Access cross-region OSS from ECS via Transit Router - Cloud Enterprise Network

This topic describes how to use an Enterprise Edition transit router to enable Elastic Compute Service (ECS) instances in a Virtual Private Cloud (VPC) to privately access Object Storage Service (OSS) across regions.

Note

The sample code in this tutorial supports one-click running. You can run the code directly. One-click run

Sample use case

This topic uses the scenario in the preceding figure as an example. An enterprise has a VPC, VPC1, in the China (Shanghai) region, where applications are deployed on ECS instances. The enterprise deploys OSS in the China (Hangzhou) region and wants the ECS instances in VPC1 to privately access the OSS service in the China (Hangzhou) region to obtain the required resources.

OSS is a region-level cloud service and does not belong to any VPC, but a VPC in the same region can access OSS through the OSS internal endpoint. Therefore, the enterprise must create a VPC, VPC2, in the China (Hangzhou) region where OSS is deployed, and use VPC2 as a transit network. Then, the enterprise connects VPC1 and VPC2 to the Enterprise Edition transit routers in their respective regions and creates an inter-region connection between the two transit routers. At the same time, routes for the OSS internal CIDR blocks are manually added in VPC1 and on the transit router in the China (Hangzhou) region. After the configuration is complete, the traffic from an ECS instance in VPC1 to OSS flows as follows: ECS instance → transit router in China (Shanghai) → inter-region connection → transit router in China (Hangzhou) → VPC2 → OSS internal endpoint.

Note

In this solution, VPC2 serves only as a transit network that provides a path for cross-region traffic to reach the OSS internal endpoint. If you already have a VPC in the China (Hangzhou) region, you can connect that VPC directly to the Enterprise Edition transit router as the transit network, and you do not need to create VPC2.

Network planning

Important

When you plan CIDR blocks, make sure that the CIDR blocks of the VPCs that need to communicate with each other do not overlap.

Resource

VPC region

CIDR block and IP address

VPC1

China (Shanghai)

Primary CIDR block: 192.168.0.0/16

CIDR block of vSwitch 1: 192.168.0.0/24. vSwitch 1 is in Zone M.
CIDR block of vSwitch 2: 192.168.20.0/24. vSwitch 2 is in Zone N.
ECS IP address: 192.168.0.1. The ECS instance is deployed in vSwitch 1.

VPC2

China (Hangzhou)

Primary CIDR block: 172.16.0.0/16

CIDR block of vSwitch 1: 172.16.1.0/24. vSwitch 1 is in Zone J.
CIDR block of vSwitch 2: 172.16.2.0/24. vSwitch 2 is in Zone K.

Procedure

This topic provides two configuration methods: console and Terraform. Select the method that suits your needs.

Console

Preparations

Before you start the configuration, make sure that you have completed the following preparations. For information about the CIDR blocks of each resource, see the Network planning section above.

China (Shanghai) region: VPC1 is created with the primary CIDR block 192.168.0.0/16. In VPC1, vSwitches are created in two zones, each vSwitch has at least one available IP address, and an ECS instance is deployed in one of the vSwitches. For more information, see Create a VPC with an IPv4 CIDR block.
China (Hangzhou) region: OSS is deployed, which means an OSS bucket is created. If you have not created a bucket, see Quick start.
The security group rules of VPC1 allow the required traffic. For more information, see View security group rules and Add a security group rule.

Step 1: Create a transit VPC

In the China (Hangzhou) region, create VPC2 with the primary CIDR block 172.16.0.0/16, and then create vSwitches in two zones. Make sure that each vSwitch has at least one available IP address. In this solution, VPC2 serves as the transit network for accessing the OSS service. If you already have a VPC in the China (Hangzhou) region, you can skip this step and select that VPC in Step 2. For more information, see Create and manage a VPC.

After VPC2 is created, make sure that its security group rules allow the required traffic so that the cross-region access traffic from VPC1 is not blocked. For more information, see View security group rules and Add a security group rule.

Step 2: Create network connectivity by using scenario-based networking

Use the scenario-based networking tool of Cloud Enterprise Network (CEN) to create a CEN instance, Enterprise Edition transit routers, VPC connections, and an inter-region connection in a batch, and to configure the routes for them automatically.

Log on to the CEN console. On the CEN Instance page, click Create CEN Instance.
In the Create CEN Instance dialog box, select Create Scenario-specific CEN (Recommended), select VPC Interconnection as the scenario, and then click Start Scenario-Based Creation.
On the first region tab, add the networking configurations:
- Region: Select China (Hangzhou).
- Zone: Select Zone J and Zone K.
- VPC: Select VPC2 and the two vSwitches of VPC2.
Click + on the right side of the tab to create a region tab, and then add the networking configurations:
- Region: Select China (Shanghai).
- Zone: Select Zone M and Zone N.
- VPC: Select VPC1 and the two vSwitches of VPC1.
Click Next. The system requires a few minutes to generate the configuration overview. On the Confirm Networking Settings and Fees page, review the resources to be automatically created and the cost details. After you confirm that the information is correct, click Start deployment.
The deployment takes about 10 minutes. Wait until the deployment is complete. The system then automatically creates the following resources:
- A CEN instance.
- One Enterprise Edition transit router in the China (Hangzhou) region and one in the China (Shanghai) region.
- VPC connections from VPC1 and VPC2 to the transit routers in their respective regions.
- An inter-region connection between the two transit routers.

Note

After the scenario-based networking is complete, private network peering is already established between VPC1 and VPC2, but the ECS instances in VPC1 still cannot access the OSS service. You must continue with the following steps to manually add the routes for the OSS internal CIDR blocks.

Step 3: Configure routes to the OSS service in the VPC

After the inter-region connection is created, VPC1 and VPC2 can communicate with each other over a private network through the Enterprise Edition transit routers. However, the ECS instances in VPC1 still cannot privately access the OSS service through the Enterprise Edition transit routers and VPC2. You must add routes to the OSS service in the route table of VPC1 to direct the traffic that is destined for the OSS service to the Enterprise Edition transit router.

Log on to the VPC console.
In the top menu bar, select the region where the VPC1 instance is deployed.
In this topic, the China (Shanghai) region is selected.
In the left-side navigation pane, click Route Tables.
On the Route Tables page, find the route table of the VPC1 instance and click the route table instance ID.
In this topic, VPC1 has only one system route table. If your VPC has multiple route tables, select the route table that is associated with the vSwitch where the ECS instance is deployed.
On the Route Entry List tab, click the Custom Route tab, and then click Add Route Entry.

In the Add Route Entry panel, configure the following parameters, and then click OK.

Based on the following information, add the routes for all CIDR blocks of the OSS service in the China (Hangzhou) region to the route table of VPC1.

For information about all CIDR blocks of the OSS service in the China (Hangzhou) region, see Access OSS via endpoints and bucket domains.

Parameter	Description	Route entry 1	Route entry 2	Route entry 3	Route entry 4
Name	Enter a name for the custom route entry.	`OSS CIDR block 1`	`OSS CIDR block 2`	`OSS CIDR block 3`	`OSS CIDR block 4`
Destination CIDR Block	Enter the destination CIDR block.	100.118.28.0/24	100.114.102.0/24	100.98.170.0/24	100.118.31.0/24
Next Hop Type	Select the next hop type of the custom route entry, and then select the next hop.	Select Transit Router, and then select the VPC1 connection.	Select Transit Router, and then select the VPC1 connection.	Select Transit Router, and then select the VPC1 connection.	Select Transit Router, and then select the VPC1 connection.

Step 4: Configure routes to the OSS service on the transit router

You must also add routes to the OSS service in the route table of the Enterprise Edition transit router in the China (Hangzhou) region. After the traffic that is destined for the OSS service enters the Enterprise Edition transit router from the ECS instances in VPC1, the transit router directs the traffic to VPC2 based on the routes to the OSS service. The ECS instances can then privately access the OSS service through VPC2.

Log on to the CEN console.
On the Cloud Enterprise Network page, find the target CEN instance and click the CEN instance ID.
On the Basic Settings > Transit Router tab, find the transit router instance in the China (Hangzhou) region and click the instance ID.
On the details page of the transit router instance, click the Route Table tab. On the left side of the tab, select the target transit router route table.
The VPC1 connection and the VPC2 connection both use the default advanced configurations, and both of them are associated with the default route table of the transit router. Therefore, this topic selects the default route table of the transit router, which is the system route table.
On the Route Entry tab, click Add Route Entry.

In the Add Route Entry dialog box, configure the following parameters, and then click OK.

Based on the following information, add the routes for all CIDR blocks of the OSS service in the China (Hangzhou) region to the route table of the transit router.

Parameter	Description	Route entry 1	Route entry 2	Route entry 3	Route entry 4
Name	Enter a name for the route entry.	`OSS CIDR block 1`	`OSS CIDR block 2`	`OSS CIDR block 3`	`OSS CIDR block 4`
Destination CIDR	Enter the destination CIDR block of the route entry.	100.118.28.0/24	100.114.102.0/24	100.98.170.0/24	100.118.31.0/24
Blackhole Route	Specifies whether the current route entry is a blackhole route. Yes: The route is a blackhole route. All traffic that is destined for this route is dropped. No: The route is not a blackhole route. You must specify the next hop connection of the route.	Select No.	Select No.	Select No.	Select No.
Next Hop	Select the next hop connection of the route entry.	Select the VPC2 connection.	Select the VPC2 connection.	Select the VPC2 connection.	Select the VPC2 connection.

Step 5: Test connectivity

After you complete the preceding configurations, the ECS instances in VPC1 can privately access the cross-region OSS service. This topic uses an ECS instance that downloads an image from the OSS service as an example to test the connectivity between the ECS instance in VPC1 and the OSS service.

Log on to the ECS instance in VPC1. For more information, see Remote connection methods for ECS instances.

On the ECS instance, attempt to download an image named OSStest.jpg from the OSS service.

Note

Before you run the test, make sure that the read and write permissions on the target file allow the ECS instance to access the file. For more information, see Overview of permissions and access control.

wget https://zxtXXXXX.oss-cn-hangzhou-internal.aliyuncs.com/OSStest.jpg
# zxtXXXXX.oss-cn-hangzhou-internal.aliyuncs.com is the access domain name of the OSS service.
# OSStest.jpg is the name of the target file.

For more information about OSS access domain names, see Use an endpoint that supports IPv6 to access OSS.

If the ECS instance receives a response similar to the following one, the ECS instance can privately access the cross-region OSS service.

[root@iZuf6bxxx hblZ ~]# wget https://zxxx2.oss-cn-hangzhou-internal.aliyuncs.com/OSStest.jpg
--2023-01-29 16:54:46--  https://zxtxxx2.oss-cn-hangzhou-internal.aliyuncs.com/OSStest.jpg
Resolving zxtxxx2.oss-cn-hangzhou-internal.aliyuncs.com (zxtxxx2.oss-cn-hangzhou-internal.aliyuncs.com)... 100.xxx.50, 100.xxx.49, 100.
45, ...
Connecting to zxtxxx2.oss-cn-hangzhou-internal.aliyuncs.com (zxxxx s2.oss-cn-hangzhou-internal.aliyuncs.com)|100.xxx.50|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 611894 (598K) [image/jpeg]
Saving to: 'OSStest.jpg.5'
OSStest.jpg.5                 100%[=================================================>] 597.55K     132KB/s    in 4.5s
2023-01-29 16:54:51 (132 KB/s) - 'OSStest.jpg.5' saved [611894/611894]

Terraform

You can use Terraform to build the sample environment of this topic. For information about how to install and configure Terraform, see Install Terraform.

The following steps use a Linux host that runs Terraform v1.9.8 as an example. Before you start, make sure that you have completed Authentication.

Note

Some resources in this tutorial incur costs. Release or unsubscribe from the resources when you no longer need them.

Step 1: Create resources

Create a directory for the scenario in this topic, and then go to the directory.
```
mkdir tf-cen-oss && cd tf-cen-oss
```
Create a main.tf file to define the resource information.
```
touch main.tf
```

Open the main.tf file, copy the following code, paste the code into the file, and then save the file. This file contains the resources and configurations that are required for the scenario in this topic.

variable "pname" {
  description = "The prefix name for resources"
  type        = string
  default     = "tf-cen-oss"
}
variable "region_id_hangzhou" {
  description = "The region id of hangzhou"
  type        = string
  default     = "cn-hangzhou"
}
variable "region_id_shanghai" { #
  description = "The region id of shanghai"
  type        = string
  default     = "cn-shanghai"
}
variable "az_hangzhou" {
  description = "List of availability zones to use"
  type        = list(string)
  default     = ["cn-hangzhou-j", "cn-hangzhou-k"]
}
variable "az_shanghai" {
  description = "List of availability zones to use"
  type        = list(string)
  default     = ["cn-shanghai-m", "cn-shanghai-n"]
}
variable "cidr_list" {
  description = "List of VPC CIDR block"
  type        = list(string)
  default     = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"]
}
# --- provider ---
provider "alicloud" { # default region hangzhou
  region = var.region_id_hangzhou
}
provider "alicloud" {
  alias  = "hangzhou"
  region = var.region_id_hangzhou
}
provider "alicloud" {
  alias  = "shanghai"
  region = var.region_id_shanghai
}
# ---  oss ---
resource "random_uuid" "default" {
}
resource "alicloud_oss_bucket" "bucket1" {
  provider = alicloud.hangzhou
  bucket   = substr("${var.pname}-${replace(random_uuid.default.result, "-", "")}", 0, 32)
}
resource "alicloud_oss_bucket_policy" "default" {
  provider = alicloud.hangzhou
  policy   = jsonencode({ "Version" : "1", "Statement" : [{ "Action" : ["oss:GetObject"], "Effect" : "Allow", "Resource" : ["acs:oss:*:*:${alicloud_oss_bucket.bucket1.bucket}"] }] })
  bucket   = alicloud_oss_bucket.bucket1.bucket
}
resource "alicloud_oss_bucket_object" "obj1" {
  provider = alicloud.hangzhou
  bucket   = alicloud_oss_bucket.bucket1.bucket
  key      = "example.txt"                     # Name of the file in the bucket
  content  = "this is example text content \n" # Content of the file
  acl      = "public-read"
}
# --- vpc ---
resource "alicloud_vpc" "vpc1" {
  provider   = alicloud.shanghai
  vpc_name   = "${var.pname}-1"
  cidr_block = "192.168.0.0/16"
}
resource "alicloud_vpc" "vpc2" {
  provider   = alicloud.hangzhou
  vpc_name   = "${var.pname}-2"
  cidr_block = "172.16.0.0/16"
}
resource "alicloud_vswitch" "vsw1-1" {
  provider     = alicloud.shanghai
  vpc_id       = alicloud_vpc.vpc1.id
  cidr_block   = "192.168.0.0/24"
  zone_id      = var.az_shanghai[0]
  vswitch_name = "${var.pname}-vsw1-1"
}
resource "alicloud_vswitch" "vsw1-2" {
  provider     = alicloud.shanghai
  vpc_id       = alicloud_vpc.vpc1.id
  cidr_block   = "192.168.1.0/24"
  zone_id      = var.az_shanghai[1]
  vswitch_name = "${var.pname}-vsw1-2"
}
resource "alicloud_vswitch" "vsw2-1" {
  provider     = alicloud.hangzhou
  vpc_id       = alicloud_vpc.vpc2.id
  cidr_block   = "172.16.0.0/24"
  zone_id      = var.az_hangzhou[0]
  vswitch_name = "${var.pname}-vsw2-1"
}
resource "alicloud_vswitch" "vsw2-2" {
  provider     = alicloud.hangzhou
  vpc_id       = alicloud_vpc.vpc2.id
  cidr_block   = "172.16.1.0/24"
  zone_id      = var.az_hangzhou[1]
  vswitch_name = "${var.pname}-vsw2-2"
}
# --- cen ---
# cen
resource "alicloud_cen_instance" "cen1" {
  cen_instance_name = "${var.pname}-cen1"
}
# tr
resource "alicloud_cen_transit_router" "tr1" {
  provider            = alicloud.shanghai
  transit_router_name = "${var.pname}-tr1"
  cen_id              = alicloud_cen_instance.cen1.id
}
resource "alicloud_cen_transit_router" "tr2" {
  provider            = alicloud.hangzhou
  transit_router_name = "${var.pname}-tr2"
  cen_id              = alicloud_cen_instance.cen1.id
}
data "alicloud_cen_transit_router_route_tables" "tr1" { # get tr sys table
  transit_router_id               = alicloud_cen_transit_router.tr1.transit_router_id
  transit_router_route_table_type = "System"
}
data "alicloud_cen_transit_router_route_tables" "tr2" {
  transit_router_id               = alicloud_cen_transit_router.tr2.transit_router_id
  transit_router_route_table_type = "System"
}
# tr-peer
resource "alicloud_cen_transit_router_peer_attachment" "peer" {
  provider                      = alicloud.shanghai
  cen_id                        = alicloud_cen_instance.cen1.id
  transit_router_id             = alicloud_cen_transit_router.tr1.transit_router_id
  peer_transit_router_region_id = var.region_id_hangzhou
  peer_transit_router_id        = alicloud_cen_transit_router.tr2.transit_router_id
  bandwidth_type                = "DataTransfer"
  bandwidth                     = 1
  auto_publish_route_enabled    = true # default is false
}
resource "alicloud_cen_transit_router_route_table_association" "ass_peer1" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr1.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_peer_attachment.peer.transit_router_attachment_id
}
resource "alicloud_cen_transit_router_route_table_propagation" "propa_peer1" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr1.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_peer_attachment.peer.transit_router_attachment_id
}
resource "alicloud_cen_transit_router_route_table_association" "ass_peer2" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr2.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_peer_attachment.peer.transit_router_attachment_id
}
resource "alicloud_cen_transit_router_route_table_propagation" "propa_peer2" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr2.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_peer_attachment.peer.transit_router_attachment_id
}
# attach1  
resource "alicloud_cen_transit_router_vpc_attachment" "attach1" {
  provider          = alicloud.shanghai
  cen_id            = alicloud_cen_instance.cen1.id
  transit_router_id = alicloud_cen_transit_router.tr1.transit_router_id
  vpc_id            = alicloud_vpc.vpc1.id
  zone_mappings {
    zone_id    = var.az_shanghai[0]
    vswitch_id = alicloud_vswitch.vsw1-1.id
  }
  zone_mappings {
    zone_id    = var.az_shanghai[1]
    vswitch_id = alicloud_vswitch.vsw1-2.id
  }
  transit_router_vpc_attachment_name = "attach1"
}
resource "alicloud_cen_transit_router_route_table_association" "ass1" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr1.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach1.transit_router_attachment_id
}
resource "alicloud_cen_transit_router_route_table_propagation" "propa1" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr1.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach1.transit_router_attachment_id
}
resource "alicloud_route_entry" "vpc1_to_tr1" {
  provider              = alicloud.shanghai
  count                 = 3
  route_table_id        = alicloud_vpc.vpc1.route_table_id
  destination_cidrblock = var.cidr_list[count.index]
  nexthop_type          = "Attachment"
  nexthop_id            = alicloud_cen_transit_router_vpc_attachment.attach1.transit_router_attachment_id
}
# attach2
resource "alicloud_cen_transit_router_vpc_attachment" "attach2" {
  provider          = alicloud.hangzhou
  cen_id            = alicloud_cen_instance.cen1.id
  transit_router_id = alicloud_cen_transit_router.tr2.transit_router_id
  vpc_id            = alicloud_vpc.vpc2.id
  zone_mappings {
    zone_id    = var.az_hangzhou[0]
    vswitch_id = alicloud_vswitch.vsw2-1.id
  }
  zone_mappings {
    zone_id    = var.az_hangzhou[1]
    vswitch_id = alicloud_vswitch.vsw2-2.id
  }
  transit_router_vpc_attachment_name = "attach2"
}
resource "alicloud_cen_transit_router_route_table_association" "ass2" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr2.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach2.transit_router_attachment_id
}
resource "alicloud_cen_transit_router_route_table_propagation" "propa2" {
  transit_router_route_table_id = data.alicloud_cen_transit_router_route_tables.tr2.tables[0].id
  transit_router_attachment_id  = alicloud_cen_transit_router_vpc_attachment.attach2.transit_router_attachment_id
}
resource "alicloud_route_entry" "vpc2_to_tr2" {
  provider              = alicloud.hangzhou
  count                 = 3
  route_table_id        = alicloud_vpc.vpc2.route_table_id
  destination_cidrblock = var.cidr_list[count.index]
  nexthop_type          = "Attachment"
  nexthop_id            = alicloud_cen_transit_router_vpc_attachment.attach2.transit_router_attachment_id
}
# oss_cidr
variable "oss_cidr" {
  description = "The OSS CIDR block"
  type        = list(string)
  default     = ["100.118.28.0/24", "100.114.102.0/24", "100.98.170.0/24", "100.118.31.0/24"]
}
# vpc entry
resource "alicloud_route_entry" "entry" {
  provider              = alicloud.shanghai
  count                 = 4
  route_table_id        = alicloud_vpc.vpc1.route_table_id
  destination_cidrblock = var.oss_cidr[count.index]
  nexthop_type          = "Attachment"
  nexthop_id            = alicloud_cen_transit_router_vpc_attachment.attach1.transit_router_attachment_id
}
# tr entry 
resource "alicloud_cen_transit_router_route_entry" "tr2_rt1_entry1" {
  count                                             = 4
  transit_router_route_table_id                     = data.alicloud_cen_transit_router_route_tables.tr2.tables[0].id
  transit_router_route_entry_destination_cidr_block = var.oss_cidr[count.index]
  transit_router_route_entry_next_hop_type          = "Attachment"
  transit_router_route_entry_next_hop_id            = alicloud_cen_transit_router_vpc_attachment.attach2.transit_router_attachment_id
}
# --- ecs ---
resource "alicloud_instance" "main" {
  provider             = alicloud.shanghai
  depends_on           = [alicloud_cen_transit_router_route_entry.tr2_rt1_entry1]
  instance_name        = "${var.pname}-ecs"
  instance_type        = "ecs.e-c1m1.large"
  security_groups      = [alicloud_security_group.default.id]
  vswitch_id           = alicloud_vswitch.vsw1-1.id
  image_id             = "aliyun_3_x64_20G_qboot_alibase_20230727.vhd"
  system_disk_category = "cloud_essd"
  private_ip           = "192.168.0.1"
  instance_charge_type = "PostPaid"
  user_data = base64encode(<<-EOT
    #!/bin/bash
    curl  https://${alicloud_oss_bucket.bucket1.bucket}.${alicloud_oss_bucket.bucket1.intranet_endpoint}/${alicloud_oss_bucket_object.obj1.key}  > /root/curl.txt
  EOT
  )
}
# sg
resource "alicloud_security_group" "default" {
  provider            = alicloud.shanghai
  security_group_name = var.pname
  vpc_id              = alicloud_vpc.vpc1.id
}
resource "alicloud_security_group_rule" "allow_inbound_ssh" {
  provider          = alicloud.shanghai
  type              = "ingress"
  ip_protocol       = "tcp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "22/22"
  priority          = 1
  security_group_id = alicloud_security_group.default.id
  cidr_ip           = "0.0.0.0/0"
}
resource "alicloud_security_group_rule" "allow_inbound_icmp" {
  provider          = alicloud.shanghai
  type              = "ingress"
  ip_protocol       = "icmp"
  nic_type          = "intranet"
  policy            = "accept"
  port_range        = "-1/-1"
  priority          = 1
  security_group_id = alicloud_security_group.default.id
  cidr_ip           = "0.0.0.0/0"
}
# --- output ---
output "ecs_login_address" {
  value = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=${var.region_id_shanghai}&instanceId=${alicloud_instance.main.id}"
}
output "test_command" {
  value = "curl ${alicloud_oss_bucket.bucket1.bucket}.${alicloud_oss_bucket.bucket1.intranet_endpoint}/${alicloud_oss_bucket_object.obj1.key}"
}

Initialize the directory to complete the Terraform initialization.
```
terraform init
```
Create the resources. After you run the command, Terraform previews the resources to be created. After you confirm that the information is correct, enter yes to officially start the creation.
```
terraform apply
```

Step 2: Verify the result

Log on to the ECS instance named tf-cen-oss-ecs.
You can find the logon address of the ECS instance in the Terraform Outputs, copy the address, and then open the address in a browser. When you log on, select Temporary SSH Key-based as the authentication method.
```
Outputs:
ecs_login_address = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=cn-shanghai&instanceId=i-uf6xxx"
test_command = "curl xxx"
```

In the Outputs, copy the command that starts with curl:

Outputs:
ecs_login_address = "https://ecs-workbench.alibabacloud.com/?from=EcsConsole&instanceType=ecs&regionId=cn-shanghai"
test_command = "curl tf-cen-oss-xxx.oss-cn-hangzhou-internal.aliyuncs.com/example.txt"

On the ECS instance, run the curl command:

curl tf-cen-oss-xxxxxx.oss-cn-hangzhou-internal.aliyuncs.com/example.txt

[root@iZuf6xxx          ~]# curl tf-cen-oss-2821xxx xxx.oss-cn-hangzhou-internal.aliyuncs.com/example.txt
this is example text content
[root@iZuf6xxx          ~]#

As shown above, if the text content is returned, the access is successful.

Step 3: Release resources

After the verification is complete, if you no longer use the resources, run the following command to release the resources and prevent further charges.

terraform destroy --auto-approve

Routing

In this topic, the default routing configuration is used when the scenario-based networking tool automatically creates the VPC connections and the inter-region connection. With the default routing configuration, CEN automatically advertises and learns routes to enable communication between VPC1 and VPC2. The default routing configuration is described as follows:

VPC

If you use the default routing configuration when you create a VPC connection, which means that all advanced settings are enabled, the system automatically applies the following routing configurations to the VPC:

Associate with Default Route Table of Transit Router
After this feature is enabled, the VPC connection is automatically associated with the default route table of the transit router. The transit router forwards the traffic of the VPC by querying the default route table.
Propagate system routes to transit router route table
After this feature is enabled, the VPC propagates its own system routes to the default route table of the transit router, which enables the network instances to communicate with each other.
Auto-add transit router routes to all VPC route tables
After this feature is enabled, the system automatically adds three route entries, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, to all route tables of the VPC instance. The next hop of all three route entries is the VPC connection.

Inter-region connection

If you use the default routing configuration when you create an inter-region connection, which means that all advanced settings are enabled, the system automatically applies the following routing configurations to the inter-region connection:

Associate with Default Route Table of Transit Router
Associates the inter-region connection with the system route tables of the transit routers in both regions. Inter-region traffic is forwarded based on these system route tables.
Propagate system routes to transit router route table
Establishes a route learning relationship between the inter-region connection and the system route tables of the transit routers in both regions.
Automatically Advertise Routes to Peer Region
Advertises routes from the local transit router's route table to the peer transit router's route table, enabling inter-region connectivity for network instances.

View route entries

You can view the route entry information of the corresponding instances in the Alibaba Cloud console:

To view the route entries of a transit router instance, see View route entries (Enterprise Edition).
To view the route entries of a VPC instance, see Create and manage a route table.