Prerequisites
Before diving in, make sure you have the right accounts, tools, and credentials. This section also covers cost expectations so there are no surprises.
Accounts and permissions
Section titled “Accounts and permissions”You need an AWS
Amazon Web Services — the cloud platform used throughout this walkthrough. account with permissions for Direct Connect, EC2, VPC
Virtual Private Cloud — an isolated private network. Both AWS and GCP use VPCs. The interconnect peers the two VPCs for private routing. , iam , and AWS Interconnect – multicloud
AWS Interconnect – multicloud — a managed private connectivity service that connects Amazon VPCs directly to VPCs on other cloud providers. GA with Google Cloud as of April 2026. .
You also need a GCP
Google Cloud Platform — the cloud provider connected to AWS via Interconnect multicloud in this walkthrough. project with billing enabled and these APIs enabled:
- Compute Engine API
- Network Connectivity API (
networkconnectivity.googleapis.com)
gcloud services enable compute.googleapis.com networkconnectivity.googleapis.com \ --project=YOUR_GCP_PROJECT_ID| Tool | Version | Used for |
|---|---|---|
| TERRAFORM HashiCorp Terraform — infrastructure-as-code tool used to provision the base AWS and GCP resources in this demo. | >= 1.5.0 | Base infrastructure |
| AWS CLI | v2 ≥ 2.34.43 | SSM AWS Systems Manager Session Manager — provides shell access to EC2 instances without a public IP or SSH key, using VPC interface endpoints. sessions; aws interconnect status checks |
| Google Cloud SDK | latest | Transport GCP Transport — a Network Connectivity resource created via `gcloud beta network-connectivity transports create`. Represents the GCP side of the cross-cloud interconnect link. + peering (beta commands) |
| Session Manager plugin | latest | SSH-less EC2 access |
Authentication
Section titled “Authentication”# AWSaws sts get-caller-identity
# GCP — Terraform uses Application Default Credentials (ADC)gcloud auth application-default logingcloud config set project YOUR_GCP_PROJECT_IDgcloud auth application-default set-quota-project YOUR_GCP_PROJECT_ID TERRAFORM
HashiCorp Terraform — infrastructure-as-code tool used to provision the base AWS and GCP resources in this demo. and the Google provider read credentials from ADC
Application Default Credentials — the credential chain used by Google Cloud client libraries and Terraform to authenticate. Set via `gcloud auth application-default login`. ,
not from gcloud config. After gcloud config set project, align the ADC quota project to the same
GCP project — otherwise you may see a mismatch warning and hit unexpected quota/billing issues:
WARNING: Your active project does not match the quota project in your localApplication Default Credentials file.Run set-quota-project whenever you switch GCP projects for this demo.
Region pairing
Section titled “Region pairing” Interconnect
AWS Interconnect – multicloud — a managed private connectivity service that connects Amazon VPCs directly to VPCs on other cloud providers. GA with Google Cloud as of April 2026. is region-to-region. Pick a supported pair
before editing terraform.tfvars.
The following region pairs are available:
| AWS Region | GCP Region |
|---|---|
| ap-southeast-1 | asia-southeast1 |
| us-east-1 | us-east4 |
| us-west-2 | us-west1 |
| us-west-1 | us-west2 |
| eu-west-2 | europe-west2 |
| eu-central-1 | europe-west3 |
List available GCP remote profiles for your target GCP region:
gcloud beta network-connectivity transports remote-profiles list \ --region=asia-southeast1