AWS prescriptive-guidance documentation change
Summary
Updated documentation to incorporate an agentic AI development approach using Kiro for automating inter-region Transit Gateway peering setup. Changes include new prerequisites (Kiro IDE), revised architecture and tools sections, and a completely rewritten epics section with step-by-step prompts for code generation and deployment.
Security assessment
The changes are focused on automation methodology and tooling (Kiro, CloudFormation, Step Functions). There is no evidence of addressing a specific security vulnerability, weakness, or incident. The mention of security groups and network ACLs is part of standard VPC configuration prerequisites and not a new security feature. The update is a procedural and architectural change, not a security fix.
Diff
diff --git a/prescriptive-guidance/latest/patterns/automate-the-setup-of-inter-region-peering-with-aws-transit-gateway.md b/prescriptive-guidance/latest/patterns/automate-the-setup-of-inter-region-peering-with-aws-transit-gateway.md index 236b9b8ac..92f758462 100644 --- a//prescriptive-guidance/latest/patterns/automate-the-setup-of-inter-region-peering-with-aws-transit-gateway.md +++ b//prescriptive-guidance/latest/patterns/automate-the-setup-of-inter-region-peering-with-aws-transit-gateway.md @@ -5 +5 @@ -SummaryPrerequisites and limitationsArchitectureToolsEpicsRelated resourcesAttachments +SummaryPrerequisites and limitationsArchitectureToolsEpicsRelated resources @@ -13 +13 @@ SummaryPrerequisites and limitationsArchitectureToolsEpicsRelated resourcesAttac -AWS Transit Gateway connects virtual private clouds (VPCs) and on-premises networks through a central hub. Transit Gateway traffic always stays on the global Amazon Web Services (AWS) backbone and doesn't traverse the public internet, which reduces threat vectors, such as common exploits and distributed denial of service (DDoS) attacks. +[AWS Transit Gateway](https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html) connects virtual private clouds (VPCs) and on-premises networks through a central hub. Transit Gateway traffic doesn't traverse the public internet, which reduces threat vectors, such as common exploits and distributed denial of service (DDoS) attacks. @@ -15 +15 @@ AWS Transit Gateway connects virtual private clouds (VPCs) and on-premises netwo -If you need to communicate between two or more AWS Regions, you can use inter-Region Transit Gateway peering to establish peering connections between transit gateways in different Regions. However, manually configuring inter-Region peering with Transit Gateway can be a time-consuming process that has multiple steps. This pattern provides an automated process to remove these manual steps by using code to perform the peering. You can use this approach if you have to repeatedly configure several Regions and AWS accounts during a multi-Region organization setup. +If you need to communicate between two or more AWS Regions, you can use inter-Region Transit Gateway peering to establish peering connections between transit gateways in different Regions. However, manually configuring inter-Region peering with Transit Gateway can be a complex and time-consuming. This pattern provides guidance for using infrastructure as code (IaC) to set up peering. You can use this approach if you have to repeatedly configure several Regions and AWS accounts for a multi-Region organization setup. @@ -17 +17 @@ If you need to communicate between two or more AWS Regions, you can use inter-Re -This pattern uses an AWS CloudFormation stack that includes the AWS Step Functions workflow, AWS Lambda functions, AWS Identity and Access Management (IAM) roles, and log groups in Amazon CloudWatch Logs. You can then start a Step Functions execution and create the inter-Region peering connection for your transit gateways. To manually set up inter-Region peering, see [Peer VPCs in different AWS Regions by using AWS Transit Gateway](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/peer-vpcs-different-regions-transit-gateway.html). +This pattern sets up an [AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html)stack that includes an AWS Step Functions [workflow](https://docs.aws.amazon.com/step-functions/latest/dg/concepts-statemachines.html), AWS Lambda [functions](https://docs.aws.amazon.com/lambda/latest/dg/concepts-basics.html#gettingstarted-concepts-function), AWS Identity and Access Management (IAM) [roles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html), and [log groups](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/Working-with-log-groups-and-streams.html) in Amazon CloudWatch Logs. You then run the Step Functions workflow to create the inter-Region peering connection for your transit gateways. @@ -25 +25 @@ This pattern uses an AWS CloudFormation stack that includes the AWS Step Functio - * An existing Amazon Simple Storage Service (Amazon S3) bucket. + * An IDE that has code-generation capability, such as [Kiro](https://kiro.dev/#what-is-kiro). @@ -27 +27 @@ This pattern uses an AWS CloudFormation stack that includes the AWS Step Functio - * Transit gateways, created and configured in the requestor Region and the acceptor Regions. The _requester_ Region is where a peering request is originated and the _acceptor_ Regions accept the peering request. For more information about this, see [Creating and accepting a VPC peering connection](https://docs.aws.amazon.com/vpc/latest/peering/create-vpc-peering-connection.html) in the Amazon VPC documentation. + * An Amazon Simple Storage Service (Amazon S3) bucket and permissions to upload objects to it. @@ -29 +29 @@ This pattern uses an AWS CloudFormation stack that includes the AWS Step Functio - * VPCs, installed and configured in the acceptor and requester Regions. For steps to create a VPC, see [Create the VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-getting-started.html#getting-started-create-vpc) from [Get Started with Amazon VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-getting-started.html) in the Amazon VPC documentation. + * Transit gateways created in the requesting and accepting Regions. @@ -31 +31 @@ This pattern uses an AWS CloudFormation stack that includes the AWS Step Functio - * The VPCs must use the `addToTransitGateway` tag and `true` value. + * VPCs created in the requesting and accepting Regions. Tag the VPCs with an `addToTransitGateway` key with a value of `true`. @@ -33 +33 @@ This pattern uses an AWS CloudFormation stack that includes the AWS Step Functio - * Security groups and network access control lists (ACLs) for your VPCs, configured according to your requirements. For more information about this, see [Security groups for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) and [Network ACLs](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html) in the Amazon VPC documentation. + * [Security groups](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html) configured for your VPCs according to your requirements. @@ -34,0 +35 @@ This pattern uses an AWS CloudFormation stack that includes the AWS Step Functio + * [Network access control lists (ACLs)](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html) configured for your VPCs according to your requirements. @@ -38 +38,0 @@ This pattern uses an AWS CloudFormation stack that includes the AWS Step Functio -**AWS Regions and limitations** @@ -40 +40 @@ This pattern uses an AWS CloudFormation stack that includes the AWS Step Functio - * Only certain AWS Regions support inter-Region peering. For a full list of Regions that support inter-Region peering, see the [AWS Transit Gateway FAQs](https://aws.amazon.com/transit-gateway/faqs/). +**Limitations** @@ -42 +42 @@ This pattern uses an AWS CloudFormation stack that includes the AWS Step Functio - * In the attached sample code, the requestor Region is assumed to be `us-east-2`, and the acceptor Region is assumed to be `us-west-2`. If you want to configure different Regions, you must edit these values in all Python files. To implement a more complex setup that involves more than two Regions, you can change the Step Function to pass the Regions as a parameter to the Lambda function and run the function for each combination. + * Only some AWS Regions support inter-Region peering. For a full list of Regions that support inter-Region peering, see the [AWS Transit Gateway FAQs](https://aws.amazon.com/transit-gateway/faqs/). @@ -49 +49 @@ This pattern uses an AWS CloudFormation stack that includes the AWS Step Functio - +The agentic AI development approach described in this pattern involves the following steps: @@ -51 +51 @@ This pattern uses an AWS CloudFormation stack that includes the AWS Step Functio -The diagram shows a workflow with the following steps: + 1. **Define the automation prompt** – Kiro receives a natural language prompt that details the peering requirements. @@ -53 +53 @@ The diagram shows a workflow with the following steps: - 1. The user creates an AWS CloudFormation stack. + 2. **Generate automation script** – Kiro generates the CloudFormation and Lambda scripts based on the provided prompt. @@ -55 +55 @@ The diagram shows a workflow with the following steps: - 2. AWS CloudFormation creates a Step Functions state machine that uses a Lambda function. For more information about this, see [Creating a Step Functions state machine that uses Lambda](https://docs.aws.amazon.com/step-functions/latest/dg/tutorial-creating-lambda-state-machine.html) in the AWS Step Functions documentation. + 3. **Deploy the stack** – Kiro uses CloudFormation to deploy the required resources. @@ -57 +57 @@ The diagram shows a workflow with the following steps: - 3. Step Functions calls a Lambda function for peering. + 4. **Set up peering** – Kiro runs the Step Functions workflow, which calls Lambda functions to create peering connections and modify route tables. @@ -59 +58,0 @@ The diagram shows a workflow with the following steps: - 4. The Lambda function creates a peering connection between transit gateways. @@ -61 +59,0 @@ The diagram shows a workflow with the following steps: - 5. Step Functions calls a Lambda function for route table modifications. @@ -63 +60,0 @@ The diagram shows a workflow with the following steps: - 6. The Lambda function modifies the route tables by adding the Classless Inter-Domain Routing (CIDR) block of the VPCs. @@ -65,4 +62 @@ The diagram shows a workflow with the following steps: - - - -**Step Functions workflow** +The following diagram shows the Step Functions workflow: @@ -72 +66 @@ The diagram shows a workflow with the following steps: -The diagram shows the following Step Functions workflow: +The workflow contains the following steps: @@ -74 +68 @@ The diagram shows the following Step Functions workflow: - 1. The Step Functions workflow calls the Lambda function for the transit gateway peering. + 1. The Step Functions workflow calls the Lambda function for the Transit Gateway peering. @@ -76 +70 @@ The diagram shows the following Step Functions workflow: - 2. There is a timer call to wait for one minute. + 2. The workflow waits for one minute. @@ -78 +72 @@ The diagram shows the following Step Functions workflow: - 3. The peering status is retrieved and sent to the condition block. The block is responsible for the looping. + 3. The workflow retrieves the peering status and sends it to the condition block. The block is responsible for the looping. @@ -82 +76,3 @@ The diagram shows the following Step Functions workflow: - 5. If the success condition is met, a Lambda function is called to modify the route tables. After this call, the Step Functions workflow ends. + 5. If the success condition is met, a Lambda function modifies the route tables. + + 6. The Step Functions workflow ends. @@ -89 +85,3 @@ The diagram shows the following Step Functions workflow: - * [AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html) – AWS CloudFormation is a service that helps you model and set up your AWS resources. + * [AWS CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html) helps you set up AWS resources, provision them quickly and consistently, and manage them throughout their lifecycle across AWS accounts and AWS Regions. + + * [Amazon CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html) helps you centralize the logs from all your systems, applications, and AWS services so you can monitor them and archive them securely. @@ -91 +89 @@ The diagram shows the following Step Functions workflow: - * [Amazon CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html) – CloudWatch Logs helps you centralize the logs from all of your systems, applications, and AWS services that you use. + * [AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)[ (](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)[IAM](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)[)](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html) helps you securely manage access to your AWS resources by controlling who is authenticated and authorized to use them. @@ -93 +91 @@ The diagram shows the following Step Functions workflow: - * [AWS Identity and Access Management (IAM)](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html) – IAM is a web service for securely controlling access to AWS services. + * [Kiro](https://kiro.dev/#what-is-kiro) is an agentic AI development tool that helps you build production-ready applications through spec-driven development. @@ -95 +93 @@ The diagram shows the following Step Functions workflow: - * [AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) – Lambda runs your code on a high-availability compute infrastructure and performs all of the administration of the compute resources. + * [AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html) is a compute service that helps you run code without needing to provision or manage servers. It runs your code only when needed and scales automatically, so you pay only for the compute time that you use. @@ -97 +95 @@ The diagram shows the following Step Functions workflow: - * [AWS Step Functions](https://docs.aws.amazon.com/step-functions/latest/dg/welcome.html) – Step Functions makes it easy to coordinate the components of distributed applications as a series of steps in a visual workflow. + * [AWS Step Functions](https://docs.aws.amazon.com/step-functions/latest/dg/welcome.html) is a serverless orchestration service that helps you combine AWS Lambda functions and other AWS services to build business-critical applications. @@ -106,2 +104,15 @@ Task| Description| Skills required -Upload the attached files to your S3 bucket.| Sign in to the AWS Management Console, open the Amazon S3 console, and then upload the `modify-transit-gateway-routes.zip`, `peer-transit-gateway.zip`, and `get-transit-gateway-peering-status.zip` files (attached) to your S3 bucket.| General AWS -Create the AWS CloudFormation stack.| Run the following command to create an AWS CloudFormation stack using the `transit-gateway-peering.json` file (attached):`aws cloudformation create-stack --stack-name myteststack --template-body file://sampletemplate.json`The AWS CloudFormation stack creates the Step Functions workflow, the Lambda functions, IAM roles, and CloudWatch log groups.Make sure that the AWS CloudFormation template refers to the S3 bucket that contains the files that you uploaded earlier. +Filling prompt placeholders with specific details| + + 1. Update the following prompt by replacing the AWS Regions and bucket names: + + - Active region: ACTIVE_REGION + - Passive region: PASSIVE_REGION + - S3_BUCKET : my-lambda-packages-bucket + - STACK_NAME : transit-gateway-peering + - All Lambda functions use two boto3 EC2 clients at module level (one per region), each with signature_version v4 and retries max_attempts=1 mode=standard. + - Print all API responses for CloudWatch logging. + + 2. Save this as a markdown file. + 3. Add this markdown file to your Kiro project for context. + + @@ -111,3 +122,2 @@ Create the AWS CloudFormation stack.| Run the following command to create an AWS -You can also create a stack by using the AWS CloudFormation console. For more information about this, see [Creating a stack on the AWS CloudFormation console](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-console-create-stack.html) in the AWS CloudFormation documentation.| DevOps engineer -Start a new execution in Step Functions.| Open the Step Functions console and start a new execution. Step Functions calls the Lambda function and creates the peering connection for the transit gateways. You don't need an input JSON file. Verify that an attachment is available and that the connection type is **Peering**.For more information about this, see [Start a new execution](https://docs.aws.amazon.com/step-functions/latest/dg/getting-started.html#start-new-execution) from [Getting started with AWS Step Functions ](https://docs.aws.amazon.com/step-functions/latest/dg/getting-started.html)in the AWS Steps Functions documentation.| DevOps engineer, General AWS -Verify the routes in the route tables. | Inter-Region peering is established between the transit gateways. The route tables are updated with the peer Region VPC's IPv4 CIDR block range. Open the Amazon VPC console and choose the **Associations** tab in the route table that corresponds to the transit gateway attachment. Verify the VPC CIDR block range of the peered Regions. For detailed steps and instructions, see [Associate a transit gateway route table](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-route-tables.html#associate-tgw-route-table) in the Amazon VPC documentation.| Network administrator +Alternatively, you can add this as an inline prompt that references the above variables without attaching the file for context.| General AWS, Network administrator +Create a Lambda function that creates the peering attachments.| @@ -115 +125,19 @@ Verify the routes in the route tables. | Inter-Region peering is established bet -## Related resources + 1. In your Kiro project, enter the following prompt: + + Write a Python Lambda that creates a transit gateway peering attachment from active region to passive region. Both of these regions will be read as environment variables of the Lambda function. Use two boto3 EC2 clients at the module level, one per Region. The handler should describe available transit gateways in both Regions. Then check if a peering attachment already exists on the active side by filtering describe_transit_gateway_attachments for resource-type "peering" and states: available, initiatingRequest, modifying, pendingAcceptance, pending, rejected, and rejecting. Only if zero results, create the peering attachment with tags for both Transit Gateway IDs, then wait 60 seconds (AWS needs this before the passive side can accept), then call accept_transit_gateway_peering_attachment on the passive client. Print all API responses. + + 2. Save and name this file `peer-transit-gateway.py`. + +| General AWS, Network administrator, Prompt engineering +Create a Lambda function that polls the peering attachment status.| + + 1. In your Kiro project, enter the following prompt: + + Using the shared context above, write a Python Lambda that polls peering attachment status. Describe available transit gateways in both regions, then call describe_transit_gateway_attachments on the active client filtered by the active Transit Gateway ID only (no resource-type filter). Return exactly `{'status': status}` where status is the State field from the first attachment. Do not return statusCode or body — the Step Function Choice state reads `$.Payload.status` and compares to "available". + + 2. Save and name this file `get-transit-gateway-peering-status.py`. + +| General AWS, Network administrator, Prompt engineering +Create a Lambda function that adds static routes to both Regions.| + + 1. In your Kiro project, enter the following prompt: @@ -117 +145 @@ Verify the routes in the route tables. | Inter-Region peering is established bet - * [Executions in Step Functions](https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-executions.html) + Using the shared context, write a Python Lambda that adds static routes to both regions' TGW route tables. Describe available transit gateways in both Regions, extract each transit gateway's AssociationDefaultRouteTableId. Discover routable VPCs by filtering describe_vpcs with tag `addtotransitgateway=true` in each region, collecting their CIDRs. Get the peering attachment ID from the active side by filtering on the active route table ID. For each passive CIDR, search the active route table using `route-search.exact-match` — only create the route if none found. For each active CIDR, search the passive route table using `route-search.supernet-of-match` (not exact-match — passive side may have supernet routes) — only create if none found. Both sides use the same peering attachment ID. @@ -119 +147 @@ Verify the routes in the route tables. | Inter-Region peering is established bet - * [Transit gateway peering attachments](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-peering.html) + 2. Save and name this file as `modify-transit-gateway-routes.py`. @@ -121 +149,42 @@ Verify the routes in the route tables. | Inter-Region peering is established bet - * [Peer VPCs in different AWS Regions by using AWS Transit Gateway](https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/peer-vpcs-different-regions-transit-gateway.html) +| General AWS, Network administrator +Create the CloudFormation template.| + + 1. Enter the following orchestration prompt, which creates a CloudFormation template: + + Write a CloudFormation JSON template that deploys: three Lambda functions (peer-transit-gateway with 600s timeout, get-transit-gateway-peering-status with 30s timeout, modify-transit-gateway-routes with 600s timeout), Lambda code from an S3 bucket parameter (no default value — user must supply the bucket name at deploy time), a Step Functions state machine, and CloudWatch log groups with 90-day retention. The state machine flow is: + + 1. Invoke peer-transit-gateway + 2. Wait 20 seconds (attachment needs time after the Lambda's internal 20s sleep + acceptance) + 3. Invoke get-transit-gateway-peering-status + 4. Choice: if `$.Payload.status` equals "available" → go to step 5, otherwise loop back to step 2 + 5. Invoke modify-transit-gateway-routes → End + + Use `Fn::Sub` with Lambda ARN references like `${PeerTransitGateways.Arn}` in the DefinitionString. The polling loop has no max retry — it loops until "available" (typically 3-5 minutes total). + + 2. Save and name the file `transit-gateway-peering.json`. + +| AWS DevOps, General AWS, Prompt engineering + +Task| Description| Skills required +---|---|--- +Deploy the CloudFormation stack by using prompts.| Enter the following prompt: + + + Using the outputs from Prompts 1-4, package and deploy the full stack. Steps: + + 1. For each of the three Python files from Prompts 1-3, create a zip named after the file (e.g. peer-transit-gateway.zip that contains peer-transit-gateway.py). + 2. Upload all three zips to S3_BUCKET. + 3. Deploy the CloudFormation template from Prompt 4 to ACTIVE_REGION with S3BucketName=S3_BUCKET and CAPABILITY_NAMED_IAM. + 4. Initiate the Step Function from the deployed stack. + + Zip file names must match the S3Key values in the template exactly. + +| AWS DevOps, Cloud administrator, General AWS, Prompt engineering +Validate deployment.| + + 1. Monitor the Step Functions workflow for successful completion. For instructions, see the [Step Functions documentation](https://docs.aws.amazon.com/step-functions/latest/dg/concepts-view-execution-details.html). + 2. Verify that the Transit Gateway attachment peering status is available. For instructions, see the [Transit Gateway documentation](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-peering.html). + +| General AWS + +## Related resources @@ -123 +192 @@ Verify the routes in the route tables. | Inter-Region peering is established bet - * [Interconnecting VPCs across AWS Regions using AWS Transit Gateway - Demo](https://www.youtube.com/watch?v=cj1rQqLxXU8) (video) + * [Starting state machine executions in Step Functions](https://docs.aws.amazon.com/step-functions/latest/dg/concepts-state-machine-executions.html)