____.             ________        ________
    |    |____  ___.__.\_____  \       \_____  \   ____   ____
    |    \__  \<   |  | /  / \  \       /   |   \ /    \_/ __ \
/\__|    |/ __ \\___  |/   \_/.  \     /    |    \   |  \  ___/
\________(____  / ____|\_____\ \_/_____\_______  /___|  /\___  >
              \/\/            \__>_____/       \/     \/     \/

--=[ PrEsENtZ ]=--

--=[ AwS CLouD NeTWoRkiNg SuiTE 3000 ]=--

--=[ Build and scale cloud network topologies from compiler components in AWS and Terraform ]=--

--=[ #StayUp ]=--

Docs

NEW Compiler Semantic Toolchain

• Ten semantic outputs that make the compiler's decisions inspectable, enabled via the inspect field on each IR module.
  • Reachability Matrix: the algebra's per-pair verdict as structured data, showing permitted/denied and which precedence level decided it.
  • Diagnostics: compiler warnings for policy states that are valid but likely unintentional.
  • Provenance: debug symbols for emitted routes, tracing each route back to the source VPC pair and the policy primitive that authorized it.
  • Policy Diff: incremental compilation preview, computing what changed in connectivity at the semantic level given a previous reachability matrix.
  • Equivalence: proves two different policy declarations produce identical reachability, the network policy equivalent of "these two programs compute the same function."
  • Assertions: postcondition checks (must_deny, must_permit) verified against the reachability matrix at plan time, with out-of-scope CIDR validation.
  • Blast Radius: operational impact of a policy change, reporting affected VPCs, route counts, and route tables touched.
  • Segment Report: per-VPC view of segment membership, reachability, and denied peers.
  • Policy Normalization: inverse compilation via reachability fingerprinting, reconstructing the minimal equivalent policy from an existing reachability matrix.
  • Connectivity Graph: DOT format export of the reachability matrix with colored edges (allow, segment, default) and segment subgraph clusters.
• First 5 semantic outputs: Blog post
• Latest 5 semantic outputs: Blog post
• See the compiler semantic toolchain docs for the full interface.

NEW Routing Policy Language

• The topology compiler now includes a routing policy language that shapes VPC reachability at compile time through four primitives with fixed precedence: deny > allow > segments > default.
• A single policy declaration controls both IPv4 and IPv6 route generation. The language is scope-invariant, the same evaluation works across Centralized Router (Regional IR), Full Mesh Trio (Global IR), and Super Router (Domain IR).
• Policy compiles to VPC route table entries (the policy edge). The TGW forwarding plane stays untouched. terraform plan shows the complete reachability proof before apply.
• RPL Blog post.
• See the Centralized Egress Dual Stack Full Mesh Trio Demo for working examples with segmentation and deny rules.
• The generate routes function with the new policy routing has been moved out of Centralized Router into its own module Generate Routes to Other VPCs.

NEW White Paper (WIP)

• What began as a modular Terraform experiment evolved into a full compiler-style architecture for AWS networking. The system transforms a declarative map of VPCs into complete multi-region Transit Gateway mesh configurations, performing automatic adjacency synthesis, route expansion, and deterministic cross-region propagation.
• The white paper documents the underlying model, a provable O(N² + V²) → O(N + V) reduction alongside empirical validation across multi-region deployments and is currently a work in progress.

Demos

NEW Super Router Revamped!

Super Router Revamped Demo

• Compose a decentralized hub and spoke Transit Gateway with full routing semantic coverage using Tiered VPC-NG (at v1.0.7), Centralized Router (at v1.2.2), Super Router (at v2.1.2), and Generate Routes to Other VPCs (at v1.2.2) modules.
• Includes VPC peering examples within a full mesh configuration used for high traffic workloads to save on cost using the VPC Peering Deluxe module (at v1.0.1).
• Requires IPAM Pools for IPv4 and IPv6 cidrs (dual stack).
• Incudes routing policy and semantic toolchain.
• Validate TGW connectivity with AWS Route Analyzer.
• Super Router now provides complete semantic coverage of the AWS TGW routing domain:
  • Expressive: handles all CIDR and address-family combinations
  • Compositional: hierarchical domains compose cleanly
  • Complete: covers the full AWS TGW routing semantic space

NEW Centralized Egress Dual Stack Full Mesh Trio!

Centralized Egress Dual Stack Full Mesh Trio Demo

• Compose a Centralized IPv4 Egress and Decentralized IPv6 Egress within a Dual Stack Full Mesh Topology across 3 regions using Tiered VPC-NG (at v1.0.7), Centralized Router (at v1.2.2), Full Mesh Trio (at v2.1.2), and Generate Routes to Other VPCs (at v1.2.2) modules.
• Includes VPC peering examples within a full mesh configuration used for high traffic workloads to save on cost using the VPC Peering Deluxe module (at v1.0.1).
• Requires IPAM Pools for IPv4 and IPv6 cidrs.
• Incudes routing policy and semantic toolchain.
• Validate TGW connectivity with Route Analyzer.

Dual Stack Full Mesh Trio!

Dual Stack Full Mesh Trio Demo

• Compose a dual stack Full Mesh Transit Gateway across 3 regions using Tiered VPC-NG (at v1.0.7), Centralized Router (at v1.2.2), Full Mesh Trio (at v2.1.2), and Generate Routes to Other VPCs (at v1.2.2) modules.
• Includes VPC peering examples within a full mesh configuration used for high traffic workloads to save on cost using the VPC Peering Deluxe module (at v1.0.1).
• Requires IPAM Pools for IPv4 and IPv6 cidrs.
• Incudes routing policy and semantic toolchain.
• Validate TGW connectivity with Route Analyzer.

Dual Stack TNT Architecture!

Dual Stack Terraform Networking Trifecta Demo

• Compose a dual stack hub and spoke Transit Gateway using Tiered VPC-NG (at v1.0.7), Centralized Router (at v1.2.2), and Generate Routes to Other VPCs (at v1.2.2) modules.
• Requires IPAM Pools for IPv4 and IPv6 cidrs.
• Incudes routing policy and semantic toolchain.
• Validate intra VPC connectivity with EC2 instances.

Super Router!

Super Router Demo

• Compose a decentralized hub and spoke Transit Gateway using Tiered VPC-NG (at v1.0.1), Centralized Router (at v1.0.1), and Super Router (at v1.0.0) modules.
• IPv4 only (no IPAM).
• No routing policy (default full mesh), no semantic toolchain.
• Validate TGW connectivity with AWS Route Analyzer.

Mega Mesh!

Mega Mesh Demo

• Compose a Full Mesh Transit Gateway across 10 regions using Tiered VPC-NG (at v1.0.1), Centralized Router (at v1.0.1) and Mega Mesh (at v1.0.0) modules.
• IPv4 only (no IPAM).
• No routing policy (default full mesh), no semantic toolchain.
• Validate TGW connectivity with AWS Route Analyzer.

Full Mesh Trio!

Full Mesh Trio Demo

• Compose a Full Mesh Transit Gateway across 3 regions using Tiered VPC-NG (at v1.0.1), Centralized Router (at v1.0.1) and Full Mesh Trio (at v1.0.0) modules.
• Includes VPC peering examples within a full mesh configuration for high traffic workloads to save on cost for intra-region using the VPC Peering Deluxe module (at v1.0.0).
• IPv4 only (no IPAM).
• No routing policy (default full mesh), no semantic toolchain.
• Validate TGW connectivity with AWS Route Analyzer.

TNT Architecture!

Terraform Networking Trifecta Demo

• Compose a hub and spoke Transit Gateway using Tiered VPC-NG (at v1.0.1) and Centralized Router (at v1.0.1) modules.
• IPv4 only (no IPAM).
• No routing policy (default full mesh), no semantic toolchain.
• Validate intra VPC connectivity with EC2 instances.

---

Useful Tools

• IPv4 Subnet Calculator
• IPv6 Subnet Calculator
• brew install ipcalc

---

Notes

• Sometimes I'll blog about ideas at jq1.io.
• All modules are first developed in the terraform-modules repo.
• The most useful modules are published to the Public Terraform Registry.
• All demos include an example of generating security group rules for intra-region and cross-region VPCs for each TGW configuration.
  • Intra VPC Security Group Rule (IPv4 only)
  • Super Intra VPC Security Group Rules (IPv4 only)
  • Full Mesh Intra VPC Security Group Rules (IPv4 only)
  • IPv6 Intra VPC Security Group Rule (IPv6 only, for use with dual stack VPCs)
  • IPv6 Full Mesh Intra VPC Security Group Rules (IPv6 only, for use with dual stack VPCs)
  • NEW IPv6 Super Intra VPC Security Group Rules (IPv6 only, for use with dual stack VPCs)
  • TODO: Mega Mesh Intra VPC Security Group Rules
• Included S3 Gateway examples via VPC Endpoint.
• The Centralized Router module is an implementation of both AWS Centralized Router and Centralized outbound routing to the internet concepts and but without VPN Gateway or Direct Connect, only VPCs.
• Available AZs (a,b,c etc) in a region are different per AWS account (ie. your us-west-2a is not the same AZ as my us-west-2a) so it's possible you'll need to change the AZ letter for a VPC if the provider is saying it's not available for the region.
• There is no overlapping CIDR detection intra-region or cross-region so it's important that the VPC's network and subnet CIDRs are allocated correctly.
• The AWS provider is updated from time to time so you may need to run terraform init -upgrade if you've ran init with a previous provider version.