Cloud WAN Global Network and Segments

aws-cloud-wan

Cloud WAN: a global network whose segments, routing and attachment placement live in one policy document rather than in per-region route tables. Works with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.

The trap this module closes. Cloud WAN does not apply a policy when you write it - it creates a new policy version, and that version has to be executed separately. A module that wrote the document and stopped would leave the network running the previous policy while Terraform reported success. The aws_networkmanager_core_network_policy_attachment resource here is that second step, and attachments depend on it.

Defaults worth knowing:

• Nothing crosses a segment boundary unless a segment_action says so. A segment is a routing domain; shared services reach the spokes because an action shares it, and the spokes do not reach each other
• isolate_attachments goes further and stops attachments inside the same segment reaching each other - what a segment of mutually untrusting tenants wants
• require_attachment_acceptance defaults to true: an attachment is a route into your global network
• Each edge location bills per hour, so the list is the regions you actually route through rather than everywhere you might one day

Verification

Static validation runs tofu fmt, init, validate, tflint and checkov. This module has not yet had a live test, so it is published as statically validated with its live test pending and does not carry the live-tested mark.