AWS Transit Gateway and Multiple Accounts

Gilles Chekroun
Lead VMware Cloud on AWS Specialist
---

Many Customers start to use AWS transit Gateway and want to be able to attach VPCs in multiple accounts.
Often AWS organisations are split by departments and have separate accounts.
This blog post will go through the detailed setup for the TGW and how to connect VPCs in separate accounts.
For a complete description of VMware Cloud on AWS and TGW, please refer to here.

AWS Shared Resource Manager

Login to the main account where the TGW was created and create a resource share

Name your share and select the TGW 

Add the other account and create the share

Verify the share creation

Log into the account we just added and look for an invitation

Accept the invitation

For the purpose of the tests we can use an existing VPC or create a new one. I am using VPC4 with CIDR 99.99.0.0/16 in the added account.

Create a TGW attachment for this new VPC

At this stage, we will get a "pending acceptance" status.

Go back to the main account and accept

Check association

We have now all attachments available and associated.

A new route from the newly attached VPC is learned

By default, the TGW doesn't update VPC route tables. We need to do that manually.

Now let's launch a small EC2 instance in VPC4 so we can do some tests.

Open the VMware Cloud on AWS Compute Gateway Firewall rule so our VMC segment 1 can talk to VPC4 and back

Ping Tests

From EC2 in VPC4 to EC2 in VPC3

From EC2 in VPC4 to EC2 in VPC2

and from EC2 in VPC4 to VMC DSL02 in segment 1 over the VPV connection and back.

Thank You !!