Creating an AWS VPC Peering Connection

There are two ways of creating an AWS VPC peering connection:

  • Use the CLI (recommended)

  • Create a manual connection

To create a peering connection on a team cluster, you must have either an admin or developer role. See Managing Teams and Users.

Using the Hazelcast Cloud CLI

This option provides the easiest way of creating an AWS VPC Peering with your Enterprise Hazelcast Cloud cluster.

Set Up Your Environment

  1. Install Hazelcast Cloud CLI.

  2. Set the following AWS envrionment variables:

    • AWS_ACCESS_KEY_ID: Your access key ID.

    • AWS_SECRET_ACCESS_KEY: Your secret access key.

      These parameters will be used in order to create a peering connection from your side with Hazelcast Cloud CLI.

      For information about setting environment variables in AWS, see the AWS CLI documentation.

Create a Peering Connection

  1. Create the peering connection.

    hzcloud aws-peering create --cluster-id={YOUR_CLUSTER_ID} \
    --region={YOUR_REGION} \
    --vpc-id={YOUR_VPC_ID} \
    --subnet-ids={YOUR_SUBNET_LIST}

    Make sure to replace the following placeholders:

    • YOUR_CLUSTER_ID with the ID of your cluster.

      To get your cluster ID, use the hzcloud enterprise-cluster list command of the Hazelcast Cloud CLI.

    • YOUR_REGION with the name of the region which contains your VPC.

      You can get a list of Regions from the AWS service endpoints.

    • YOUR_VPC_ID with the ID of your VPC which you will create VPC Peering Connection.

      To get your VPC ID, use the aws ec2 describe-vpcs command of the AWS CLI.

    • YOUR_SUBNET_LIST with the comma-separated IDs of your subnets under your VPC that you provided.

      To get your VPC ID, use the aws ec2 describe-subnets command of the AWS CLI.

      When you run this command, it will create a VPC Peering connection from your environment to the VPC of your Hazelcast Cloud Enterprise cluster, then it will create the necessary routes for the VPC Peering connection. Lastly, it will accept this connection request from the Hazelcast Cloud side.

      CLI output for the <code>list</code> command

      This command may take up to 4 minutes to finish. You can follow ongoing actions while it is running.

  2. Check for active peerings in the Peering Connections tabs after you select VPC Service on AWS for your side of peering. In the example below, you can see how an active peering connection seems like.

    A list of active peering connections

    Do not overlap the CIDR of your Hazelcast Cloud Enterprise cluster and the CIDR of your VPC, otherwise the connection will fail.

Creating a Manual Connection

You can still create AWS VPC Peering without using Hazelcast Cloud CLI. But, you need the handle everything it does properly. This way is more difficult but more configurable.

In order to create AWS VPC Peering, you need to do the followings - Collect AWS Peering Properties for your Cluster with our API. - Create an AWS Peering Connection from your side to our side. - Create routes for AWS Peering Connection - Accept our side of the AWS VPC Peering Connection that you already sent, with API.

Collecting Properties

You need to collect AWS VPC Peering properties for your Enterprise Hazelcast Cloud cluster on AWS in order to create your side of the AWS VPC Peering connection. You can get these properties from Hazelcast Cloud Public API or Hazelcast Cloud SDK Go as the following command.

  • Hazelcast Cloud Public API

  • Hazelcast Cloud SDK

query {
  awsPeeringProperties(clusterId: "{YOUR_CLUSTER_ID}") {
    vpcId
    vpcCidr
    ownerId
    region
  }
}
client, _, _ := hazelcastcloud.New()
properties, _, _ := client.AwsPeering.GetProperties(context.Background(), &models.GetAwsPeeringPropertiesInput{ClusterId: "{YOUR_CLUSTER_ID}",}
)
fmt.Println(properties.VpcId)
fmt.Println(properties.VpcCidr)
fmt.Println(properties.OwnerId)
fmt.Println(properties.Region)

Creating a Peering Connection

To create a peering connection from your VPC to the Hazelcast Cloud VPC, use the values that you collected from the peering properties.

You can check how to create a VPC Peering Connection on AWS in the AWS documentation.

Creating Routes

To access the Hazelcast VPC, you must create routes.

You can check how to create routes properly according to for your VPC Peering Connection from Updating your Route tables for a VPC peering connection.

Accepting a Peering Request

To accept an AWS VPC Peering connection, use either the Hazelcast Cloud Public API or Hazelcast Cloud Go SDK.

  • Hazelcast Cloud Public API

  • Hazelcast Cloud SDK

mutation {
  acceptAwsPeering(
    input: {
      clusterId: "YOUR_CLUSTER_ID",
      vpcId: "YOUR_VPC_ID"
      vpcCidr: "YOUR_VPC_CIDR"
      peeringConnectionId: "YOUR_PEERING_CONNECTION_ID"
      subnets: [
        {subnetId: "YOUR_SUBNET_1", subnetCidr: "SUBNET_1_CIDR",},
        {subnetId: "YOUR_SUBNET_2", subnetCidr: "SUBNET_2_CIDR",},
        .
        .
        .
      ]
    }
  ) {
    status
  }
}
client, _, _ := hazelcastcloud.New()
result, _, _ := client.AwsPeering.Accept(context.Background(), &models.AcceptAwsPeeringInput{
  ClusterId: "YOUR_CLUSTER_ID",
  VpcId: "YOUR_VPC_ID",
  VpcCidr: "YOUR_VPC_CIDR",
  PeeringConnectionId: "YOUR_PEERING_CONNECTION_ID",
  Subnets: []models.AcceptAwsVpcPeeringInputSubnets{
  {
    SubnetId: "YOUR_SUBNET_1", SubnetCidr: "YOUR_SUBNET_1_CIDR"
  },
  {
    SubnetId: "YOUR_SUBNET_2", SubnetCidr: "YOUR_SUBNET_2_CIDR"
  },
   .
   .
   .
  },
})
fmt.Println(result.Status)

Verifying a Peering Connection

After you see the status value as Initiated., you can check for active peerings from the Peering Connections tabs after you select VPC Service on AWS on your side of peering.

The CIDR of your Hazelcast Cloud Enterprise cluster and the CIDR of your VPC should not overlap, otherwise you will not see a connection in this list.

Listing Peering Connections

You can list VPC peerings on your Enterprise Hazelcast Cluster by going to Cluster Details > *Settings > VPC Peering one by one as shown below. You can check where the connection established by checking VPC ID and Subnet from the list.

VPC peering settings

Also, you can easily use Hazelcast Cloud SDK, Hazelcast Cloud CLI for this.

  • Hazelcast Cloud Public API

  • Hazelcast Cloud SDK

query {
  awsPeerings(clusterId: "YOUR_CLUSTER_ID") {
    id
    vpcId
    vpcCidr
    subnetId
    subnetCidr
  }
}
client, _, _ := hazelcastcloud.New()
peerings, _, _ := client.AwsPeering.List(context.Background(), &models.ListAwsPeeringsInput{
    ClusterId: "YOUR_CLUSTER_ID",
})
for _,peering := range *peerings {
  fmt.Println(peering.Id)
  fmt.Println(peering.VpcId)
  fmt.Println(peering.VpcCidr)
  fmt.Println(peering.SubnetId)
  fmt.Println(peering.SubnetCidr)
}

Deleting Peering Connections

You can delete the VPC Peering Connection of your Enterprise Hazelcast Cluster on AWS from the VPC Peerings list by easily clicking the cross on the item.

Click Delete to delete the VPC peering connection

Also, you can easily use Hazelcast Cloud SDK, Hazelcast Cloud CLI for this.

  • Hazelcast Cloud Public API

  • Hazelcast Cloud SDK

mutation {
  deleteAwsPeering(id: "ID_OF_PEERING") {
    status
  }
}
client, _, _ := hazelcastcloud.New()
result, _, _ := client.AwsPeering.Delete(context.Background(), &models.DeleteAwsPeeringInput{
    Id: "ID_OF_PEERING",
})
fmt.Println(result.Status)