Peering and testing Connections of two separated VPCS on AWS using Terraform

🚀 Overview:

VPC peering across two AWS regions is a network connection that allows Virtual Private Clouds (VPCs) in different geographic locations to communicate securely and directly with each other, enabling seamless data transfer and resource access while maintaining the isolation and security of each VPC. This inter-region connectivity facilitates distributed application architectures, disaster recovery setups, and data replication scenarios, enhancing the versatility and global reach of AWS infrastructure for businesses and organizations. This project utilizes Terraform, an Infrastructure as Code (IaC) tool, to provision and manage the infrastructure components, enabling automation, repeatability, and scalability. The primary objective of this project is to design and deploy two virtual Private Cloud on AWS in two separated region “us-west-2” and “us-east-1” then we will create a VPC peering to link both VPCs and finally launch two EC2 instances in both private subnets then test connectivity between them.

🔧 Problem Statement

Terraform is an IaC software tool that provides a consistent command line interface (CLI) workflow to manage hundreds of cloud services. Terraform codifies cloud APIs into declarative configuration files. In this specific case you need to create VPC peering across two AWS regions. It is a network connection that allows Virtual Private Clouds (VPCs) in different geographic locations to communicate securely and directly with each other, enabling seamless data transfer and resource access while maintaining the isolation and security of each VPC. This inter-region connectivity facilitates distributed application architectures, disaster recovery setups, and data replication scenarios, enhancing the versatility and global reach of AWS infrastructure for businesses and organizations. Terraform will use his deployment to provide all AWS needed elements avoiding us to use the console and it will automate the setup, ensuring consistency and reducing human error.

💽 Techonology Stack

The architecture consists of the following services tiers:

• VPC: AWS VPC

• Subnets: AWS Subnets

• Route table: AWS route table

• NACL: AWS NACL

• Internet Gateway: AWS IGW

• NatGateway : AWS NATGATEWAY

• SSM Role: AWS IAM

• EC2 Instance: AWS EC2

• Peering Connection: AWS VPC Peering

📌 Architecture Diagram

🌟 Project Requirements

Before you get started, make sure you have the following prerequisites in place:

• Terraform installed on your local machine.

• AWS IAM credentials configured in your text editor. In this case we will use VSCODE.

• Git installed on your local machine and Github account set up Github

• Git for cloning the repository.

• AWS VPC services

You must know the goal of the peering connection:

To achieve VPC peering across regions, first, create the necessary VPCs in each region, ensuring they have unique CIDR blocks. Next, create VPC peering connections in both regions, accepting the peer requests. Update the route tables in each VPC to include routes for the peer VPC's CIDR block, pointing to the peering connection. Finally, configure security groups and network ACLs to allow the required traffic between the peered VPCs. This setup enables seamless and secure communication between resources in the US East and US west regions while maintaining network isolation. We will skip the completion of these manual steps and we will use Terraform where cade with all those steps were wrote and now will just be run and deploy.

📋 Table of Contents

I - Terraform Configuration files

Step 1: Providers Configuration

Step 2: Variables Configuration

Step 3: VPCs Configuration

Step 4: Main Configuration

Step 5: Output Configuration

II - Instructions of Deployment

Step 1: Clone Repository

Step 2: Initialize Folder

Step 3: Format Files

Step 4: Validate Files

Step 5: Plan

Step 6: Apply

Step 7: Review of Resources

Step 8: Testing Connectivity

Step 9: Destroy

✨Terraform Configuration files

You need to write different files generating resources

Step 1: Provider Configuration

Here we declare our cloud provider and we specify the regions where we will be launching resources. The regions us-east-1 and us-west-2 are the two to be precise.

• providers Configuration

Step 2: Variables Configuration

This is where we declare all variables and their value. It includes

Variables: List of element that can vary or change. They can be reuse values throughout our code without repeating ourselves and help make the code dynamic. We can de declare stuff like CIDR blocks, ports numbers, key name, instance type, count VPCs and subnets name.

Value: Declare different default value of each variables

We have

• variables Configuration

• value Configuration

Step 3: VPCs Configuration

This is where you create the basement, foundation and networking where all the resources will be launch. It includes VPC, Subnets, IGW, NatGateway, EIP, NCAL and Route tables

• vpc-east

• vpc-west

We have here

• VPC: Virtual Private Cloud the main and private environment where all resources will be launch

• Subnets: is a segmented portion of a virtual private cloud (VPC) that allows you to partition your network resources. Subnets are used to organize and manage your cloud resources more effectively by providing isolation and control over network traffic. We will be having two public and private in each VPCs

• Internet Gateway: it plays a crucial role in enabling internet connectivity for resources within a VPC, allowing instances to access services, applications, and data hosted on the public internet while providing scalability, redundancy, and security features. One for the each will allow access to internet for each VPCs.

• Route Tables: is a fundamental networking component that controls the routing of network traffic within a Virtual Private Cloud (VPC). Route tables define the rules for directing traffic from one subnet to another or to external networks, such as the internet or on-premises networks. As we need to are peering tow VPCs we will need to route the traffic from local to internet and the private link between the two close environment.

• NCAL: Network Access Control Lists (NACLs) are a security layer in AWS that act as a firewall for controlling traffic in and out of one or more subnets within a Virtual Private Cloud (VPC).

• Security Groups: a security group acts as a virtual firewall for controlling inbound and outbound traffic to AWS resources, such as EC2 instances, RDS databases, and other services within a Virtual Private Cloud (VPC). Security groups allow you to define rules that specify the type of traffic allowed or denied based on protocols, ports, and IP addresses.

Step 4: Main Configuration

This is where we declare the file for the peering which is the main file. The main file is the one containing the goal of the project which is the peering of both VPCs. This is where the link and the attachment and connectivity of the VPCs is done.

. main

The SSM file will be the role because we will connect to the instance using the private IP and as we will connect to the instance securely. The easier way will be by SSM connect

. ssm-role

The both instances will bee launched in the private subnets of each VPCs. Here are the contains of each files that will launch the instances

. ec2-east

. ec2-west

Step 5: Output Configuration

Know as Output Value : it is a convenient way to get useful information about your infrastructure printed on the CLI. It is showing the ARN, name or ID of a resource. In this case we are bringing out the both VPCs Id and both EC2 private IP. we gonna us those private IPs to test the connectivity

• Output Configuration

💼 Instructions of Deployment

Follow these steps to deploy the architecture:

Step 1: Clone Repository:

Clone the repository in your local machine using the command "git clone"

git clone https://github.com/Joebaho/VPC-PEERING

Step 2: Initialize Folder

Initialize the folder containing configuration files that were clone to Terraform and apply the configuration by typing the following command

terraform init

You must see this image

Step 3: Format Files

Apply any changes on files and Review the changes and confirm the good format with command:

terraform fmt

Step 4: Validate Files

Ensure that every files are syntactically valid and ready to go with the command:

terraform validate

If everything is good you will have something like this

Step 5: Plan

Create an execution plan to provide the achievement of the desired state. It Check and confirm the numbers of resources that will be create. Use command:

terraform plan

The list of all resources in stage of creation will appear and you can see all properties(arguments and attributs) of each resources

Step 6: Apply

Bring all desired state resources on life. It Launch and create all resources listed in the configuration files. The command to perform the task is:

terraform apply -auto-approve

Now, the creation will start and you will be able to see which resources is on the way to be create and the time it taking to create.

At the end you will receive a prompt message showing all resources status: created, changed and the numbers of them.

Here are the outputs :

Step 7: Review of resources

Go back on the console and check all actual state resources one by one to see. You will have

• VPC-EAST

In the VPC option, we can see here the VPC, subnets( Public & Private) routes tables ( public & Private), Internet Gateway , Nat Gateway deployed in the us-east-1 region.

This shows route for the connectivity. Every communication from the CDIR block of the other VPC will have as target the VPC peering, for local one use the CDIR block of the requester VPC. If you want to access internet the Internet Gateway or the Nat Gateway will be the way to go.

• VPC_WEST

We can see here the VPC, subnets( Public & Private) routes tables ( public & Private), Internet Gateway , Nat Gateway deployed in the us-west-2 region.

This shows route for the connectivity. Every communication from the CDIR block of the other VPC will have as target the VPC peering, for local one use the CDIR block of the requester VPC. If you want to access internet the Internet Gateway or the Nat Gateway will be the way to go.

• Peering Connection east

VPC peering connects two VPCs privately. The requester VPC-west initiates the connection, and the accepter VPC-east approves it. Both configure route tables for traffic flow between the VPCs. Manually this process needs acceptance confirmation of the accepter but in this case we placed that automatically in the code.

• Peering Connection west

VPC peering connects two VPCs privately. The requester VPC-west initiates the connection, and the accepter VPC-east approves it.

• EC2-WEST

• EC2-EAST

• Server-west connect

After selecting the instance, we may now look for a way to connect to it. As we added the SSM role we will have to select it and hit on “Connect” that will land us directly in the server.

• Server-east connect

Step 8: Testing Connectivity

The testing process will require to use the ping command to see if there is any response from the server. We need to grab the private IP of ec2-east server and test it the ec2-west server. As you can see on the both Screenshots each ping return a response this mean the connectivity is perfect and going through

• Ping server west

• Ping server east

Step 9: Destroy

Destroy the terraform managed infrastructure meaning all resources created will be shut down. This action can be done with the command "terraform destroy"

terraform destroy -auto-approve

At the end you will receive a prompt message showing all resources has been destroyed. The 53 resources created for the purpose of this project will all be destroyed and instances terminated. After typing the command the process of deleting resources will be launch and at the end there will be a confirmation message. See screenshot bellow:

🤝 Contributing

Your perspective is valuable! Whether you see potential for improvement or appreciate what's already here, your contributions are welcomed and appreciated. Thank you for considering joining us in making this project even better. Feel free to follow me for updates on this project and others, and to explore opportunities for collaboration. Together, we can create something amazing!

📄 License

This project is licensed under the JoebahoCloud License