before you measure

Prerequisites

You need an existing Transit Gateway and inspection VPC. This lab only adds the stream harness on top.

See architecture Setup the harness

Existing hub

Required hub environment with three accounts Consumer spoke EC2 reaches provider relay via Transit Gateway hairpin through Network Firewall in the network account. Appliance mode required on the inspection attachment. Existing hub - 3 accounts (required) TGW hairpin + Network Firewall Consumer VPC SSM host sub.py Transit Gateway spoke route table Inspection VPC Network Firewall stateful inspection same TGW appliance mode Provider VPC Relay target private IP :9000 provider CIDR inspection RT no-inspection RT hairpin

Appliance mode on the inspection attachment. Allow consumer CIDR to provider TCP 9000. Icons from aws-icons.

TGW Spoke attachments two spokes attached
Inspection VPC + Network Firewall hairpin route tables
Sticky Appliance mode same firewall endpoint both ways
CIDRs Non-overlapping spokes two spoke accounts
Spokes VPC + private / private-lb EC2 in private; NLB in private-lb
Allow Firewall policy consumer → provider :9000 (hub; not this repo)
Egress NAT for live ingest relay reaches Wikimedia

Accounts and profiles

Provider shared-services EC2 · relay · NLB · endpoint service
Consumer consumer subscriber · interface EP

Walkthrough pages set the profile per step:

export AWS_PROFILE=shared-services   # provider
export AWS_PROFILE=consumer          # consumer

Optional script helpers use PROVIDER_PROFILE / CONSUMER_PROFILE (same defaults). The network hub is a prerequisite you already operate — no profile required for this harness.

Toolchain

Tool Used for
AWS CLI v2 shared-services and consumer profiles
Session Manager plugin SSM into the spoke hosts
On consumer host tmux, nc (nmap-ncat), nping (nmap), pv — install in Consumer
Python 3 relay.py / optional sub.py (stdlib only)
bash Optional helpers under scripts/

Same Region for both paths. Cross-Region limits: PrivateLink Conduit.

Architecture What the harness adds on top of this hub Setup Prep · provider · consumer