Skip to content
AWS Private Connectivity Patterns Walkthrough

AWS Private Connectivity Patterns Walkthrough

Deploy and compare five independent AWS private cross-account connectivity patterns — VPC Peering, PrivateLink, VPC Lattice, Transit Gateway, and Cloud WAN
Get Started View on GitHub

What you’ll build

Section titled “What you’ll build”

Compare five patterns

Side-by-side guidance for VPC Peering
L3 point-to-point connection between two VPCs. Requires non-overlapping CIDRs, acceptance, and optional DNS resolution enablement., PrivateLink
AWS PrivateLink — L4 private connectivity via interface VPC endpoints to a provider endpoint service, without shared CIDR routing., VPC Lattice
AWS VPC Lattice — L7 service networking with service networks, discovery, routing, and auth policies shared across accounts via RAM., Transit Gateway
AWS Transit Gateway — regional L3 hub connecting many VPCs. Cross-account use needs RAM share, attachment acceptance, and routes., and Cloud WAN
AWS Cloud WAN — managed global L3 network with multi-region edges and segment-based isolation policies. — OSI layer, CIDR overlap, cost drivers, and when to choose each.

Map the account topology

Shared_Services_Account
Provider/hub AWS account accessed via the `shared-services` CLI profile — owns shared apps, endpoint services, TGW, Lattice networks, and the Cloud WAN core network. as provider hub and Dev_Account
Consumer/spoke AWS account accessed via the `dev` CLI profile — hosts consumer VPCs, test EC2, endpoints, and attachments. as consumer spoke, with Primary_Region
`ap-southeast-2` — default deployment region for VPC Peering, PrivateLink, VPC Lattice, and Transit Gateway., Cloud_WAN_Regions
Workload regions for Cloud WAN attachments: `ap-southeast-2`, `ap-southeast-6`, and `ap-southeast-1` — distinct from RAM_Region., and RAM_Region
`us-east-1` — required for creating and accepting RAM shares of global resources such as the Cloud WAN core network; not a workload region. for the global core network
Global Cloud WAN backbone that connects regional edges. Segment policies apply at the core network; it is a global resource shared via RAM. share.

Deploy one pattern at a time

Apply shared-services then consumer, verify with curl via Session Manager
AWS Systems Manager Session Manager — interactive shell on private EC2 without SSH or bastions; used for curl verification in this walkthrough., then tear down before starting the next pattern.

Verify Cloud WAN segments

Multi-region segments
Logical Cloud WAN partition with its own route policy. This demo uses shared, workloads (mutual allow), and sandbox (isolated). with shared ↔ workloads allow and sandbox isolation — plus why RAM
AWS Resource Access Manager — shares Lattice service networks, Transit Gateways, and Cloud WAN core networks across accounts. sharing of the global core network uses us-east-1.