aws-secure-environment-accelerator icon indicating copy to clipboard operation
aws-secure-environment-accelerator copied to clipboard

[BUG][Functional] Routes - pcx routes only allow targeting one subnet group, not entire vpc CIDR range

Open Brian969 opened this issue 3 years ago • 1 comments

Required Basic Info

  • Accelerator Version: v1.3.5

Describe the bug

  • pcx routes only allow targeting one subnet, not entire vpc CIDR range
  • see example

Failure Info

  • Not a failure, simply a feature gap

Steps To Reproduce

  • use a sample config file, with a local workload account based VPC which is NOT TGW attached
  • On a workload account named {account-name} on VPC named {vpcname}, add the following config
          "pcx": {
            "source": "operations",
            "source-vpc": "Central",
            "source-subnets": "App",
            "local-subnets": "App"
          } 

On that same VPC, add the following to the route table (i.e. {vpcname}VPC_Common):

                {
                  "destination": {
                    "account": "operations",
                    "vpc": "Central",
                    "subnet": "App"
                  },
                  "target": "pcx"
                }

Add the following to the CentralVPC_Common route table on the Central VPC, Central OU:

                {
                  "destination": {
                    "account": "{account-name}",
                    "vpc": "{vpcname}",
                    "subnet": "App"
                  },
                  "target": "pcx"
                }
  • This works as expected, adding the route to the workload accounts App subnet CIDR's to the Central VPC
  • but Central should be able to communicate with all subnets in the peered VPC
  • subnet field is mandatory and removal causes SM to fail
  • we also do not support adding multiple routes to the same pcx in the same route table

Expected behavior

  • add ability to drop the subnet parameter (maintain it as optional parameter for existing customers)
  • use the VPC CIDR range for route creation, rather than the subnets
  • true for both ends of the connection

Additional context

  • Customers need to join all workloads in App, Data, Management to the MAD

Brian969 avatar Jul 29 '21 18:07 Brian969

Fixed in this PR :

https://github.com/aws-samples/aws-secure-environment-accelerator/pull/877

fredbonin avatar Dec 02 '21 19:12 fredbonin

Done

archikierstead avatar Nov 30 '23 15:11 archikierstead