From ee332c93b84a51a28b2692179079c41732a490e6 Mon Sep 17 00:00:00 2001 From: Diana <75819066+cloudjumpercat@users.noreply.github.com> Date: Tue, 13 Oct 2026 16:25:03 -0500 Subject: [PATCH 1/3] add request to get the vpc id Signed-off-by: Diana <75819066+cloudjumpercat@users.noreply.github.com> --- .../transit-gateways.md | 56 ++++++++++--------- 1 file changed, 30 insertions(+), 26 deletions(-) diff --git a/app/dedicated-cloud-gateways/transit-gateways.md b/app/dedicated-cloud-gateways/transit-gateways.md index d59cfde482e..4cadfb13b80 100644 --- a/app/dedicated-cloud-gateways/transit-gateways.md +++ b/app/dedicated-cloud-gateways/transit-gateways.md @@ -53,32 +53,21 @@ When you host your Data Plane nodes on [Dedicated Cloud Gateways](/dedicated-clo ## AWS configuration for Transit Gateway peering -This process includes three main steps: - -1. Create and share the [Transit Gateway in AWS](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-getting-started.html): - - 1. Navigate to **VPC > Transit Gateways** in the AWS Console. - 1. Select **Create transit gateway**, provide a name, and create the gateway. - 1. Save the Transit Gateway ID. - 1. Open the **Resource Access Manager**, and select **Create Resource Share**. - 1. Choose **Transit Gateways** as the resource type and select the newly created gateway. - 1. Name the resource share and retain default managed permission settings. - 1. Enable **Allow external accounts**, choose **AWS Account**, and enter the **AWS ID** from the {{site.konnect_short_name}} UI (**API Gateway > Networks**). - 1. Create the resource share and save the resulting **RAM Share ARN**. - - {:.warning} - > **RAM share requirements:** - > * The same Transit Gateway can be used in multiple networks, but they must be shared by different RAM shares. - > * Create a separate RAM share for each shared resource (do not include multiple resources in a single RAM share). - -2. Accept the Transit Gateway Attachment in AWS: - - 1. Go to **VPC > Transit Gateway Attachments** in the AWS Console. - 1. Locate the incoming attachment request from the {{site.konnect_short_name}} AWS Account ID. - 1. Accept the request to establish the connection. - 1. **Important:** Make sure a Transit Gateway Attachment is set up for each AWS VPC that needs to send or receive traffic. - - Each AWS VPC that needs to send or receive traffic must have its own Transit Gateway attachment. +Create and share the [Transit Gateway in AWS](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-getting-started.html): + +1. Navigate to **VPC > Transit Gateways** in the AWS Console. +1. Select **Create transit gateway**, provide a name, and create the gateway. +1. Save the Transit Gateway ID. +1. Open the **Resource Access Manager**, and select **Create Resource Share**. +1. Choose **Transit Gateways** as the resource type and select the newly created gateway. +1. Name the resource share and retain default managed permission settings. +1. Enable **Allow external accounts**, choose **AWS Account**, and enter the **AWS ID** from the {{site.konnect_short_name}} UI (**API Gateway > Networks**). +1. Create the resource share and save the resulting **RAM Share ARN**. + +{:.warning} +> **RAM share requirements:** +> * The same Transit Gateway can be used in multiple networks, but they must be shared by different RAM shares. +> * Create a separate RAM share for each shared resource (do not include multiple resources in a single RAM share). ## {{site.konnect_short_name}} configuration for Transit Gateway peering @@ -127,6 +116,21 @@ rows: To accept the Transit Gateway attachment in AWS, do the following: 1. In the AWS Console, go to **VPC > Transit Gateway Attachments**. +1. If you have more than one pending attachment request, look up each network's Kong-side AWS VPC ID so you can match it to the correct request in the AWS console. You can find the network ID by clicking **Networks** in the {{site.konnect_short_name}} sidebar: + + {% capture network_vpc_id %} + + {% konnect_api_request %} + url: /v2/cloud-gateways/networks/$KONNECT_NETWORK_ID + status_code: 200 + region: global + method: GET + {% endkonnect_api_request %} + + {% endcapture %} + {{ network_vpc_id | indent }} + + Match the value in `provider_metadata.vpc_id` against the VPC ID shown for each pending attachment request in the AWS console. 1. Wait for an attachment request from the Konnect AWS Account ID. 1. Accept the request. From 1d4b3c25737dd1434e2c48c2659ccab737b38e44 Mon Sep 17 00:00:00 2001 From: Diana <75819066+cloudjumpercat@users.noreply.github.com> Date: Wed, 14 Oct 2026 08:42:46 -0500 Subject: [PATCH 2/3] flip steps Signed-off-by: Diana <75819066+cloudjumpercat@users.noreply.github.com> --- app/dedicated-cloud-gateways/transit-gateways.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/dedicated-cloud-gateways/transit-gateways.md b/app/dedicated-cloud-gateways/transit-gateways.md index 4cadfb13b80..672f83e01de 100644 --- a/app/dedicated-cloud-gateways/transit-gateways.md +++ b/app/dedicated-cloud-gateways/transit-gateways.md @@ -116,6 +116,7 @@ rows: To accept the Transit Gateway attachment in AWS, do the following: 1. In the AWS Console, go to **VPC > Transit Gateway Attachments**. +1. Wait for an attachment request from the Konnect AWS Account ID. 1. If you have more than one pending attachment request, look up each network's Kong-side AWS VPC ID so you can match it to the correct request in the AWS console. You can find the network ID by clicking **Networks** in the {{site.konnect_short_name}} sidebar: {% capture network_vpc_id %} @@ -131,7 +132,6 @@ To accept the Transit Gateway attachment in AWS, do the following: {{ network_vpc_id | indent }} Match the value in `provider_metadata.vpc_id` against the VPC ID shown for each pending attachment request in the AWS console. -1. Wait for an attachment request from the Konnect AWS Account ID. 1. Accept the request. Ensure that each AWS VPC requiring traffic forwarding has its own Transit Gateway attachment. From 3897ecd8723d58e3a42f640fff7f3a740c2bf9ab Mon Sep 17 00:00:00 2001 From: Diana <75819066+cloudjumpercat@users.noreply.github.com> Date: Tue, 20 Oct 2026 11:58:03 -0500 Subject: [PATCH 3/3] Apply batched suggestions from code review Co-authored-by: kong-ksai[bot] <313415923+kong-ksai[bot]@users.noreply.github.com> Co-authored-by: lena-larionova <54370747+lena-larionova@users.noreply.github.com> --- app/dedicated-cloud-gateways/transit-gateways.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/app/dedicated-cloud-gateways/transit-gateways.md b/app/dedicated-cloud-gateways/transit-gateways.md index 672f83e01de..ab322ae36e1 100644 --- a/app/dedicated-cloud-gateways/transit-gateways.md +++ b/app/dedicated-cloud-gateways/transit-gateways.md @@ -67,7 +67,7 @@ Create and share the [Transit Gateway in AWS](https://docs.aws.amazon.com/vpc/la {:.warning} > **RAM share requirements:** > * The same Transit Gateway can be used in multiple networks, but they must be shared by different RAM shares. -> * Create a separate RAM share for each shared resource (do not include multiple resources in a single RAM share). +> * Create a separate RAM share for each shared resource. **Do not** include multiple resources in a single RAM share. ## {{site.konnect_short_name}} configuration for Transit Gateway peering @@ -117,7 +117,7 @@ To accept the Transit Gateway attachment in AWS, do the following: 1. In the AWS Console, go to **VPC > Transit Gateway Attachments**. 1. Wait for an attachment request from the Konnect AWS Account ID. -1. If you have more than one pending attachment request, look up each network's Kong-side AWS VPC ID so you can match it to the correct request in the AWS console. You can find the network ID by clicking **Networks** in the {{site.konnect_short_name}} sidebar: +1. If you have more than one pending attachment request, look up each network's Kong-side AWS VPC ID. You can find the network ID by clicking **Networks** in the {{site.konnect_short_name}} sidebar: {% capture network_vpc_id %}