Account Topology

Every pattern in this walkthrough uses the same two-account model. The Shared Services AccountShared Services Account
Provider/hub AWS account accessed via the `shared-services` CLI profile — owns shared apps, endpoint services, TGW, Lattice networks, and the Cloud WAN core network. acts as the provider (hub) and the Dev AccountDev Account
Consumer/spoke AWS account accessed via the `dev` CLI profile — hosts consumer VPCs, test EC2, endpoints, and attachments. acts as the consumer (spoke). Most patterns deploy in a single region; Cloud WANCloud WAN
AWS Cloud WAN — managed global L3 network with multi-region edges and segment-based isolation policies. extends across three workload regions with a separate RAM regionRAM region
`us-east-1` — required for creating and accepting RAM shares of global resources such as the Cloud WAN core network; not a workload region. for the global core networkcore network
Global Cloud WAN backbone that connects regional edges. Segment policies apply at the core network; it is a global resource shared via RAM..

Two-account model

Account	Placeholder ID	Role	Purpose
Shared Services	123456789012	Provider (hub)	Hosts the shared application, endpoint service, transit hub, or Cloud WAN core network resources
Dev	987654321098	Consumer (spoke)	Hosts the consumer VPC, test EC2 instance, and pattern-specific attachment or endpoint

Cross-account connectivity always flows from the provider toward the consumer: the shared-services Terraform root creates resources that the consumer root depends on. No assume_role is used between accounts; values pass manually via terraform output and -var flags.

Example identity ARNs used throughout this site:

arn:aws:iam::123456789012:role/AdministratorAccess-EXAMPLE
arn:aws:iam::987654321098:role/AdministratorAccess-EXAMPLE

Regional scope

Region label	AWS Region	Role in this walkthrough
Primary_RegionPrimary_Region `ap-southeast-2` — default deployment region for VPC Peering, PrivateLink, VPC Lattice, and Transit Gateway.	ap-southeast-2	Default deployment region for VPC Peering, PrivateLink, VPC Lattice, and Transit Gateway
Cloud_WAN_RegionsCloud_WAN_Regions Workload regions for Cloud WAN attachments: `ap-southeast-2`, `ap-southeast-6`, and `ap-southeast-1` — distinct from RAM_Region.	ap-southeast-2, ap-southeast-6, ap-southeast-1	Workload VPC attachment regions for the Cloud WAN pattern only
RAM_RegionRAM_Region `us-east-1` — required for creating and accepting RAM shares of global resources such as the Cloud WAN core network; not a workload region.	us-east-1	Global Cloud WAN core-network share region — not a workload region

The RAM_RegionRAM_Region
`us-east-1` — required for creating and accepting RAM shares of global resources such as the Cloud WAN core network; not a workload region. (us-east-1) exists because the Cloud WAN core networkcore network
Global Cloud WAN backbone that connects regional edges. Segment policies apply at the core network; it is a global resource shared via RAM. is a global AWS resource. AWS Resource Access Manager (RAM)AWS Resource Access Manager (RAM)
AWS Resource Access Manager — shares Lattice service networks, Transit Gateways, and Cloud WAN core networks across accounts. requires global resource shares to be created and accepted in us-east-1 so every region can see the share. Workload VPCs and attachments remain in Cloud_WAN_RegionsCloud_WAN_Regions
Workload regions for Cloud WAN attachments: `ap-southeast-2`, `ap-southeast-6`, and `ap-southeast-1` — distinct from RAM_Region.; nothing in this demo runs application workloads in us-east-1.

Topology diagram

The diagram below shows the account boundaries, CLI profiles, and regional labels used across all patterns.

AWS CLI profiles

Configure both profiles for AWS IAM Identity Center (SSOSSO
AWS IAM Identity Center (SSO) — federated login used by the `shared-services` and `dev` CLI profiles in this walkthrough.) access before running any Terraform apply.

Profile	Target account	Account ID	Role	Assumed IAM permission set
shared-services	Shared Services Account	123456789012	Provider	AdministratorAccess
dev	Dev Account	987654321098	Consumer	AdministratorAccess

Validate each profile before deploying:

aws sts get-caller-identity --profile shared-services
aws sts get-caller-identity --profile dev

Expected output uses the placeholderplaceholder
Synthetic AWS identifier used in docs (e.g. `123456789012`, ARNs ending in EXAMPLE) instead of real account IDs or hostnames. account IDs above. A successful response confirms SSO login and profile mapping are correct.

Hub-and-spoke relationship

In every pattern:

1. The shared-services profile applies Terraform in account 123456789012 first.
2. The dev profile applies Terraform in account 987654321098 second, consuming outputs from step 1.
3. Some patterns require an additional manual step (peering acceptance, RAM acceptance, route configuration) documented on the walkthrough pages.

Each pattern is fully independent: separate Terraform state, separate VPC CIDRCIDR
Classless Inter-Domain Routing — IP range notation such as `10.10.0.0/16`. Peering and TGW need non-overlapping CIDRs; PrivateLink and Lattice do not. blocks, and separate test EC2 instances. Deploy one pattern at a time, verify connectivity, then tear down before moving to the next.