Transit Gatewayでインスペクション用VPCに通信を集約する場合はTransit Gatewayのアプライアンスモードを有効にしよう

AWS CDKのディレクトリ構成

> tree                                                                                                                   金  8/20 13:27:14 2021
.
├── .gitignore
├── .npmignore
├── .vscode
│   └── settings.json
├── README.md
├── bin
│   └── tgw-appliance-mode-network-firewall.ts
├── cdk.json
├── jest.config.js
├── lib
│   └── tgw-appliance-mode-network-firewall-stack.ts
├── package-lock.json
├── package.json
├── test
│   └── tgw-appliance-mode-network-firewall.test.ts
└── tsconfig.json

./lib/tgw-appliance-mode-network-firewall-stack.ts

import * as cdk from "@aws-cdk/core";
import * as ec2 from "@aws-cdk/aws-ec2";
import * as logs from "@aws-cdk/aws-logs";
import * as iam from "@aws-cdk/aws-iam";
import * as networkfirewall from "@aws-cdk/aws-networkfirewall";

export class TgwApplianceModeNetworkFirewallStack extends cdk.Stack {
  constructor(scope: cdk.Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // Get the string after the stack name in the stack id to append to the end of the Log Group name to make it unique.
    const stackId = new cdk.ScopedAws(this).stackId;
    const stackIdAfterStackName = cdk.Fn.select(2, cdk.Fn.split("/", stackId));

    // Create CloudWatch Logs for VPC Flow Logs
    const flowLogsLogGroup = new logs.LogGroup(this, "FlowLogsLogGroup", {
      logGroupName: `/aws/vendedlogs/vpcFlowLogs-${stackIdAfterStackName}`,
      retention: logs.RetentionDays.ONE_WEEK,
    });

    // Create CloudWatch Logs for Network Firewall Flow Logs
    const networkFirewallFlowLogsLogGroup = new logs.LogGroup(
      this,
      "NetworkFirewallFlowLogsLogGroup",
      {
        logGroupName: `/aws/vendedlogs/networkFirewallFlowLogs-${stackIdAfterStackName}`,
        retention: logs.RetentionDays.ONE_WEEK,
      }
    );

    // Create CloudWatch Logs for Network Firewall Alert Logs
    const networkFirewallAlertLogsLogGroup = new logs.LogGroup(
      this,
      "NetworkFirewallAlertLogsLogGroup",
      {
        logGroupName: `/aws/vendedlogs/networkFirewallAlertLogs-${stackIdAfterStackName}`,
        retention: logs.RetentionDays.ONE_WEEK,
      }
    );

    // Create VPC Flow Logs IAM role
    const flowLogsIamrole = new iam.Role(this, "FlowLogsIamrole", {
      assumedBy: new iam.ServicePrincipal("vpc-flow-logs.amazonaws.com"),
    });

    // Create SSM IAM role
    const ssmIamRole = new iam.Role(this, "SsmIamRole", {
      assumedBy: new iam.ServicePrincipal("ec2.amazonaws.com"),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName(
          "AmazonSSMManagedInstanceCore"
        ),
      ],
    });

    // Create VPC Flow Logs IAM Policy
    const flowLogsIamPolicy = new iam.Policy(this, "FlowLogsIamPolicy", {
      statements: [
        new iam.PolicyStatement({
          effect: iam.Effect.ALLOW,
          actions: ["iam:PassRole"],
          resources: [flowLogsIamrole.roleArn],
        }),
        new iam.PolicyStatement({
          effect: iam.Effect.ALLOW,
          actions: [
            "logs:CreateLogStream",
            "logs:PutLogEvents",
            "logs:DescribeLogStreams",
          ],
          resources: [flowLogsLogGroup.logGroupArn],
        }),
      ],
    });

    // Atach VPC Flow Logs IAM Policy
    flowLogsIamrole.attachInlinePolicy(flowLogsIamPolicy);

    // Create a VPC for inspection
    const inspectionVpc = new ec2.Vpc(this, "InspectionVpc", {
      cidr: "10.0.0.0/24",
      enableDnsHostnames: true,
      enableDnsSupport: true,
      maxAzs: 2,
      subnetConfiguration: [
        {
          name: "TgwAttachment",
          subnetType: ec2.SubnetType.ISOLATED,
          cidrMask: 28,
        },
        {
          name: "Firewall",
          subnetType: ec2.SubnetType.ISOLATED,
          cidrMask: 28,
        },
      ],
    });

    // Setting VPC Flow Logs for InspectionVpc
    new ec2.CfnFlowLog(this, "FlowLogToLogsForInspectionVpc", {
      resourceId: inspectionVpc.vpcId,
      resourceType: "VPC",
      trafficType: "ALL",
      deliverLogsPermissionArn: flowLogsIamrole.roleArn,
      logDestination: flowLogsLogGroup.logGroupArn,
      logDestinationType: "cloud-watch-logs",
      logFormat:
        "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status} ${vpc-id} ${subnet-id} ${instance-id} ${tcp-flags} ${type} ${pkt-srcaddr} ${pkt-dstaddr} ${region} ${az-id} ${sublocation-type} ${sublocation-id} ${pkt-src-aws-service} ${pkt-dst-aws-service} ${flow-direction} ${traffic-path}",
      maxAggregationInterval: 60,
    });

    // Create a VPC for Egress
    const egressVpc = new ec2.Vpc(this, "EgressVpc", {
      cidr: "10.0.1.0/24",
      enableDnsHostnames: true,
      enableDnsSupport: true,
      maxAzs: 2,
      natGateways: 2,
      subnetConfiguration: [
        {
          name: "TgwAttachment",
          subnetType: ec2.SubnetType.PRIVATE,
          cidrMask: 28,
        },
        {
          name: "Public",
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 28,
        },
      ],
    });

    // Setting VPC Flow Logs for EgressVpc
    new ec2.CfnFlowLog(this, "FlowLogToLogsForEgressVpc", {
      resourceId: egressVpc.vpcId,
      resourceType: "VPC",
      trafficType: "ALL",
      deliverLogsPermissionArn: flowLogsIamrole.roleArn,
      logDestination: flowLogsLogGroup.logGroupArn,
      logDestinationType: "cloud-watch-logs",
      logFormat:
        "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status} ${vpc-id} ${subnet-id} ${instance-id} ${tcp-flags} ${type} ${pkt-srcaddr} ${pkt-dstaddr} ${region} ${az-id} ${sublocation-type} ${sublocation-id} ${pkt-src-aws-service} ${pkt-dst-aws-service} ${flow-direction} ${traffic-path}",
      maxAggregationInterval: 60,
    });

    // Create a VPC for Spoke A
    const spokeVpcA = new ec2.Vpc(this, "SpokeVpcA", {
      cidr: "10.0.2.0/24",
      enableDnsHostnames: true,
      enableDnsSupport: true,
      maxAzs: 2,
      subnetConfiguration: [
        {
          name: "TgwAttachment",
          subnetType: ec2.SubnetType.ISOLATED,
          cidrMask: 28,
        },
        {
          name: "Workload",
          subnetType: ec2.SubnetType.ISOLATED,
          cidrMask: 28,
        },
      ],
    });

    // Setting VPC Flow Logs for SpokeVpcA
    new ec2.CfnFlowLog(this, "FlowLogToLogsForSpokeVpcA", {
      resourceId: spokeVpcA.vpcId,
      resourceType: "VPC",
      trafficType: "ALL",
      deliverLogsPermissionArn: flowLogsIamrole.roleArn,
      logDestination: flowLogsLogGroup.logGroupArn,
      logDestinationType: "cloud-watch-logs",
      logFormat:
        "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status} ${vpc-id} ${subnet-id} ${instance-id} ${tcp-flags} ${type} ${pkt-srcaddr} ${pkt-dstaddr} ${region} ${az-id} ${sublocation-type} ${sublocation-id} ${pkt-src-aws-service} ${pkt-dst-aws-service} ${flow-direction} ${traffic-path}",
      maxAggregationInterval: 60,
    });

    // Create a VPC for Spoke B
    const spokeVpcB = new ec2.Vpc(this, "SpokeVpcB", {
      cidr: "10.0.3.0/24",
      enableDnsHostnames: true,
      enableDnsSupport: true,
      maxAzs: 2,
      subnetConfiguration: [
        {
          name: "TgwAttachment",
          subnetType: ec2.SubnetType.ISOLATED,
          cidrMask: 28,
        },
        {
          name: "Workload",
          subnetType: ec2.SubnetType.ISOLATED,
          cidrMask: 28,
        },
      ],
    });

    // Setting VPC Flow Logs for SpokeVpcB
    new ec2.CfnFlowLog(this, "FlowLogToLogsForSpokeVpcB", {
      resourceId: spokeVpcB.vpcId,
      resourceType: "VPC",
      trafficType: "ALL",
      deliverLogsPermissionArn: flowLogsIamrole.roleArn,
      logDestination: flowLogsLogGroup.logGroupArn,
      logDestinationType: "cloud-watch-logs",
      logFormat:
        "${version} ${account-id} ${interface-id} ${srcaddr} ${dstaddr} ${srcport} ${dstport} ${protocol} ${packets} ${bytes} ${start} ${end} ${action} ${log-status} ${vpc-id} ${subnet-id} ${instance-id} ${tcp-flags} ${type} ${pkt-srcaddr} ${pkt-dstaddr} ${region} ${az-id} ${sublocation-type} ${sublocation-id} ${pkt-src-aws-service} ${pkt-dst-aws-service} ${flow-direction} ${traffic-path}",
      maxAggregationInterval: 60,
    });

    // Create Transit Gateway
    const tgw = new ec2.CfnTransitGateway(this, "Tgw", {
      defaultRouteTableAssociation: "disable",
      defaultRouteTablePropagation: "disable",
    });

    // Create Transit Gateway attachment for InspectionVpc
    const tgwAttachmentForInspectionVpc = new ec2.CfnTransitGatewayAttachment(
      this,
      "TgwAttachmentForInspectionVpc",
      {
        subnetIds: inspectionVpc.selectSubnets({
          subnetGroupName: "TgwAttachment",
        }).subnetIds,
        transitGatewayId: tgw.attrId,
        vpcId: inspectionVpc.vpcId,
        tags: [
          {
            key: "Name",
            value: "TgwAttachmentForInspectionVpc",
          },
        ],
      }
    );

    // Create Transit Gateway attachment for EgressVpc
    const tgwAttachmentForEgressVpc = new ec2.CfnTransitGatewayAttachment(
      this,
      "TgwAttachmentForEgressVpc",
      {
        subnetIds: egressVpc.selectSubnets({
          subnetGroupName: "TgwAttachment",
        }).subnetIds,
        transitGatewayId: tgw.attrId,
        vpcId: egressVpc.vpcId,
        tags: [
          {
            key: "Name",
            value: "TgwAttachmentForEgressVpc",
          },
        ],
      }
    );

    // Create Transit Gateway attachment for SpokeVpcA
    const tgwAttachmentForSpokeVpcA = new ec2.CfnTransitGatewayAttachment(
      this,
      "TgwAttachmentForSpokeVpcA",
      {
        subnetIds: spokeVpcA.selectSubnets({
          subnetGroupName: "TgwAttachment",
        }).subnetIds,
        transitGatewayId: tgw.attrId,
        vpcId: spokeVpcA.vpcId,
        tags: [
          {
            key: "Name",
            value: "TgwAttachmentForSpokeVpcA",
          },
        ],
      }
    );

    // Create Transit Gateway attachment for SpokeVpcB
    const tgwAttachmentForSpokeVpcB = new ec2.CfnTransitGatewayAttachment(
      this,
      "TgwAttachmentForSpokeVpcB",
      {
        subnetIds: spokeVpcB.selectSubnets({
          subnetGroupName: "TgwAttachment",
        }).subnetIds,
        transitGatewayId: tgw.attrId,
        vpcId: spokeVpcB.vpcId,
        tags: [
          {
            key: "Name",
            value: "TgwAttachmentForSpokeVpcB",
          },
        ],
      }
    );

    // Create Transit Gateway route table for InspectionVpc
    const tgwRouteTableForInspectionVpc = new ec2.CfnTransitGatewayRouteTable(
      this,
      "TgwRouteTableForInspectionVpc",
      {
        transitGatewayId: tgw.attrId,
        tags: [
          {
            key: "Name",
            value: "TgwRouteTableForInspectionVpc",
          },
        ],
      }
    );

    // Associate Transit Gateway attachment for InspectionVpc
    new ec2.CfnTransitGatewayRouteTableAssociation(
      this,
      "TgwRouteTableAssociationForInspectionVpc",
      {
        transitGatewayAttachmentId: tgwAttachmentForInspectionVpc.ref,
        transitGatewayRouteTableId: tgwRouteTableForInspectionVpc.ref,
      }
    );

    // Add Route InspectionVpc To EgressVpc
    new ec2.CfnTransitGatewayRoute(this, "TgwRouteInspectionVpcToEgressVpc", {
      transitGatewayAttachmentId: tgwAttachmentForEgressVpc.ref,
      transitGatewayRouteTableId: tgwRouteTableForInspectionVpc.ref,
      destinationCidrBlock: "0.0.0.0/0",
    });

    // Add Route InspectionVpc To SpokeVpcA
    new ec2.CfnTransitGatewayRoute(this, "TgwRouteInspectionVpcToSpokeVpcA", {
      transitGatewayAttachmentId: tgwAttachmentForSpokeVpcA.ref,
      transitGatewayRouteTableId: tgwRouteTableForInspectionVpc.ref,
      destinationCidrBlock: spokeVpcA.vpcCidrBlock,
    });

    // Add Route InspectionVpc To SpokeVpcB
    new ec2.CfnTransitGatewayRoute(this, "TgwRouteInspectionVpcToSpokeVpcB", {
      transitGatewayAttachmentId: tgwAttachmentForSpokeVpcB.ref,
      transitGatewayRouteTableId: tgwRouteTableForInspectionVpc.ref,
      destinationCidrBlock: spokeVpcB.vpcCidrBlock,
    });

    // Create Transit Gateway route table for EgressVpc
    const tgwRouteTableForEgressVpc = new ec2.CfnTransitGatewayRouteTable(
      this,
      "TgwRouteTableForEgressVpc",
      {
        transitGatewayId: tgw.attrId,
        tags: [
          {
            key: "Name",
            value: "TgwRouteTableForEgressVpc",
          },
        ],
      }
    );

    // Associate Transit Gateway attachment for EgressVpc
    new ec2.CfnTransitGatewayRouteTableAssociation(
      this,
      "TgwRouteAssociationTableForEgressVpc",
      {
        transitGatewayAttachmentId: tgwAttachmentForEgressVpc.ref,
        transitGatewayRouteTableId: tgwRouteTableForEgressVpc.ref,
      }
    );

    // Add Route EgressVpc To InspectionVpc
    new ec2.CfnTransitGatewayRoute(this, "TgwRouteEgressVpcToInspectionVpc", {
      transitGatewayAttachmentId: tgwAttachmentForInspectionVpc.ref,
      transitGatewayRouteTableId: tgwRouteTableForEgressVpc.ref,
      destinationCidrBlock: "0.0.0.0/0",
    });

    // Create Transit Gateway route table for SpokeVpcA
    const tgwRouteTableForSpokeVpcA = new ec2.CfnTransitGatewayRouteTable(
      this,
      "TgwRouteTableForSpokeVpcA",
      {
        transitGatewayId: tgw.attrId,
        tags: [
          {
            key: "Name",
            value: "TgwRouteTableForSpokeVpcA",
          },
        ],
      }
    );

    // Associate Transit Gateway attachment for SpokeVpcA
    new ec2.CfnTransitGatewayRouteTableAssociation(
      this,
      "TgwRouteAssociationTableForSpokeVpcA",
      {
        transitGatewayAttachmentId: tgwAttachmentForSpokeVpcA.ref,
        transitGatewayRouteTableId: tgwRouteTableForSpokeVpcA.ref,
      }
    );

    // Add Route SpokeVpcA To InspectionVpc
    new ec2.CfnTransitGatewayRoute(this, "TgwRouteSpokeVpcAToInspectionVpc", {
      transitGatewayAttachmentId: tgwAttachmentForInspectionVpc.ref,
      transitGatewayRouteTableId: tgwRouteTableForSpokeVpcA.ref,
      destinationCidrBlock: "0.0.0.0/0",
    });

    // Create Transit Gateway route table for SpokeVpcB
    const tgwRouteTableForSpokeVpcB = new ec2.CfnTransitGatewayRouteTable(
      this,
      "TgwRouteTableForSpokeVpcB",
      {
        transitGatewayId: tgw.attrId,
        tags: [
          {
            key: "Name",
            value: "TgwRouteTableForSpokeVpcB",
          },
        ],
      }
    );

    // Associate Transit Gateway attachment for SpokeVpcB
    new ec2.CfnTransitGatewayRouteTableAssociation(
      this,
      "TgwRouteAssociationTableForSpokeVpcB",
      {
        transitGatewayAttachmentId: tgwAttachmentForSpokeVpcB.ref,
        transitGatewayRouteTableId: tgwRouteTableForSpokeVpcB.ref,
      }
    );

    // Add Route SpokeVpcB To InspectionVpc
    new ec2.CfnTransitGatewayRoute(this, "TgwRouteSpokeVpcBToInspectionVpc", {
      transitGatewayAttachmentId: tgwAttachmentForInspectionVpc.ref,
      transitGatewayRouteTableId: tgwRouteTableForSpokeVpcB.ref,
      destinationCidrBlock: "0.0.0.0/0",
    });

    // Create Network Firewall rule group
    const icmpAlertStatefulRuleGroup = new networkfirewall.CfnRuleGroup(
      this,
      "IcmpAlertStatefulRuleGroup",
      {
        capacity: 100,
        ruleGroupName: "icmp-alert",
        type: "STATEFUL",
        ruleGroup: {
          rulesSource: {
            statefulRules: [
              {
                action: "ALERT",
                header: {
                  destination: "10.0.0.0/16",
                  destinationPort: "ANY",
                  direction: "ANY",
                  protocol: "ICMP",
                  source: "10.0.0.0/16",
                  sourcePort: "ANY",
                },
                ruleOptions: [
                  {
                    keyword: `msg:"icmp alert"`,
                  },
                  {
                    keyword: "sid:1000001",
                  },
                  {
                    keyword: "rev:1",
                  },
                ],
              },
            ],
          },
        },
      }
    );

    // Create Network Firewall policy
    const networkfirewallPolicy = new networkfirewall.CfnFirewallPolicy(
      this,
      "NetworkFirewallPolicy",
      {
        firewallPolicyName: "InspectionPolicy",
        firewallPolicy: {
          statelessDefaultActions: ["aws:forward_to_sfe"],
          statelessFragmentDefaultActions: ["aws:forward_to_sfe"],
          statefulRuleGroupReferences: [
            {
              resourceArn: icmpAlertStatefulRuleGroup.attrRuleGroupArn,
            },
          ],
        },
      }
    );

    // Create Network Firewall
    const networkFirewall = new networkfirewall.CfnFirewall(
      this,
      "NetworkFirewall",
      {
        firewallName: "NetworkFirewall",
        firewallPolicyArn: networkfirewallPolicy.attrFirewallPolicyArn,
        vpcId: inspectionVpc.vpcId,
        subnetMappings: (() => {
          const firewallSubnetIds: { subnetId: string }[] = new Array();
          inspectionVpc
            .selectSubnets({ subnetGroupName: "Firewall" })
            .subnets.forEach((subnet) => {
              firewallSubnetIds.push({ subnetId: subnet.subnetId });
            });
          return firewallSubnetIds;
        })(),
      }
    );

    // // Setting Network Firewall logs
    new networkfirewall.CfnLoggingConfiguration(
      this,
      "NetworkFirewallFlowLogsToLogs",
      {
        firewallArn: networkFirewall.ref,
        loggingConfiguration: {
          logDestinationConfigs: [
            {
              logDestination: {
                logGroup: networkFirewallFlowLogsLogGroup.logGroupName,
              },
              logDestinationType: "CloudWatchLogs",
              logType: "FLOW",
            },
            {
              logDestination: {
                logGroup: networkFirewallAlertLogsLogGroup.logGroupName,
              },
              logDestinationType: "CloudWatchLogs",
              logType: "ALERT",
            },
          ],
        },
      }
    );

    // Add Route InspectionVpc to Transit Gateway
    inspectionVpc
      .selectSubnets({ subnetGroupName: "Firewall" })
      .subnets.map((subnet, index) => {
        new ec2.CfnRoute(this, `InspectionVpcRouteToTgwt-${index}`, {
          routeTableId: subnet.routeTable.routeTableId,
          destinationCidrBlock: "0.0.0.0/0",
          transitGatewayId: tgw.ref,
        }).addDependsOn(tgwAttachmentForInspectionVpc);
      });

    // Add Route EgressVpc to Transit Gateway
    egressVpc
      .selectSubnets({ subnetGroupName: "Public" })
      .subnets.map((subnet, index) => {
        new ec2.CfnRoute(this, `EgressVpcRouteToTgw-${index}`, {
          routeTableId: subnet.routeTable.routeTableId,
          destinationCidrBlock: "10.0.0.0/16",
          transitGatewayId: tgw.ref,
        }).addDependsOn(tgwAttachmentForEgressVpc);
      });

    // Add Route SpokeVpcA to Transit Gateway
    spokeVpcA
      .selectSubnets({ subnetGroupName: "Workload" })
      .subnets.map((subnet, index) => {
        new ec2.CfnRoute(this, `SpokeVpcARouteToTgw-${index}`, {
          routeTableId: subnet.routeTable.routeTableId,
          destinationCidrBlock: "0.0.0.0/0",
          transitGatewayId: tgw.ref,
        }).addDependsOn(tgwAttachmentForSpokeVpcA);
      });

    // Add Route SpokeVpcB to Transit Gateway
    spokeVpcB
      .selectSubnets({ subnetGroupName: "Workload" })
      .subnets.map((subnet, index) => {
        new ec2.CfnRoute(this, `SpokeVpcBRouteToTgw-${index}`, {
          routeTableId: subnet.routeTable.routeTableId,
          destinationCidrBlock: "0.0.0.0/0",
          transitGatewayId: tgw.ref,
        }).addDependsOn(tgwAttachmentForSpokeVpcB);
      });

    // Add Route InspectionVpc to Network Firewall
    inspectionVpc
      .selectSubnets({ subnetGroupName: "TgwAttachment" })
      .subnets.map((subnet, index) => {
        new ec2.CfnRoute(this, `InspectionVpcRouteToNetworkFirewall-${index}`, {
          routeTableId: subnet.routeTable.routeTableId,
          destinationCidrBlock: "0.0.0.0/0",
          vpcEndpointId: cdk.Fn.select(
            1,
            cdk.Fn.split(
              ":",
              cdk.Fn.select(index, networkFirewall.attrEndpointIds)
            )
          ),
        }).addDependsOn(networkFirewall);
      });

    // Create Security Group
    const spokeVpcASg = new ec2.SecurityGroup(this, "SpokeVpcASg", {
      allowAllOutbound: true,
      vpc: spokeVpcA,
    });
    spokeVpcASg.addIngressRule(
      ec2.Peer.ipv4("10.0.0.0/16"),
      ec2.Port.allTraffic()
    );

    const spokeVpcBSg = new ec2.SecurityGroup(this, "SpokeVpcBSg", {
      allowAllOutbound: true,
      vpc: spokeVpcB,
    });
    spokeVpcBSg.addIngressRule(
      ec2.Peer.ipv4("10.0.0.0/16"),
      ec2.Port.allTraffic()
    );

    // Create EC2 instance
    spokeVpcA
      .selectSubnets({ subnetGroupName: "Workload" })
      .subnets.map((subnet, index) => {
        new ec2.Instance(this, `SpokeVpcAEc2Instance-${index}`, {
          machineImage: ec2.MachineImage.latestAmazonLinux({
            generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,
          }),
          instanceType: new ec2.InstanceType("t3.micro"),
          vpc: spokeVpcA,
          vpcSubnets: spokeVpcA.selectSubnets({
            subnetGroupName: "Workload",
            availabilityZones: [spokeVpcA.availabilityZones[index]],
          }),
          securityGroup: spokeVpcASg,
          role: ssmIamRole,
        });
      });

    spokeVpcB
      .selectSubnets({ subnetGroupName: "Workload" })
      .subnets.map((subnet, index) => {
        new ec2.Instance(this, `SpokeVpcBEc2Instance-${index}`, {
          machineImage: ec2.MachineImage.latestAmazonLinux({
            generation: ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,
          }),
          instanceType: new ec2.InstanceType("t3.micro"),
          vpc: spokeVpcB,
          vpcSubnets: spokeVpcB.selectSubnets({
            subnetGroupName: "Workload",
            availabilityZones: [spokeVpcB.availabilityZones[index]],
          }),
          securityGroup: spokeVpcBSg,
          role: ssmIamRole,
        });
      });
  }
}

./package.json

{
  "name": "tgw-appliance-mode-network-firewall",
  "version": "0.1.0",
  "bin": {
    "tgw-appliance-mode-network-firewall": "bin/tgw-appliance-mode-network-firewall.js"
  },
  "scripts": {
    "build": "tsc",
    "watch": "tsc -w",
    "test": "jest",
    "cdk": "cdk"
  },
  "devDependencies": {
    "@aws-cdk/assert": "1.118.0",
    "@types/jest": "^26.0.10",
    "@types/node": "10.17.27",
    "aws-cdk": "^1.118.0",
    "jest": "^26.4.2",
    "ts-jest": "^26.2.0",
    "ts-node": "^9.0.0",
    "typescript": "~3.9.7"
  },
  "dependencies": {
    "@aws-cdk/aws-ec2": "^1.118.0",
    "@aws-cdk/aws-iam": "^1.118.0",
    "@aws-cdk/aws-logs": "^1.118.0",
    "@aws-cdk/aws-networkfirewall": "^1.118.0",
    "@aws-cdk/core": "1.118.0",
    "source-map-support": "^0.5.16"
  }
}