VPC/VNet/VCN Peering Across Clouds

# Create VPC peering between two VPCs
PEERING_ID=$(aws ec2 create-vpc-peering-connection \
  --vpc-id vpc-aaa111 \
  --peer-vpc-id vpc-bbb222 \
  --peer-owner-id 111222333444 \
  --peer-region us-west-2 \
  --query 'VpcPeeringConnection.VpcPeeringConnectionId' \
  --output text)

# Accept the peering (from the peer account/VPC owner)
aws ec2 accept-vpc-peering-connection \
  --vpc-peering-connection-id "$PEERING_ID" \
  --region us-west-2

# Add routes to each VPC's route table
aws ec2 create-route \
  --route-table-id rtb-aaa111 \
  --destination-cidr-block 10.1.0.0/16 \
  --vpc-peering-connection-id "$PEERING_ID"

aws ec2 create-route \
  --route-table-id rtb-bbb222 \
  --destination-cidr-block 10.0.0.0/16 \
  --vpc-peering-connection-id "$PEERING_ID" \
  --region us-west-2

# Create bidirectional VNet peering
az network vnet peering create \
  --name hub-to-spoke1 \
  --resource-group network-rg \
  --vnet-name hub-vnet \
  --remote-vnet spoke1-vnet \
  --allow-vnet-access \
  --allow-forwarded-traffic \
  --allow-gateway-transit

az network vnet peering create \
  --name spoke1-to-hub \
  --resource-group network-rg \
  --vnet-name spoke1-vnet \
  --remote-vnet hub-vnet \
  --allow-vnet-access \
  --allow-forwarded-traffic \
  --use-remote-gateways

# Check peering status
az network vnet peering list \
  --resource-group network-rg \
  --vnet-name hub-vnet \
  --query '[].{Name:name, State:peeringState, AllowForwarded:allowForwardedTraffic}' \
  --output table

# Create bidirectional VPC peering
gcloud compute networks peerings create hub-to-app \
  --network=hub-vpc \
  --peer-network=app-vpc \
  --peer-project=app-project-id \
  --export-custom-routes \
  --import-custom-routes

gcloud compute networks peerings create app-to-hub \
  --network=app-vpc \
  --peer-network=hub-vpc \
  --peer-project=hub-project-id \
  --export-custom-routes \
  --import-custom-routes \
  --project=app-project-id

# Check peering status
gcloud compute networks peerings list \
  --network=hub-vpc \
  --format='table(name, network, peerNetwork, state, exportCustomRoutes, importCustomRoutes)'

# AWS Transit Gateway
resource "aws_ec2_transit_gateway" "main" {
  description                     = "Central transit hub"
  default_route_table_association = "enable"
  default_route_table_propagation = "enable"
  dns_support                     = "enable"
  auto_accept_shared_attachments  = "enable"

  tags = {
    Name = "central-tgw"
  }
}

resource "aws_ec2_transit_gateway_vpc_attachment" "vpc_a" {
  transit_gateway_id = aws_ec2_transit_gateway.main.id
  vpc_id             = aws_vpc.vpc_a.id
  subnet_ids         = aws_subnet.vpc_a_private[*].id

  tags = {
    Name = "vpc-a-attachment"
  }
}

resource "aws_ec2_transit_gateway_vpc_attachment" "vpc_b" {
  transit_gateway_id = aws_ec2_transit_gateway.main.id
  vpc_id             = aws_vpc.vpc_b.id
  subnet_ids         = aws_subnet.vpc_b_private[*].id

  tags = {
    Name = "vpc-b-attachment"
  }
}

# AWS to GCP VPN: AWS side
resource "aws_vpn_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags   = { Name = "aws-to-gcp-vgw" }
}

resource "aws_customer_gateway" "gcp" {
  bgp_asn    = 65002
  ip_address = google_compute_ha_vpn_gateway.main.vpn_interfaces[0].ip_address
  type       = "ipsec.1"
  tags       = { Name = "gcp-cgw" }
}

resource "aws_vpn_connection" "gcp" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.gcp.id
  type                = "ipsec.1"
  static_routes_only  = false
  tags                = { Name = "aws-to-gcp-vpn" }
}

# GCP side
resource "google_compute_ha_vpn_gateway" "main" {
  name    = "gcp-to-aws-vpn"
  network = google_compute_network.main.id
  region  = "us-central1"
}

resource "google_compute_external_vpn_gateway" "aws" {
  name            = "aws-vpn-gateway"
  redundancy_type = "TWO_IPS_REDUNDANCY"

  interface {
    id         = 0
    ip_address = aws_vpn_connection.gcp.tunnel1_address
  }
  interface {
    id         = 1
    ip_address = aws_vpn_connection.gcp.tunnel2_address
  }
}

resource "google_compute_vpn_tunnel" "tunnel1" {
  name                  = "aws-tunnel-1"
  vpn_gateway           = google_compute_ha_vpn_gateway.main.id
  peer_external_gateway = google_compute_external_vpn_gateway.aws.id
  shared_secret         = aws_vpn_connection.gcp.tunnel1_preshared_key
  router                = google_compute_router.main.id
  vpn_gateway_interface = 0
  peer_external_gateway_interface = 0
}