Enabling Network Connectivity Across Multiple Accounts by Sharing an Enterprise Router Using RAM

Scenario

Enterprises commonly use multiple accounts to isolate different cloud-based workloads and functions. However, workloads deployed across different accounts need to communicate with each other to support business collaboration. Traditionally, VPC peering connections must be established between VPCs in different accounts. Over time, this approach can result in a complex network that is difficult to manage.

This section describes how to enable network connectivity across multiple accounts by sharing an enterprise router (ER) instance using the resource sharing capabilities of RAM. In this example, Company A's organization contains a network management account, business account A, and business account B.

Creating an Enterprise Router

1. Log in to the management console and navigate to the Enterprise Routers list page.
2. Click Create Enterprise Router in the upper right corner of the page.
   Figure 1 Creating an enterprise router
   

3. Configure the basic information as prompted on the page, and select the Auto Accept Shared Attachments option to accept shared connections. For details about the parameters, see Creating an Enterprise Router.
4. Click Next.
5. On the configuration confirmation page, verify the enterprise router information. If the information is correct, click Submit to return to the Enterprise Routers page.
6. On the Enterprise Routers page, check the enterprise router status. When the status changes from Creating to Normal, the enterprise router has been created successfully.

Sharing an Enterprise Router

1. Log in to the RAM console.
2. In the navigation pane, choose Settings and toggle on Enable sharing with Organizations.
3. When the Enable sharing with Organizations toggle is blue, the function is enabled.
   Figure 2 Enabling sharing with organizations
   

4. Choose Shared by Me > Resource Shares.
5. Click Create Resource Share in the upper right corner.
   Figure 3 Creating a share
   

6. On the displayed Specify Resource Share Details page, configure basic information and specify the ER to share, and then click Next: Associate Permissions in the lower right corner.
   Figure 4 Specifying resources to share
   

7. On the Associate Permissions page, select the shared permissions supported by the specified resource type. Then, click Next: Specify Principals in the lower right corner.
   Figure 5 Associating permissions
   

8. On the Grant Access to Principals page, specify business account A and business account B as the principals that can use the shared resource. After completing the configuration, click Next: Confirm in the lower right corner.
   Figure 6 Specifying principals to grant access
   

9. Check the configuration and click OK in the lower right corner.
   Figure 7 Confirming configurations
   

Attaching a VPC in Business Account A to the Enterprise Router

1. Log in to the management console using business account A and go to the Enterprise Routers page.
2. Locate the shared enterprise router.
3. Click Manage Attachment in the upper right corner of the enterprise router pane to open its Attachments tab.
4. Click Add Attachment. The Add Attachment page is displayed.
5. Configure the basic information for the VPC attachment as prompted on the page. For details about the parameters, see Adding a VPC Attachment to an Enterprise Router.
6. After configuring the basic information, click Create Now to return to the attachment list.
7. Check the attachment status in the list. When the status changes from Creating to Normal, the attachment has been created successfully.
8. Navigate to the VPC list, select the target VPC, and configure its routes to enable network connectivity between the business accounts. For details about adding routes, see Creating a Custom Route Table.

Attaching a VPC in Business Account B to the Enterprise Router

1. Log in to the management console using business account B and go to the Enterprise Routers page.
2. Locate the shared enterprise router.
3. Click Manage Attachment in the upper right corner of the enterprise router pane to open its Attachments tab.
4. Click Add Attachment. The Add Attachment page is displayed.
5. Configure the basic information for the VPC attachment as prompted on the page. For details about the parameters, see Adding a VPC Attachment to an Enterprise Router.
6. After configuring the basic information, click Create Now to return to the attachment list.
7. Check the attachment status in the list. When the status changes from Creating to Normal, the attachment has been created successfully.
8. Navigate to the VPC list, select the target VPC, and configure its routes to enable network connectivity between the business accounts. For details about adding routes, see Creating a Custom Route Table.