Attach AWS Network Manager Core Network Policies

The aws:networkmanager/coreNetworkPolicyAttachment:CoreNetworkPolicyAttachment resource, part of the Pulumi AWS provider, attaches a policy document to a core network and deploys it globally as the LIVE policy. This guide focuses on three capabilities: attaching policies to existing networks, bootstrapping new networks with base policies, and multi-region edge location configuration.

Policy attachments require an existing core network and policy document. New networks need a base policy before VPC attachments can succeed, creating a two-stage deployment pattern. The examples are intentionally small. Combine them with your own global networks, VPCs, and routing requirements.

Attach a policy to an existing core network

Teams with an established core network can update their configuration by attaching a new policy document that becomes LIVE immediately.

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.networkmanager.CoreNetwork("example", {globalNetworkId: exampleAwsNetworkmanagerGlobalNetwork.id});
const exampleCoreNetworkPolicyAttachment = new aws.networkmanager.CoreNetworkPolicyAttachment("example", {
    coreNetworkId: example.id,
    policyDocument: exampleAwsNetworkmanagerCoreNetworkPolicyDocument.json,
});

import pulumi
import pulumi_aws as aws

example = aws.networkmanager.CoreNetwork("example", global_network_id=example_aws_networkmanager_global_network["id"])
example_core_network_policy_attachment = aws.networkmanager.CoreNetworkPolicyAttachment("example",
    core_network_id=example.id,
    policy_document=example_aws_networkmanager_core_network_policy_document["json"])

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/networkmanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := networkmanager.NewCoreNetwork(ctx, "example", &networkmanager.CoreNetworkArgs{
			GlobalNetworkId: pulumi.Any(exampleAwsNetworkmanagerGlobalNetwork.Id),
		})
		if err != nil {
			return err
		}
		_, err = networkmanager.NewCoreNetworkPolicyAttachment(ctx, "example", &networkmanager.CoreNetworkPolicyAttachmentArgs{
			CoreNetworkId:  example.ID(),
			PolicyDocument: pulumi.Any(exampleAwsNetworkmanagerCoreNetworkPolicyDocument.Json),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.NetworkManager.CoreNetwork("example", new()
    {
        GlobalNetworkId = exampleAwsNetworkmanagerGlobalNetwork.Id,
    });

    var exampleCoreNetworkPolicyAttachment = new Aws.NetworkManager.CoreNetworkPolicyAttachment("example", new()
    {
        CoreNetworkId = example.Id,
        PolicyDocument = exampleAwsNetworkmanagerCoreNetworkPolicyDocument.Json,
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.networkmanager.CoreNetwork;
import com.pulumi.aws.networkmanager.CoreNetworkArgs;
import com.pulumi.aws.networkmanager.CoreNetworkPolicyAttachment;
import com.pulumi.aws.networkmanager.CoreNetworkPolicyAttachmentArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new CoreNetwork("example", CoreNetworkArgs.builder()
            .globalNetworkId(exampleAwsNetworkmanagerGlobalNetwork.id())
            .build());

        var exampleCoreNetworkPolicyAttachment = new CoreNetworkPolicyAttachment("exampleCoreNetworkPolicyAttachment", CoreNetworkPolicyAttachmentArgs.builder()
            .coreNetworkId(example.id())
            .policyDocument(exampleAwsNetworkmanagerCoreNetworkPolicyDocument.json())
            .build());

    }
}

resources:
  example:
    type: aws:networkmanager:CoreNetwork
    properties:
      globalNetworkId: ${exampleAwsNetworkmanagerGlobalNetwork.id}
  exampleCoreNetworkPolicyAttachment:
    type: aws:networkmanager:CoreNetworkPolicyAttachment
    name: example
    properties:
      coreNetworkId: ${example.id}
      policyDocument: ${exampleAwsNetworkmanagerCoreNetworkPolicyDocument.json}

The coreNetworkId references your existing core network. The policyDocument contains the JSON policy from getCoreNetworkPolicyDocument. When you apply this resource, the policy transitions to LIVE state and deploys globally. Note that deleting this resource does not revert to the previous policy version.

Bootstrap a new core network with VPC attachments

New core networks require a LIVE policy before VPCs can attach. When your final policy references VPC attachments, you need a two-stage deployment.

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const exampleGlobalNetwork = new aws.networkmanager.GlobalNetwork("example", {});
const base = aws.networkmanager.getCoreNetworkPolicyDocument({
    coreNetworkConfigurations: [{
        asnRanges: ["65022-65534"],
        edgeLocations: [{
            location: "us-west-2",
            asn: "65500",
        }],
    }],
    segments: [{
        name: "segment",
    }],
});
const exampleCoreNetwork = new aws.networkmanager.CoreNetwork("example", {
    globalNetworkId: exampleGlobalNetwork.id,
    basePolicyDocument: base.then(base => base.json),
    createBasePolicy: true,
});
const exampleVpcAttachment = new aws.networkmanager.VpcAttachment("example", {
    coreNetworkId: exampleCoreNetwork.id,
    subnetArns: exampleAwsSubnet.map(__item => __item.arn),
    vpcArn: exampleAwsVpc.arn,
});
const example = aws.networkmanager.getCoreNetworkPolicyDocumentOutput({
    coreNetworkConfigurations: [{
        asnRanges: ["65022-65534"],
        edgeLocations: [{
            location: "us-west-2",
            asn: "65500",
        }],
    }],
    segments: [{
        name: "segment",
    }],
    segmentActions: [{
        action: "create-route",
        segment: "segment",
        destinationCidrBlocks: ["0.0.0.0/0"],
        destinations: [exampleVpcAttachment.id],
    }],
});
const exampleCoreNetworkPolicyAttachment = new aws.networkmanager.CoreNetworkPolicyAttachment("example", {
    coreNetworkId: exampleCoreNetwork.id,
    policyDocument: example.apply(example => example.json),
});

import pulumi
import pulumi_aws as aws

example_global_network = aws.networkmanager.GlobalNetwork("example")
base = aws.networkmanager.get_core_network_policy_document(core_network_configurations=[{
        "asn_ranges": ["65022-65534"],
        "edge_locations": [{
            "location": "us-west-2",
            "asn": "65500",
        }],
    }],
    segments=[{
        "name": "segment",
    }])
example_core_network = aws.networkmanager.CoreNetwork("example",
    global_network_id=example_global_network.id,
    base_policy_document=base.json,
    create_base_policy=True)
example_vpc_attachment = aws.networkmanager.VpcAttachment("example",
    core_network_id=example_core_network.id,
    subnet_arns=[__item["arn"] for __item in example_aws_subnet],
    vpc_arn=example_aws_vpc["arn"])
example = aws.networkmanager.get_core_network_policy_document_output(core_network_configurations=[{
        "asn_ranges": ["65022-65534"],
        "edge_locations": [{
            "location": "us-west-2",
            "asn": "65500",
        }],
    }],
    segments=[{
        "name": "segment",
    }],
    segment_actions=[{
        "action": "create-route",
        "segment": "segment",
        "destination_cidr_blocks": ["0.0.0.0/0"],
        "destinations": [example_vpc_attachment.id],
    }])
example_core_network_policy_attachment = aws.networkmanager.CoreNetworkPolicyAttachment("example",
    core_network_id=example_core_network.id,
    policy_document=example.json)

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/networkmanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
exampleGlobalNetwork, err := networkmanager.NewGlobalNetwork(ctx, "example", nil)
if err != nil {
return err
}
base, err := networkmanager.GetCoreNetworkPolicyDocument(ctx, &networkmanager.GetCoreNetworkPolicyDocumentArgs{
CoreNetworkConfigurations: []networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfiguration{
{
AsnRanges: []string{
"65022-65534",
},
EdgeLocations: []networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocation{
{
Location: "us-west-2",
Asn: pulumi.StringRef("65500"),
},
},
},
},
Segments: []networkmanager.GetCoreNetworkPolicyDocumentSegment{
{
Name: "segment",
},
},
}, nil);
if err != nil {
return err
}
exampleCoreNetwork, err := networkmanager.NewCoreNetwork(ctx, "example", &networkmanager.CoreNetworkArgs{
GlobalNetworkId: exampleGlobalNetwork.ID(),
BasePolicyDocument: pulumi.String(base.Json),
CreateBasePolicy: pulumi.Bool(true),
})
if err != nil {
return err
}
var splat0 []interface{}
for _, val0 := range exampleAwsSubnet {
splat0 = append(splat0, val0.Arn)
}
exampleVpcAttachment, err := networkmanager.NewVpcAttachment(ctx, "example", &networkmanager.VpcAttachmentArgs{
CoreNetworkId: exampleCoreNetwork.ID(),
SubnetArns: toPulumiArray(splat0),
VpcArn: pulumi.Any(exampleAwsVpc.Arn),
})
if err != nil {
return err
}
example := networkmanager.GetCoreNetworkPolicyDocumentOutput(ctx, networkmanager.GetCoreNetworkPolicyDocumentOutputArgs{
CoreNetworkConfigurations: networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationArray{
&networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationArgs{
AsnRanges: pulumi.StringArray{
pulumi.String("65022-65534"),
},
EdgeLocations: networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArray{
&networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArgs{
Location: pulumi.String("us-west-2"),
Asn: pulumi.String("65500"),
},
},
},
},
Segments: networkmanager.GetCoreNetworkPolicyDocumentSegmentArray{
&networkmanager.GetCoreNetworkPolicyDocumentSegmentArgs{
Name: pulumi.String("segment"),
},
},
SegmentActions: networkmanager.GetCoreNetworkPolicyDocumentSegmentActionArray{
&networkmanager.GetCoreNetworkPolicyDocumentSegmentActionArgs{
Action: pulumi.String("create-route"),
Segment: pulumi.String("segment"),
DestinationCidrBlocks: pulumi.StringArray{
pulumi.String("0.0.0.0/0"),
},
Destinations: pulumi.StringArray{
exampleVpcAttachment.ID(),
},
},
},
}, nil);
_, err = networkmanager.NewCoreNetworkPolicyAttachment(ctx, "example", &networkmanager.CoreNetworkPolicyAttachmentArgs{
CoreNetworkId: exampleCoreNetwork.ID(),
PolicyDocument: pulumi.String(example.ApplyT(func(example networkmanager.GetCoreNetworkPolicyDocumentResult) (*string, error) {
return &example.Json, nil
}).(pulumi.StringPtrOutput)),
})
if err != nil {
return err
}
return nil
})
}
func toPulumiArray(arr []) pulumi.Array {
var pulumiArr pulumi.Array
for _, v := range arr {
pulumiArr = append(pulumiArr, pulumi.(v))
}
return pulumiArr
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var exampleGlobalNetwork = new Aws.NetworkManager.GlobalNetwork("example");

    var @base = Aws.NetworkManager.GetCoreNetworkPolicyDocument.Invoke(new()
    {
        CoreNetworkConfigurations = new[]
        {
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationInputArgs
            {
                AsnRanges = new[]
                {
                    "65022-65534",
                },
                EdgeLocations = new[]
                {
                    new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationInputArgs
                    {
                        Location = "us-west-2",
                        Asn = "65500",
                    },
                },
            },
        },
        Segments = new[]
        {
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentSegmentInputArgs
            {
                Name = "segment",
            },
        },
    });

    var exampleCoreNetwork = new Aws.NetworkManager.CoreNetwork("example", new()
    {
        GlobalNetworkId = exampleGlobalNetwork.Id,
        BasePolicyDocument = @base.Apply(@base => @base.Apply(getCoreNetworkPolicyDocumentResult => getCoreNetworkPolicyDocumentResult.Json)),
        CreateBasePolicy = true,
    });

    var exampleVpcAttachment = new Aws.NetworkManager.VpcAttachment("example", new()
    {
        CoreNetworkId = exampleCoreNetwork.Id,
        SubnetArns = exampleAwsSubnet.Select(__item => __item.Arn).ToList(),
        VpcArn = exampleAwsVpc.Arn,
    });

    var example = Aws.NetworkManager.GetCoreNetworkPolicyDocument.Invoke(new()
    {
        CoreNetworkConfigurations = new[]
        {
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationInputArgs
            {
                AsnRanges = new[]
                {
                    "65022-65534",
                },
                EdgeLocations = new[]
                {
                    new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationInputArgs
                    {
                        Location = "us-west-2",
                        Asn = "65500",
                    },
                },
            },
        },
        Segments = new[]
        {
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentSegmentInputArgs
            {
                Name = "segment",
            },
        },
        SegmentActions = new[]
        {
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentSegmentActionInputArgs
            {
                Action = "create-route",
                Segment = "segment",
                DestinationCidrBlocks = new[]
                {
                    "0.0.0.0/0",
                },
                Destinations = new[]
                {
                    exampleVpcAttachment.Id,
                },
            },
        },
    });

    var exampleCoreNetworkPolicyAttachment = new Aws.NetworkManager.CoreNetworkPolicyAttachment("example", new()
    {
        CoreNetworkId = exampleCoreNetwork.Id,
        PolicyDocument = example.Apply(getCoreNetworkPolicyDocumentResult => getCoreNetworkPolicyDocumentResult.Json),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.networkmanager.GlobalNetwork;
import com.pulumi.aws.networkmanager.NetworkmanagerFunctions;
import com.pulumi.aws.networkmanager.inputs.GetCoreNetworkPolicyDocumentArgs;
import com.pulumi.aws.networkmanager.CoreNetwork;
import com.pulumi.aws.networkmanager.CoreNetworkArgs;
import com.pulumi.aws.networkmanager.VpcAttachment;
import com.pulumi.aws.networkmanager.VpcAttachmentArgs;
import com.pulumi.aws.networkmanager.CoreNetworkPolicyAttachment;
import com.pulumi.aws.networkmanager.CoreNetworkPolicyAttachmentArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var exampleGlobalNetwork = new GlobalNetwork("exampleGlobalNetwork");

        final var base = NetworkmanagerFunctions.getCoreNetworkPolicyDocument(GetCoreNetworkPolicyDocumentArgs.builder()
            .coreNetworkConfigurations(GetCoreNetworkPolicyDocumentCoreNetworkConfigurationArgs.builder()
                .asnRanges("65022-65534")
                .edgeLocations(GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArgs.builder()
                    .location("us-west-2")
                    .asn("65500")
                    .build())
                .build())
            .segments(GetCoreNetworkPolicyDocumentSegmentArgs.builder()
                .name("segment")
                .build())
            .build());

        var exampleCoreNetwork = new CoreNetwork("exampleCoreNetwork", CoreNetworkArgs.builder()
            .globalNetworkId(exampleGlobalNetwork.id())
            .basePolicyDocument(base.json())
            .createBasePolicy(true)
            .build());

        var exampleVpcAttachment = new VpcAttachment("exampleVpcAttachment", VpcAttachmentArgs.builder()
            .coreNetworkId(exampleCoreNetwork.id())
            .subnetArns(exampleAwsSubnet.stream().map(element -> element.arn()).collect(toList()))
            .vpcArn(exampleAwsVpc.arn())
            .build());

        final var example = NetworkmanagerFunctions.getCoreNetworkPolicyDocument(GetCoreNetworkPolicyDocumentArgs.builder()
            .coreNetworkConfigurations(GetCoreNetworkPolicyDocumentCoreNetworkConfigurationArgs.builder()
                .asnRanges("65022-65534")
                .edgeLocations(GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArgs.builder()
                    .location("us-west-2")
                    .asn("65500")
                    .build())
                .build())
            .segments(GetCoreNetworkPolicyDocumentSegmentArgs.builder()
                .name("segment")
                .build())
            .segmentActions(GetCoreNetworkPolicyDocumentSegmentActionArgs.builder()
                .action("create-route")
                .segment("segment")
                .destinationCidrBlocks("0.0.0.0/0")
                .destinations(exampleVpcAttachment.id())
                .build())
            .build());

        var exampleCoreNetworkPolicyAttachment = new CoreNetworkPolicyAttachment("exampleCoreNetworkPolicyAttachment", CoreNetworkPolicyAttachmentArgs.builder()
            .coreNetworkId(exampleCoreNetwork.id())
            .policyDocument(example.applyValue(_example -> _example.json()))
            .build());

    }
}

The basePolicyDocument creates an initial LIVE policy with edge locations and ASN assignments. The createBasePolicy flag enables this bootstrap behavior. After the base policy deploys, VPC attachments can succeed. The final policy attachment then adds segment actions that create static routes pointing to the VPC attachments. This two-stage approach is necessary because VPCs cannot attach to a core network without an existing LIVE policy.

Bootstrap with automatic base policy generation

When you don’t need to customize edge location ASNs, the core network can generate a base policy automatically.

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const exampleGlobalNetwork = new aws.networkmanager.GlobalNetwork("example", {});
const exampleCoreNetwork = new aws.networkmanager.CoreNetwork("example", {
    globalNetworkId: exampleGlobalNetwork.id,
    createBasePolicy: true,
});
const exampleVpcAttachment = new aws.networkmanager.VpcAttachment("example", {
    coreNetworkId: exampleCoreNetwork.id,
    subnetArns: exampleAwsSubnet.map(__item => __item.arn),
    vpcArn: exampleAwsVpc.arn,
});
const example = aws.networkmanager.getCoreNetworkPolicyDocumentOutput({
    coreNetworkConfigurations: [{
        asnRanges: ["65022-65534"],
        edgeLocations: [{
            location: "us-west-2",
        }],
    }],
    segments: [{
        name: "segment",
    }],
    segmentActions: [{
        action: "create-route",
        segment: "segment",
        destinationCidrBlocks: ["0.0.0.0/0"],
        destinations: [exampleVpcAttachment.id],
    }],
});
const exampleCoreNetworkPolicyAttachment = new aws.networkmanager.CoreNetworkPolicyAttachment("example", {
    coreNetworkId: exampleCoreNetwork.id,
    policyDocument: example.apply(example => example.json),
});

import pulumi
import pulumi_aws as aws

example_global_network = aws.networkmanager.GlobalNetwork("example")
example_core_network = aws.networkmanager.CoreNetwork("example",
    global_network_id=example_global_network.id,
    create_base_policy=True)
example_vpc_attachment = aws.networkmanager.VpcAttachment("example",
    core_network_id=example_core_network.id,
    subnet_arns=[__item["arn"] for __item in example_aws_subnet],
    vpc_arn=example_aws_vpc["arn"])
example = aws.networkmanager.get_core_network_policy_document_output(core_network_configurations=[{
        "asn_ranges": ["65022-65534"],
        "edge_locations": [{
            "location": "us-west-2",
        }],
    }],
    segments=[{
        "name": "segment",
    }],
    segment_actions=[{
        "action": "create-route",
        "segment": "segment",
        "destination_cidr_blocks": ["0.0.0.0/0"],
        "destinations": [example_vpc_attachment.id],
    }])
example_core_network_policy_attachment = aws.networkmanager.CoreNetworkPolicyAttachment("example",
    core_network_id=example_core_network.id,
    policy_document=example.json)

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/networkmanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
exampleGlobalNetwork, err := networkmanager.NewGlobalNetwork(ctx, "example", nil)
if err != nil {
return err
}
exampleCoreNetwork, err := networkmanager.NewCoreNetwork(ctx, "example", &networkmanager.CoreNetworkArgs{
GlobalNetworkId: exampleGlobalNetwork.ID(),
CreateBasePolicy: pulumi.Bool(true),
})
if err != nil {
return err
}
var splat0 []interface{}
for _, val0 := range exampleAwsSubnet {
splat0 = append(splat0, val0.Arn)
}
exampleVpcAttachment, err := networkmanager.NewVpcAttachment(ctx, "example", &networkmanager.VpcAttachmentArgs{
CoreNetworkId: exampleCoreNetwork.ID(),
SubnetArns: toPulumiArray(splat0),
VpcArn: pulumi.Any(exampleAwsVpc.Arn),
})
if err != nil {
return err
}
example := networkmanager.GetCoreNetworkPolicyDocumentOutput(ctx, networkmanager.GetCoreNetworkPolicyDocumentOutputArgs{
CoreNetworkConfigurations: networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationArray{
&networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationArgs{
AsnRanges: pulumi.StringArray{
pulumi.String("65022-65534"),
},
EdgeLocations: networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArray{
&networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArgs{
Location: pulumi.String("us-west-2"),
},
},
},
},
Segments: networkmanager.GetCoreNetworkPolicyDocumentSegmentArray{
&networkmanager.GetCoreNetworkPolicyDocumentSegmentArgs{
Name: pulumi.String("segment"),
},
},
SegmentActions: networkmanager.GetCoreNetworkPolicyDocumentSegmentActionArray{
&networkmanager.GetCoreNetworkPolicyDocumentSegmentActionArgs{
Action: pulumi.String("create-route"),
Segment: pulumi.String("segment"),
DestinationCidrBlocks: pulumi.StringArray{
pulumi.String("0.0.0.0/0"),
},
Destinations: pulumi.StringArray{
exampleVpcAttachment.ID(),
},
},
},
}, nil);
_, err = networkmanager.NewCoreNetworkPolicyAttachment(ctx, "example", &networkmanager.CoreNetworkPolicyAttachmentArgs{
CoreNetworkId: exampleCoreNetwork.ID(),
PolicyDocument: pulumi.String(example.ApplyT(func(example networkmanager.GetCoreNetworkPolicyDocumentResult) (*string, error) {
return &example.Json, nil
}).(pulumi.StringPtrOutput)),
})
if err != nil {
return err
}
return nil
})
}
func toPulumiArray(arr []) pulumi.Array {
var pulumiArr pulumi.Array
for _, v := range arr {
pulumiArr = append(pulumiArr, pulumi.(v))
}
return pulumiArr
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var exampleGlobalNetwork = new Aws.NetworkManager.GlobalNetwork("example");

    var exampleCoreNetwork = new Aws.NetworkManager.CoreNetwork("example", new()
    {
        GlobalNetworkId = exampleGlobalNetwork.Id,
        CreateBasePolicy = true,
    });

    var exampleVpcAttachment = new Aws.NetworkManager.VpcAttachment("example", new()
    {
        CoreNetworkId = exampleCoreNetwork.Id,
        SubnetArns = exampleAwsSubnet.Select(__item => __item.Arn).ToList(),
        VpcArn = exampleAwsVpc.Arn,
    });

    var example = Aws.NetworkManager.GetCoreNetworkPolicyDocument.Invoke(new()
    {
        CoreNetworkConfigurations = new[]
        {
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationInputArgs
            {
                AsnRanges = new[]
                {
                    "65022-65534",
                },
                EdgeLocations = new[]
                {
                    new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationInputArgs
                    {
                        Location = "us-west-2",
                    },
                },
            },
        },
        Segments = new[]
        {
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentSegmentInputArgs
            {
                Name = "segment",
            },
        },
        SegmentActions = new[]
        {
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentSegmentActionInputArgs
            {
                Action = "create-route",
                Segment = "segment",
                DestinationCidrBlocks = new[]
                {
                    "0.0.0.0/0",
                },
                Destinations = new[]
                {
                    exampleVpcAttachment.Id,
                },
            },
        },
    });

    var exampleCoreNetworkPolicyAttachment = new Aws.NetworkManager.CoreNetworkPolicyAttachment("example", new()
    {
        CoreNetworkId = exampleCoreNetwork.Id,
        PolicyDocument = example.Apply(getCoreNetworkPolicyDocumentResult => getCoreNetworkPolicyDocumentResult.Json),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.networkmanager.GlobalNetwork;
import com.pulumi.aws.networkmanager.CoreNetwork;
import com.pulumi.aws.networkmanager.CoreNetworkArgs;
import com.pulumi.aws.networkmanager.VpcAttachment;
import com.pulumi.aws.networkmanager.VpcAttachmentArgs;
import com.pulumi.aws.networkmanager.NetworkmanagerFunctions;
import com.pulumi.aws.networkmanager.inputs.GetCoreNetworkPolicyDocumentArgs;
import com.pulumi.aws.networkmanager.CoreNetworkPolicyAttachment;
import com.pulumi.aws.networkmanager.CoreNetworkPolicyAttachmentArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var exampleGlobalNetwork = new GlobalNetwork("exampleGlobalNetwork");

        var exampleCoreNetwork = new CoreNetwork("exampleCoreNetwork", CoreNetworkArgs.builder()
            .globalNetworkId(exampleGlobalNetwork.id())
            .createBasePolicy(true)
            .build());

        var exampleVpcAttachment = new VpcAttachment("exampleVpcAttachment", VpcAttachmentArgs.builder()
            .coreNetworkId(exampleCoreNetwork.id())
            .subnetArns(exampleAwsSubnet.stream().map(element -> element.arn()).collect(toList()))
            .vpcArn(exampleAwsVpc.arn())
            .build());

        final var example = NetworkmanagerFunctions.getCoreNetworkPolicyDocument(GetCoreNetworkPolicyDocumentArgs.builder()
            .coreNetworkConfigurations(GetCoreNetworkPolicyDocumentCoreNetworkConfigurationArgs.builder()
                .asnRanges("65022-65534")
                .edgeLocations(GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArgs.builder()
                    .location("us-west-2")
                    .build())
                .build())
            .segments(GetCoreNetworkPolicyDocumentSegmentArgs.builder()
                .name("segment")
                .build())
            .segmentActions(GetCoreNetworkPolicyDocumentSegmentActionArgs.builder()
                .action("create-route")
                .segment("segment")
                .destinationCidrBlocks("0.0.0.0/0")
                .destinations(exampleVpcAttachment.id())
                .build())
            .build());

        var exampleCoreNetworkPolicyAttachment = new CoreNetworkPolicyAttachment("exampleCoreNetworkPolicyAttachment", CoreNetworkPolicyAttachmentArgs.builder()
            .coreNetworkId(exampleCoreNetwork.id())
            .policyDocument(example.applyValue(_example -> _example.json()))
            .build());

    }
}

Setting createBasePolicy to true without basePolicyDocument generates a base policy using the provider’s region. This simplifies deployment when default ASN assignments are acceptable. The VPC attachment and final policy follow the same pattern as the previous example, but you skip the explicit base policy document definition.

Deploy multi-region networks with custom ASNs

Global networks spanning multiple regions require edge locations in each region with region-specific ASN assignments.

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const exampleGlobalNetwork = new aws.networkmanager.GlobalNetwork("example", {});
const base = aws.networkmanager.getCoreNetworkPolicyDocument({
    coreNetworkConfigurations: [{
        asnRanges: ["65022-65534"],
        edgeLocations: [
            {
                location: "us-west-2",
                asn: "65500",
            },
            {
                location: "us-east-1",
                asn: "65501",
            },
        ],
    }],
    segments: [{
        name: "segment",
    }],
});
const exampleCoreNetwork = new aws.networkmanager.CoreNetwork("example", {
    globalNetworkId: exampleGlobalNetwork.id,
    basePolicyDocument: base.then(base => base.json),
    createBasePolicy: true,
});
const exampleUsWest2 = new aws.networkmanager.VpcAttachment("example_us_west_2", {
    coreNetworkId: exampleCoreNetwork.id,
    subnetArns: exampleUsWest2AwsSubnet.map(__item => __item.arn),
    vpcArn: exampleUsWest2AwsVpc.arn,
});
const exampleUsEast1 = new aws.networkmanager.VpcAttachment("example_us_east_1", {
    coreNetworkId: exampleCoreNetwork.id,
    subnetArns: exampleUsEast1AwsSubnet.map(__item => __item.arn),
    vpcArn: exampleUsEast1AwsVpc.arn,
});
const example = aws.networkmanager.getCoreNetworkPolicyDocumentOutput({
    coreNetworkConfigurations: [{
        asnRanges: ["65022-65534"],
        edgeLocations: [
            {
                location: "us-west-2",
                asn: "65500",
            },
            {
                location: "us-east-1",
                asn: "65501",
            },
        ],
    }],
    segments: [
        {
            name: "segment",
        },
        {
            name: "segment2",
        },
    ],
    segmentActions: [
        {
            action: "create-route",
            segment: "segment",
            destinationCidrBlocks: ["10.0.0.0/16"],
            destinations: [exampleUsWest2.id],
        },
        {
            action: "create-route",
            segment: "segment",
            destinationCidrBlocks: ["10.1.0.0/16"],
            destinations: [exampleUsEast1.id],
        },
    ],
});
const exampleCoreNetworkPolicyAttachment = new aws.networkmanager.CoreNetworkPolicyAttachment("example", {
    coreNetworkId: exampleCoreNetwork.id,
    policyDocument: example.apply(example => example.json),
});

import pulumi
import pulumi_aws as aws

example_global_network = aws.networkmanager.GlobalNetwork("example")
base = aws.networkmanager.get_core_network_policy_document(core_network_configurations=[{
        "asn_ranges": ["65022-65534"],
        "edge_locations": [
            {
                "location": "us-west-2",
                "asn": "65500",
            },
            {
                "location": "us-east-1",
                "asn": "65501",
            },
        ],
    }],
    segments=[{
        "name": "segment",
    }])
example_core_network = aws.networkmanager.CoreNetwork("example",
    global_network_id=example_global_network.id,
    base_policy_document=base.json,
    create_base_policy=True)
example_us_west2 = aws.networkmanager.VpcAttachment("example_us_west_2",
    core_network_id=example_core_network.id,
    subnet_arns=[__item["arn"] for __item in example_us_west2_aws_subnet],
    vpc_arn=example_us_west2_aws_vpc["arn"])
example_us_east1 = aws.networkmanager.VpcAttachment("example_us_east_1",
    core_network_id=example_core_network.id,
    subnet_arns=[__item["arn"] for __item in example_us_east1_aws_subnet],
    vpc_arn=example_us_east1_aws_vpc["arn"])
example = aws.networkmanager.get_core_network_policy_document_output(core_network_configurations=[{
        "asn_ranges": ["65022-65534"],
        "edge_locations": [
            {
                "location": "us-west-2",
                "asn": "65500",
            },
            {
                "location": "us-east-1",
                "asn": "65501",
            },
        ],
    }],
    segments=[
        {
            "name": "segment",
        },
        {
            "name": "segment2",
        },
    ],
    segment_actions=[
        {
            "action": "create-route",
            "segment": "segment",
            "destination_cidr_blocks": ["10.0.0.0/16"],
            "destinations": [example_us_west2.id],
        },
        {
            "action": "create-route",
            "segment": "segment",
            "destination_cidr_blocks": ["10.1.0.0/16"],
            "destinations": [example_us_east1.id],
        },
    ])
example_core_network_policy_attachment = aws.networkmanager.CoreNetworkPolicyAttachment("example",
    core_network_id=example_core_network.id,
    policy_document=example.json)

package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/networkmanager"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
exampleGlobalNetwork, err := networkmanager.NewGlobalNetwork(ctx, "example", nil)
if err != nil {
return err
}
base, err := networkmanager.GetCoreNetworkPolicyDocument(ctx, &networkmanager.GetCoreNetworkPolicyDocumentArgs{
CoreNetworkConfigurations: []networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfiguration{
{
AsnRanges: []string{
"65022-65534",
},
EdgeLocations: []networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocation{
{
Location: "us-west-2",
Asn: pulumi.StringRef("65500"),
},
{
Location: "us-east-1",
Asn: pulumi.StringRef("65501"),
},
},
},
},
Segments: []networkmanager.GetCoreNetworkPolicyDocumentSegment{
{
Name: "segment",
},
},
}, nil);
if err != nil {
return err
}
exampleCoreNetwork, err := networkmanager.NewCoreNetwork(ctx, "example", &networkmanager.CoreNetworkArgs{
GlobalNetworkId: exampleGlobalNetwork.ID(),
BasePolicyDocument: pulumi.String(base.Json),
CreateBasePolicy: pulumi.Bool(true),
})
if err != nil {
return err
}
var splat0 []interface{}
for _, val0 := range exampleUsWest2AwsSubnet {
splat0 = append(splat0, val0.Arn)
}
exampleUsWest2, err := networkmanager.NewVpcAttachment(ctx, "example_us_west_2", &networkmanager.VpcAttachmentArgs{
CoreNetworkId: exampleCoreNetwork.ID(),
SubnetArns: toPulumiArray(splat0),
VpcArn: pulumi.Any(exampleUsWest2AwsVpc.Arn),
})
if err != nil {
return err
}
var splat1 []interface{}
for _, val0 := range exampleUsEast1AwsSubnet {
splat1 = append(splat1, val0.Arn)
}
exampleUsEast1, err := networkmanager.NewVpcAttachment(ctx, "example_us_east_1", &networkmanager.VpcAttachmentArgs{
CoreNetworkId: exampleCoreNetwork.ID(),
SubnetArns: toPulumiArray(splat1),
VpcArn: pulumi.Any(exampleUsEast1AwsVpc.Arn),
})
if err != nil {
return err
}
example := networkmanager.GetCoreNetworkPolicyDocumentOutput(ctx, networkmanager.GetCoreNetworkPolicyDocumentOutputArgs{
CoreNetworkConfigurations: networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationArray{
&networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationArgs{
AsnRanges: pulumi.StringArray{
pulumi.String("65022-65534"),
},
EdgeLocations: networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArray{
&networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArgs{
Location: pulumi.String("us-west-2"),
Asn: pulumi.String("65500"),
},
&networkmanager.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArgs{
Location: pulumi.String("us-east-1"),
Asn: pulumi.String("65501"),
},
},
},
},
Segments: networkmanager.GetCoreNetworkPolicyDocumentSegmentArray{
&networkmanager.GetCoreNetworkPolicyDocumentSegmentArgs{
Name: pulumi.String("segment"),
},
&networkmanager.GetCoreNetworkPolicyDocumentSegmentArgs{
Name: pulumi.String("segment2"),
},
},
SegmentActions: networkmanager.GetCoreNetworkPolicyDocumentSegmentActionArray{
&networkmanager.GetCoreNetworkPolicyDocumentSegmentActionArgs{
Action: pulumi.String("create-route"),
Segment: pulumi.String("segment"),
DestinationCidrBlocks: pulumi.StringArray{
pulumi.String("10.0.0.0/16"),
},
Destinations: pulumi.StringArray{
exampleUsWest2.ID(),
},
},
&networkmanager.GetCoreNetworkPolicyDocumentSegmentActionArgs{
Action: pulumi.String("create-route"),
Segment: pulumi.String("segment"),
DestinationCidrBlocks: pulumi.StringArray{
pulumi.String("10.1.0.0/16"),
},
Destinations: pulumi.StringArray{
exampleUsEast1.ID(),
},
},
},
}, nil);
_, err = networkmanager.NewCoreNetworkPolicyAttachment(ctx, "example", &networkmanager.CoreNetworkPolicyAttachmentArgs{
CoreNetworkId: exampleCoreNetwork.ID(),
PolicyDocument: pulumi.String(example.ApplyT(func(example networkmanager.GetCoreNetworkPolicyDocumentResult) (*string, error) {
return &example.Json, nil
}).(pulumi.StringPtrOutput)),
})
if err != nil {
return err
}
return nil
})
}
func toPulumiArray(arr []) pulumi.Array {
var pulumiArr pulumi.Array
for _, v := range arr {
pulumiArr = append(pulumiArr, pulumi.(v))
}
return pulumiArr
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var exampleGlobalNetwork = new Aws.NetworkManager.GlobalNetwork("example");

    var @base = Aws.NetworkManager.GetCoreNetworkPolicyDocument.Invoke(new()
    {
        CoreNetworkConfigurations = new[]
        {
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationInputArgs
            {
                AsnRanges = new[]
                {
                    "65022-65534",
                },
                EdgeLocations = new[]
                {
                    new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationInputArgs
                    {
                        Location = "us-west-2",
                        Asn = "65500",
                    },
                    new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationInputArgs
                    {
                        Location = "us-east-1",
                        Asn = "65501",
                    },
                },
            },
        },
        Segments = new[]
        {
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentSegmentInputArgs
            {
                Name = "segment",
            },
        },
    });

    var exampleCoreNetwork = new Aws.NetworkManager.CoreNetwork("example", new()
    {
        GlobalNetworkId = exampleGlobalNetwork.Id,
        BasePolicyDocument = @base.Apply(@base => @base.Apply(getCoreNetworkPolicyDocumentResult => getCoreNetworkPolicyDocumentResult.Json)),
        CreateBasePolicy = true,
    });

    var exampleUsWest2 = new Aws.NetworkManager.VpcAttachment("example_us_west_2", new()
    {
        CoreNetworkId = exampleCoreNetwork.Id,
        SubnetArns = exampleUsWest2AwsSubnet.Select(__item => __item.Arn).ToList(),
        VpcArn = exampleUsWest2AwsVpc.Arn,
    });

    var exampleUsEast1 = new Aws.NetworkManager.VpcAttachment("example_us_east_1", new()
    {
        CoreNetworkId = exampleCoreNetwork.Id,
        SubnetArns = exampleUsEast1AwsSubnet.Select(__item => __item.Arn).ToList(),
        VpcArn = exampleUsEast1AwsVpc.Arn,
    });

    var example = Aws.NetworkManager.GetCoreNetworkPolicyDocument.Invoke(new()
    {
        CoreNetworkConfigurations = new[]
        {
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationInputArgs
            {
                AsnRanges = new[]
                {
                    "65022-65534",
                },
                EdgeLocations = new[]
                {
                    new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationInputArgs
                    {
                        Location = "us-west-2",
                        Asn = "65500",
                    },
                    new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationInputArgs
                    {
                        Location = "us-east-1",
                        Asn = "65501",
                    },
                },
            },
        },
        Segments = new[]
        {
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentSegmentInputArgs
            {
                Name = "segment",
            },
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentSegmentInputArgs
            {
                Name = "segment2",
            },
        },
        SegmentActions = new[]
        {
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentSegmentActionInputArgs
            {
                Action = "create-route",
                Segment = "segment",
                DestinationCidrBlocks = new[]
                {
                    "10.0.0.0/16",
                },
                Destinations = new[]
                {
                    exampleUsWest2.Id,
                },
            },
            new Aws.NetworkManager.Inputs.GetCoreNetworkPolicyDocumentSegmentActionInputArgs
            {
                Action = "create-route",
                Segment = "segment",
                DestinationCidrBlocks = new[]
                {
                    "10.1.0.0/16",
                },
                Destinations = new[]
                {
                    exampleUsEast1.Id,
                },
            },
        },
    });

    var exampleCoreNetworkPolicyAttachment = new Aws.NetworkManager.CoreNetworkPolicyAttachment("example", new()
    {
        CoreNetworkId = exampleCoreNetwork.Id,
        PolicyDocument = example.Apply(getCoreNetworkPolicyDocumentResult => getCoreNetworkPolicyDocumentResult.Json),
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.networkmanager.GlobalNetwork;
import com.pulumi.aws.networkmanager.NetworkmanagerFunctions;
import com.pulumi.aws.networkmanager.inputs.GetCoreNetworkPolicyDocumentArgs;
import com.pulumi.aws.networkmanager.CoreNetwork;
import com.pulumi.aws.networkmanager.CoreNetworkArgs;
import com.pulumi.aws.networkmanager.VpcAttachment;
import com.pulumi.aws.networkmanager.VpcAttachmentArgs;
import com.pulumi.aws.networkmanager.CoreNetworkPolicyAttachment;
import com.pulumi.aws.networkmanager.CoreNetworkPolicyAttachmentArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var exampleGlobalNetwork = new GlobalNetwork("exampleGlobalNetwork");

        final var base = NetworkmanagerFunctions.getCoreNetworkPolicyDocument(GetCoreNetworkPolicyDocumentArgs.builder()
            .coreNetworkConfigurations(GetCoreNetworkPolicyDocumentCoreNetworkConfigurationArgs.builder()
                .asnRanges("65022-65534")
                .edgeLocations(                
                    GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArgs.builder()
                        .location("us-west-2")
                        .asn("65500")
                        .build(),
                    GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArgs.builder()
                        .location("us-east-1")
                        .asn("65501")
                        .build())
                .build())
            .segments(GetCoreNetworkPolicyDocumentSegmentArgs.builder()
                .name("segment")
                .build())
            .build());

        var exampleCoreNetwork = new CoreNetwork("exampleCoreNetwork", CoreNetworkArgs.builder()
            .globalNetworkId(exampleGlobalNetwork.id())
            .basePolicyDocument(base.json())
            .createBasePolicy(true)
            .build());

        var exampleUsWest2 = new VpcAttachment("exampleUsWest2", VpcAttachmentArgs.builder()
            .coreNetworkId(exampleCoreNetwork.id())
            .subnetArns(exampleUsWest2AwsSubnet.stream().map(element -> element.arn()).collect(toList()))
            .vpcArn(exampleUsWest2AwsVpc.arn())
            .build());

        var exampleUsEast1 = new VpcAttachment("exampleUsEast1", VpcAttachmentArgs.builder()
            .coreNetworkId(exampleCoreNetwork.id())
            .subnetArns(exampleUsEast1AwsSubnet.stream().map(element -> element.arn()).collect(toList()))
            .vpcArn(exampleUsEast1AwsVpc.arn())
            .build());

        final var example = NetworkmanagerFunctions.getCoreNetworkPolicyDocument(GetCoreNetworkPolicyDocumentArgs.builder()
            .coreNetworkConfigurations(GetCoreNetworkPolicyDocumentCoreNetworkConfigurationArgs.builder()
                .asnRanges("65022-65534")
                .edgeLocations(                
                    GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArgs.builder()
                        .location("us-west-2")
                        .asn("65500")
                        .build(),
                    GetCoreNetworkPolicyDocumentCoreNetworkConfigurationEdgeLocationArgs.builder()
                        .location("us-east-1")
                        .asn("65501")
                        .build())
                .build())
            .segments(            
                GetCoreNetworkPolicyDocumentSegmentArgs.builder()
                    .name("segment")
                    .build(),
                GetCoreNetworkPolicyDocumentSegmentArgs.builder()
                    .name("segment2")
                    .build())
            .segmentActions(            
                GetCoreNetworkPolicyDocumentSegmentActionArgs.builder()
                    .action("create-route")
                    .segment("segment")
                    .destinationCidrBlocks("10.0.0.0/16")
                    .destinations(exampleUsWest2.id())
                    .build(),
                GetCoreNetworkPolicyDocumentSegmentActionArgs.builder()
                    .action("create-route")
                    .segment("segment")
                    .destinationCidrBlocks("10.1.0.0/16")
                    .destinations(exampleUsEast1.id())
                    .build())
            .build());

        var exampleCoreNetworkPolicyAttachment = new CoreNetworkPolicyAttachment("exampleCoreNetworkPolicyAttachment", CoreNetworkPolicyAttachmentArgs.builder()
            .coreNetworkId(exampleCoreNetwork.id())
            .policyDocument(example.applyValue(_example -> _example.json()))
            .build());

    }
}

The basePolicyDocument defines multiple edge locations, each with its own ASN for BGP routing control. VPC attachments in each region reference region-specific subnets and VPCs. The final policy’s segmentActions create routes pointing to attachments in different regions, enabling cross-region connectivity through the core network’s global backbone.

Beyond these examples

These snippets focus on specific policy attachment features: policy attachment and LIVE deployment, base policy bootstrapping for new networks, and multi-region edge location configuration. They’re intentionally minimal rather than full network deployments.

The examples may reference pre-existing infrastructure such as global networks, VPCs and subnets, VPC attachments, and policy documents from getCoreNetworkPolicyDocument. They focus on attaching policies rather than provisioning the underlying network infrastructure.

To keep things focused, common policy patterns are omitted, including:

Policy versioning and rollback (state property is read-only)
Segment isolation and attachment policies
Cross-region peering and transit gateway integration
Policy validation before attachment

These omissions are intentional: the goal is to illustrate how policy attachment is wired, not provide drop-in network modules. See the Core Network Policy Attachment resource reference for all available configuration options.

Let's attach AWS Network Manager Core Network Policies

Get started with Pulumi Cloud, then follow our quick setup guide to deploy this infrastructure.

Try Pulumi Cloud for FREE

Frequently Asked Questions

Policy Lifecycle & Updates

What happens when I delete this resource?

Deleting the resource removes it from Pulumi state but doesn’t delete the policy from the core network or revert to a previous version. The current LIVE policy remains active.

What happens when I update the policy document?

Updating policyDocument immediately sets the new policy as both LATEST and LIVE, deploying changes globally. There’s no separate approval step.

Can I change the core network ID after creation?

No, coreNetworkId is immutable and cannot be changed after the resource is created.

Initial Setup & Base Policies

Why do I need a LIVE policy before attaching VPCs?

VPCs can only be attached to a core network that has an active LIVE policy. For first-time deployments, set createBasePolicy to true on the aws.networkmanager.CoreNetwork resource to create an initial LIVE policy.

What's the difference between basePolicyDocument and basePolicyRegions?

Both create base policies for the aws.networkmanager.CoreNetwork resource. basePolicyDocument allows full customization of edge locations and ASNs, while basePolicyRegions is simpler and just takes a list of regions.

VPC Attachments & Dependencies

How do I attach VPCs with static routes to my core network?

Follow this workflow:

Create a base policy (using createBasePolicy or basePolicyDocument on the CoreNetwork resource)
Create VPC attachments referencing the core network
Attach the final policy document with segmentActions that reference the VPC attachment IDs

Using a different cloud?

Explore networking guides for other cloud providers:

Azure Guides GCP Guides