Skip to content

Commit

Permalink
update markdown to add shared-setup and vpc0 process
Browse files Browse the repository at this point in the history
  • Loading branch information
dwara001 committed May 14, 2026
1 parent 4250288 commit b477852
Showing 1 changed file with 21 additions and 106 deletions.
127 changes: 21 additions & 106 deletions docs/how-to/aws-vpc-setup/shared-vpc.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -184,92 +184,6 @@ Go into that git repository.
* lab-gov internal lab-network-nonprod
* 269244441389-lab-gov-network-nonprod

Then, go to the directory with desired region and selected VPC number. You **must** use one from the table above, as the files are copied from the network account in a later
step. There is no variation permitted here.

```script
cd vpc-shared/west/general
cd vpc5 # ite
```

* edit `variables.share.auto.tfvars`
* add account or OU

```hcl
share_organizational_unit_list = [ ]
share_account_list = [
{
alias = "ma48-gov"
account_id = "247901282001"
enabled = true
},
]
```

```console
% tf-plan
.
.
% tf-plan summary
* tf-plan summary from log logs/plan.20230705.1688581247.log
> to-be created (30)
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-004877491965ff626:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-021984493e1e380ee:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-040f269a66fc4b393:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-0449a3f9e37ef5a39:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-05082541fe0274138:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-0648dcfba9b43df8c:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-0692c31434d79f1e7:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-09eb4a4d53fb4f6da:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-0a75fcbf843541aab:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-0a9f392349a9f983c:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-0b219a62f11ec6e03:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-0cc5ceab4a41703ca:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-0f4c538e1401a4200:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-0f59e1f1643bee84e:247901282001"] will be created
# module.share_networks.aws_ram_principal_association.subnets_accounts["subnet-0f7df49f43efa76bf:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-004877491965ff626:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-021984493e1e380ee:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-040f269a66fc4b393:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-0449a3f9e37ef5a39:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-05082541fe0274138:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-0648dcfba9b43df8c:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-0692c31434d79f1e7:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-09eb4a4d53fb4f6da:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-0a75fcbf843541aab:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-0a9f392349a9f983c:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-0b219a62f11ec6e03:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-0cc5ceab4a41703ca:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-0f4c538e1401a4200:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-0f59e1f1643bee84e:247901282001"] will be created
# module.share_networks.aws_ram_resource_association.subnets_accounts["subnet-0f7df49f43efa76bf:247901282001"] will be created

> to-be updated (0)

> to-be replaced (0)

> to-be destroyed (0)

> has changed (0)

Plan: 30 to add, 0 to change, 0 to destroy
```

Then, if everything looks good, apply.

```script
tf-apply
```

Perform the normal git operations (this should be done in a branch, add, commit, PR, apply from merged PR).

## target account

Now we will be working in the target account. That is, the account in which you want to *use* the shared VPC.
We have a per-region setup, as well as a per-VPC setup. For the first time setup of any shared VPC, you will copy the
code into the shared per-region setup. If you add another shared VPC into the account, for the same region, you need only
apply the shared per-region code.

### shared setup

Expand All @@ -280,15 +194,10 @@ and the latest from that branch (`git pull origin tf-upgrade`). You'll then syn
```console
% cd TARGET-ACCOUNT-REPO
% cd vpc/west
% mkdir shared-setup
% cd shared-setup

# if needed to setup tf 1.x, run next line
% tf-run init

% rsync -avRWH PATH/terraform-modules/aws-vpc-setup/examples/region-shared-setup/./ ./
sending incremental file list
./
Update credentials.network_account.auto.tfvars and uncomment the correct network prod account
README.md
credentials.network_account.auto.tfvars
credentials.network_account.tf
Expand All @@ -297,34 +206,38 @@ tags.tf
tf-run.data
versions.tf

sent 2946 bytes received 129 bytes 6150.00 bytes/sec
total size is 2512 speedup is 0.82
```

Uncomment the appropriate `network_role_arn` from `credentials.network_account.auto.tfvars` based on what environment you are
using (ent network-prod, ent dmz-network-prod, lab network-nonprod).

The apply has multiple steps, so be sure to run them both. You do not need need a plan here.

```console
% tf-run apply
.
.
Plan: 158 to add, 0 to change, 0 to destroy.
.
.
Apply complete! Resources: 158 added, 0 changed, 0 destroyed.
% tf-run plan
.
.
Plan: 8 to add, 0 to change, 0 to destroy.
Plan: 1376 to add, 0 to change, 0 to destroy.
```
% cd vpc/west/vpc0
```console
% tf-run plan
.
.
Apply complete! Resources: 8 added, 0 changed, 0 destroyed.
Plan: 2 to add, 0 to change, 0 to destroy.
```

Perform the normal git operations (this should be done in a branch, add, commit, PR, apply from merged PR; note it's okay here to add the files
created after the apply, when doing this for the first time).

* commit, push, and PR
* review and merge
Then, if everything looks good, apply.

```console
%tf-run apply

Apply complete! Resources: 1376 to add, 0 to change, 0 to destroy.
.
```

### vpc setup

Use the same vpc number as in the shared directory from the table. You will now copy in from the example code the per-vpc configuration files
Expand Down Expand Up @@ -451,3 +364,5 @@ Perform the normal git operations (this should be done in a branch, add, commit,
- update indicating no actions needed in network acount
- add links
- add table for DMZ vpc
* 1.0.15 -- 2026-05-14
- update on markdown and adding directions on shared-setup and vpc0

0 comments on commit b477852

Please sign in to comment.