Partner Cross-Cloud Interconnect for AWS provisioning overview

Preview

This feature is subject to the "Pre-GA Offerings Terms" in the General Service Terms section of the Service Specific Terms. Pre-GA features are available "as is" and might have limited support. For more information, see the launch stage descriptions.

This page describes the steps to successfully create and provision a Partner Cross-Cloud Interconnect for Amazon Web Services (AWS) connection.

You can initiate connectivity from either Google Cloud or from Amazon Web Services. To achieve a successful connection, you must create the transport resource. After a resource is created and connectivity is up, the flow is identical regardless of where the provisioning is initiated. You can manage the resource from either side to enable, disable, or change the bandwidth on the resources.

Before you start the Partner Cross-Cloud Interconnect for AWS provisioning process, ensure that the following conditions are met:

• You must already have an AWS account.
• You must also create a Virtual Private Cloud (VPC) network, if it doesn't already exist, to connect your transport to.
• If you are a VPC Service Controls user, you must set up ingress and egress rules using the [e-mail] service account that is associated with Partner Cross-Cloud Interconnect for AWS.

Set up ingress and egress rules (for VPC Service Controls users)

If you are a VPC Service Controls user, follow the instructions to Update ingress and egress policies for a service perimeter.

Google recommends that you set up rules to allow the account to access all resources and operations within the VPC Service Controls security perimeter.

Use the [e-mail] service account to set up the ingress and egress rules.

The following example shows an ingress rule YAML that you can apply.

- ingressFrom:
    identities:
      - serviceAccount:[e-mail]
    sources:
      - accessLevel: '*'
  ingressTo:
    operations:
      - serviceName: '*'
        methodSelectors:
          - method: '*'
    resources:
      - '*'

The following is an example of an egress rule YAML.

- egressTo:
    operations:
      - serviceName: '*'
        methodSelectors:
          - method: '*'
    resources:
      - '*'
  egressFrom:
    identities:
      - serviceAccount:[e-mail]

For information about ingress and egress rules, see Ingress and egress rules.

Note: For definitions of terms used on this page, see Cloud Interconnect key terms.

Your workflow might differ based on whether you have an activation key from AWS or not. For details, see the following sections.

Initiate connection from Google Cloud if you don't have an activation key

If you don't have an activation key from AWS, you can initiate and provision a Partner Cross-Cloud Interconnect for AWS connection from Google Cloud. To do so, follow these steps.

1. Choose a paired location.

   Google Cloud regions are paired with specific AWS regions. When you choose a specific Google Cloud region to create your resources in, you must choose the corresponding AWS region.

2. List the available profiles in the region.

3. Select the correct profile and create the transport resource.

4. Use the generated activation key to create the connection in your AWS account.

5. Establish VPC Network Peering.

6. Verify the connection by listing the peered VPC networks and route tables.

Initiate a connection from AWS if you have an activation key

If you already have an activation key from AWS, you can initiate and provision a Partner Cross-Cloud Interconnect for AWS connection from AWS. To do so, follow these steps.

1. Activate your key by using the AWS Console.

2. Follow instructions to create a connection from the AWS Console. You must provide the project and region where you want the connection to land in Google Cloud. For a list of paired locations, see Choose a paired location.

3. After the resource is created on the AWS side, create the Google Cloud resource with the provided activation key.

4. Peer your VPC network to the transport's peering VPC network.