AWS Networking: Hands-on Runbook
Runbook · AWS · Networking
AWS Networking: Hands-on Runbook
Build a production-shaped VPC from the CLI and prove each part works: a two-AZ VPC with public, app and data subnets, an internet gateway, a NAT gateway (regional or zonal), gateway and interface endpoints, chained security groups and tight network ACLs, private access with Session Manager and EC2 Instance Connect Endpoint, flow logs, Reachability Analyzer and Block Public Access, then peering, a transit gateway, a Site-to-Site VPN, IPv6, the Direct Connect calls, and a clean teardown. Tick as you go. Concepts and the twenty-one diagrams live in bubim-awsnet.
aws ec2 describe-vpcs cpx · bub.im
0 / 0
P0
Prepare
0 / 0Use a sandbox account: NAT gateways, endpoints, the transit gateway and the VPN bill by the hour, and Block Public Access in phase 8 applies to the whole Region. Keep one shell open; later steps reuse the variables.
0.1 Check the tools
aws --version session-manager-plugin --version jq --version
0.2 Pick the Region and two AZs
export AWS_REGION=eu-central-1 read AZ_A AZ_B <<< "$(aws ec2 describe-availability-zones --filters Name=state,Values=available \ --query 'AvailabilityZones[0:2].ZoneName' --output text)" export AZ_A AZ_B ACCOUNT=$(aws sts get-caller-identity --query Account --output text) echo $ACCOUNT $AZ_A $AZ_B
0.3 A tagging helperEvery resource gets a Name and project=netlab, which the clean-up phase relies on.
tags(){ echo "ResourceType=$1,Tags=[{Key=Name,Value=$2},{Key=project,Value=netlab}]"; }
tags vpc lab-vpcP1
VPC and subnets
0 / 010.0.0.0/16 with three tiers in two AZs. The plan leaves 10.0.2.0 to 10.0.9.255 and the /28 blocks at 10.0.30.0 free for later.
fig 1 · the main route table keeps only the local route, so a subnet nobody associated stays private
| Subnet | AZ a | AZ b | Route table |
|---|---|---|---|
| public | 10.0.0.0/24 | 10.0.1.0/24 | rt-public: IGW |
| app (private) | 10.0.10.0/24 | 10.0.11.0/24 | rt-app: NAT gateway |
| data (isolated) | 10.0.20.0/24 | 10.0.21.0/24 | rt-data: local only |
| transit gateway | 10.0.30.0/28 | 10.0.30.16/28 | main: local only |
1.1 Create the VPC with DNS hostnames on
export VPC=$(aws ec2 create-vpc --cidr-block 10.0.0.0/16 --tag-specifications "$(tags vpc lab-vpc)" \
--query Vpc.VpcId --output text)
aws ec2 modify-vpc-attribute --vpc-id $VPC --enable-dns-hostnames '{"Value":true}'
echo $VPC1.2 Create the six tier subnets
sub(){ aws ec2 create-subnet --vpc-id $VPC --cidr-block $1 --availability-zone $2 \
--tag-specifications "$(tags subnet $3)" --query Subnet.SubnetId --output text; }
export PUB_A=$(sub 10.0.0.0/24 $AZ_A pub-a) PUB_B=$(sub 10.0.1.0/24 $AZ_B pub-b)
export APP_A=$(sub 10.0.10.0/24 $AZ_A app-a) APP_B=$(sub 10.0.11.0/24 $AZ_B app-b)
export DB_A=$(sub 10.0.20.0/24 $AZ_A data-a) DB_B=$(sub 10.0.21.0/24 $AZ_B data-b)1.3 Check sizes: 251 free addresses in each /24
aws ec2 describe-subnets --filters Name=vpc-id,Values=$VPC \ --query 'Subnets[].[Tags[?Key==`Name`]|[0].Value,CidrBlock,AvailabilityZone,AvailableIpAddressCount]' --output table
1.4 Empty the default security groupNothing should use it; with no rules, anything attached by mistake gets no traffic.
DEF_SG=$(aws ec2 describe-security-groups --filters Name=vpc-id,Values=$VPC Name=group-name,Values=default \
--query 'SecurityGroups[0].GroupId' --output text)
rules(){ aws ec2 describe-security-group-rules --filters Name=group-id,Values=$1 \
--query "SecurityGroupRules[?IsEgress==\`$2\`].SecurityGroupRuleId" --output text; }
aws ec2 revoke-security-group-ingress --group-id $DEF_SG --security-group-rule-ids $(rules $DEF_SG false)
aws ec2 revoke-security-group-egress --group-id $DEF_SG --security-group-rule-ids $(rules $DEF_SG true)P2
Internet gateway and the public route table
0 / 0A subnet becomes public by its route table, not by its name. The main table stays local-only, so a forgotten subnet is private.
2.1 Create and attach the internet gateway
export IGW=$(aws ec2 create-internet-gateway --tag-specifications "$(tags internet-gateway lab-igw)" \ --query InternetGateway.InternetGatewayId --output text) aws ec2 attach-internet-gateway --internet-gateway-id $IGW --vpc-id $VPC
2.2 Public route table: default route to the IGW
export RT_PUB=$(aws ec2 create-route-table --vpc-id $VPC --tag-specifications "$(tags route-table rt-public)" \ --query RouteTable.RouteTableId --output text) aws ec2 create-route --route-table-id $RT_PUB --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW for s in $PUB_A $PUB_B; do aws ec2 associate-route-table --route-table-id $RT_PUB --subnet-id $s; done
2.3 Confirm the main table has only the local route
aws ec2 describe-route-tables --filters Name=vpc-id,Values=$VPC Name=association.main,Values=true \ --query 'RouteTables[0].Routes[].[DestinationCidrBlock,GatewayId,State]' --output table
P3
NAT gateway and private routing
0 / 0Do 3.1 and 3.2 for a regional NAT gateway, or 3.3 instead for the classic zonal pair. Data subnets get no internet route at all.
3.1 Create a regional NAT gatewayNo public subnet and no Elastic IP to manage; it follows your workloads into each AZ. A new AZ can take up to an hour; meanwhile traffic crosses AZs.
export NAT=$(aws ec2 create-nat-gateway --availability-mode regional --vpc-id $VPC \ --tag-specifications "$(tags natgateway lab-nat)" --query NatGateway.NatGatewayId --output text) aws ec2 wait nat-gateway-available --nat-gateway-ids $NAT
3.2 App route table: default route to the NAT gateway
export RT_APP=$(aws ec2 create-route-table --vpc-id $VPC --tag-specifications "$(tags route-table rt-app)" \ --query RouteTable.RouteTableId --output text) aws ec2 create-route --route-table-id $RT_APP --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NAT for s in $APP_A $APP_B; do aws ec2 associate-route-table --route-table-id $RT_APP --subnet-id $s; done
3.3 Or: one zonal NAT gateway per AZNeeded for private NAT or a fixed Elastic IP per AZ; this replaces 3.1 and 3.2. Each AZ’s app subnet gets its own route table and NAT gateway, and later steps loop over $RT_APP and $RT_APP_B.
nat_az(){
eip=$(aws ec2 allocate-address --domain vpc --tag-specifications "$(tags elastic-ip $3-eip)" \
--query AllocationId --output text)
nat=$(aws ec2 create-nat-gateway --subnet-id $1 --allocation-id $eip \
--tag-specifications "$(tags natgateway $3-nat)" --query NatGateway.NatGatewayId --output text)
aws ec2 wait nat-gateway-available --nat-gateway-ids $nat
rt=$(aws ec2 create-route-table --vpc-id $VPC --tag-specifications "$(tags route-table $3)" \
--query RouteTable.RouteTableId --output text)
aws ec2 create-route --route-table-id $rt --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $nat >/dev/null
aws ec2 associate-route-table --route-table-id $rt --subnet-id $2 >/dev/null
echo $rt
}
export RT_APP=$(nat_az $PUB_A $APP_A rt-app-a) RT_APP_B=$(nat_az $PUB_B $APP_B rt-app-b)3.4 Data route table: local only
export RT_DB=$(aws ec2 create-route-table --vpc-id $VPC --tag-specifications "$(tags route-table rt-data)" \ --query RouteTable.RouteTableId --output text) for s in $DB_A $DB_B; do aws ec2 associate-route-table --route-table-id $RT_DB --subnet-id $s; done
P4
VPC endpoints
0 / 0S3 through a free gateway endpoint (no NAT charge per GB), and Session Manager through interface endpoints, so management traffic stays private and keeps working without the NAT gateway.
4.1 S3 gateway endpoint on the app and data route tables
export VPCE_S3=$(aws ec2 create-vpc-endpoint --vpc-id $VPC --vpc-endpoint-type Gateway \ --service-name com.amazonaws.$AWS_REGION.s3 --route-table-ids $RT_APP $RT_APP_B $RT_DB \ --query VpcEndpoint.VpcEndpointId --output text) aws ec2 describe-route-tables --route-table-ids $RT_APP \ --query 'RouteTables[0].Routes[].[DestinationCidrBlock,DestinationPrefixListId,GatewayId,NatGatewayId]' --output table
4.2 Security group for interface endpoints
export EP_SG=$(aws ec2 create-security-group --group-name lab-endpoints --description "Interface endpoints" \ --vpc-id $VPC --query GroupId --output text) aws ec2 authorize-security-group-ingress --group-id $EP_SG --protocol tcp --port 443 --cidr 10.0.0.0/16
4.3 Interface endpoints for Session Manager
for svc in ssm ssmmessages; do
aws ec2 create-vpc-endpoint --vpc-id $VPC --vpc-endpoint-type Interface \
--service-name com.amazonaws.$AWS_REGION.$svc --subnet-ids $APP_A $APP_B \
--security-group-ids $EP_SG --private-dns-enabled --query VpcEndpoint.VpcEndpointId --output text
doneP5
Chained security groups
0 / 0Load balancer from anywhere on 443, app only from the load balancer’s group, database only from the app’s group.
5.1 Create the groups
sg(){ aws ec2 create-security-group --group-name $1 --description "$2" --vpc-id $VPC --query GroupId --output text; }
export ALB_SG=$(sg lab-alb "Public load balancer")
export APP_SG=$(sg lab-app "Application tier")
export DB_SG=$(sg lab-db "Database tier")5.2 Rules that reference groups, not addresses
aws ec2 authorize-security-group-ingress --group-id $ALB_SG --protocol tcp --port 443 --cidr 0.0.0.0/0 aws ec2 authorize-security-group-ingress --group-id $APP_SG --protocol tcp --port 8080 --source-group $ALB_SG aws ec2 authorize-security-group-ingress --group-id $DB_SG --protocol tcp --port 5432 --source-group $APP_SG
5.3 Review the result
aws ec2 describe-security-group-rules --filters Name=group-id,Values=$ALB_SG,$APP_SG,$DB_SG \ --query 'SecurityGroupRules[?!IsEgress].[GroupId,IpProtocol,FromPort,CidrIpv4,ReferencedGroupInfo.GroupId]' --output table
P6
Network ACLs
0 / 0A coarse guard on the data subnets: PostgreSQL in from the app subnets only, replies out to them only. NACLs are stateless, so both directions are spelled out.
6.1 Create the data NACLA new NACL denies everything until rules are added.
export NACL_DB=$(aws ec2 create-network-acl --vpc-id $VPC --tag-specifications "$(tags network-acl nacl-data)" \ --query NetworkAcl.NetworkAclId --output text)
6.2 Rules: 5432 in from 10.0.10.0/23, replies out to it10.0.10.0/23 covers both app subnets. Protocol 6 is TCP. Add 443 to the VPC if the database must call interface endpoints.
e(){ aws ec2 create-network-acl-entry --network-acl-id $NACL_DB "$@"; }
e --ingress --rule-number 100 --protocol 6 --port-range From=5432,To=5432 --cidr-block 10.0.10.0/23 --rule-action allow
e --egress --rule-number 100 --protocol 6 --port-range From=1024,To=65535 --cidr-block 10.0.10.0/23 --rule-action allow
aws ec2 describe-network-acls --network-acl-ids $NACL_DB \
--query 'NetworkAcls[0].Entries[].[Egress,RuleNumber,Protocol,PortRange.From,PortRange.To,CidrBlock,RuleAction]' --output table6.3 Move the data subnets onto itA subnet always has exactly one NACL, so you replace the association rather than add one.
for s in $DB_A $DB_B; do
assoc=$(aws ec2 describe-network-acls --filters Name=association.subnet-id,Values=$s \
--query "NetworkAcls[0].Associations[?SubnetId=='$s'].NetworkAclAssociationId" --output text)
aws ec2 replace-network-acl-association --association-id $assoc --network-acl-id $NACL_DB
doneP7
A private instance and two ways in
0 / 0No public IP, no inbound port from the internet, no bastion.
7.1 Instance role for Session ManagerSkip if Default Host Management Configuration is on in this Region.
trust-ec2.json
{
"Version": "2012-10-17",
"Statement": [{"Effect": "Allow", "Principal": {"Service": "ec2.amazonaws.com"}, "Action": "sts:AssumeRole"}]
}aws iam create-role --role-name netlab-ssm --assume-role-policy-document file://trust-ec2.json aws iam attach-role-policy --role-name netlab-ssm --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore aws iam create-instance-profile --instance-profile-name netlab-ssm aws iam add-role-to-instance-profile --instance-profile-name netlab-ssm --role-name netlab-ssm
7.2 Launch it in app subnet AIf the launch says the instance profile is invalid, IAM has not propagated yet; wait ten seconds and run it again.
export I=$(aws ec2 run-instances --image-id resolve:ssm:/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 \ --instance-type t3.micro --subnet-id $APP_A --security-group-ids $APP_SG \ --iam-instance-profile Name=netlab-ssm --metadata-options HttpTokens=required \ --tag-specifications "$(tags instance lab-app-1)" --query 'Instances[0].InstanceId' --output text) aws ec2 wait instance-status-ok --instance-ids $I
7.3 Session Manager: prove NAT and the S3 endpointInside the session, the first request goes out through the NAT gateway, the second through the S3 gateway endpoint; any HTTP status line means the path works.
aws ssm start-session --target $I
# inside the session
curl -sI https://aws.amazon.com | head -1
curl -sI https://s3.eu-central-1.amazonaws.com | head -17.4 EC2 Instance Connect Endpoint for SSHThe endpoint’s group may send SSH only to the app group; the app group accepts SSH only from it.
export EICE_SG=$(sg lab-eice "Instance Connect Endpoint") aws ec2 revoke-security-group-egress --group-id $EICE_SG --protocol all --port all --cidr 0.0.0.0/0 aws ec2 authorize-security-group-egress --group-id $EICE_SG --protocol tcp --port 22 --source-group $APP_SG aws ec2 authorize-security-group-ingress --group-id $APP_SG --protocol tcp --port 22 --source-group $EICE_SG export EICE=$(aws ec2 create-instance-connect-endpoint --subnet-id $APP_A --security-group-ids $EICE_SG \ --query InstanceConnectEndpoint.InstanceConnectEndpointId --output text)
7.5 Connect through itThe CLI pushes a short-lived key and tunnels through the endpoint; wait until the endpoint is create-complete.
aws ec2 describe-instance-connect-endpoints --instance-connect-endpoint-ids $EICE \ --query 'InstanceConnectEndpoints[0].State' --output text aws ec2-instance-connect ssh --instance-id $I --os-user ec2-user --connection-type eice
7.6 If a bastion stays: ProxyJump, not agent forwarding
~/.ssh/config
Host bastion HostName 203.0.113.25 User ec2-user IdentityFile ~/.ssh/lab.pem Host 10.0.* User ec2-user IdentityFile ~/.ssh/lab.pem ProxyJump bastion
P8
Flow logs, Reachability Analyzer, Block Public Access
0 / 0Visibility before more connectivity: a record of every flow, a configuration check that costs ten cents a run, and a Region-wide guard against accidental public exposure.
8.1 Log group and delivery roleThe source account condition stops another account’s flow logs from using your role.
trust-flowlogs.json
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Principal": {"Service": "vpc-flow-logs.amazonaws.com"},
"Action": "sts:AssumeRole",
"Condition": {"StringEquals": {"aws:SourceAccount": "REPLACE_WITH_ACCOUNT_ID"}}
}]
}flowlogs-policy.json
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogGroups", "logs:DescribeLogStreams"],
"Resource": "arn:aws:logs:REPLACE_WITH_REGION:REPLACE_WITH_ACCOUNT_ID:log-group:/vpc/netlab/*"
}]
}sed -i "s/REPLACE_WITH_ACCOUNT_ID/$ACCOUNT/g; s/REPLACE_WITH_REGION/$AWS_REGION/g" trust-flowlogs.json flowlogs-policy.json aws logs create-log-group --log-group-name /vpc/netlab/flow aws logs put-retention-policy --log-group-name /vpc/netlab/flow --retention-in-days 14 export FL_ROLE=$(aws iam create-role --role-name netlab-flowlogs \ --assume-role-policy-document file://trust-flowlogs.json --query Role.Arn --output text) aws iam put-role-policy --role-name netlab-flowlogs --policy-name deliver --policy-document file://flowlogs-policy.json
8.2 Flow log for the whole VPCOne-minute aggregation suits a lab; the default ten minutes is cheaper. For long-term storage, send to S3 in Parquet and query with Athena.
export FL=$(aws ec2 create-flow-logs --resource-type VPC --resource-ids $VPC --traffic-type ALL \ --log-destination-type cloud-watch-logs --log-group-name /vpc/netlab/flow \ --deliver-logs-permission-arn $FL_ROLE --max-aggregation-interval 60 \ --query 'FlowLogIds[0]' --output text)
8.3 After a few minutes, list what was droppedLogs Insights finds the fields of the default format by itself. Expect scanners hitting nothing, since no instance has a public address.
Q=$(aws logs start-query --log-group-name /vpc/netlab/flow \ --start-time $(date -d '-30 min' +%s) --end-time $(date +%s) \ --query-string 'filter action = "REJECT" | stats count(*) as drops by srcAddr, dstAddr, dstPort | sort drops desc | limit 20' \ --query queryId --output text) sleep 10; aws logs get-query-results --query-id $Q --query results --output text
8.4 Reachability Analyzer: the internet cannot reach the instanceA configuration check, no packets sent. Expect False, with an explanation naming what is missing. Phase 9 reuses the function.
reach(){
p=$(aws ec2 create-network-insights-path --source $1 --destination $2 --protocol tcp --destination-port $3 \
--query NetworkInsightsPath.NetworkInsightsPathId --output text)
a=$(aws ec2 start-network-insights-analysis --network-insights-path-id $p \
--query NetworkInsightsAnalysis.NetworkInsightsAnalysisId --output text)
sleep 40
aws ec2 describe-network-insights-analyses --network-insights-analysis-ids $a \
--query 'NetworkInsightsAnalyses[0].[Status,NetworkPathFound,Explanations[0].ExplanationCode]' --output text
}
reach $IGW $I 228.5 Block Public Access, with the public subnets excludedRegion-wide: in ingress mode, every VPC in this Region loses inbound internet access except the excluded subnets, while NAT and egress-only traffic keep working. In a shared account, agree it first; 14.7 turns it off.
aws ec2 modify-vpc-block-public-access-options --internet-gateway-block-mode block-ingress
x(){ aws ec2 create-vpc-block-public-access-exclusion --subnet-id $1 --internet-gateway-exclusion-mode allow-bidirectional \
--query VpcBlockPublicAccessExclusion.ExclusionId --output text; }
export BPA_X1=$(x $PUB_A) BPA_X2=$(x $PUB_B)
aws ec2 describe-vpc-block-public-access-options \
--query 'VpcBlockPublicAccessOptions.[InternetGatewayBlockMode,State]' --output textP9
VPC peering
0 / 0A second VPC, 10.1.0.0/16, joined by a peering connection. Phases 9 to 13 build the picture below.
fig 2 · peering for one close neighbour, the transit gateway as the hub for everything else; each VPN has two tunnels, so keep both up
9.1 Create VPC B with one subnet
export VPC_B=$(aws ec2 create-vpc --cidr-block 10.1.0.0/16 --tag-specifications "$(tags vpc lab-vpc-b)" \
--query Vpc.VpcId --output text)
aws ec2 modify-vpc-attribute --vpc-id $VPC_B --enable-dns-hostnames '{"Value":true}'
export SUB_B=$(aws ec2 create-subnet --vpc-id $VPC_B --cidr-block 10.1.0.0/24 --availability-zone $AZ_A \
--tag-specifications "$(tags subnet b-a)" --query Subnet.SubnetId --output text)
export RT_B=$(aws ec2 create-route-table --vpc-id $VPC_B --tag-specifications "$(tags route-table rt-b)" \
--query RouteTable.RouteTableId --output text)
aws ec2 associate-route-table --route-table-id $RT_B --subnet-id $SUB_B9.2 Request and accept the peeringAnother account adds –peer-owner-id, another Region –peer-region, and the other side accepts there. A request not accepted within seven days expires.
export PCX=$(aws ec2 create-vpc-peering-connection --vpc-id $VPC --peer-vpc-id $VPC_B \ --tag-specifications "$(tags vpc-peering-connection lab-a-b)" \ --query VpcPeeringConnection.VpcPeeringConnectionId --output text) aws ec2 wait vpc-peering-connection-exists --vpc-peering-connection-ids $PCX aws ec2 accept-vpc-peering-connection --vpc-peering-connection-id $PCX aws ec2 describe-vpc-peering-connections --vpc-peering-connection-ids $PCX \ --query 'VpcPeeringConnections[0].Status.Code' --output text
9.3 Routes on both sides, app tier onlyThe public and data tiers get no route, so they cannot reach VPC B even though the peering exists; VPC B routes back to the app subnets only.
for rt in $RT_APP $RT_APP_B; do aws ec2 create-route --route-table-id $rt --destination-cidr-block 10.1.0.0/16 --vpc-peering-connection-id $PCX done aws ec2 create-route --route-table-id $RT_B --destination-cidr-block 10.0.10.0/23 --vpc-peering-connection-id $PCX
9.4 Resolve the other side’s DNS names to private IPs
aws ec2 modify-vpc-peering-connection-options --vpc-peering-connection-id $PCX \ --requester-peering-connection-options AllowDnsResolutionFromRemoteVpc=true \ --accepter-peering-connection-options AllowDnsResolutionFromRemoteVpc=true
9.5 A security group that names the peer’s group, and a test targetWithin one Region a rule may reference a group in the peered VPC; across Regions, use CIDRs. An unattached network interface is a free target for Reachability Analyzer.
export B_SG=$(aws ec2 create-security-group --group-name lab-b --description "VPC B test" --vpc-id $VPC_B \ --query GroupId --output text) aws ec2 authorize-security-group-ingress --group-id $B_SG --protocol tcp --port 443 --source-group $APP_SG export ENI_B=$(aws ec2 create-network-interface --subnet-id $SUB_B --groups $B_SG --description "reachability target" \ --query NetworkInterface.NetworkInterfaceId --output text)
9.6 Prove it: 443 passes, 22 does notExpect True for 443 and False for 22, with the security group of VPC B as the reason.
reach $I $ENI_B 443 reach $I $ENI_B 22
P10
Transit gateway
0 / 0The regional hub for everything that is not a single close neighbour. Here it carries the VPN of phase 11; VPC B stays on its peering.
10.1 Create the transit gatewayDefault association and propagation keep the lab to one route table; production often turns both off and keeps a table per segment, such as prod, dev and shared.
export TGW=$(aws ec2 create-transit-gateway --description "netlab hub" \ --options AmazonSideAsn=64512,DefaultRouteTableAssociation=enable,DefaultRouteTablePropagation=enable,DnsSupport=enable,VpnEcmpSupport=enable \ --tag-specifications "$(tags transit-gateway lab-tgw)" --query TransitGateway.TransitGatewayId --output text) until [ "$(aws ec2 describe-transit-gateways --transit-gateway-ids $TGW \ --query 'TransitGateways[0].State' --output text)" = available ]; do sleep 15; done
10.2 Attachment subnets and the VPC attachmentSmall dedicated subnets keep the attachment’s interfaces apart from workloads; they stay on the main route table, which holds only the local route.
export TGW_A=$(sub 10.0.30.0/28 $AZ_A tgw-a) TGW_B=$(sub 10.0.30.16/28 $AZ_B tgw-b) export TGW_ATT=$(aws ec2 create-transit-gateway-vpc-attachment --transit-gateway-id $TGW --vpc-id $VPC \ --subnet-ids $TGW_A $TGW_B --options DnsSupport=enable,ApplianceModeSupport=disable \ --tag-specifications "$(tags transit-gateway-attachment lab-vpc-att)" \ --query TransitGatewayVpcAttachment.TransitGatewayAttachmentId --output text) until [ "$(aws ec2 describe-transit-gateway-vpc-attachments --transit-gateway-attachment-ids $TGW_ATT \ --query 'TransitGatewayVpcAttachments[0].State' --output text)" = available ]; do sleep 15; done
10.3 Send the on-premises range to the hub
for rt in $RT_APP $RT_APP_B; do aws ec2 create-route --route-table-id $rt --destination-cidr-block 192.168.0.0/16 --transit-gateway-id $TGW done
10.4 Read the hub’s route tableExpect 10.0.0.0/16 propagated from the VPC attachment; 192.168.0.0/16 appears once the VPN’s BGP sessions are up.
export TGW_RT=$(aws ec2 describe-transit-gateways --transit-gateway-ids $TGW \ --query 'TransitGateways[0].Options.AssociationDefaultRouteTableId' --output text) aws ec2 search-transit-gateway-routes --transit-gateway-route-table-id $TGW_RT --filters Name=state,Values=active \ --query 'Routes[].[DestinationCidrBlock,Type,TransitGatewayAttachments[0].ResourceType]' --output table
Moving VPC B to the hub Attach it as in 10.2, then replace the pcx- routes with tgw- routes on both sides. Peering and the hub can serve the same VPC for different prefixes; the longest prefix decides.
P11
Site-to-Site VPN on the transit gateway
0 / 0Two IPsec tunnels with BGP to an on-premises network, 192.168.0.0/16. Without a real device the tunnels stay down, which is still enough to practise this phase and PB3. Each connection bills per hour.
11.1 Customer gatewayThe public IP of your device, or of the NAT in front of it (NAT traversal then uses UDP 4500).
export CGW_IP=REPLACE_WITH_ON_PREM_PUBLIC_IP export CGW=$(aws ec2 create-customer-gateway --type ipsec.1 --bgp-asn 65010 --ip-address $CGW_IP \ --tag-specifications "$(tags customer-gateway lab-onprem)" --query CustomerGateway.CustomerGatewayId --output text)
11.2 Tunnel options: IKEv2, strong proposals, AWS starts the tunnelsWith the startup action start, AWS brings the tunnels up instead of waiting for traffic from your side. Large tunnels (5 Gbps each) work only on a transit gateway or Cloud WAN.
vpn-options.json
{
"StaticRoutesOnly": false,
"TunnelBandwidth": "standard",
"TunnelOptions": [
{
"TunnelInsideCidr": "169.254.10.0/30",
"StartupAction": "start",
"DPDTimeoutAction": "restart",
"IKEVersions": [{"Value": "ikev2"}],
"Phase1EncryptionAlgorithms": [{"Value": "AES256-GCM-16"}],
"Phase1IntegrityAlgorithms": [{"Value": "SHA2-384"}],
"Phase1DHGroupNumbers": [{"Value": 20}],
"Phase2EncryptionAlgorithms": [{"Value": "AES256-GCM-16"}],
"Phase2IntegrityAlgorithms": [{"Value": "SHA2-384"}],
"Phase2DHGroupNumbers": [{"Value": 20}],
"LogOptions": {"CloudWatchLogOptions": {"LogEnabled": true, "BgpLogEnabled": true, "LogOutputFormat": "json",
"LogGroupArn": "arn:aws:logs:REPLACE_WITH_REGION:REPLACE_WITH_ACCOUNT_ID:log-group:/vpn/netlab",
"BgpLogGroupArn": "arn:aws:logs:REPLACE_WITH_REGION:REPLACE_WITH_ACCOUNT_ID:log-group:/vpn/netlab"}}
},
{
"TunnelInsideCidr": "169.254.10.4/30",
"StartupAction": "start",
"DPDTimeoutAction": "restart",
"IKEVersions": [{"Value": "ikev2"}],
"Phase1EncryptionAlgorithms": [{"Value": "AES256-GCM-16"}],
"Phase1IntegrityAlgorithms": [{"Value": "SHA2-384"}],
"Phase1DHGroupNumbers": [{"Value": 20}],
"Phase2EncryptionAlgorithms": [{"Value": "AES256-GCM-16"}],
"Phase2IntegrityAlgorithms": [{"Value": "SHA2-384"}],
"Phase2DHGroupNumbers": [{"Value": 20}],
"LogOptions": {"CloudWatchLogOptions": {"LogEnabled": true, "BgpLogEnabled": true, "LogOutputFormat": "json",
"LogGroupArn": "arn:aws:logs:REPLACE_WITH_REGION:REPLACE_WITH_ACCOUNT_ID:log-group:/vpn/netlab",
"BgpLogGroupArn": "arn:aws:logs:REPLACE_WITH_REGION:REPLACE_WITH_ACCOUNT_ID:log-group:/vpn/netlab"}}
}
]
}sed -i "s/REPLACE_WITH_ACCOUNT_ID/$ACCOUNT/g; s/REPLACE_WITH_REGION/$AWS_REGION/g" vpn-options.json aws logs create-log-group --log-group-name /vpn/netlab export VPN=$(aws ec2 create-vpn-connection --type ipsec.1 --customer-gateway-id $CGW --transit-gateway-id $TGW \ --options file://vpn-options.json --pre-shared-key-storage SecretsManager \ --tag-specifications "$(tags vpn-connection lab-vpn)" --query VpnConnection.VpnConnectionId --output text) aws ec2 wait vpn-connection-available --vpn-connection-ids $VPN
11.3 Device configurationThe file holds both tunnels’ outside addresses, inside addresses and BGP neighbours; treat it as sensitive.
aws ec2 get-vpn-connection-device-types \ --query 'VpnConnectionDeviceTypes[].[VpnConnectionDeviceTypeId,Vendor,Platform,Software]' --output table aws ec2 get-vpn-connection-device-sample-configuration --vpn-connection-id $VPN \ --vpn-connection-device-type-id REPLACE_WITH_DEVICE_TYPE_ID --internet-key-exchange-version ikev2 \ --query VpnConnectionDeviceSampleConfiguration --output text > vpn-device.txt
11.4 Tunnel status
aws ec2 describe-vpn-connections --vpn-connection-ids $VPN \ --query 'VpnConnections[0].VgwTelemetry[].[OutsideIpAddress,Status,StatusMessage,AcceptedRouteCount]' --output table
11.5 Alarm when a tunnel goes downA minimum below 1 means at least one tunnel is down, so you hear about lost redundancy before the second tunnel goes. AWS maintenance replaces one tunnel at a time, which is why both must be configured.
export TOPIC=$(aws sns create-topic --name netlab-alerts --query TopicArn --output text) aws sns subscribe --topic-arn $TOPIC --protocol email --notification-endpoint REPLACE_WITH_EMAIL aws cloudwatch put-metric-alarm --alarm-name netlab-vpn-tunnel-down --namespace AWS/VPN --metric-name TunnelState \ --dimensions Name=VpnId,Value=$VPN --statistic Minimum --period 300 --evaluation-periods 2 \ --threshold 1 --comparison-operator LessThanThreshold --treat-missing-data breaching --alarm-actions $TOPIC
P12
IPv6 dual stack
0 / 0Public and app tiers get IPv6 next to IPv4. IPv6 addresses are free, which matters now that every public IPv4 address bills by the hour.
12.1 An Amazon-provided /56 for the VPC
aws ec2 associate-vpc-cidr-block --vpc-id $VPC --amazon-provided-ipv6-cidr-block sleep 10 export V6=$(aws ec2 describe-vpcs --vpc-ids $VPC \ --query 'Vpcs[0].Ipv6CidrBlockAssociationSet[0].Ipv6CidrBlock' --output text) echo $V6
12.2 A /64 per public and app subnetNumber the /64s like the IPv4 third octet, so 10.0.10.0/24 pairs with the /64 ending in 0a. New interfaces in the app tier then get an IPv6 address automatically.
v6sub(){
python3 -c 'import ipaddress, sys
net = ipaddress.ip_network(sys.argv[1])
print(list(net.subnets(new_prefix=64))[int(sys.argv[2])])' $V6 $1
}
aws ec2 associate-subnet-cidr-block --subnet-id $PUB_A --ipv6-cidr-block $(v6sub 0)
aws ec2 associate-subnet-cidr-block --subnet-id $PUB_B --ipv6-cidr-block $(v6sub 1)
aws ec2 associate-subnet-cidr-block --subnet-id $APP_A --ipv6-cidr-block $(v6sub 10)
aws ec2 associate-subnet-cidr-block --subnet-id $APP_B --ipv6-cidr-block $(v6sub 11)
for s in $APP_A $APP_B; do aws ec2 modify-subnet-attribute --subnet-id $s --assign-ipv6-address-on-creation; done12.3 Egress-only internet gateway and the ::/0 routesIPv6 has no NAT. The egress-only gateway lets the app tier open connections out and refuses connections in, as the NAT gateway does for IPv4.
export EIGW=$(aws ec2 create-egress-only-internet-gateway --vpc-id $VPC \ --tag-specifications "$(tags egress-only-internet-gateway lab-eigw)" \ --query EgressOnlyInternetGateway.EgressOnlyInternetGatewayId --output text) aws ec2 create-route --route-table-id $RT_PUB --destination-ipv6-cidr-block ::/0 --gateway-id $IGW for rt in $RT_APP $RT_APP_B; do aws ec2 create-route --route-table-id $rt --destination-ipv6-cidr-block ::/0 --egress-only-internet-gateway-id $EIGW done
12.4 IPv6 rules, an address for the instance, and a testSecurity group rules are per address family. Amazon Linux picks up the new address by DHCPv6 within a minute. The data tier stays IPv4-only.
aws ec2 authorize-security-group-ingress --group-id $ALB_SG \
--ip-permissions 'IpProtocol=tcp,FromPort=443,ToPort=443,Ipv6Ranges=[{CidrIpv6=::/0}]'
ENI=$(aws ec2 describe-instances --instance-ids $I \
--query 'Reservations[0].Instances[0].NetworkInterfaces[0].NetworkInterfaceId' --output text)
aws ec2 assign-ipv6-addresses --network-interface-id $ENI --ipv6-address-count 1
# inside a session on the instance
curl -6 -sI https://www.google.com | head -1P13
Direct Connect
0 / 0A connection takes weeks and bills per port hour, so in a lab run only 13.1 and 13.2, which cost nothing. 13.3 and 13.4 show the shape of the real thing.
13.1 Locations and port speeds in this Region
aws directconnect describe-locations \ --query 'locations[].[locationCode,locationName,join(`,`, availablePortSpeeds),join(`,`, availableMacSecPortSpeeds)]' \ --output table
13.2 A Direct Connect gatewayA global object: one gateway reaches VPCs and transit gateways in many Regions. Its ASN must differ from the transit gateway’s.
export DXGW=$(aws directconnect create-direct-connect-gateway --direct-connect-gateway-name netlab-dxgw \ --amazon-side-asn 64513 --query directConnectGateway.directConnectGatewayId --output text)
13.3 Associate it with the transit gateway (real connection only)Allowed prefixes are what AWS advertises to your router over the transit VIF; summarise them.
aws directconnect create-direct-connect-gateway-association --direct-connect-gateway-id $DXGW \ --gateway-id $TGW --add-allowed-prefixes-to-direct-connect-gateway cidr=10.0.0.0/16
13.4 Order a port and a transit VIF (do not run in a lab)AWS issues a Letter of Authorization (LOA-CFA) for the cross-connect at the location. Port hours start when the connection comes up, or 90 days after the order, whichever is first. Resilience needs a second connection at a second location.
aws directconnect create-connection --location REPLACE_WITH_LOCATION_CODE --bandwidth 10Gbps \ --connection-name netlab-dx --request-mac-sec aws directconnect create-transit-virtual-interface --connection-id REPLACE_WITH_DXCON_ID \ --new-transit-virtual-interface "virtualInterfaceName=netlab-tvif,vlan=101,asn=65010,mtu=8500,directConnectGatewayId=$DXGW"
P14
Clean up
0 / 0Reverse order, because most deletes fail while something still depends on the resource. Network interfaces of endpoints and NAT gateways take minutes to go; if a delete reports a dependency, wait and run it again.
14.1 VPN, alarm, customer gateway
aws ec2 delete-vpn-connection --vpn-connection-id $VPN aws ec2 wait vpn-connection-deleted --vpn-connection-ids $VPN aws ec2 delete-customer-gateway --customer-gateway-id $CGW aws cloudwatch delete-alarms --alarm-names netlab-vpn-tunnel-down aws sns delete-topic --topic-arn $TOPIC aws logs delete-log-group --log-group-name /vpn/netlab
14.2 Direct Connect gatewayIf you made the association in 13.3, the gateway delete fails until the association is gone.
ASSOC=$(aws directconnect describe-direct-connect-gateway-associations --direct-connect-gateway-id $DXGW \ --query 'directConnectGatewayAssociations[0].associationId' --output text) [ "$ASSOC" != None ] && aws directconnect delete-direct-connect-gateway-association --association-id $ASSOC aws directconnect delete-direct-connect-gateway --direct-connect-gateway-id $DXGW
14.3 Transit gateway
for rt in $RT_APP $RT_APP_B; do aws ec2 delete-route --route-table-id $rt --destination-cidr-block 192.168.0.0/16; done aws ec2 delete-transit-gateway-vpc-attachment --transit-gateway-attachment-id $TGW_ATT while aws ec2 describe-transit-gateway-vpc-attachments --transit-gateway-attachment-ids $TGW_ATT \ --query 'TransitGatewayVpcAttachments[0].State' --output text | grep -Eq 'available|deleting'; do sleep 15; done aws ec2 delete-transit-gateway --transit-gateway-id $TGW
14.4 Peering and VPC B
aws ec2 delete-network-interface --network-interface-id $ENI_B aws ec2 delete-vpc-peering-connection --vpc-peering-connection-id $PCX aws ec2 delete-security-group --group-id $B_SG aws ec2 delete-subnet --subnet-id $SUB_B aws ec2 delete-route-table --route-table-id $RT_B aws ec2 delete-vpc --vpc-id $VPC_B
14.5 Instance, Instance Connect Endpoint, VPC endpoints
aws ec2 terminate-instances --instance-ids $I aws ec2 delete-instance-connect-endpoint --instance-connect-endpoint-id $EICE aws ec2 delete-vpc-endpoints --vpc-endpoint-ids $(aws ec2 describe-vpc-endpoints --filters Name=vpc-id,Values=$VPC \ --query 'VpcEndpoints[].VpcEndpointId' --output text) aws ec2 wait instance-terminated --instance-ids $I
14.6 NAT gateways and their Elastic IPsA regional NAT gateway in automatic mode manages its own addresses; the release loop finds only the tagged Elastic IPs of option 3.3.
NATS=$(aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=$VPC Name=state,Values=available \ --query 'NatGateways[].NatGatewayId' --output text) for n in $NATS; do aws ec2 delete-nat-gateway --nat-gateway-id $n; done aws ec2 wait nat-gateway-deleted --nat-gateway-ids $NATS for a in $(aws ec2 describe-addresses --filters Name=tag:project,Values=netlab --query 'Addresses[].AllocationId' --output text); do aws ec2 release-address --allocation-id $a done
14.7 Flow logs, Block Public Access, logging role
aws ec2 delete-flow-logs --flow-log-ids $FL aws logs delete-log-group --log-group-name /vpc/netlab/flow aws iam delete-role-policy --role-name netlab-flowlogs --policy-name deliver aws iam delete-role --role-name netlab-flowlogs aws ec2 modify-vpc-block-public-access-options --internet-gateway-block-mode off for x in $BPA_X1 $BPA_X2; do aws ec2 delete-vpc-block-public-access-exclusion --exclusion-id $x; done
14.8 Gateways, subnets, route tables, NACL
aws ec2 detach-internet-gateway --internet-gateway-id $IGW --vpc-id $VPC aws ec2 delete-internet-gateway --internet-gateway-id $IGW aws ec2 delete-egress-only-internet-gateway --egress-only-internet-gateway-id $EIGW for s in $PUB_A $PUB_B $APP_A $APP_B $DB_A $DB_B $TGW_A $TGW_B; do aws ec2 delete-subnet --subnet-id $s; done for rt in $RT_PUB $RT_APP $RT_APP_B $RT_DB; do aws ec2 delete-route-table --route-table-id $rt; done aws ec2 delete-network-acl --network-acl-id $NACL_DB
14.9 Security groups, then the VPCThe groups reference each other, so their rules go first; rules() is the helper from 1.4.
for g in $ALB_SG $APP_SG $DB_SG $EICE_SG $EP_SG; do aws ec2 revoke-security-group-ingress --group-id $g --security-group-rule-ids $(rules $g false) 2>/dev/null aws ec2 revoke-security-group-egress --group-id $g --security-group-rule-ids $(rules $g true) 2>/dev/null done for g in $ALB_SG $APP_SG $DB_SG $EICE_SG $EP_SG; do aws ec2 delete-security-group --group-id $g; done aws ec2 delete-vpc --vpc-id $VPC
14.10 Instance role, and a last search for leftoversThe tag search lags a little behind deletions; anything still listed after ten minutes was missed.
aws iam remove-role-from-instance-profile --instance-profile-name netlab-ssm --role-name netlab-ssm aws iam delete-instance-profile --instance-profile-name netlab-ssm aws iam detach-role-policy --role-name netlab-ssm --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore aws iam delete-role --role-name netlab-ssm aws resourcegroupstaggingapi get-resources --tag-filters Key=project,Values=netlab \ --query 'ResourceTagMappingList[].ResourceARN' --output text
PB
Playbooks
For the day something goes wrong. Ticks here do not count toward the runbook progress.
PB1 No internet from a private instance
when package updates or API calls time out from the app tier
Read the subnet’s route tableNo result means the subnet uses the main table. Look for 0.0.0.0/0 to an available NAT gateway; a blackhole state means the target is gone.
S=REPLACE_WITH_SUBNET_ID aws ec2 describe-route-tables --filters Name=association.subnet-id,Values=$S \ --query 'RouteTables[0].Routes[].[DestinationCidrBlock,NatGatewayId,GatewayId,State]' --output table
Check the NAT gateway and Block Public AccessA zonal NAT gateway must sit in a public subnet whose table sends 0.0.0.0/0 to the IGW. A regional one may still be expanding into a new AZ. Block Public Access in bidirectional mode stops NAT egress too.
aws ec2 describe-nat-gateways --filter Name=vpc-id,Values=$VPC \ --query 'NatGateways[].[NatGatewayId,State,AvailabilityMode,SubnetId,FailureMessage]' --output table aws ec2 describe-vpc-block-public-access-options --query 'VpcBlockPublicAccessOptions.InternetGatewayBlockMode'
Check the filters and DNSSecurity group egress; the subnet NACL’s outbound rule and its inbound rule for replies on 1024-65535; enableDnsSupport on, with the resolver at the VPC base address plus two.
PB2 No traffic across a peering
when the peering is active but connections time out
Find the route tables that use itEach side needs a route to the other’s range in the table of the subnet actually in use.
aws ec2 describe-vpc-peering-connections --vpc-peering-connection-ids $PCX --query 'VpcPeeringConnections[0].Status' aws ec2 describe-route-tables --filters Name=route.vpc-peering-connection-id,Values=$PCX \ --query 'RouteTables[].[VpcId,RouteTableId]' --output table
Rule out what peering never doesNo transitive routing: traffic cannot leave through the peer’s IGW, NAT gateway, VPN, Direct Connect or another peering. Overlapping ranges cannot peer. Security group references do not work across Regions.
Let Reachability Analyzer name the blockerRun it between the two interfaces with the function from 8.4; the explanation names the route, group or ACL in the way.
reach REPLACE_WITH_SOURCE_ENI REPLACE_WITH_DEST_ENI 443
PB3 VPN tunnel down
when the alarm from 11.5 fires or a tunnel shows DOWN
Read the telemetryIPSEC IS DOWN points at IKE or the device. IPSEC IS UP with no accepted routes points at BGP.
aws ec2 describe-vpn-connections --vpn-connection-ids $VPN \ --query 'VpnConnections[0].VgwTelemetry[].[OutsideIpAddress,Status,StatusMessage,AcceptedRouteCount]' --output table
Read the tunnel and BGP logs
aws logs tail /vpn/netlab --since 30m --format short
Check the usual causesThe device’s public IP changed; UDP 500, UDP 4500 or ESP blocked on the way; a proposal mismatch (IKE version, cipher, DH group); a wrong BGP ASN or 169.254 neighbour address.
Replace a stuck tunnel endpointThat tunnel drops briefly; the other one carries the traffic.
aws ec2 replace-vpn-tunnel --vpn-connection-id $VPN --vpn-tunnel-outside-ip-address REPLACE_WITH_TUNNEL_IP
PB4 Timeout or refused?
when a connection to something in the VPC fails
Tell them apartRefused means the packet arrived and nothing listens, or the host firewall rejected it: the network path is fine. A timeout means something dropped it: a route, a security group, a NACL, or the host is down. Security groups and NACLs drop silently; they never refuse.
nc -vz -w 5 10.0.20.15 5432
Find the drop in the flow logsREJECT on the request: a security group or NACL on the way in. ACCEPT on the request but REJECT on the reply: a NACL without the reply ports, since security groups are stateful. Nothing at all: a route sends the traffic elsewhere.
Q=$(aws logs start-query --log-group-name /vpc/netlab/flow \ --start-time $(date -d '-15 min' +%s) --end-time $(date +%s) \ --query-string 'filter dstAddr = "10.0.20.15" or srcAddr = "10.0.20.15" | fields @timestamp, srcAddr, srcPort, dstAddr, dstPort, action | sort @timestamp desc | limit 50' \ --query queryId --output text) sleep 10; aws logs get-query-results --query-id $Q --query results --output text
PB5 Subnet out of addresses
when launches fail with InsufficientFreeAddressesInSubnet, or pods stay pending
Measure and find the consumers
aws ec2 describe-subnets --subnet-ids $S --query 'Subnets[0].[CidrBlock,AvailableIpAddressCount]' --output text aws ec2 describe-network-interfaces --filters Name=subnet-id,Values=$S \ --query 'NetworkInterfaces[].[InterfaceType,Status]' --output text | sort | uniq -c | sort -rn
Free space, then add moreDelete interfaces left in the available state. A subnet cannot grow: add a secondary range to the VPC, for example from 100.64.0.0/10, and create new subnets for the growing tier. For EKS, use prefix delegation or custom networking.
aws ec2 associate-vpc-cidr-block --vpc-id $VPC --cidr-block 100.64.0.0/16
FIX
Troubleshooting
| Symptom | Cause | Fix | Step |
|---|---|---|---|
| Subnet creation fails with an invalid or conflicting CIDR | block outside the VPC range, or overlapping another subnet | pick a free block inside the VPC range | 1.2 |
| Instance in a public subnet unreachable from the internet | no public address, no 0.0.0.0/0 to the IGW, or Block Public Access in ingress mode | add an Elastic IP or a load balancer; check the route; exclude the subnet | 2.2, 8.5 |
| NAT gateway creation fails | no internet gateway attached, or (zonal) no Elastic IP left | attach the IGW; release unused Elastic IPs | 2.1, 3.1 |
| Private instance offline in Session Manager | ssm or ssmmessages endpoint missing, private DNS off, or the endpoint group without 443 | create both endpoints with private DNS; allow 443 from the VPC | 4.2, 4.3 |
| S3 traffic still billed through the NAT gateway | gateway endpoint not on that subnet’s table, or the bucket is in another Region | add the route table to the endpoint; cross-Region buckets need an interface endpoint or NAT | 4.1 |
| App cannot reach the database though the group allows it | data NACL without the reply rule, or the app outside 10.0.10.0/23 | egress 1024-65535 to the app range | 6.2 |
| Instance Connect Endpoint times out | app group without 22 from the endpoint’s group, or the endpoint still creating | the two rules from 7.4; wait for create-complete | 7.4, 7.5 |
| Flow log created but no log streams | role trust or policy wrong, or no traffic yet | trust vpc-flow-logs.amazonaws.com; wait one aggregation interval | 8.1 |
| Peering expired | not accepted within seven days | request again and accept in the other account or Region | 9.2 |
| Rule naming the peer’s group rejected | peering across Regions, or not yet active | use the peer’s CIDR | 9.5 |
| Hub has no route to the VPC | propagation off, or the attachment not available | enable propagation or add a static route | 10.4 |
| Traffic reaches the VPC through the hub but replies are lost | the subnet’s table has no route back for that prefix | add the prefix with target tgw- | 10.3 |
| Tunnels down after editing options | proposal mismatch with the device | match IKE version, cipher and DH group on the device | 11.2 |
| Tunnel up, no routes learned | wrong BGP ASN or neighbour address, or nothing advertised | compare AcceptedRouteCount with the device’s BGP setup | 11.4 |
| Instance has no IPv6 address in the OS | no address assigned, or DHCPv6 off in the OS | assign one; enable DHCPv6 | 12.4 |
| Clean-up fails with DependencyViolation | interfaces of endpoints, NAT or the Instance Connect Endpoint still releasing | wait a few minutes and run the delete again | 14.8, 14.9 |
AWS Networking Runbook · REV 2026.10
© 2026 · BUB.IM · made in vim
0 comments