GCP API Prep

Step 2b — GCP prep (before first transports create)

TERRAFORM TERRAFORM
HashiCorp Terraform — infrastructure-as-code tool used to provision the base AWS and GCP resources in this demo. creates demo-vpc-network but not the Network Connectivity service agent. Do this once per GCP GCP
Google Cloud Platform — the cloud provider connected to AWS via Interconnect multicloud in this walkthrough. project:

export GCP_PROJECT="$(terraform output -raw gcp_project_id)"

gcloud services enable networkconnectivity.googleapis.com --project="$GCP_PROJECT"

# Confirm API is enabled
gcloud services list --enabled --project="$GCP_PROJECT" \
  --filter="name:networkconnectivity.googleapis.com"

# Required if create fails with gcp-sa-networkconnectivity ... Not found
gcloud beta services identity create \
  --service=networkconnectivity.googleapis.com \
  --project="$GCP_PROJECT"

Tip

Wait 2–5 minutes after services identity create before running the transport create in Step 4.

Pre-flight: reach each VM locally (Step 2c)

Before moving to the interconnect steps, confirm you can reach both VMs through their respective management channels:

AWS — SSM Session Manager

aws ssm start-session \
  --target "$(terraform output -raw aws_instance_id)" \
  --region "$(terraform output -raw aws_region)"

If SSM SSM
AWS Systems Manager Session Manager — provides shell access to EC2 instances without a public IP or SSH key, using VPC interface endpoints. fails, wait 2–3 minutes after apply for VPC endpoints to become ready and the SSM agent to register.

GCP — IAP tunnel SSH

terraform output -raw gce_ssh_private_key > demo-gce-key
chmod 600 demo-gce-key

gcloud compute ssh "$(terraform output -raw gce_instance_name)" \
  --zone="$(terraform output -raw gce_instance_zone)" \
  --project="$(terraform output -raw gcp_project_id)" \
  --tunnel-through-iap \
  --ssh-key-file=demo-gce-key

Both working? You’re ready for the Interconnect steps.