Connectivity Test

Step 7 — End-to-end connectivity test

Allow a few minutes after the InterconnectInterconnect
AWS Interconnect – multicloud — a managed private connectivity service that connects Amazon VPCs directly to VPCs on other cloud providers. GA with Google Cloud as of April 2026.
AWS Interconnect docs shows Available for BGPBGP
Border Gateway Protocol — the routing protocol used to exchange routes between AWS and GCP over the interconnect. and routes to converge.

Resolve ping targets

terraform output is not available inside EC2 (SSMSSM
AWS Systems Manager Session Manager — provides shell access to EC2 instances without a public IP or SSH key, using VPC interface endpoints.) or GCEGCE
Google Compute Engine — GCP virtual machine instances. The demo GCE VM is reachable via IAP tunnel SSH. (SSH) shells — note the IPs before you connect:

export GCP_PROJECT="$(terraform output -raw gcp_project_id)"
export GCE_IP="$(terraform output -raw gce_instance_private_ip)"
export AWS_IP="$(terraform output -raw aws_instance_private_ip)"
echo "GCP project: ${GCP_PROJECT}"
echo "GCE target: ${GCE_IP}"
echo "AWS target: ${AWS_IP}"

EC2 → GCE (SSM Session Manager)

The instance has no public IP. From your workstation:

aws ssm start-session \
  --target "$(terraform output -raw aws_instance_id)" \
  --region "$(terraform output -raw aws_region)"

From the EC2 shell, ping using the GCE IP you printed above:

ping -c 5 10.1.0.2   # replace with your gce_instance_private_ip

GCE → EC2 (IAP tunnel)

From your workstation, save the TERRAFORMTERRAFORM
HashiCorp Terraform — infrastructure-as-code tool used to provision the base AWS and GCP resources in this demo.
Terraform docs-generated key pair and connect:

terraform output -raw gce_ssh_private_key > demo-gce-key
terraform output -raw gce_ssh_public_key > demo-gce-key.pub
chmod 600 demo-gce-key demo-gce-key.pub

Note

If gce_ssh_public_key is not found, run terraform apply once (no infrastructure changes — only registers the output). Or derive the matching public key: ssh-keygen -y -f demo-gce-key > demo-gce-key.pub && chmod 600 demo-gce-key.pub

gcloud compute ssh "$(terraform output -raw gce_instance_name)" \
  --zone="$(terraform output -raw gce_instance_zone)" \
  --project="$(terraform output -raw gcp_project_id)" \
  --tunnel-through-iap \
  --ssh-key-file=demo-gce-key

Caution

gcloud compute ssh --ssh-key-file requires both private and .pub files. Do not answer y if gcloud offers to overwrite broken keys — that would replace the Terraform key with a new one the VM does not trust.

Danger

These files contain secrets. They are listed in .gitignore (demo-gce-key, demo-gce-key.pub) — do not commit them. Remove them during Teardown.

From the GCE shell, ping using the AWS IP you printed above:

ping -c 5 10.0.1.10   # replace with your aws_instance_private_ip

Success criteria

Successful round-trip ping confirms traffic is flowing over the Interconnect multicloudInterconnect multicloud
AWS Interconnect – multicloud — a managed private connectivity service that connects Amazon VPCs directly to VPCs on other cloud providers. GA with Google Cloud as of April 2026.
AWS Interconnect docs path.

Optional: Run traceroute from either side — hops should not traverse public internet addresses.