aws-solutions / network-orchestration-for-aws-transit-gateway

The Network Orchestration for AWS Transit Gateway solution automates the process of setting up and managing transit networks in distributed AWS environments. It creates a web interface to help control, audit, and approve (transit) network changes.
https://aws.amazon.com/solutions/implementations/serverless-transit-network-orchestrator/
Apache License 2.0
116 stars 49 forks source link

Removing Subnet from TGW Attachment results in VPC default route being removed #73

Closed gfawcett22 closed 1 year ago

gfawcett22 commented 1 year ago

Describe the bug

If a VPC has multiple subnets attached to the TGW via the Attach-to-tgw tag and one of the tags are removed to remove a single subnet, the default route for the VPC is removed even though additional subnets are still attached to the TGW.

To Reproduce

  1. Create a VPC with subnets in multiple AZs
  2. Attach multiple subnets to the TGW via the Attach-to-tgw tag
  3. Verify there is a default route of 0.0.0.0/0 in the VPC route table and multiple subnets are attached to the TGW.
  4. Remove the Attach-to-tgw tag from a single subnet
  5. Notice there are still subnet(s) attached to the TGW, but there is no default route in the VPC route table and the subnets attached could not route to the TGW.

Expected behavior

Default Route is only removed when all subnets are detached.

Please complete the following information about the solution:

To get the version of the solution, you can look at the description of the created CloudFormation stack. For example, "(SO0009) - The AWS CloudFormation template for deployment of the aws-centralized-logging. Version v1.0.0". You can also find the version from releases

Screenshots If applicable, add screenshots to help explain your problem (please DO NOT include sensitive information).

Additional context The error is being caused here in the vpc_handler. I'm wondering if self.event.get("Action") == "RemoveSubnet" should not be there.

groverlalit commented 1 year ago

Thanks for opening this issue. We are investigating this issue.

groverlalit commented 1 year ago

In v3.1 we do not support changes to main route table. By design we remove the routes from the explicit route table associated with the subnet where the user deletes the "Attach-to-tgw" tag.

This is a valid behavior for the subnets associated with a single main route table.