Skip to content
AWS-GCP Interconnect

Checking for Errors

When to worry

Section titled “When to worry”

Pending is not an error — it means AWS is still provisioning after GCP Steps 4–5 complete. Worry when state becomes failed, or pending exceeds ~30 minutes with no progress.

Decision tree

Section titled “Decision tree”

Interconnect troubleshooting decision tree: four branches for pending (normal), failed, missing routes, and ping failures

AWS — CloudTrail (interconnect events)

Section titled “AWS — CloudTrail (interconnect events)”

Console: CloudTrail Event history → filter Event source = interconnect.amazonaws.com.

CLI:

Terminal window
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventSource,AttributeValue=interconnect.amazonaws.com \
  --start-time "$(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ)" \
  --max-results 10 \
  --query 'Events[*].{Time:EventTime,Name:EventName}' \
  --output table

AWS — Organization SCPs

Section titled “AWS — Organization SCPs”

If you use AWS Organizations / Control Tower, ensure SCPs allow interconnect:* — a separate namespace from directconnect:*. SCP denials often produce a silent failed state with no CloudTrail denial log.

Confirm interconnect and DXGW are in the same account as Terraform:

Terminal window
aws sts get-caller-identity
terraform output -raw aws_dx_gateway_id

GCP — transport or peering failures

Section titled “GCP — transport or peering failures”

Transport stuck in CREATING (not PENDING_CONFIG) for hours — check VPC Service Controls: allow networkconnectivity-transportmanager-clh@system.gserviceaccount.com through the perimeter.

Recent transport operations:

Terminal window
gcloud beta network-connectivity operations list \
  --region="$GCP_REGION" --project="$GCP_PROJECT" --limit=5