Skip to content

reuse same account client when it found in vpc attachments#684

Merged
RomanMelnyk113 merged 1 commit intomainfrom
fix-tgw-same-account-permissions
Apr 10, 2026
Merged

reuse same account client when it found in vpc attachments#684
RomanMelnyk113 merged 1 commit intomainfrom
fix-tgw-same-account-permissions

Conversation

@RomanMelnyk113
Copy link
Copy Markdown
Contributor

@RomanMelnyk113 RomanMelnyk113 commented Apr 5, 2026

When a Transit Gateway peering attachment connects two TGWs in the same AWS account (but possibly different regions), the VPC discovery logic was skipped unless AWSCrossAccountRoleARN was configured, this caused kvisor to fall back to route CIDRs and miss actual VPC/subnet metadata for same-account peers.

In this PR following changes were done:

  • Fetch the provider's own AWS account ID at initialization time using STS GetCallerIdentity
  • Allow VPC discovery to proceed for same-account TGW peering attachments without requiring a cross-account role ARN
  • Add a same-account fast-path that reuses the existing IRSA-credentialed EC2 client (or builds a region-scoped one) instead of attempting role assumption

@RomanMelnyk113 RomanMelnyk113 marked this pull request as draft April 5, 2026 20:53
@RomanMelnyk113 RomanMelnyk113 marked this pull request as ready for review April 7, 2026 14:17
@RomanMelnyk113 RomanMelnyk113 merged commit 38d1816 into main Apr 10, 2026
3 checks passed
@RomanMelnyk113 RomanMelnyk113 deleted the fix-tgw-same-account-permissions branch April 10, 2026 10:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants