aws-cloudwan-workshop-code/cloudformation/CoreNetwork.yaml at main · aws-samples/aws-cloudwan-workshop-code · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
AWSTemplateFormatVersion: 2010-09-09
Description: CloudWAN Workshop

Resources:
  GlobalNetwork:
    Type: AWS::NetworkManager::GlobalNetwork
    Properties:
      Description: Global Network - AWS Cloud WAN workshop
      Tags:
        - Key: Name
          Value: global-network-cwan-workshop

  CoreNetwork:
    Type: AWS::NetworkManager::CoreNetwork
    Properties:
      Description: Core Network - AWS Cloud WAN workshop
      GlobalNetworkId: !Ref GlobalNetwork
      Tags:
        - Key: Name
          Value: core-network-cwan-workshop
      PolicyDocument:
        version: "2021.12"
        core-network-configuration:
          vpn-ecmp-support: false
          asn-ranges:
            - 64520-65525
          edge-locations:
            - location: eu-north-1
            - location: us-west-2
        segments:
          - name: prod
            require-attachment-acceptance: false
            edge-locations:
              - eu-north-1
              - us-west-2
          - name: thirdparty
            isolate-attachments: true
            require-attachment-acceptance: false
            edge-locations:
              - eu-north-1
              - us-west-2
          - name: onpremises
            require-attachment-acceptance: false
          # - name: legacy
          #   require-attachment-acceptance: false
          #   edge-locations:
          #     - eu-north-1
          #     - us-west-2
        network-function-groups:
          - name: EgressInspectionVpcs
            require-attachment-acceptance: false
          - name: InspectionVpcs
            require-attachment-acceptance: false
        # attachment-policies:
        #   - rule-number: 100
        #     condition-logic: or
        #     conditions:
        #       - type: tag-value
        #         operator: equals
        #         key: nfg
        #         value: inspection
        #     action:
        #       add-to-network-function-group: InspectionVpcs
        #   - rule-number: 200
        #     condition-logic: or
        #     conditions:
        #       - type: tag-value
        #         operator: equals
        #         key: nfg
        #         value: egressinspection
        #     action:
        #       add-to-network-function-group: EgressInspectionVpcs
        #   - rule-number: 300
        #     condition-logic: or
        #     conditions:
        #       - type: tag-exists
        #         key: domain
        #     action:
        #       association-method: tag
        #       tag-value-of-key: domain
        #   - rule-number: 400
        #     condition-logic: or
        #     conditions:
        #       - type: attachment-type
        #         operator: equals
        #         value: transit-gateway-route-table
        #     action:
        #       association-method: constant
        #       segment: legacy
        # segment-actions:
        #   - action: share
        #     mode: attachment-route
        #     segment: onpremises
        #     share-with:
        #       - prod
        #   - action: send-to
        #     segment: prod
        #     via:
        #       network-function-groups:
        #         - EgressInspectionVpcs
        #   - action: send-to
        #     segment: thirdparty
        #     via:
        #       network-function-groups:
        #         - EgressInspectionVpcs
        #   - action: send-via
        #     segment: thirdparty
        #     mode: dual-hop
        #     when-sent-to:
        #       segments:
        #         - prod
        #     via:
        #       network-function-groups:
        #         - InspectionVpcs
        #   - action: share
        #     mode: attachment-route
        #     segment: legacy
        #     share-with:
        #       - prod

Outputs:
  CoreNetworkId:
    Value: !GetAtt CoreNetwork.CoreNetworkId
    Description: Core Network Id
  CoreNetworkArn:
    Value: !GetAtt CoreNetwork.CoreNetworkArn
    Description: Core Network ARN