aws-secure-environment-accelerator
aws-secure-environment-accelerator copied to clipboard
Fix/issue 855 - TGW routes
Fixed the issue by inserting the TGW local name in the construct name for associations.
I did not use the remote TGW name as mentioned here #855 since it might lead to collision : name would be tgw_associate_Main_core and tgw_associate_Main_core if 2 TGWs want to target Main TGW for the save core route.
With the TGW local name, it works : tgw_associate_TGW2_core and tgw_associate_TGW3_core
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
PR is NOT working per design:
- To test, requires a TGW in 3 regions (ca-central-1, us-east-1, and us-west-1)
- Everything works fine with 2 TGW's (ca-central-1, us-east-1)
- adding the 3 TGW works fine without an attachment/associations:
- but obviously not usable
{
"name": "West",
"asn": 64555,
"region": "us-west-1",
"features": {
"DNS-support": true,
"VPN-ECMP-support": true,
"Default-route-table-association": false,
"Default-route-table-propagation": false,
"Auto-accept-sharing-attachments": true
},
"route-tables": ["core-w", "segregated-w", "shared-w", "standalone-w"],
"tgw-routes": []
}
- adding JUST an attachment, the peering connection is never approved
- while this SM succeeds, if a rt-association had been included, it would have failed the SM waiting for approval
{
"name": "West",
"asn": 64555,
"region": "us-west-1",
"features": {
"DNS-support": true,
"VPN-ECMP-support": true,
"Default-route-table-association": false,
"Default-route-table-propagation": false,
"Auto-accept-sharing-attachments": true
},
"route-tables": ["core-w", "segregated-w", "shared-w", "standalone-w"],
"tgw-attach": {
"associate-to-tgw": "Main",
"account": "shared-network",
"region": "${HOME_REGION}",
"tgw-rt-associate-local": [],
"tgw-rt-associate-remote": []
},
"tgw-routes": []
}
- If we manually approve the peering connection, change config to, and rerun SM:
"tgw-rt-associate-local": ["core-w"],
"tgw-rt-associate-remote": ["shared"]
- SM succeeds, BUT, it DROPS the east to central tgw association, when it creates the West to central tgw association
- PR needs reworking.
Thank you for contributing to ASEA. Note that customers should look at using Landing Zone Accelerator on AWS (LZA) We're currently only merging security and critical bug fixes. However all ASEA PRs and Issues are noted by the LZA team while developing that solution. Thank you!