Create a connection initiated from Cloud de Confiance

This page describes the steps to successfully create and provision a Partner Cross-Cloud Interconnect for Amazon Web Services (AWS) connection initiated from Cloud de Confiance by S3NS.

If you don't have an activation key from AWS, you can initiate and provision a Partner Cross-Cloud Interconnect for AWS connection from Cloud de Confiance.

Before you start the Partner Cross-Cloud Interconnect for AWS provisioning process, ensure that the following conditions are met:

• You must already have an Amazon Web Services account.
• You must also create a Virtual Private Cloud (VPC) network, if it doesn't already exist, to connect your transport to.

To achieve a successful connection, you must create the transport resource. Follow these instructions to create the transport.

Before you begin

Before you get started, review the following sections.

Create or select a project

To make it easier to configure Network Connectivity Center, start by identifying a valid project.

1. In the Cloud de Confiance console, on the project selector page, select or create a Cloud de Confiance project.

   Roles required to select or create a project

   • Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
   • Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

   Go to project selector

2. Verify that billing is enabled for your Cloud de Confiance project.

3. Install the Google Cloud CLI.

4. Configure the gcloud CLI to use your federated identity.

   For more information, see Sign in to the gcloud CLI with your federated identity.

5. To initialize the gcloud CLI, run the following command:

   gcloud init

6. If you are using the Google Cloud CLI, set your project ID by using the gcloud config set command.

   gcloud config set project PROJECT_ID

   Replace PROJECT_ID with your unique project ID.

   The gcloud CLI instructions on this page assume that you have set your project ID.

7. To confirm that you set the project ID correctly, use the gcloud config list command.

   gcloud config list --format='text(core.project)'

Enable the Network Connectivity API

Before you can perform any tasks using Network Connectivity Center, you must enable the Network Connectivity API.

Alternatively, you can enable the API by using the Cloud de Confiance console API Library, as described in Enabling APIs.

List available profiles

To list the available profiles in a specific project in the region where you want to provision connectivity, follow these steps.

$ curl -H "Authorization: Bearer $(gcloud auth print-access-token)" "https://networkconnectivity.googleapis.com/v1beta/projects/PROJECT/locations/LOCATION/remoteTransportProfiles"

Create the transport resource

During the transport resource creation process, you must specify the bandwidth, network, remoteProfile and remoteAccountId fields. advertisedRoutes is an optional field, however, in order to ensure connectivity from AWS, you must specify this field. This field can be a list of IPv4 and IPv6 subnets. If your network uses automatic subnet creation, use the 10.128.0.0/9 value from Cloud de Confiance.

To create a transport resource, follow these steps.

curl -X POST -H "Authorization: Bearer $(gcloud auth print-access-token)" -H "Content-Type: application/json" "https://networkconnectivity.googleapis.com/v1beta/projects/PROJECT/locations/LOCATION/transports?="TRANSPORT_ID" --data '{
"network": "NETWORK",
"remoteProfile": "REMOTE_PROFILE",
"bandwidth": "BANDWIDTH",
"remoteAccountId": "AWS_ACCOUNT_ID",
"advertisedRoutes": ["IP_RANGE_1","IP_RANGE_2"],
"stackType": "STACK_TYPE
}'

GET https://networkconnectivity.googleapis.com/v1/locations/LOCATION/operations/OPERATION_ID

Complete the steps on the AWS API

Use the activation key that you generated in the previous step to complete setup by using the AWS Console.

Establish VPC Network Peering

You can proactively establish VPC Network Peering at the Cloud de Confiance end. To do this, use the peeringNetwork returned from the previous created transport resource and ensure that you create a peering with the same stack type. The default stack type matches the transport resource using IPV4_ONLY.

To receive the AWS routes, you must enable the Import custom routes field.

The MTU in the peering VPC network is explicitly set to the maximum in order to avoid MTU issues in the connectivity. If you're using an MTU less than 8896, you might get a warning WARNING: Some requests generated warnings: - Network MTU 1460B does not match the peer's MTU 8896B. In that case, you must ensure that you're using matching MTU configurations between your Cloud de Confiance VPC network and the AWS VPC network. If these are mismatched, you might need to override MTU values to the lowest common denominator. For example, if you're using 8896 in Cloud de Confiance and 8800 in AWS, everything in Cloud de Confiance must be configured as 8800.

gcloud compute networks peerings create "TRANSPORT_NAME" \
    --network="VPC_NETWORK"
    --peer-network="PEERING_NETWORK" \
    --import-custom-routes
    --export-custom-routes

POST https://compute.googleapis.com/compute/v1/projects/PROJECT/global/networks/NETWORK/addPeering

Verify your connection

You can verify that connectivity has been established by listing the peered VPC networks and the route tables. After the AWS configuration is complete, you can see your AWS routes in the list.

gcloud compute networks peerings list

DEST_RANGE   TYPE                   NEXT_HOP_REGION  PRIORITY  STATUS
10.0.0.0/16  DYNAMIC_PEERING_ROUTE  us-east4         0         accepted
10.0.0.0/16  DYNAMIC_PEERING_ROUTE  us-east4         0         accepted

gcloud compute networks peerings list-routes TRANSPORT_ID\
    --direction=INCOMING \
    --network=NETWORK \
    --region=LOCATION

GET https://compute.googleapis.com/compute/v1/projects/PROJECT/global/networks

GET https://compute.googleapis.com/compute/v1/projects/PROJECT/global/networks/NETWORK/listPeeringRoutes

What's next

• To find answers to common questions about Cloud Interconnect architecture and features, see the Cloud Interconnect FAQ.
• To find out more about Cloud Interconnect, see the Cloud Interconnect overview.
• To learn about best practices when planning for and configuring Cloud Interconnect, see Best practices.
• To find Cloud de Confiance by S3NS resource names, see the Cloud Interconnect APIs.