tgw | Tiny Go Web

Since it might help somebody in the future - I will out myself ;)

I found out that I had due to copy of the arn had some Zero-width space characters in the line of the transit gateway arn.

https://en.wikipedia.org/wiki/Zero-width_space

I never encountered it before it is invisible in a lot of editors, i was able to see it in vi.

If you know roughly how long it takes for the aws_vpn_connection to be fully initialized and ready to use after its creation, you can use time_sleep resource to delay execution of your aws_ec2_transit_gateway_route_table_propagation.

For example, assuming it takes 30 seconds, you could do:

Sadly you can't do this. The proper way to structure your code is into modules. So you would have to transform main1 and main2 into submodules and then create top-level main.tf. The creation of main1 and main2 modules in main will ensure correct order.

This is not very clear in the terraform documentation, but I found an example on the internet that clarified this question.

In short, the aws_customer_gateway config is not on the AWS side of the IPSec tunnel... these resources are "remote" with respect to AWS:

So in this case, the ip_address will be the destination ip address of AWS IPSec packets leaving the AWS Transit Gateway; the aws_customer_gateway ip_address is not owned by AWS.

"Auto-accept shared attachments" applies for TG VPC attachments . However you are trying to do TG peering attachment. For such attachments, there is no auto-accept:

To activate the peering attachment, the owner of the accepter transit gateway must accept the peering attachment request. This is required even if both transit gateways are in the same account. The peering attachment must be in the pendingAcceptance state. Accept the peering attachment request from the Region that the accepter transit gateway is located in.

The aws_ec2_transit_gateway_vpc_attachment_accepter you are trying to use applies to TG VPC attachments, not TG peering ones.

If the two accounts are managed by one statefile, you can use module outputs.

If both accounts are created separately, you can use a data module in terraform to reference a resource that is not managed by terraform or managed by a different statefile.

The key options for a transit gateway data resource are documented here.

The simplest way is to add the ID value in configuration for your account 2 build, and reference it that way. If that's not possible, you can add a friendly name in a tag, and use a filter to find it elsewhere:

You can try the following version:

The AWS docs write that you can have your gateway in only one subnet per AZ:

You must select at least one subnet. You can select only one subnet per Availability Zone.

Your error msg suggests that your module.vpc.private_subnets are in same AZ. You have to redefine your VPC so that module.vpc.private_subnets are in two different AZs, or just use one subnet in your subnet_ids.

To use one subnet:

There are no [9, 10, 11, 12] in your tga_vpn, so I will just focus on prod and dev.

You should be able to construct your data structure, assuming that I understand correctly your desired outcome, as follows: