Overview

The story

On April 14, 2026, AWS announced the general availability of AWS Interconnect – multicloud AWS Interconnect – multicloud
AWS Interconnect – multicloud — a managed private connectivity service that connects Amazon VPCs directly to VPCs on other cloud providers. GA with Google Cloud as of April 2026. , a managed private connectivity service that connects Amazon VPCs directly to VPCs on other cloud providers. At GA, Google Cloud Google Cloud
Google Cloud Platform — the cloud provider connected to AWS via Interconnect multicloud in this walkthrough. is the only officially supported partner — Microsoft Azure and Oracle Cloud Infrastructure (OCI) are coming later in 2026.

AWS Interconnect removes the traditional complexity of cross-cloud networking: no VPN tunnels to manage, no colocation facilities to coordinate, no third-party network fabrics to configure. You select a provider, pick your regions, choose bandwidth, and AWS generates an activation key. Use that key on the GCP side, and private connectivity is established in minutes.

Traffic flows entirely over the AWS global backbone and Google Cloud Google Cloud
Google Cloud Platform — the cloud provider connected to AWS via Interconnect multicloud in this walkthrough. ‘s private network — it never traverses the public internet. Every connection uses MACsec MACsec
IEEE 802.1AE MACsec — encryption applied to the physical links between AWS and GCP routers at interconnection facilities. Enabled by default on every Interconnect connection. encryption on the physical links between AWS and GCP routers. Resiliency is built in: each connection spans multiple logical links distributed across at least two physical facilities.

Why GCP (and only GCP right now)

As of this writing, Google Cloud is the only GA partner for AWS Interconnect – multicloud. The service page and blog are clear: Azure and OCI are “coming later in 2026.” This walkthrough focuses exclusively on the AWS ↔ GCP path because it’s the only one you can actually provision today.

On the GCP side, the corresponding service is Partner Cross-Cloud Interconnect Partner Cross-Cloud Interconnect
Partner Cross-Cloud Interconnect — the GCP-side service that accepts the AWS activation key and creates a managed transport for cross-cloud connectivity. . The flow is:

1. AWS generates an activation key (console)
2. GCP uses that key to create a transport transport
   GCP Transport — a Network Connectivity resource created via `gcloud beta network-connectivity transports create`. Represents the GCP side of the cross-cloud interconnect link. (gcloud beta)
3. You peer your workload VPC VPC
   Virtual Private Cloud — an isolated private network. Both AWS and GCP use VPCs. The interconnect peers the two VPCs for private routing. to the transport’s managed network

No physical cross-connect, no LOA, no colocation visit.

What this demo proves

After completing every step, an EC2 instance in a private AWS subnet and a GCE GCE
Google Compute Engine — GCP virtual machine instances. The demo GCE VM is reachable via IAP tunnel SSH. VM in a private GCP subnetwork can reach each other over ICMP and SSH entirely through the managed Interconnect path — no public internet, no colocation cross-connect, no VPN.

We chose EC2-to-VM connectivity because it’s straightforward to verify and a common real-world pattern. But the interconnect itself is not limited to this — any workload in either VPC (containers on ECS/EKS, Lambda functions, managed databases, internal load balancers) can use the same private path once the route exchange is in place.

Architecture

Traffic path (AWS → GCP): EC2 → VGW VGW
Virtual Private Gateway — an AWS VPN gateway attached to a VPC. Routes to GCP are propagated through the VGW via the DX Gateway association. → DX Gateway DX Gateway
Direct Connect Gateway — an AWS resource that connects a Virtual Private Gateway (or Transit Gateway) to a Direct Connect or Interconnect link. Created by Terraform in this demo. → Interconnect → GCP Transport Transport
GCP Transport — a Network Connectivity resource created via `gcloud beta network-connectivity transports create`. Represents the GCP side of the cross-cloud interconnect link. → VPC peering VPC peering
VPC Network Peering — a GCP feature that connects two VPC networks for private route exchange. Used here to peer the workload VPC with the transport managed network. → GCE VM

What Terraform manages

Resource	Purpose
aws_dx_gateway	Attach point for the multicloud Interconnect (console Step 3)
aws_vpc, subnet, VGW, route table	AWS workload network
aws_dx_gateway_association	Links VGW to DX Gateway; advertises aws_vpc_cidr toward GCP
aws_instance + SSM	Demo EC2 in a private subnet (reachable via Session Manager)
VPC interface endpoints	SSM connectivity without a bastion or NAT
google_compute_network, subnet, firewall	GCP workload network
google_compute_instance	Demo GCE VM (reachable via IAP tunnel SSH)

What’s created manually

These steps are documented in this walkthrough but not yet automatable via TERRAFORM TERRAFORM
HashiCorp Terraform — infrastructure-as-code tool used to provision the base AWS and GCP resources in this demo. :

Step	Tool	Resource
3	AWS console	AWS Interconnect – multicloud (1 Gbps) → activation key
4	gcloud beta	Partner Cross-Cloud Interconnect transport
5	gcloud	VPC network peering (workload VPC ↔ transport peering network)

Note

When provider support lands (terraform-provider-aws#47458), these steps can move into Terraform. Until then, this walkthrough is the source of truth for the interconnect layer.

Walkthrough checklist

Track your progress. Steps 3–5 are not in Terraform — they must be removed manually before terraform destroy or hourly interconnect charges continue.

Step	What	How	In Terraform?	Billable?
1	Configure terraform.tfvars	edit file	—	—
2	Base infra (VPC, EC2, GCE, DXGW, …)	terraform apply	Yes	Yes (~$30–40/mo)
2b	GCP API + service agent (one-time prep)	gcloud	No	No
2c	Pre-flight: reach each VM locally	SSM (AWS), IAP SSH (GCP)	—	—
3	AWS Interconnect multicloud (paid 1 Gbps)	AWS console	No	Yes (~$1.37/hr AWS)
4	GCP Partner Cross-Cloud transport	gcloud beta	No	Yes (~$5/hr GCP)
5	VPC peering (workload ↔ transport network)	gcloud	No	No
6	Verify routing + poll until AWS Available	aws interconnect / gcloud	—	—
7	Ping EC2 ↔ GCE over interconnect	SSM + IAP	—	—
Teardown	Delete peering → transport → AWS → destroy	gcloud + CLI/console	Steps 3–5	Stop billing