Create a connection initiated from Google Cloud using NCC

This page describes how to successfully create and provision a Partner Cross-Cloud Interconnect for Amazon Web Services (AWS) connection using Network Connectivity Center (NCC) initiated from Google Cloud.

If you don't have an activation key from AWS, you can initiate and provision a Partner Cross-Cloud Interconnect for AWS connection from Google Cloud.

To achieve a successful connection, you must create the transport resource. Follow the instructions on this page to create the transport.

Before you start the Partner Cross-Cloud Interconnect for AWS provisioning process, ensure that the following conditions are met:

• You have an Amazon Web Services account.
• You create an NCC hub, if it doesn't already exist, to connect your transport resource to.

Considerations

Keep in mind the following considerations when using NCC to provision your Partner Cross-Cloud Interconnect for AWS connection:

• The default connectivity topology for the configuration is mesh topology.
• If you use star topology, the hybrid spokes are added to the center group. Edge group isn't supported for Partner Cross-Cloud Interconnect for AWS hybrid spokes.
• Spokes are auto accepted into a project.

Before you begin

Before you get started, review the following sections.

Create or select a project

To make it easier to configure Partner Cross-Cloud Interconnect for AWS, start by identifying a valid project.

Sign in to your Google Cloud account. If you're new to Google Cloud, create an account to evaluate how our products perform in real-world scenarios. New customers also get $300 in free credits to run, test, and deploy workloads.

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Install the Google Cloud CLI.

If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

To initialize the gcloud CLI, run the following command:

gcloud init

In the Google Cloud console, on the project selector page, select or create a Google Cloud project.

Roles required to select or create a project

• Select a project: Selecting a project doesn't require a specific IAM role—you can select any project that you've been granted a role on.
• Create a project: To create a project, you need the Project Creator role (roles/resourcemanager.projectCreator), which contains the resourcemanager.projects.create permission. Learn how to grant roles.

Go to project selector

Verify that billing is enabled for your Google Cloud project.

Install the Google Cloud CLI.

If you're using an external identity provider (IdP), you must first sign in to the gcloud CLI with your federated identity.

To initialize the gcloud CLI, run the following command:

gcloud init

1. If you are using the Google Cloud CLI, set your project ID by using the gcloud config set command.

   gcloud config set project PROJECT_ID

   Replace PROJECT_ID with your unique project ID.

   The gcloud CLI instructions on this page assume that you have set your project ID.

2. To confirm that you set the project ID correctly, use the gcloud config list command.

   gcloud config list --format='text(core.project)'

Enable the Network Connectivity API

Before you can perform any tasks using Cloud Interconnect, you must enable the Network Connectivity API.

Alternatively, you can enable the API by using the Google Cloud console API Library, as described in Enabling APIs.

Initiate connection from Google Cloud if you don't have an activation key

List available profiles

To list the available profiles in a specific project in the region where you want to provision connectivity, follow these steps.

gcloud network-connectivity transports remote-profiles list --region REGION

$ curl -H "Authorization: Bearer $(gcloud auth print-access-token)" "https://networkconnectivity.googleapis.com/v1/projects/PROJECT/locations/REGION/remoteTransportProfiles"

Create an NCC hub

If you haven't already, create an NCC hub to connect your transport resource to.

Create the transport resource

During the transport resource creation process, you must specify the bandwidth, remoteProfile and remoteAccountId fields.

advertisedRoutes is an optional field that advertises routes in addition to the hub's routing table.

Running the following commands establishes connectivity. As part of the hub, several new hybrid spokes are created.

To create a transport resource, follow these steps.

gcloud network-connectivity transports create TRANSPORT_NAME \
    --region=REGION \
    --remote-account-id=REMOTE_ACCOUNT_ID \
    --remote-profile=REMOTE_PROFILE_NAME \
    --bandwidth=BANDWIDTH \
    --hub=HUB_NAME \
    --advertised-routes=ADVERTISED_ROUTES \
    --stack-type=STACK_TYPE \
    --auto-accept

curl -X POST -H "Authorization: Bearer $(gcloud auth print-access-token)" -H "Content-Type: application/json" "https://networkconnectivity.googleapis.com/v1/projects/PROJECT/locations/REGION/transports?transportId="TRANSPORT_NAME" --data '{
"hub": "HUB_NAME",
"remoteProfile": "REMOTE_PROFILE_NAME",
"bandwidth": "BANDWIDTH",
"remoteAccountId": "REMOTE_ACCOUNT_ID",
"advertisedRoutes": ["ADVERTISED_ROUTE"],
"stackType": "STACK_TYPE",
"autoAccept": "true"
}'

GET https://networkconnectivity.googleapis.com/v1/locations/REGION/operations/OPERATION_ID

Complete the steps on the AWS API

Follow the instructions in the AWS API reference document, using the activation key that you generated in the previous step.

Verify your connection

You can verify that connectivity has been established by listing spokes attached to the hub that you created. You can also list NCC routes for your hub.

gcloud network-connectivity hubs list-spokes HUB_NAME

gcloud network-connectivity hubs route-tables routes list \
    --hub=HUB_NAME \
    --route_table=default

IP_CIDR_RANGE  PRIORITY  LOCATION   STATE   TYPE           SITE_TO_SITE  NEXT_HOP                                     HUB          ROUTE_TABLE
10.0.0.0/9     65536     us-east1   ACTIVE  DYNAMIC_ROUTE  OFF           transport-c24daa3d1fa6969a-7a3f13c5553ee9a0  HUB_NAME     default

GET https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs/HUB_NAME:listSpokes

GET https://networkconnectivity.googleapis.com/v1/projects/PROJECT_ID/locations/global/hubs/HUB_NAME/routeTables/NAME/routes

What's next

• To find answers to common questions about Cloud Interconnect architecture and features, see the Cloud Interconnect FAQ.
• To find out more about Cloud Interconnect, see the Cloud Interconnect overview.
• To learn about best practices when planning for and configuring Cloud Interconnect, see Best practices.
• To find Google Cloud resource names, see the Cloud Interconnect APIs.