-
Notifications
You must be signed in to change notification settings - Fork 46
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update Spoke template from v3.2.1 to v3.3.1 failed #96
Comments
In v3.3.1, we removed the TGW Service-Linked Role (SLR) from the spoke stack to avoid the CloudFormation error shared above. The reason the AWSServiceRoleForVPCTransitGateway can't be deleted because there is an existing TGW attachment. This is by design to avoid issues with TGW attachment creation workflow. The CloudFormation stack will attempt to delete the SLR resource 3 times and give up. The update stack will complete. |
Hi Lalit, |
The update stackSet for spoke stack should complete as the stack will continue to reach "UPDATE_COMPLETE". The new spoke SLR stack can be deployed using higher fault tolerance. Alos, note that TGW SLR can also be created automatically by VPC during attachment creation but only in new accounts (with no existing TGW SLR). I would not recommend using v3.3.0 as it will impact your upgrade path for future releases. The option to CreateServiceRoleForVPCTransitGateway CFN parameter worked for your use case but it was not a viable option for multi-region deployments. |
Closing this issue in to no activity for over a month. Please reopen this issue if needed. Thanks |
Describe the bug
Update Spoke template from v3.2.1 to v3.3.1 failed
To Reproduce
Update Spoke template from v3.2.1 to v3.3.1
Expected behavior
ServiceLinkedRole is used by existing Attachment and cannot be deleted.
Please complete the following information about the solution:
To get the version of the solution, you can look at the description of the created CloudFormation stack. For example, "(SO0009) - The AWS CloudFormation template for deployment of the aws-centralized-logging. Version v1.0.0". You can also find the version from releases
Screenshots
![image](https://private-user-images.githubusercontent.com/6791330/255954034-0188c7c9-76f8-4b41-9c84-5e36e37d3949.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjE5Njg3MDksIm5iZiI6MTcyMTk2ODQwOSwicGF0aCI6Ii82NzkxMzMwLzI1NTk1NDAzNC0wMTg4YzdjOS03NmY4LTRiNDEtOWM4NC01ZTM2ZTM3ZDM5NDkucG5nP1gtQW16LUFsZ29yaXRobT1BV1M0LUhNQUMtU0hBMjU2JlgtQW16LUNyZWRlbnRpYWw9QUtJQVZDT0RZTFNBNTNQUUs0WkElMkYyMDI0MDcyNiUyRnVzLWVhc3QtMSUyRnMzJTJGYXdzNF9yZXF1ZXN0JlgtQW16LURhdGU9MjAyNDA3MjZUMDQzMzI5WiZYLUFtei1FeHBpcmVzPTMwMCZYLUFtei1TaWduYXR1cmU9MzE2YjE0YTZhNzBkYzdmMTU2YmU5ZDE0MzJiMjQzYTFiNGYwZWJhZTFlN2I4MTNkODc1NWNlNjUxMTQxZDU3NSZYLUFtei1TaWduZWRIZWFkZXJzPWhvc3QmYWN0b3JfaWQ9MCZrZXlfaWQ9MCZyZXBvX2lkPTAifQ.JexgNzXWQQJ75gk_-N0hdPdqmy-hwbfdjSR5qmzS01M)
Additional context
CloudFormation Error:
Resource of type 'AWS::IAM::ServiceLinkedRole' with identifier 'AWSServiceRoleForVPCTransitGateway' has a conflict. Reason: SLR [AWSServiceRoleForVPCTransitGateway] is in use by other resources: [[RoleUsageType(Region=eu-central-1, Resources=[tgw-attach-0c74b850d9f6e7945])]].
IAM Error:
AWSServiceRoleForVPCTransitGateway
Deletion failed.
The text was updated successfully, but these errors were encountered: