Cloud WAN Walkthrough

Cloud WANCloud WAN
AWS Cloud WAN — managed global L3 network with multi-region edges and segment-based isolation policies. is the most complex pattern: a global L3 hub with explicit segmentsegment
Logical Cloud WAN partition with its own route policy. This demo uses shared, workloads (mutual allow), and sandbox (isolated). isolation across three regions. Workloads attach to segment-specific edge locations; route policies control which segments can reach each other.

Segment	Region	Account	CIDR
shared	ap-southeast-2 (Sydney)	123456789012 (shared-services)	10.14.0.0/16
workloads	ap-southeast-6 (Auckland)	987654321098 (dev)	10.24.0.0/16
sandbox	ap-southeast-1 (Singapore)	987654321098 (dev)	10.34.0.0/16

Upstream Terraform:

• shared-services
• consumer

Danger

Cloud WAN is the highest-cost and most complex pattern of the five. It provisions a global core network, edge locations in three regions, and multi-region VPC attachments. Deploy this pattern last, after validating simpler patterns, and destroy promptly when finished.

Global Core Network and RAM Region

The Cloud WAN core networkcore network
Global Cloud WAN backbone that connects regional edges. Segment policies apply at the core network; it is a global resource shared via RAM. is a global resource. AWS RAMAWS RAM
AWS Resource Access Manager — shares Lattice service networks, Transit Gateways, and Cloud WAN core networks across accounts. requires global resource shares to be created and accepted in the RAM_RegionRAM_Region
`us-east-1` — required for creating and accepting RAM shares of global resources such as the Cloud WAN core network; not a workload region. (us-east-1) — not because workloads run there, but because that is the required RAM region for global resources. All workload VPCs and attachmentsattachments
Connection of a VPC (or similar) to a TGW or Cloud WAN edge. Cross-account attachments often need acceptance and route setup. remain in Cloud_WAN_RegionsCloud_WAN_Regions
Workload regions for Cloud WAN attachments: `ap-southeast-2`, `ap-southeast-6`, and `ap-southeast-1` — distinct from RAM_Region. (ap-southeast-2, ap-southeast-6, and ap-southeast-1).

Tip

RAM sharing of the Cloud WAN core network must be performed in us-east-1 because the core network is a global resource. AWS RAM mandates that global resource shares use us-east-1 regardless of where your workload VPCs are attached. No application workloads in this walkthrough are deployed to us-east-1.

Segment route policy: shared ↔ workloads allow mutual traffic; sandbox is isolated from all other segments.

Step 1 — Shared-Services Apply (Global Network + Core Network + RAM Share)

Creates the global network, core network with segment definitions and route policies, shared-services VPC attachment in the shared segment (ap-southeast-2), internal ALB, demo API, and RAM share of the core network to the dev account.

export DEV_ACCOUNT_ID=987654321098

AWS_PROFILE=shared-services terraform -chdir=terraform/patterns/cloudwan/shared-services init -upgrade
AWS_PROFILE=shared-services terraform -chdir=terraform/patterns/cloudwan/shared-services apply \
  -var="consumer_account_id=$DEV_ACCOUNT_ID"

Capture outputs:

export CWAN_CORE_NETWORK_ID=$(AWS_PROFILE=shared-services terraform -chdir=terraform/patterns/cloudwan/shared-services output -raw core_network_id)
export CWAN_CORE_NETWORK_ARN=$(AWS_PROFILE=shared-services terraform -chdir=terraform/patterns/cloudwan/shared-services output -raw core_network_arn)
export CWAN_RESOURCE_SHARE_ARN=$(AWS_PROFILE=shared-services terraform -chdir=terraform/patterns/cloudwan/shared-services output -raw core_network_resource_share_arn)
export ALB_DNS_NAME=$(AWS_PROFILE=shared-services terraform -chdir=terraform/patterns/cloudwan/shared-services output -raw alb_dns_name)

Example outputs:

core_network_id = core-network-EXAMPLE1234567890
core_network_arn = arn:aws:networkmanager::123456789012:core-network/core-network-EXAMPLE1234567890
core_network_resource_share_arn = arn:aws:ram:us-east-1:123456789012:resource-share/EXAMPLE-cwan-share
alb_dns_name = internal-apcp-cwan-ss-app-alb-EXAMPLE.ap-southeast-2.elb.amazonaws.com

Step 2 — Accept Global Core Network RAM Share (us-east-1)

The consumer module accepts the RAM share, but you can verify the pending invitation from the RAM region before consumer apply:

AWS_PROFILE=dev aws ram get-resource-shares \
  --resource-owner OTHER-ACCOUNTS \
  --region us-east-1 \
  --query "resourceShares[?contains(arn, 'EXAMPLE-cwan-share')].status"

Expected before consumer apply: "PENDING".

Tip

Always use --region us-east-1 when inspecting or accepting the Cloud WAN core network RAM share. Using a workload region (ap-southeast-2) will not show the global share.

Step 3 — Consumer Apply (Accept RAM + Multi-Region Attachments)

Creates VPCs and core network attachments in ap-southeast-6 (workloads segment) and ap-southeast-1 (sandbox segment). The consumer module accepts the global core network RAM share and attaches both VPCs.

AWS_PROFILE=dev terraform -chdir=terraform/patterns/cloudwan/consumer init -upgrade
AWS_PROFILE=dev terraform -chdir=terraform/patterns/cloudwan/consumer apply \
  -var="core_network_id=$CWAN_CORE_NETWORK_ID" \
  -var="core_network_arn=$CWAN_CORE_NETWORK_ARN" \
  -var="core_network_resource_share_arn=$CWAN_RESOURCE_SHARE_ARN"

Example outputs:

workloads_test_ec2_instance_id = i-EXAMPLEworkloads123
sandbox_test_ec2_instance_id = i-EXAMPLEsandbox123

Segment Connectivity Expectations

Source segment	Target segment	Expected result
workloads	shared	Allow — workloads can reach shared-services API
shared	workloads	Allow — mutual segment connectivity
sandbox	shared	Deny — sandbox is isolated
sandbox	workloads	Deny — sandbox is isolated

Step 4 — Segment Verification (Route Policy Checks)

Verify segmentation directly from Cloud WAN routing state:

# workloads segment CAN see shared CIDR (10.14.0.0/16)
AWS_PROFILE=shared-services aws networkmanager list-core-network-routing-information \
  --region ap-southeast-2 \
  --core-network-id "$CWAN_CORE_NETWORK_ID" \
  --segment-name workloads \
  --edge-location ap-southeast-6 \
  --query "CoreNetworkRoutingInformation[?Prefix=='10.14.0.0/16']"

Expected: one or more route entries (non-empty array).

# sandbox segment CANNOT see shared CIDR (must return [])
AWS_PROFILE=shared-services aws networkmanager list-core-network-routing-information \
  --region ap-southeast-2 \
  --core-network-id "$CWAN_CORE_NETWORK_ID" \
  --segment-name sandbox \
  --edge-location ap-southeast-1 \
  --query "CoreNetworkRoutingInformation[?Prefix=='10.14.0.0/16']"

Expected: empty array [].

Verify End-to-End Connectivity

See Verification — Cloud WAN for SSM curl tests from both segments.

Teardown

See Teardown — Cloud WAN. Destroy multi-region consumer attachments before the global core network.