search

PaloAltoNetworks / aws-transit-vpc

automated AWS transit vpc
41 stars 34 forks source link

Cloud Formation Stack updates not updating Transit Dynamo Tables #56

Open peterb154 opened 5 years ago

peterb154 commented 5 years ago

I had a situation where I incorrectly entered the PaGroupTemplateUrl when setting up the transit vpc account, which caused an error in the createNewPaGroup-transitVpcAccout function, failing with the following exception:

botocore.exceptions.ClientError: An error occurred (ValidationError) when calling the CreateStack operation: TemplateURL must be an Amazon S3 URL.

Realizing my mistake, I then tried correcting the error by updating the stack. The updated stack applied just fine, but got the same error.

Digging into the DynamoDb table: TransitConfig-transitVpcAccout, I noticed that the parameter: PaGroupTemplateUrl was still set to the original, incorrect url for the paGroupCft.json file, even though the cloud formation stack had been successfully updated.

I learned that the causes is that the lambda TransitConfig-transitVpcAccout does not update the dynamo tables on a cloudformation update event.

I will submit a PR to update lambda/initializeTransitDynamoTables.py from:

158     elif event['RequestType'] == 'Update':
159         if accountNumbers:
160             updateAssumeRole(roleName, accountNumbers)
161             cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, "CustomResourcePhysicalID")
162         else:
163             cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, "CustomResourcePhysicalID")
164     elif event['RequestType'] == 'Delete':

to: 

158     elif event['RequestType'] == 'Update':
159         if accountNumbers:
160             updateAssumeRole(roleName, accountNumbers)
161             cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, "CustomResourcePhysicalID")
162         else:
163             cfnresponse.send(event, context, cfnresponse.SUCCESS, responseData, "CustomResourcePhysicalID")
>164         #Update DynamoDB TranstiConfig Table
>165         updateTransitConfig(transitConfig, event['ResourceProperties'])
166     elif event['RequestType'] == 'Delete':
peterb154 commented 5 years ago

Submitted PR: https://github.com/PaloAltoNetworks/aws-transit-vpc/pull/57