Loading

ewbankkit commented Apr 4, 2019

bflad commented Apr 15, 2019

bflad commented Apr 16, 2019

bflad commented Apr 25, 2019

ewbankkit commented Apr 26, 2019

noah-mercado commented Apr 26, 2019

ewbankkit commented Apr 26, 2019 • edited Loading

Account Z

Account A

Account Z

noah-mercado commented Apr 26, 2019

ewbankkit commented Apr 26, 2019

Resource: aws_dx_cross_account_gateway_association

Example Usage

Argument Reference

Attributes Reference

ewbankkit commented May 9, 2019

Example Usage

bflad commented May 24, 2019

ghost commented Mar 29, 2020

ewbankkit commented Mar 27, 2019 •

edited

Loading

heycasey commented Mar 29, 2019 •

edited

Loading

ewbankkit commented Apr 26, 2019 •

edited

Loading