Create a connection initiated from AWS with VPC Network Peering

This page describes the steps to successfully create and provision a partner Cross-Cloud Interconnect for Amazon Web Services (AWS) connection from AWS if you already have an activation key.

If you want to initiate a connection from the AWS Console, see Getting started with AWS Interconnect for creating the required resource. Provide the project and region information where you want the connection to land in Google Cloud. After AWS has created the resource, you must create the Google Cloud resource with the provided activation key.

Configuration requirements

Before you start the partner Cross-Cloud Interconnect for AWS provisioning process, ensure that the following conditions are met:

• You must already have an AWS account.
• You must also create a Virtual Private Cloud (VPC) network, if it doesn't already exist, to connect your transport resource to.

To achieve a successful connection, you must create the transport resource. Follow these instructions to create the transport.

Before you begin

Before you get started, review the following sections.

Create or select a project

To make it easier to configure partner Cross-Cloud Interconnect for AWS, start by identifying a valid project.

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Install the Google Cloud CLI.

If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

To initialize the gcloud CLI, run the following command:

gcloud init

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Install the Google Cloud CLI.

If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

To initialize the gcloud CLI, run the following command:

gcloud init

1. If you are using the Google Cloud CLI, set your project ID by using the gcloud config set command.

   gcloud config set project PROJECT_ID

   Replace PROJECT_ID with your unique project ID.

   The gcloud CLI instructions on this page assume that you have set your project ID.

2. To confirm that you set the project ID correctly, use the gcloud config list command.

   gcloud config list --format='text(core.project)'

Enable the Network Connectivity API

Before you can perform any tasks using partner Cross-Cloud Interconnect for AWS, you must enable the Network Connectivity API.

Console

To enable the Network Connectivity API, do the following:

1. In the Google Cloud console, go to the Network Connectivity API page.

   Go to Network Connectivity API

2. Click Enable.

Alternatively, you can enable the API by using the Google Cloud console API Library, as described in Enabling APIs.

Initiate a connection from AWS with an AWS activation key

Permissions required for this task

To perform this task, you must have been granted the following permissions or the following IAM roles.

Permissions

• networkconnectivity.remoteTransportProfiles.get to get transport profiles
• networkconnectivity.remoteTransportProfiles.list to list transport profiles
• networkconnectivity.transports.get to view transports
• networkconnectivity.transports.list to view transports
• networkconnectivity.transports.create to create a transport
• networkconnectivity.transports.update to update a transport
• Networkconnectivity.transports.delete to delete a transport
• compute.networks.use to establish VPC Network Peering
• compute.networks.addPeering to establish VPC Network Peering

Roles

You need the following roles to create a transport resource:

• roles/networkconnectivity.transportAdmin to create a transport
• roles/compute.networkAdmin to create a transport

Create the transport resource

Console

1. In the Google Cloud console, go to the Partner Cross-Cloud Interconnect page.

   Go to Partner Cross-Cloud Interconnect

2. In the project menu, select a project.

3. Click Create transport.

4. Under Connection start point, click Remote Cloud Service Provider (e.g. AWS).

5. In the Activation key field, enter the activation key that you have from AWS.

6. Click Validate. If you see an error message, make sure that the activation key that you have entered is accurate.

7. After your key is validated, click Continue.

8. Under Transport profile, choose the transport in the region where you want to provision connectivity.

9. In the Remote ID field, enter the account ID of your AWS account.

10. Click Continue.

11. In the Basic configuration field, enter the following:

    • A Transport name for the transport resource that you want to create.
    • An optional Description for the transport resource.
    • (Optional) Choose the Bandwidth for your connection, such as 1G. Make sure that the value matches the value selected when the key was created with AWS.
    • (Optional) Choose the IP stack type. By default, IPv4 is selected.
    • Choose the Transport connectivity.

12. Click Continue.

13. Under Connection, choose the name of your VPC network.

14. In the Advertised routes field, enter a comma-separated list of the IP addresses for the Google Cloud VPC network's routes to be advertised to AWS.

15. Click Create.

16. To verify your connection, click View transport details. The Transport details page shows the transport details and the connection status.

gcloud

Use the gcloud network-connectivity transports create command:

gcloud network-connectivity transports create TRANSPORT_NAME \
    --region=REGION \
    --activation-key=ACTIVATION_KEY \
    --network=NETWORK \
    --advertised-routes=ADVERTISED_ROUTES \
    --stack-type=STACK_TYPE

Replace the following values:

• TRANSPORT_NAME: a name for the transport resource that you want to create
• LOCATION: the name of the region where you want to provision connectivity, such as, us-west1
• ACTIVATION_KEY: the activation key that you have received from AWS
• NETWORK: the name of your VPC network
• ADVERTISED_ROUTE: IP addresses for the Google Cloud VPC network's routes to be advertised to AWS.
• STACK_TYPE (optional): IP address version stack type. Must be IPV4_ONLY or IPV4_IPV6. Defaults to IPV4_ONLY

API

Use the networkconnectivity.transports.create method:

POST https://networkconnectivity.googleapis.com/v1/projects/PROJECT/locations/LOCATION/transport/TRANSPORT_NAME

curl \
-H "Authorization: Bearer $(gcloud auth print-access-token)" \
-H "Content-Type: application/json" \
https://networkconnectivity.googleapis.com/v1/projects/PROJECT/locations/LOCATION/transports?transportId=TRANSPORT_NAME \
--data '
{
"network": "NETWORK",
"advertisedRoutes": ["ADVERTISED_ROUTE"],
"providedActivationKey": "ACTIVATION_KEY",
"stackType": "STACK_TYPE"
}'

Replace the following values:

• PROJECT: the name of the project in which you want to create the transport
• LOCATION: the name of the Google Cloud region where you want to provision connectivity, such as, us-west1
• TRANSPORT_NAME: a name for the transport resource
• NETWORK: the network in which you want to create the transport
• ADVERTISED_ROUTE: IP addresses for the Google Cloud VPC network's routes to be advertised to AWS.
• ACTIVATION_KEY: the activation key that you have received from AWS
• STACK_TYPE (optional): IP address version stack type. Must be IPV4_ONLY or IPV4_IPV6. Defaults to IPV4_ONLY

Retrieve the peering network name

After you create the transport resource, retrieve the name of the peering network it is attached to. The name of the peering network is used to establish VPC Network Peering.

To view the peering network name, do the following:

gcloud

Use the network-connectivity transports describe command.

gcloud network-connectivity transports describe "TRANSPORT_NAME"

Replace TRANSPORT_NAME with the name of the transport that you created.

If the command is successful, copy the output's peeringNetwork field to use when establishing VPC Network Peering.

API

Use the networkconnectivity.transports.get method:

GET https://networkconnectivity.googleapis.com/v1/projects/PROJECT/locations/LOCATION/transport/TRANSPORT_NAME

Replace the following values:

• PROJECT: the name of the project that you created the transport resource in
• LOCATION: the name of the Google Cloud region where you want to provision connectivity, such as, us-west1
• TRANSPORT_NAME: the name of the transport that you created

Establish VPC Network Peering

You can proactively establish VPC Network Peering at the Google Cloud end. To do this, use the peeringNetwork resource and ensure that you create a peering with the same stack type. The default stack type matches the transport resource using IPV4_ONLY.

To receive the AWS routes, you must enable the Import custom routes field.

The MTU in the peering VPC network is explicitly set to the maximum in order to avoid MTU issues in the connectivity. If you're using an MTU less than 8896, you might get a warning WARNING: Some requests generated warnings: - Network MTU 1460B does not match the peer's MTU 8896B. In that case, you must ensure that you're using matching MTU configurations between your Google Cloud VPC network and the AWS VPC network. If these are mismatched, you might need to override MTU values to the lowest common denominator. For example, if you're using 8896 in Google Cloud and 8800 in AWS, everything in Google Cloud must be configured as 8800.

gcloud

To establish VPC Network Peering, use the gcloud compute networks peerings create command.

gcloud compute networks peerings create "TRANSPORT_NAME" \
    --network="VPC_NETWORK" \
    --peer-network="PEERING_NETWORK" \
    --stack-type=STACK_TYPE \
    --import-custom-routes \
    --export-custom-routes

Replace the following values:

• TRANSPORT_NAME: the name of the transport that you created
• VPC_NETWORK: the name of the VPC network that you want to list the routes for
• PEERING_NETWORK: the name of the VPC network provided by the Transport resource
• STACK_TYPE: IP address version stack type. Must be IPV4_ONLY or IPV4_IPV6. Defaults to IPV4_ONLY

If the command is successful, the output's state field has the value ACTIVE.

API

To establish VPC Network Peering, use the compute.networks.addPeering method.

POST https://compute.googleapis.com/compute/v1/projects/PROJECT/global/networks/NETWORK/addPeering

Replace the following values:

• PROJECT: the name of the project that you are peering
• NETWORK: the name of the network resource to add peering to

Verify your connection

You can verify that connectivity has been established by listing the peered VPC networks and the route tables. After the AWS configuration is complete, you can see your AWS routes in the list.

Console

1. In the Google Cloud console, go to the Partner Cross-Cloud Interconnect page.

   Go to Partner Cross-Cloud Interconnect

2. In the project menu, select your project.

3. On the Transports page, click the transport that you just created.

4. The Transport details page shows the transport details and the connection status.

gcloud

To list the peered VPC networks, use the gcloud compute networks peerings list command.

gcloud compute networks peerings list

The output is similar to the following:

NAME           NETWORK  PEER_PROJECT           PEER_NETWORK                   STACK_TYPE  PEER_MTU  IMPORT_CUSTOM_ROUTES  EXPORT_CUSTOM_ROUTES  UPDATE_STRATEGY  STATE   STATE_DETAILS
cci-virginia  cci      ke526b767340356b7p-tp  transport-b52816f13d929baf-vpc  IPV4_ONLY   8896      True                  True                  INDEPENDENT      ACTIVE  [2026-01-22T07:20:58.891-08:00]: Connected.

To list routes for a specific transport, use the gcloud compute networks peerings list-routes command.

gcloud compute networks peerings list-routes TRANSPORT_NAME \
    --direction=INCOMING \
    --network=NETWORK \
    --region=REGION

Replace the following values:

• TRANSPORT_NAME: the name of the transport resource
• NETWORK: the name of the VPC network that you want to list the route tables for
• REGION: the region of the transport resource

The output is similar to the following:

DEST_RANGE   TYPE                   NEXT_HOP_REGION  PRIORITY  STATUS
10.0.0.0/16  DYNAMIC_PEERING_ROUTE  us-east4         0         accepted

API

To list peered networks, use the compute.networks.list method.

GET https://compute.googleapis.com/compute/v1/projects/PROJECT/global/networks

Replace PROJECT with the name of the project that you want to list the networks for.

To list routes, use the compute.routes.listPeeringRoutes method

GET https://compute.googleapis.com/compute/v1/projects/PROJECT/global/networks/NETWORK/listPeeringRoutes

Replace the following values:

• PROJECT with the name of the project that you want to list the routes for
• NETWORK: the name of the VPC network that you want to list the route tables for

What's next

• To find answers to common questions about Cloud Interconnect architecture and features, see the Cloud Interconnect FAQ.
• To find out more about Cloud Interconnect, see the Cloud Interconnect overview.
• To learn about best practices when planning for and configuring Cloud Interconnect, see Best practices.
• To find Google Cloud resource names, see the Cloud Interconnect APIs.