AWS Multi-Account Transit Gateway Walkthrough

Steps

1. 1

   Step 1: Inspect AWS Organizations & SCP Guardrails

   Review the organizational structure under organizations.tf and scp.tf. The baseline provisions Security, Infrastructure, and Workloads OUs with SCP guardrails that disallow root access and restrict unapproved regions.

   cat organizations.tf
   cat scp.tf
   

2. 2

   Step 2: Review Transit Gateway Route Attachments

   Examine transit-gateway.tf and spokes.tf to see how Workload VPCs attach to the central Transit Gateway hub. Notice how East-West traffic is isolated via dedicated Route 53 Resolver and Transit Gateway route tables.

   cat transit-gateway.tf
   cat spokes.tf
   

3. 3

   Step 3: Validate the Multi-Account Terraform Configuration

   Initialize Terraform without a backend and run terraform validate to verify the multi-account HCL configuration.

   terraform init -backend=false
   terraform validate
   

   Checked by the agent (terraform-validate): The runner checks that all AWS provider blocks and module calls adhere to Terraform HCL constraints offline.