AWS Amazon EC2 Transit Gateway Route
This page shows how to write Terraform and CloudFormation for Amazon EC2 Transit Gateway Route and write them securely.
aws_ec2_transit_gateway_route (Terraform)
The Transit Gateway Route in Amazon EC2 can be configured in Terraform with the resource name aws_ec2_transit_gateway_route. The following sections describe 5 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "aws_ec2_transit_gateway_route" "vpc1" {
destination_cidr_block = "10.10.0.0/19"
transit_gateway_route_table_id = data.aws_ec2_transit_gateway_route_table.this.id
transit_gateway_attachment_id = "tgw-attach-042344e68c52304b5"
}
resource "aws_ec2_transit_gateway_route" "vpc1" {
destination_cidr_block = "10.10.0.0/19"
transit_gateway_route_table_id = data.aws_ec2_transit_gateway_route_table.this.id
transit_gateway_attachment_id = "tgw-attach-042344e68c52304b5"
}
resource "aws_ec2_transit_gateway_route" "Apps_Default_route" {
destination_cidr_block = "0.0.0.0/0"
transit_gateway_attachment_id = aws_ec2_transit_gateway_vpc_attachment.TGW-attach-Egress.id
transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.Apps_RT.id
}
// Blackhole routes
resource "aws_ec2_transit_gateway_route" "inspection_vpc_route" {
transit_gateway_route_table_id = aws_ec2_transit_gateway_route_table.egress_rt_table.id
destination_cidr_block = "0.0.0.0/0"
transit_gateway_attachment_id = module.tgw.ec2_transit_gateway_vpc_attachment["inspection_vpc"]["id"]
blackhole = false
resource "aws_ec2_transit_gateway_route" "source_vpc" {
destination_cidr_block = module.source_vpc.vpc_cidr_block
transit_gateway_attachment_id = aws_ec2_transit_gateway_vpc_attachment.source_vpc.id
transit_gateway_route_table_id = aws_ec2_transit_gateway.this.association_default_route_table_id
}
Parameters
-
blackholeoptional - bool -
destination_cidr_blockrequired - string -
idoptional computed - string -
transit_gateway_attachment_idoptional - string -
transit_gateway_route_table_idrequired - string
Explanation in Terraform Registry
Manages an EC2 Transit Gateway Route.
Tips: Best Practices for The Other AWS Amazon EC2 Resources
In addition to the aws_default_vpc, AWS Amazon EC2 has the other resources that should be configured for security reasons. Please check some examples of those resources and precautions.
aws_default_vpc
Ensure to avoid using default VPC
It is better to define the own VPC and use it.
aws_network_acl_rule
Ensure your network ACL rule blocks unwanted inbound traffic
It is better to block unwanted inbound traffic.
aws_ebs_volume
Ensure to use a customer-managed key for EBS volume encryption
It is better to use a customer-managed key for EBS volume encryption. It can be gain more control over the encryption by using customer-managed keys (CMK).
aws_instance
Ensure to avoid storing AWS access keys in user data
It is better to avoid storing AWS access keys in user data. `aws_iam_instance_profile` could be used instead.
aws_security_group
Ensure your security group blocks unwanted inbound traffic
It is better to block unwanted inbound traffic.
AWS::EC2::TransitGatewayRoute (CloudFormation)
The TransitGatewayRoute in EC2 can be configured in CloudFormation with the resource name AWS::EC2::TransitGatewayRoute. The following sections describe 10 examples of how to use the resource and its parameters.
Example Usage from GitHub
Type: "AWS::EC2::TransitGatewayRouteTable"
Properties:
Tags:
- Key: Name
Value: !Sub '${AWS::StackName}-RT-VPC-IN'
TransitGatewayId: !Ref TransitGatewayGWLB
Type: AWS::EC2::TransitGatewayRoute
Properties:
DestinationCidrBlock: 10.0.0.0/8
TransitGatewayAttachmentId: !ImportValue
'Fn::Sub': '${InspectionVPCStackName}-TGW-Att'
TransitGatewayRouteTableId: !ImportValue
Type: AWS::EC2::TransitGatewayRouteTableAssociation
Properties:
TransitGatewayAttachmentId: !Ref NewAttachmentID
TransitGatewayRouteTableId: !ImportValue AppIsolatedDevTGWRTID
################
Type: AWS::EC2::TransitGatewayRouteTableAssociation
Properties:
TransitGatewayAttachmentId: !Ref NewAttachmentID
TransitGatewayRouteTableId: !ImportValue AppIsolatedProdTGWRTID
################
Type: AWS::EC2::TransitGatewayRouteTablePropagation
Properties:
TransitGatewayAttachmentId: !Ref VPNTransitGatewayAttachment
TransitGatewayRouteTableId: !Ref EnvTGRTable
Route:
"Type" : "AWS::EC2::TransitGatewayRouteTable",
"Properties" : {
"TransitGatewayId" : { "Ref" : "transitGatewayId" },
"Tags": [
{
"Key": "Name",
"AWS::EC2::TransitGatewayRoute": {
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-transitgatewayroute.html",
"Properties": {
"TransitGatewayRouteTableId": {
"Required": true,
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-transitgatewayroute.html#cfn-ec2-transitgatewayroute-transitgatewayroutetableid",
"AWS::EC2::TransitGatewayRoute": {
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-transitgatewayroute.html",
"Properties": {
"TransitGatewayRouteTableId": {
"Required": true,
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-transitgatewayroute.html#cfn-ec2-transitgatewayroute-transitgatewayroutetableid",
"AWS::EC2::TransitGatewayRoute": {
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-transitgatewayroute.html",
"Properties": {
"TransitGatewayRouteTableId": {
"Required": true,
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-transitgatewayroute.html#cfn-ec2-transitgatewayroute-transitgatewayroutetableid",
"AWS::EC2::TransitGatewayRoute": {
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-transitgatewayroute.html",
"Properties": {
"TransitGatewayRouteTableId": {
"Required": true,
"Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-transitgatewayroute.html#cfn-ec2-transitgatewayroute-transitgatewayroutetableid",
Parameters
-
TransitGatewayRouteTableIdrequired - String -
DestinationCidrBlockoptional - String -
Blackholeoptional - Boolean -
TransitGatewayAttachmentIdoptional - String
Explanation in CloudFormation Registry
Specifies a static route for a transit gateway route table.
Frequently asked questions
What is AWS Amazon EC2 Transit Gateway Route?
AWS Amazon EC2 Transit Gateway Route is a resource for Amazon EC2 of Amazon Web Service. Settings can be wrote in Terraform and CloudFormation.
Where can I find the example code for the AWS Amazon EC2 Transit Gateway Route?
For Terraform, the dipendrachaudhary/chcs-test, dipendrachaudhary/chcs-test and gchek/egress-vpc source code examples are useful. See the Terraform Example section for further details.
For CloudFormation, the whchoi98/gwlb, vagira/Granular-Security-with-AWS-Network-Firewall-and-Transit-Gateway and JeremieRodon/TransitGatewayAutomation source code examples are useful. See the CloudFormation Example section for further details.
