[Music]
hello hello welcome to solving with AWS
solutions your deep dive in architecture
is built by AWS that are ready to deploy
instantly in the cloud I'm Rob your host
joined today with a man whose AWS Aurora
is glowing around him how you doing tom
hi all today we're going to be looking
at service transit network Orchestrator
a solution that helps customers manage
and automate routing between multiple V
pcs so this AWS solution is specific to
customers supporting multiple accounts
it helps customers organize their multi
account and multi network strategy and
it can be leveraged a single account
level across multiple accounts or even
at the organization level it's useful
for any customers who need to route
traffic between multiple V pcs the big
value add here is automation and time
savings of complex network
administration that's right all the
customer has to do is apply a set of
tags to their V pcs and the solution
will take care of the rest
sounds great let's get into it so Tom
talk to me about serverless transit
network Orchestrator what's going on
certainly let's call it sta no it's a
little easier to see it's another one of
our solutions it has a landing page it
has an implementation guide
CloudFormation template so you can spin
it up in your account and of course the
source code is available on github
that's awesome let's dive into the
architecture sure so we are looking at
two CloudFormation templates to deploy
this solution the first is the hub
account so where you have your transit
gateway are you going to deploy this
template out of the box it's going to
create for route tables in your transit
gateway and then it's going to build out
this architecture so that we can
seamlessly and automatically attach VP
C's from this account and multiple other
accounts to your transit gateway okay
the other piece to the hub accountants
we also have a UI that's attached to it
so you can kind of visualize and see an
audit trail of what's been going on in
that account so that's part of the hub
account you said there was a second
cloud formation that's also deployed as
part of this solution so the second time
play is really just creating a cloud
watch event within the account so that
and that's looking for changes in tag
within your V pcs so the way the
solution works is every time you tag a V
PC that you've created or one that you
have with certain predefined tags that
are part of the solution that's going to
kick off that cloud watch event and
that's going to make a call out to the
Amazon event bridge which allows into
connectivity between accounts for events
and that's going to trigger our workflow
to attach that view PC to to the transit
gateway so I heard two important things
first is every time we have a new VPC
there's a cloud formation template we
need to deploy as part of that V PC that
will then tie it back to that hub
account it is there's a second way that
you can deploy it as well it's either
per account or if you're working with in
AWS organizations you can pre-populate
the first cloud formation template with
the arm of your organization and that
will automatically add all of those
accounts in turn into the solution you
still have to deploy the second template
so you have that cloud watch event but
it's for organizations you can just put
in the on and then all of your accounts
are automatically ready to be connected
gotcha
the backbone of this solution seems to
be transit gateway can you talk a little
bit about what that function is doing
yes so what we're doing in here is we
have as we talked about earlier you've
got a central location where you can set
up your route tables for internet
connectivity between V pcs accounts and
on print ok to manually then actually go
through that process you have to go back
and forth between the account that you
want to connect where you have your V
pcs you need to set up associations you
have to set up or the gateways the
connectivity this solution takes away
all of that manual labor and replaces it
with a combination of lambda and step
functions to go through that process for
you
so you're eliminating the manual
configuration speeding time to deploy
these new VB corrects so all you have to
do now is just tag your VP sees in your
subnets with the associated tags that
will trigger your cloud watch event and
that will trigger the solution to
actually connect up you know transit
gateway that's pretty cool can you show
me a little bit about how that happens
yeah let's take a quick look in the
implementation guide we have deep we've
detailed out the tags now you can
customize the solution and change these
but out of the box what we've done is
we've set up four
route tables as just as examples okay
and then within all of your other
accounts on your VP C's all you need to
do is tag your VP C with either
associate or propagate and then define
the the route table as the value and
then for your subnets you simply tag it
with the attached to tgw so again not to
be repetitive here but this is occurring
on those spoke accounts or spoke VP C's
do so see that could be the same account
it doesn't have to be okay account so
you can do this on an account level
multiple account level or even at an
organization so can you show me a little
bit about the UI as part of this yes so
the UI gives us a couple of options the
solution can be deployed in two
different ways you can either say I want
to automatically approve any connections
to transit gateway okay so anything this
tagged will just get connected the other
option is that you can actually when you
deploy as you can say that I want to be
able to approve so little tighter
control tighter control so there's an
SNS subscription set up so that every
time the process the workflow is kicked
off you'll get a message or you can come
in to this dashboard and you can say yes
I approve that connection now I reject
it so the network administrator's
notified via SNS and when that event
occurred when that happens and then they
can also come in here in the cannot see
see all of the VP C's that are
associated with their transit gateway
and the nice piece about this doing it
this way is you also get a audit trail
so you'll see a history of all the
connectivities that's been set up so now
we could actually see all those spoke
accounts that have been associated with
our hub network correct so automation
and some degree of history to see what's
been going on and the ability to run
some kind of auditing that's pretty cool
sounds like it's saving us a lot of time
in administrating of these network
accounts great that's the water thanks
Tom
so st doe provides the tools necessary
to automate setting up and managing
transit networks and distributed AWS
environments the customer sets up their
routing tables through AWS transit
gateway then all they have to do is take
their v PCs and subnets Sdn I will
handle the rest a simple solution to a
complex problem I love it go check out
sto and other solutions on our AWS
solutions website
[Music]
you