CloudHub 2.0 Transit Gateway Connection Fails with 'Invalid Request' When Using Different Resource Share IDs for Same TGW

CAUSE

CloudHub 2.0 Private Spaces are designed to connect to a Transit Gateway (TGW) in your AWS account via an AWS Resource Access Manager (RAM) Resource Share. When multiple Private Spaces need to connect to the same TGW, they must all reference the same RAM Resource Share ID during the TGW connection setup in Anypoint Platform.

The "Invalid Request" error occurs because Anypoint Platform expects a consistent Resource Share ID when establishing multiple connections to the same underlying TGW. The Resource Share ID acts as a permission set defining which resources (like your TGW) are shared with the MuleSoft AWS account. While each Private Space will create its own unique TGW attachment in AWS, the permission mechanism (the Resource Share) must be consistent for the same target TGW. Attempting to use a different Resource Share ID for a subsequent connection to the same TGW is considered an invalid configuration.

SOLUTION

To successfully establish Transit Gateway connections for multiple CloudHub 2.0 Private Spaces to the same Transit Gateway in your AWS account, ensure you use the same AWS Resource Access Manager (RAM) Resource Share ID for all these connections.

1.  Identify your Transit Gateway: Determine the AWS Transit Gateway (TGW) in your AWS account that you intend to connect your CloudHub 2.0 Private Spaces to.
2.  Create or Identify a RAM Resource Share: In your AWS account, create or identify an existing AWS Resource Access Manager (RAM) Resource Share that includes your TGW and shares it with the MuleSoft AWS account ID for your region.
3.  Use the same Resource Share ID for all connections: When configuring the TGW connection for each CloudHub 2.0 Private Space in Anypoint Platform:

• Navigate to your Private Space settings.
• Initiate the Transit Gateway connection setup.
• When prompted for the Resource Share ID, provide the exact same Resource Share ID that you used or intend to use for all other Private Spaces connecting to this TGW.

Note: Even when using the same Resource Share ID, each CloudHub 2.0 Private Space will create its own distinct TGW attachment object in AWS, ensuring proper isolation and management at the attachment level. The name you provide for the TGW connection in Anypoint Platform serves as a label for the target TGW resource, not the specific attachment.

If you require the ability to name TGW connections differently in Anypoint Platform while using the same underlying TGW and Resource Share, consider submitting an enhancement request via the MuleSoft Ideas Portal.

APPLIES TO

CloudHub 2.0
Transit Gateway (TGW) connections