# Configure AWS Transit Gateway (TGW) VPC Attachment Connection
Available with the Premium plan
ScyllaDB Cloud allows you to connect your application’s private network to the ScyllaDB clusters by using AWS TGW VPC Attachment Connection.
By following this guide, you will establish a network connection from your VPC to a cluster datacenter via [TGW](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-TGW).
There are two AWS TGW VPC Attachment Connection options:
* **RAM Shared Option**
RAM Shared option allows you to connect to a [TGW](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-TGW) from another account.
With this option, TGW is shared with [Cluster AWS Account](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-Cluster-AWS-Account) via [RAM](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-RAM).
#### NOTE
This is the only option that is available for clusters deployed on [ScyllaDB Cloud AWS Account](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-ScyllaDB-Cloud-AWS-Account) (Non-Bring Your Own Account clusters).
#### NOTE
[RAM](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-RAM) can be re-used across connections and clusters within one ScyllaDB Cloud Account.
* **Non-shared Option**
> If you have access to a [Cluster AWS Account](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-Cluster-AWS-Account), you can create a [TGW](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-TGW) on the same region where the cluster is running,
> and this TGW becomes available to the cluster - no need to share it via [RAM](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-RAM).
For more information on AWS TGW VPC Attachment and its advantages, see
[AWS TGW documentation](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-transit-gateways.html) and
[AWS TGW VPC Attachment documentation](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-vpc-attachments.html).
## Workflow
1. Launch a ScyllaDB Cloud cluster on AWS with the **VPC Peering / Transit Gateway** option enabled.
2. Set up AWS TGW VPC Attachment Connection.
3. Create AWS TGW VPC Attachment Connection on ScyllaDB Cloud.
4. Route traffic via TGW.
## Set Up AWS TGW VPC Attachment Connection
### Prerequisites
* Find target **AWS Region**: AWS [TGW](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-TGW) is a regional service; you have to deploy it on the same region where the cluster is running.
* [AWS TGW](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-TGW) can entail additional traffic charges; make sure that you read and understand [AWS TGW Pricing](https://aws.amazon.com/transit-gateway/pricing/).
* Decide on the option that suits your case: Non-shared option or RAM Shared option.
### Setup
#### Step 1. Create [TGW](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-TGW)
1. Open AWS Cloud Console at [VPC> Transit Gateways](https://console.aws.amazon.com/vpc/home#TransitGateways:).
2. Pick **Target Region**, which should be the same region where the target cluster is running.
3. Click **Create transit gateway**.
4. Set **Name**.
5. (Optional) Set **Auto accept shared attachments** to make your TGW automatically accept attachment requests from other accounts.
6. Click **Create transit gateway** and wait until TGW is created.
7. Go back to [VPC> Transit Gateways](https://console.aws.amazon.com/vpc/home#TransitGateways:).
8. Find TGW you just created.
9. Copy the ID of TGW. You will need it to create a connection on ScyllaDB Cloud.
#### Step 2. Attach your VPC to the [TGW](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-TGW)
1. Go to [VPC> Transit Gateway attachments](https://console.aws.amazon.com/vpc/home#TransitGatewayAttachments:).
2. Click **Create transit gateway attachment**.
3. Set **Name**, **Transit gateway ID** to ID of TGW you just created, **Attachment type** to **VPC**.
4. Set **VPC ID** to a VPC you want to connect to the cluster.
5. Pick subnets for all AZs you want to have access to the cluster.
6. Click **Create transit gateway attachment**.
#### Step 3. Share [TGW](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-TGW) with [Cluster AWS Account](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-Cluster-AWS-Account)
1. Open AWS Cloud Console at [Resource Access Manager> Shared by me: Resource shares](https://console.aws.amazon.com/ram/home#OwnedResourceShares:).
2. Click **Create resource share**.
3. Set **Name**.
4. Set **Resource type** to **Transit Gateways**, find your TGW, and check it in.
5. Make sure your TGW is in the list below.
6. Click **Next**.
7. Review permissions at **Associate managed permissions**.
8. Click **Next**.
9. Add [Cluster AWS Account](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-Cluster-AWS-Account) to a list of principals.
10. Make sure [Cluster AWS Account](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-Cluster-AWS-Account) is in the list of selected principals.
11. Click **Next**.
12. In the **Review and create** section, review all information.
13. Click **Create resource share**.
14. Go back to [Resource Access Manager> Shared by me: Resource shares](https://console.aws.amazon.com/ram/home#OwnedResourceShares:).
15. Find the [RAM](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-RAM) you just created and click on its name.
16. Copy it’s ARN. You will need it to create a connection on **ScyllaDB Cloud**.
## Create AWS TGW VPC Attachment Connection on ScyllaDB Cloud
1. Go to [ScyllaDB Cloud](https://cloud.scylladb.com)> **My Clusters**.
2. Find the target cluster.
3. Click **ADD CONNECTION**. You can add a connection only after the cluster is fully provisioned.
4. Click **Add Transit Gateway Connection** and fill in the following information:
* **Name** - Enter the name of the cluster connection.
* **Data Center** - Choose the datacenter you want to connect to the TGW.
* **AWS RAM ARN** - Enter the ARN of the RAM created as described in the [Share TGW with ScyllaDB Cloud AWS Account](#share-tgw-via-ram) section or leave it empty if you choose the [Non-shared option](#aws-tgw-non-shared-option).
* **AWS Transit Gateway ID** - Enter the ID of the TGW created as described in the [Create TGW](#create-tgw) section.
* **AWS VPC CIDRs** - Enter a list of networks that you want to expose to the cluster via this connection.
5. Click **Add Transit Gateway** and wait for it to become **ACTIVE**.
## Route Traffic from the Application to the Cluster via TGW
1. Open AWS Cloud Console at [VPC> Route tables](https://console.aws.amazon.com/vpcconsole/home#RouteTables:).
2. Find and select the main route table for your VPC (the one that has **Yes** in the **Main** column).
3. Click **Actions> Edit routes**.
4. Click **Add route**.
5. Enter Target [Cluster Datacenter CIDR](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-Cluster-Datacenter-CIDR) to a **Destination** column, pick **Transit gateway** for **Target**, and choose your TGW from the drop-down list right below it.
> 
6. Check cluster availability; see [Checking Cluster Availability](https://cloud.docs.scylladb.com/stable/cluster-connections/checking-cluster-availability.md).
## Troubleshooting Transit Gateway Connection
### Connection stuck at stage: waiting client to send resource share invitation
**Reason**
You did not send [RAM](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-RAM-Invitation) to [Cluster AWS Account](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-Cluster-AWS-Account).
**How to fix it**
Follow [these steps](#share-tgw-via-ram) to share TGW with cluster AWS acccount.
### Connection stuck at stage: **waiting client to share transit gateway**
**Reason**
You did not share TGW with [Cluster AWS Account](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-Cluster-AWS-Account).
Please check that tgw-id is the same on [RAM](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-RAM) and on cluster connection.
**How to fix it**
Following [steps](#share-tgw-via-ram) make sure that tgw-id is exactly the same on [RAM](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-RAM) and on cluster connection.
### Connection stuck at stage: **waiting client to accept tgw attachment**
**Reason**
[AWS TGW](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-TGW) is not configured with **Auto accept shared attachments** enabled.
**How to fix it**
You can fix it in one of the following ways:
**- I. Fix TGW to auto-accept attachments:**
#### NOTE
These steps won’t accept any pending attachments. In order to accept pending attachments, please follow [Manually accept TGW attachment](#manually-accept-tgw-attachment).
1. Open AWS Cloud Console at [VPC> Transit Gateways](https://console.aws.amazon.com/vpc/home#TransitGateways:).
2. Pick **AWS Region**, which should be the same region where the target cluster datacenter is running.
3. Find your [TGW](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-TGW) (using **TGW ID**) and click **Actions> Modify transit gateway**.
4. Select **Auto accept shared attachments** to make your [TGW](https://cloud.docs.scylladb.com/stable/cluster-connections/glossary-cluster-connection.md#term-TGW) automatically accept attachment requests from other accounts.
5. Click **Modify transit gateway**.
**- II. Manually accept TGW attachment:**
> #### NOTE
> Make sure that the connection is not failed by timeout. If it is, delete it, recreate it, and when it gets to the **waiting client to accept tgw attachment** stage, proceed with the steps below.
1. Go to [VPC> Transit Gateway attachments](https://console.aws.amazon.com/vpc/home#TransitGatewayAttachments:).
2. Find the attachment pending acceptance by **TGW Attachment ID**.
3. Accept the attachment.
