AWS Cloud WANとAWS Transit Gatewayを関連付けてTransit Gatewayと接続しているVPCやSite-to-Site VPNの経路情報をCloud WANに登録してみた

.
├── bin
│   └── aws-cdk-cloud-wan-tgw-s2s-vpn.ts   # CDK アプリケーションのエントリポイント。ap-northeast-1 に AwsCdkCloudWanTgwS2SVpnStack を 1 つ定義
├── lib
│   ├── aws-cdk-cloud-wan-tgw-s2s-vpn-stack.ts  # メイン Stack。Cloud WAN / TGW×2 / VPC×6 / VPN×3 / Cloud WAN-TGW peering 一式を組み立て
│   ├── constructs
│   │   ├── core-network.ts                # Cloud WAN の GlobalNetwork / CoreNetwork / prod セグメント / attachment-policies を定義する Construct
│   │   ├── index.ts                       # Construct のバレルファイル
│   │   ├── private-vpc.ts                 # ワークロード用 VPC の Construct。discriminated union で Cloud WAN attach と TGW attach を切替 (TGW 時は RT association/propagation も自動生成)
│   │   ├── transit-gateway.ts             # TGW + 明示 Route Table を作成。Cloud WAN peering 用 Policy Table を AwsCustomResource (createTransitGatewayPolicyTable) で作成
│   │   └── vpn-vpc.ts                     # オンプレ接続用 VPC の Construct。VPN Router EC2 / EIP / CGW / Site-to-Site VPN を含む。Cloud WAN/TGW attach を props で切替、TGW 時はDescribeTransitGatewayAttachments で attachment ID を取得し RT association/propagation を実行
│   └── network-config.ts                  # CIDR / ASN / セグメント名 / VPN tunnel inside CIDR / PSK など全設定を集中管理
├── src
│   └── ec2
│       └── vpn-router-userdata.sh         # VPN Router EC2 の UserData。Libreswan (IPsec) + FRR (BGP) + ネットワーク namespace (vrf1) を自動セットアップ。CGW_ASN / AWS_ASN を Fn::Sub で受け取り
Cloud WAN / TGW 双方で再利用可能
├── test
│   ├── aws-cdk-cloud-wan-tgw-s2s-vpn.test.ts   # Stack 全体のユニットテスト。リソース数 (TGW×2 / VPC×6 / VPN×3 / EIC×5 など) と prod segment tag を検証
│   └── constructs
│       ├── core-network.test.ts           # CoreNetwork の policy document (prod segment / attachment-policies) を検証
│       ├── private-vpc.test.ts            # Cloud WAN attach / TGW attach の両ケースで attachment 種別とルート先を検証
│       ├── transit-gateway.test.ts        # TGW が default RT 無効 + 明示 RT を作成し、ASN が prop で渡せることを検証
│       └── vpn-vpc.test.ts                # Cloud WAN attach / TGW attach / createEicEndpoint=false の各パターンで VPN リソース構成を検証
├── cdk.context.json                       
├── cdk.json                               
├── jest.config.js                         
├── package.json                           
├── pnpm-lock.yaml                         
├── README.md                              
├── .gitignore
├── .npmignore
└── tsconfig.json                          

{
  "core-network-configuration": {
    "vpn-ecmp-support": true,
    "asn-ranges": [
      "64512-64555"
    ],
    "edge-locations": [
      {
        "location": "ap-northeast-1",
        "asn": 64512
      }
    ],
    "inside-cidr-blocks": [
      "192.168.0.0/16"
    ]
  },
  "version": "2021.12",
  "attachment-policies": [
    {
      "rule-number": 100,
      "condition-logic": "or",
      "description": "attachment segment prod",
      "action": {
        "association-method": "constant",
        "segment": "prod"
      },
      "conditions": [
        {
          "type": "tag-value",
          "value": "prod",
          "operator": "equals",
          "key": "cloudwan-seg"
        }
      ]
    }
  ],
  "segments": [
    {
      "name": "prod",
      "require-attachment-acceptance": false,
      "edge-locations": [
        "ap-northeast-1"
      ]
    }
  ]
}

$ hostname -i
10.11.1.138

$ ping -c 4 10.21.1.206
PING 10.21.1.206 (10.21.1.206) 56(84) bytes of data.
64 bytes from 10.21.1.206: icmp_seq=1 ttl=121 time=10.4 ms
64 bytes from 10.21.1.206: icmp_seq=2 ttl=121 time=6.33 ms
64 bytes from 10.21.1.206: icmp_seq=3 ttl=121 time=6.14 ms
64 bytes from 10.21.1.206: icmp_seq=4 ttl=121 time=6.21 ms

--- 10.21.1.206 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 6.142/7.262/10.370/1.795 ms