Adding a cross-account connection

Adding a cross-account connection in the UI

To connect networks that different accounts own by using the UI, follow these steps:

1. From your browser, open the IBM Cloud console and log in to your account.

2. Select the Navigation Menu icon from the upper left, then click Interconnectivity > Transit Gateway.

3. Click the name of the transit gateway where you want to add a connection. Then, click Add connection.

4. Choose your network connection type. Then, select Request connection to a network in another account.

5. Type the CRN of the cross-account network, or if Classic infrastructure or an Unbound or RedundantGRE, enter the IBM Cloud account ID that you want to connect to.

   • To get the IBM Cloud account ID for a Classic infrastructure or an Unbound or RedundantGRE tunnel connection, select Manage > Account from the IBM Cloud console and choose Account Settings. Your account ID shows in the Account section of the Account settings page.
   • To get the CRN of a VPC, Direct Link, or Power Systems Virtual Server, select the Navigation Menu icon from the upper left, then click Resource list. Expand Networking (for VPC and Direct Link) or Computing (for Power Systems Virtual Server) to list your networking resources, then locate the service that you are looking for. Next, click anywhere in the service's table row (except for the Name link). From the side window that appears, copy the CRN and paste it into the Add connection pane.

6. Complete any remaining fields, then click Add. The network connection now shows the Pending approval status in the gateway owner's account.

   For the Classic infrastructure connection, the ID number is for your IBM Cloud account, not for a SoftLayer account.

   The network owner's account then receives a notification of the request. If the network owner rejects the cross-account connection, no connectivity is established and the connection shows a status of Rejected. You can now delete this connection. If the cross-account connection is not explicitly approved, it expires after 72 hours.

   Connection requests can be resubmitted if they expire or are rejected.

7. A user with the necessary IAM permissions in the network owner's account can see the gateway and the details of all other connections that are attached to it in View only mode. From the network owner's account, go to the Transit Gateway page and click the gateway name in the table.

8. In the Connections section, see Action required to view the incoming network connection request. A user with the necessary additional IAM permissions can then click Approve to approve the request.

   After the network owner's account ensures that the connection request is from a legitimate source and approves it, the system establishes routes to and from all other networks that are connected to the same transit gateway. Use of network ACLs and/or security groups within networks that are accessible across accounts are highly recommended to control the network traffic flows. You can unilaterally detach cross-account connections by either account through users who have the appropriate permissions.

   Click Approve to confirm. The status of the network connection indicates Attaching.

9. When you change back to the original account, the status of the connection changes to Attached, indicating that the network request was approved.

   The gateway owner's account (or the network owner's account) can delete the connection. If the network owner deletes the connection, the gateway owner sees the connection status as Detached.

Adding a cross-account connection from the CLI

Creating a cross-account connection consists of the following steps:

1. Request connection to communicate with other account.
2. Approve/Reject connection on other account.

For example, to request a connection to communicate with another account, run the following command:

ibmcloud tg connection-create|cc GATEWAY_ID --name NAME --network-type NETWORK-TYPE --network-id NETWORK_ID [-h, --help]

Where:

GATEWAY_ID

ID of the gateway that the new connection is on.

--name

Name of the new connection.

--network-type

Network type of the connection. Values are classic, vpc, directlink, or power_virtual_server.

To create an unbound GRE tunnel, see the ibmcloud tg connection-create-gre command.

--network-id

ID of the network connection. For classic connections, do not set a value. Use the CRN for all other network types.

--output json

Optional. Specify whether you want the output to display in JSON format.

--help | -h

Optional. Get help on this command.

ibmcloud tg cc $gateway --name vpc-connection --network-id $vpcCRN --network-type vpc

ibmcloud tg cc $gateway --name classic-conn --network-account-id 67123579566843320188712647902101 --network-type classic

ibmcloud tg connection-approve|ca GATEWAY_ID CONNECTION_ID [-h, --help]

ibmcloud tg connection-reject|cr GATEWAY_ID CONNECTION_ID [-h, --help]

Adding a cross-account connection with the API

To add a cross-account connection, follow these steps:

1. Request a connection to communicate between other accounts.
2. Perform actions on a requested connection. This must be completed.

For classic cross-account connections, be sure that the network-account-id is set to the account you are requesting to communicate with. For VPC cross-account connections, be sure that the network-id is set to the account that you are requesting to communicate with.

For more information, see Adds a connection to a Transit Gateway and Performs actions on a connection for a Transit Gateway in the Transit Gateway API reference.

curl -X POST --location --header "Authorization: Bearer {iam_token}" \
  --header "Accept: application/json" \
  --header "Content-Type: application/json" \
  --data '{ "network_type": "vpc" }'
  "
{base_url}/transit_gateways/{transit_gateway_id}/connections?version={version}"

  "name": "Transit_Service_BWTN_SJ_DL",
  "network_id": "crn:v1:bluemix:public:is:us-south:a/123456::vpc:4727d842-f94f-4a2d-824a-9bc9b02c523b",
  "network_type": "vpc",
  "prefix_filters": [
    {
      "action": "permit",
      "ge": 0,
      "le": 32,
      "prefix": "192.168.100.0/24"
    }
  ],
  "prefix_filters_default": "permit",

{
  "created_at": "2020-03-31T12:08:05Z",
  "id": "1a15dca5-7e33-45e1-b7c5-bc690e569531",
  "name": "example-connection",
  "network_id": "crn:[...]",
  "network_type": "vpc",
  "status": "pending",
  "updated_at": "2020-03-31T12:08:05Z"
}

"
{base_url}/transit_gateways/{transit_gateway_id}/connections/{id}/actions?version={version}"
{
  "action": "approve"
}

{
  "errors": [
    {
      "code": "missing_field",
      "message": "The `location` field is required.",
      "more_info": "https://transitservice.cloud.ibm.com/",
      "target": {
        "name": "location",
        "type": "field"
      }
    }
  ],
  "trace": "86780a34-e651-4b47-9fb0-184a169cc9af"
}

Adding a connection by using Terraform

Review the following argument references that you can specify for your resource when you create a cross-connection for a transit gateway using Terraform:

resource "ibm_tg_connection" "test_ibm_tg_connection" {
  gateway      = ibm_tg_gateway.test_tg_gateway.id
  network_type = "vpc"
  name         = "myconnection"
  network_id   = ibm_is_vpc.test_tg_vpc.resource_crn
}