CfnTransitGatewayRouteTable: not returning the default routing table to add additional routes

[edwinperez]

Describe the bug

In: "aws-cdk": "2.46.0"
When creating TransitGateway:

const securityCenterTransitGateway = new CfnTransitGateway(stack, 'Security-Center-Transit-Gateway', {
      description: "Security Center TransitGateway",
      vpnEcmpSupport: 'enable',
      autoAcceptSharedAttachments: "enable",
      defaultRouteTableAssociation: "enable",
      defaultRouteTablePropagation: "enable",
      tags: [{
        key: 'Name',
        value: "Security Center Transit Gateway"
      }],
    });

you get the following error:
failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "enable DefaultRouteTableAssociation conflicts with AssociationDefaultRouteTableId null

Essentially the AssociationDefaultRouteTableId and PropagationDefaultRouteTableId are required. However in order to create a routing table you must have the transitGatewayID: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnTransitGatewayRouteTable.html

If you try to overwrite TransitGateway properties after you initialize a routing table you get a circular dependency error.

Expected Behavior

You must be able to create a routing table and overwrite the TransitGateway params to enable default association and propagation.

Current Behavior

It is impossible to configure default propagation and association routing table.

Reproduction Steps

1. create a TWG:

// Creates Transit gateway
    const securityCenterTransitGateway = new CfnTransitGateway(stack, 'Security-Center-Transit-Gateway', {
      description: "Security Center TransitGateway",
      vpnEcmpSupport: 'enable',
      autoAcceptSharedAttachments: "enable",
      defaultRouteTableAssociation: "enable",
      defaultRouteTablePropagation: "enable",
      tags: [{
        key: 'Name',
        value: "Security Center Transit Gateway"
      }],
    });

This will give you the error: failed to deploy: UPDATE_ROLLBACK_COMPLETE: Resource handler returned message: "enable DefaultRouteTableAssociation conflicts with AssociationDefaultRouteTableId null

2. create a TWG instance without the defaults:

// Creates Transit gateway
    const securityCenterTransitGateway = new CfnTransitGateway(stack, 'Security-Center-Transit-Gateway', {
      description: "Security Center TransitGateway",
      vpnEcmpSupport: 'enable',
      autoAcceptSharedAttachments: "enable",
      tags: [{
        key: 'Name',
        value: "Security Center Transit Gateway"
      }],
    });

3. create a new route table:

const securityCenterDefaultTgwRouteTable = new CfnTransitGatewayRouteTable(stack, 'Security-Center-Default-Tgw-Route-Table', {
      transitGatewayId: securityCenterTransitGateway.ref,
      tags: [{
        key: 'Name',
        value: 'SecurityCenterDefaultTgwRouteTable',
      }],
    });

4. Try to overwrite the TWG property:

securityCenterTransitGateway.addOverride('Properties.associationDefaultRouteTableId', securityCenterDefaultTgwRouteTable.ref);
securityCenterTransitGateway.addOverride('Properties.defaultRouteTableAssociation', 'enable');

Get the error:
[[securityCenterDefaultTgwRouteTable](failed: Error [ValidationError]: Circular dependency between resources: [securityCenterDefaultTgwRouteTable, ....)

Possible Solution

Remove circular dependency or create a custom resource to update once created.

Additional Information/Context

No response

CDK CLI Version

2.46.0

Framework Version

No response

Node.js Version

v16.15.0

OS

13.1 (22C65)

Language

Typescript

Language Version

4.6.3

Other information

No response

[pahud]

Thank you for your feedback. As TransitGateway is currently L1 construct, it's pretty much cloudformation resources mapping at this moment. But I will try reproduce this in my environment and see what I can do with that. Meanwhile, any community feedbacks are welcome and highly appreciated here.

[pahud]

Essentially the AssociationDefaultRouteTableId and PropagationDefaultRouteTableId are required. However in order to create a routing table you must have the transitGatewayID: https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnTransitGatewayRouteTable.html

Hi

I got your point here. This causes circular dependency and it seems not possible to deploy with native cloudformation resources like that. I'll try reproduce it in my account.

[pahud]

Hi,

From my test with cdk 2.68.0, you should be able to deploy this with no error.

    new ec2.CfnTransitGateway(this, 'TGW', {
      autoAcceptSharedAttachments: 'enable',
      defaultRouteTableAssociation: 'enable',
      vpnEcmpSupport: 'enable',
      defaultRouteTablePropagation: 'enable',
    })

According to the doc:

When you create a transit gateway, we create a default transit gateway route table and use it as the default association route table and the default propagation route table.

Let me know if it works with you.

[edwinperez]

Thank you for the update, we need to create a custom table due to some other requirements. Ended up creating a custom resource to update those values using SDK.

[pahud]

@edwinperez Yeah I also noticed some limitation. The TransitGateway CFN resource will not return its default routing table ID(see return values) so it would be difficult to add additional route into the generated default routing table. To fill such gap, custom resource would be required at this moment. I will keep this issue open until we fill the gap from CFN.

[pahud]

I have reported this to the CFN coverage map
aws-cloudformation/cloudformation-coverage-roadmap#1556

[tmokmss]

Here's the code of a custom resource to get the default route table ID:

    const getDefaultRouteTableId = new cr.AwsCustomResource(this, 'GetDefaultRouteTableId', {
      onUpdate: {
        service: 'EC2',
        action: 'describeTransitGateways',
        parameters: {
          TransitGatewayIds: [this.tgw.ref],
        },
        physicalResourceId: cr.PhysicalResourceId.of('GetDefaultRouteTableId'),
      },
      policy: cr.AwsCustomResourcePolicy.fromSdkCalls({
        resources: cr.AwsCustomResourcePolicy.ANY_RESOURCE,
      }),
    });
    const routeTableId = getDefaultRouteTableId.getResponseField(
      'TransitGateways.0.Options.AssociationDefaultRouteTableId',
    );

    peerCidrs.forEach((cidr, i) => {
      new ec2.CfnTransitGatewayRoute(this, `TgwRoute${i}`, {
        destinationCidrBlock: cidr,
        transitGatewayRouteTableId: routeTableId,
        transitGatewayAttachmentId: peeringAttachmentId,
      });
    });

[tdalbo92]

It feels really broken to have the Transit Gateway L1 automatically create a default route table, and then have no way to access it? A custom resource is definitely not ideal.