Verify Routing

Step 6 — Verify routing and wait for AWS

After Step 5, you are waiting on AWS AWS
Amazon Web Services — the cloud platform used throughout this walkthrough. (pending → available). GCP GCP
Google Cloud Platform — the cloud provider connected to AWS via Interconnect multicloud in this walkthrough. peering ACTIVE with transport transport
GCP Transport — a Network Connectivity resource created via `gcloud beta network-connectivity transports create`. Represents the GCP side of the cross-cloud interconnect link. PENDING_CONFIG and 0 incoming routes is a healthy in-progress state — not an error.

Expected states (healthy in-progress)

Check	Good	Bad
AWS interconnect state	pending	failed
DXGW association	associated (can happen before Available)	stuck pending / disassociated
GCP peering	ACTIVE / Connected	INACTIVE or error in STATE_DETAILS
GCP transport	PENDING_CONFIG, adminEnabled: true	stuck CREATING for hours
GCP incoming routes	0 items	still 0 after AWS available (10+ min)

Combined health check

Run this after Step 5. Re-run every 5–10 minutes until AWS shows available:

export AWS_REGION="$(terraform output -raw aws_region)"
export GCP_PROJECT="$(terraform output -raw gcp_project_id)"
export GCP_REGION="$(terraform output -raw gcp_region)"
export GCP_NETWORK="$(terraform output -raw gcp_vpc_network_name)"
export TRANSPORT_NAME="$(terraform output -raw gcp_transport_name)"

# 1. AWS interconnect state
aws interconnect list-connections --region "$AWS_REGION" --output json

# 2. DX Gateway association
aws directconnect describe-direct-connect-gateway-associations \
  --direct-connect-gateway-id "$(terraform output -raw aws_dx_gateway_id)" \
  --output json

# 3. GCP transport
gcloud beta network-connectivity transports describe "$TRANSPORT_NAME" \
  --region="$GCP_REGION" --project="$GCP_PROJECT" \
  --format='yaml(state,adminEnabled,updateTime)'

# 4. GCP peering
gcloud compute networks peerings list --network="$GCP_NETWORK" --project="$GCP_PROJECT"

# 5. GCP incoming routes (empty until AWS is available — not an error yet)
gcloud compute networks peerings list-routes demo-aws-peering \
  --direction=INCOMING --network="$GCP_NETWORK" \
  --region="$GCP_REGION" --project="$GCP_PROJECT"

Poll AWS until available

Replace mcc-xxxxxxxx with your connection id from the list-connections output:

aws interconnect get-connection \
  --identifier mcc-xxxxxxxx \
  --region "$AWS_REGION" \
  --query 'connection.{state:state,id:id,attachPoint:attachPoint}' \
  --output table

Timeline: 0–15 min pending is normal · 15–30 min still pending — keep polling · > 30 min or failed — see Troubleshooting.

AWS — Interconnect status

Check the multicloud connection — this is the main gate for route exchange.

Console (recommended): AWS Interconnect — set region= to your aws_region. Status should move Pending → Available.

CLI (optional): Requires AWS CLI 2.34.43+:

aws --version   # must show 2.34.43 or newer

aws interconnect list-connections \
  --region "$(terraform output -raw aws_region)" \
  --query 'connections[*].{id:id,state:state,description:description}' \
  --output table

Caution

aws directconnect describe-interconnects is the legacy physical Direct Connect API — not AWS Interconnect multicloud. Do not use it for this demo.

AWS — DX Gateway association

aws directconnect describe-direct-connect-gateway-associations \
  --direct-connect-gateway-id "$(terraform output -raw aws_dx_gateway_id)" \
  --query 'directConnectGatewayAssociations[*].{state:associationState,allowed:allowedPrefixesToDirectConnectGateway}' \
  --output table

The association can reach associated while the interconnect interconnect
AWS Interconnect – multicloud — a managed private connectivity service that connects Amazon VPCs directly to VPCs on other cloud providers. GA with Google Cloud as of April 2026. is still pending — that is normal. Allowed prefixes should include your aws_vpc_cidr (e.g. 10.0.0.0/16).

AWS — VGW route propagation

In the AWS console: VPC → Route tables → demo-private-rt

You should see:

• 10.1.0.0/16 (your gcp_vpc_cidr) → Virtual Private Gateway (static route from Terraform)
• GCP-learned routes may appear once BGP BGP
  Border Gateway Protocol — the routing protocol used to exchange routes between AWS and GCP over the interconnect. over the Interconnect is up

GCP — peering routes (incoming from AWS)

After AWS shows Available, AWS routes should appear on the peering:

gcloud compute networks peerings list-routes demo-aws-peering \
  --direction=INCOMING \
  --network="$GCP_NETWORK" \
  --region="$GCP_REGION" \
  --project="$GCP_PROJECT"

Target: 10.0.0.0/16 (your aws_vpc_cidr) with status accepted. Listed 0 items before AWS is Available is expected.

Outgoing (GCP → AWS) may show 10.1.0.0/16 earlier:

gcloud compute networks peerings list-routes demo-aws-peering \
  --direction=OUTGOING \
  --network="$GCP_NETWORK" \
  --region="$GCP_REGION" \
  --project="$GCP_PROJECT"

GCP — custom routes

gcloud compute routes list --filter="network:$GCP_NETWORK" --project="$GCP_PROJECT"

You should see routes toward your AWS VPC VPC
Virtual Private Cloud — an isolated private network. Both AWS and GCP use VPCs. The interconnect peers the two VPCs for private routing. CIDR CIDR
Classless Inter-Domain Routing — a notation for IP address ranges (e.g. 10.0.0.0/16). AWS and GCP VPC CIDRs must not overlap for interconnect routing. learned via the peering/transport path once BGP BGP
Border Gateway Protocol — the routing protocol used to exchange routes between AWS and GCP over the interconnect. is up.