AWS Connectiontion Guide

The following are the detailed steps on how to implement the remote management and application connections to your cloud HSMs under subscription via Amazon Web Services (AWS).

Please validate the appropriate combination of region and location:

Location	Region
Equinix DC2/DC11, Ashburn, VA	us-east-1
Equinix AM3, Amsterdam	eu-central-1
Equinix FR5, Frankfurt	eu-central-1

Share the Account ID with Thales in the On-boarding form - TO BE HYPERLINKED.

Thales uses the Account ID to create Primary and Secondary connections from the hosted HSM to AWS and sends a confirmation regarding the setup of primary and secondary connection.
Login to your Amazon Web Services account.
Create Virtual Private Cloud (VPC) by entering VPC in the search bar, and press return.
Select Create VPC.

The Create VPC screen appears.
Select the appropriate VPC resource you need to create.
Click View VPC.
Type Direct Connect in the search bar, and press enter on the keyboard.
From the left menu, select Connections.
Select the hosted connections – Primary as well as Secondary, and choose View details.
Select the confirmation check box and choose Accept connection.

After accepting both the connections, the state changes to “available”.

The next step is to configure the Direct Connect Gateways.
Type Direct Connect Gateways in the search bar, and press enter on the keyboard.
Select the Direct Connect gateways option.

The Create Direct Connect gateway screen appears.
Enter the following details:

• Name of the gateway as per your preference
• Amazon-side ASN i.e., the Autonomous System Number for the gateway
Click Create Direct Connect gateway.

It is now time to create a Virtual Interface for the hosted Primary and Secondary hosted connections.
Type Virtual Interface in the search bar.
Select the Virtual Interfaces from the results appeared on the screen.

You will be directed to Create virtual interface window.
Select the type of the virtual interface as Private in the Virtual interface type section.
In the Private virtual interface settings section, fill-in the following details:

a. Enter the name of the virtual interface
b. Select the appropriate connection using the dropdown arrow
c. Virtual interface owner – My AWS account
d. Gateway type – Direct Connect Gateway

Select the Direct Connect gateway created in above steps.

e. BGP ASN:

Region Data Center Peer ASN

US East US DC13 65013

US East US CU02 65014

EU West NL AM02 65021

EU West DE FR04 65022
Select Create virtual interface.

Repeat the above steps to create virtual interface for the secondary hosted connection.
Select the Direct Connect gateways from the left-hand menu.
Select the Direct Connect gateways created in the above steps.

Under “Virtual interface attachments” two virtual interfaces display with state “attached”.
Type “Virtual Private Gateways” in the search bar, and press enter.
Select Virtual private gateways from the list displayed, and configure the gateway as shown below.

In the Details section,:

a. Enter the name tag (optional).
b. Select Amazon default ASN as the Autonomous System Number (ASN).
Select Create virtual private gateway.
Select the virtual private gateway created in above steps, and from the Actions, select Attach to VPC.
On Attach to VPC screen, select an available VPC from the Available VPCs drop down list.
Click Attach to VPC.
Select the Direct Connect gateway in left menu and the gateway created in the above steps displays.
Select Gateway associations tab, and then select Associate gateway.

You will be directed to the Associate gateway screen.
In the Association settings, select a Virtual Private gateway created in above steps using the drop-down list and click Associate gateway.
Select Virtual interface on the left-hand menu.

Two virtual interfaces created (one for each hosted connection) display on the screen.
Select each virtual interface at a time and share the below information to Thales to complete the BGP connection:
- VLAN
- BGP authentication key
- Your router peer IP
- Amazon router peer IP
At this stage, the BGP status displays as “down”.

Thales configures the BGP connection using the above information provided. After successful setup, the BGP status changes to “up” as shown in the image below.
Create a Virtual Machine and add it to the same VPC network.