Hi, everyone, and welcome back.
Now, in today's video, we are going to discuss about the transit gateway sharing.
Now, generally in real world environments and organizations can have hundreds of accounts and there
might be a requirement to go ahead and establish a interconnectivity between VPC across all of those
accounts.
So in such cases, transit gateway sharing helps here.
So at a high level overview, transit gateway sharing allows the VPC across multiple accounts to use
the transit gateway for interconnectivity.
So you can have a central account here where you have a transit gateway, which you can share to multiple
set of accounts.
And the VPC that are part of these accounts can go ahead and associate with the transit gateway through
the VPC attachment, and you will have an end to end connectivity between all of these accounts.
Now, again, one thing to note is that transit gateway is region specific.
So if this transit gateway is in Mumbai region, you will be able to share it with the Mumbai region
of other accounts as well.
So let's go ahead and have our favorite demos so that we can understand this in better terms.
Now, for today's demo, I have a transit gateway available.
Call the Multi Account Transit Gateway.
Now, this specific gateway is created in this account where I'm currently logged in and if you see
it is also showing me the account ID which matches the account ID of my account.
Now I have shared this specific transit gateway to the account number two, which is in the different
browser.
So let's switch to the account number two.
If you look here, the name is Sandbox Account and it has a different ID altogether.
Now, within the account number two, if we go to the transit gateways, you see, we can see the transit
gateway.
Now the owner ID here does not really match the account ID that you see over here.
Now, since the transit gateway is shared to the account number two from the account number two.
Also we can go ahead and create the gateway attachment so you can easily create a gateway attachment
to this specific transit gateway ID.
Now, one thing that you will see, I already created a transit gateway attachment for the account number
two.
And as part of this attachment, what we have done, we have attached this default VPC of the account
number to.
Now, going back to the account, number one, if I quickly open up the VPC within your I have attached
the service VPC.
So the service VPC with a CIDR of 1077 from account one is attached and the default VPC of account two
with a CIDR of one 7231 is attached.
So essentially the AC two instances across both the accounts should be able to communicate among each
other.
So let's go ahead and also try it out.
Now if you'll see in the account one, I already have a EC two instance here and in the account two
also I have an easy to instance with the name of account to EC two.
So let's quickly log into the account one easy to instance.
So from the terminal, let's go ahead and quickly connect.
And in order to verify things are working, I do a ping.
And we'll copy the private IP address and let's do a ping.
And you see, things are working.
So the connectivity is working perfectly well.
Now, in case if you are wondering on how exactly the sharing happens, this happens.
We are the resource access manager now in the resource Access manager console, you'll see that I have
one resource share associated with the transit gateway.
Now if I quickly open this up.
It will show me the account ID with whom we have shared this specific transit gateway.
The account ID ends with 555, and if you verify the account ID of sandbox again, it ends with triple
Y.
Great.
So I hope with this at a high level overview, you understood the basics on how we can share the transit
gateway across multiple accounts.
Now, a few important pointers to note here.
First one is that if you have a site to site VPN, then the associated attachment must be created in
the same account that owns the transit gateway.
Second important point is that if you share a transit gateway with a secondary account, that secondary
account has limited permissions or that, for example, it cannot create, modify or delete its transit
gateway route tables or its transit gateway route table propagation and associations, for example,
in the account that has created the transit Gateway, which is the owner.
Let's quickly look into it.
So this account is the owner.
Now, from this account we can go ahead and easily delete and also remove the association if we'd like.
However, from the account number two, if you try to do that, let's verify.
So I'll go to the transit gateway.
We can see the transit gateway.
If we go to the transit gateway route table.
At this stage you see the permissions are very limited.
You cannot really see the route table.
Also related to the attachment, you can only see the attachment that you have created in this secondary
account.
The primary account's attachment are not visible here.
On the contrary, from the account that owns the transit gateway, if you look into the gateway attachments,
you will be able to see both the attachments.
So the first attachment is associated with the present account.
The second attachment that you see over here, this is associated with the secondary account.
If you see in the resource owner ID, it states shared grid.
So I hope with this at a very high level overview, you understood the basics of transit gateway sharing
and with this will conclude today's video.