Overview

Purpose

This site is an operational walkthrough companion that teaches platform engineers how to deploy, verify, and compare five independent AWS private cross-account connectivity patterns. Each pattern connects a Shared_Services_AccountShared_Services_Account
Provider/hub AWS account accessed via the `shared-services` CLI profile — owns shared apps, endpoint services, TGW, Lattice networks, and the Cloud WAN core network. (provider) to a Dev_AccountDev_Account
Consumer/spoke AWS account accessed via the `dev` CLI profile — hosts consumer VPCs, test EC2, endpoints, and attachments. (consumer) using a different networking approach — from simple point-to-point peering to global multi-region Cloud WANCloud WAN
AWS Cloud WAN — managed global L3 network with multi-region edges and segment-based isolation policies. segmentation.

You will learn when to choose each pattern, how the account topology maps to your environment, and the exact apply, verification, and teardown sequence for each option. All Terraform code lives in the upstream demo repositoryupstream demo repository
jajera/aws-private-connectivity-patterns-demo — Terraform for all five patterns; this site is the documentation companion only.; this site documents how to run it safely.

Target audience

This walkthrough is written for platform engineers, cloud network architects, and DevOps engineers who:

• Manage multi-account AWS environments with separate provider and consumer accounts
• Need hands-on experience comparing VPC PeeringVPC Peering
  L3 point-to-point connection between two VPCs. Requires non-overlapping CIDRs, acceptance, and optional DNS resolution enablement., PrivateLinkPrivateLink
  AWS PrivateLink — L4 private connectivity via interface VPC endpoints to a provider endpoint service, without shared CIDR routing., VPC LatticeVPC Lattice
  AWS VPC Lattice — L7 service networking with service networks, discovery, routing, and auth policies shared across accounts via RAM., Transit GatewayTransit Gateway
  AWS Transit Gateway — regional L3 hub connecting many VPCs. Cross-account use needs RAM share, attachment acceptance, and routes., and Cloud WANCloud WAN
  AWS Cloud WAN — managed global L3 network with multi-region edges and segment-based isolation policies.
• Are comfortable with AWS CLI profiles, Terraform, and Session ManagerSession Manager
  AWS Systems Manager Session Manager — interactive shell on private EC2 without SSH or bastions; used for curl verification in this walkthrough.
• Want a repeatable lab workflow: deploy one pattern, verify connectivity, tear down, then try the next

You do not need prior experience with every pattern, but familiarity with VPCs, routing, and IAM is assumed.

Success criteria

After completing this walkthrough, you should be able to:

1. Explain the trade-offs among all five patterns and recommend one for a given use case
2. Deploy any single pattern end-to-end using the upstream Terraform roots
3. Verify cross-account connectivity via Session Manager and HTTP checks
4. Tear down resources in the correct order without orphaned dependencies
5. Distinguish this documentation site from the upstream Terraform repository

Non-goals

This site does not:

• Provide production-ready Terraform modules for your organization
• Cover public internet connectivity, VPN, or Direct Connect patterns
• Replace official AWS documentation for service configuration details
• Support running multiple patterns simultaneously in the same accounts
• Include infrastructure-as-code — all Terraform lives upstream

What this is / What this is not

What this is	What this is not
A documentation companion deployed as an Astro + Starlight site on GitHub Pages	The Terraform source repository
Step-by-step walkthroughs, architecture diagrams, and reference material	A one-click deploy button or managed lab environment
A documentation companion for the upstream Terraform demo	A living substitute for the upstream repository
Safe to publish publicly using Placeholder_IDPlaceholder_ID Synthetic AWS identifier used in docs (e.g. `123456789012`, ARNs ending in EXAMPLE) instead of real account IDs or hostnames. values only	A place to store real account IDs, ARNs, or credentials

All Terraform code, modules, and pattern roots live in the Upstream_Demo_Repo (jajera/aws-private-connectivity-patterns-demo). Clone that repository to apply infrastructure; use this site to understand and operate it.

Pattern comparison summary

Pattern	Scope	Complexity	Primary use case
VPC Peering	Single-region	Low	Point-to-point L3 connectivity between two VPCs with non-overlapping CIDR blocks.
PrivateLink	Single-region	Low	Expose a provider service to consumer VPCs without requiring CIDR coordination.
VPC Lattice	Single-region	Medium	L7 service discovery, routing, and auth policies across VPCs and accounts.
Transit Gateway	Single-region	Medium	Hub-and-spoke routing connecting multiple VPCs through a central gateway.
Cloud WAN	Multi-region	High	Global multi-region routing with segment-based isolation and policy controls.

Tip

Start with PrivateLinkPrivateLink
AWS PrivateLink — L4 private connectivity via interface VPC endpoints to a provider endpoint service, without shared CIDR routing. to validate cross-account connectivity with the lowest complexity, then explore patterns that match your scaling and OSI-layer requirements.