search

aws-solutions / network-orchestration-for-aws-transit-gateway

The Network Orchestration for AWS Transit Gateway solution automates the process of setting up and managing transit networks in distributed AWS environments. It creates a web interface to help control, audit, and approve (transit) network changes.
https://aws.amazon.com/solutions/implementations/serverless-transit-network-orchestrator/
Apache License 2.0
110 stars 48 forks source link

Allow Deploying Spoke into Hub Account #40

Closed t04glovern closed 2 years ago

t04glovern commented 2 years ago

When trying to deploy the Spoke template into the same account as the Hub we recieve the following error

Logical ID: CustomServiceLinkedRole
SLR [AWSServiceRoleForVPCTransitGateway] already exists but does not have a description. Please verify your SLR use case. If you are sure the use case is correct please modify your CloudFormation template and keep SLR description consistent.

I believe this is because the Service Linked Role is created in both the Hub and Spoke templates https://github.com/aws-solutions/serverless-transit-network-orchestrator/search?q=CustomServiceLinkedRole&type=code

Could the role creation be put behind a Conditional check for a parameter, something like the following?

Parameters:
  SpokeInHubOverride:
    Type: String
    Description: Override the default action of not allowing the spoke template to be deployed into the hub account

...

Conditions:
  NoSpokeInHub:  !Not 
    - !Equals  
      - !Ref SpokeInHubOverride
      - 'true'

...

Resources:
  # The following description enables the idempotency and CFN template will not rollback if the role
  # already exist. Do not change the description below.
  CustomServiceLinkedRole:
    Type: "AWS::IAM::ServiceLinkedRole"
    Condition: NoSpokeInHub
    Properties:
      AWSServiceName: 'transitgateway.amazonaws.com'
      Description: Allows TGW and VPC Attachment operations.

This would be handy for users who might have other Networking infrastructure such as client VPN configurations that might require VPC's and attachments in the networking account.

t04glovern commented 2 years ago

Ah, sorry; I've just seen this comment in the spoke template; so I presume this is unlikely to be a supported featured. Feel free to close the issue if so.

Conditions:
  # Adding an EventBus as a target within an account is not allowed.
  IsSpokeAccountEqualToHubAccount: !Not [!Equals [!Ref HubAccount, !Ref "AWS::AccountId"]]