awslabs / landing-zone-accelerator-on-aws

Deploy a multi-account cloud foundation to support highly-regulated workloads and complex compliance requirements.
https://aws.amazon.com/solutions/implementations/landing-zone-accelerator-on-aws/
Apache License 2.0
514 stars 401 forks source link

Synth and Validation steps do not pick up misconfigured VPC Interface Endpoints #271

Open hplm opened 9 months ago

hplm commented 9 months ago

Describe the bug When creating VPC Interface Endpoints, misconfigured entries do not get validated or checked, resulting in successful pipeline releases, but with inexistent endpoints. Troubleshooting is very difficult and misleading.

Example of misconfigured endpoints on network-config.yaml:

    interfaceEndpointConfig:
      defaultPolicy: Default
      endpoints:
        - ec2
        - ec2messages
        - ssm
        - ssmmessages
        - rds
        - lambda
        - execute-api
        - sns
        - sqs
        - states
        - sync-states

Correctly configured endpoints:

    interfaceEndpoints:
      defaultPolicy: Default
      endpoints:
        - service: ec2
        - service: ec2messages
        - service: ssm
        - service: ssmmessages
        - service: rds
        - service: lambda
        - service: execute-api
        - service: sns
        - service: sqs
        - service: states
        - service: sync-states

To Reproduce To reproduce the error, simply deploy the interfaceEndpointConfig object as above in any VPC or VPC template.

Expected behavior LZA pipeline synth and validation steps should pick up the misconfiguration and alert the users for effective fix.

Please complete the following information about the solution:

Additional context Happy to assist on the resolution. Thanks!

bhkhatri221 commented 9 months ago

Hello @hplm, thank you for filing an issue with the Landing Zone Accelerator team! I have filed a feature request to add the validation steps. I will keep this issue open and keep you up to date on the status of this issue.

I have re-categorized this issue as an enhancement. I will update this issue accordingly, thank you for your interest in the LZA!