[HELP] No connectivity between VPCs

[lpossamai]

I'm trying to setup a VPC Peering connection between two different accounts in the same region (ap-southeast-2).

The Source VPC has been created using the terraform-aws-vpc Terraform module. The peer VPC has been created using CloudFormation many years ago.

The code I am using looks like this:

# VPC Peering between geoop-prod and geoop-production for Bucardo
module "single_account_single_region" {
  source = "github.com/grem11n/terraform-aws-vpc-peering"

  providers = {
    aws.this = aws
    aws.peer = aws.peer
  }

  this_vpc_id = module.vpc.vpc_id
  peer_vpc_id = var.peer_vpc_id

  auto_accept_peering = true

  tags = {
    Name        = "Bucardo-VPC-Peering"
    Environment = local.workspace["environment"]
    Terraform   = "True"
  }
}

When applying the code with Terraform, it gets applied successfully. However, I do not have connectivity between the two VPCs.

Checking the Route Tables on the peer VPC looks okay. I can see the route to the VPC Peering connection with the correct CIDR.

However, the Source VPC Routes are not correct. I can see that the Destination CIDR is the Peer VPC CIDR, but the Target shows as local, instead of the VPC Peering ID.

Source VPC CIDR: 10.0.0.0/18 Peer VPC CIDR: 10.31.0.0/16

Source VPC Route Table:

Peer VPC Route Table:

Terraform version: What Terraform version do you use? I'm using Terraform v0.15.4.

What am I missing here, please? Cheers!

[grem11n]

Hello, @lpossamai,

Thank you for reporting this! I've tried to reproduce this with the similar configuration: multi account, single region (ap-southeast-2) and the route tables look Ok:

Source (this) VPC Route Table:

Peer VPC Route Table:

This is the configuration, I used. And here is the configuration of VPCs themselves.

I've also added this scenario as yet another test case.

Hope, this helps!

[lpossamai]

Hi @grem11n , thanks for looking into this.

I have modified my terraform code as per your suggestion:

# VPC Peering between prod and Bucardo
module "multi_account_single_region" {
  source = "github.com/grem11n/terraform-aws-vpc-peering"

  providers = {
    aws.this = aws
    aws.peer = aws.peer
  }

  this_vpc_id = module.vpc.vpc_id
  peer_vpc_id = var.peer_vpc_id

  auto_accept_peering = true

  tags = {
    Name        = "Bucardo-VPC-Peering"
    Environment = local.workspace["environment"]
    Terraform   = "True"
  }
}

I decided to delete the entire VPC and re-create it again in order to test this. When applying it, I get the error:

│ Error: Invalid count argument
│ 
│   on .terraform/modules/multi_account_single_region/main.tf line 59, in resource "aws_route" "this_routes":
│   59:   count                     = var.from_this ? length(local.this_routes) : 0
│ 
│ The "count" value depends on resource attributes that cannot be determined
│ until apply, so Terraform cannot predict how many instances will be
│ created. To work around this, use the -target argument to first apply only
│ the resources that the count depends on.

Any suggestions? Thanks!

Edit: Tried on Terraform 0.15 and 1.0.9.

[grem11n]

This error sounds familiar to the one I was getting when implementing the depends_on functionality back in a day. To fix that I had to define Route Table IDs explicitly. As in the example for depends_on scenario: https://github.com/grem11n/terraform-aws-vpc-peering/tree/master/examples/module-depends-on

I'm not 100% sure that it will resolve your issue, but it might help. The general idea is that you have to provide explicitly resources that cannot be determined by Terraform.

[lpossamai]

Interesting! Yep, that worked!

For further reference, this is the code I used:

module "module_depends_on" {
  source = "github.com/grem11n/terraform-aws-vpc-peering"

  depends_on = [
    module.vpc.private_route_table_ids,
    module.vpc.private_route_table_ids,
  ]

  providers = {
    aws.this = aws
    aws.peer = aws.peer
  }

  this_vpc_id  = module.vpc.vpc_id
  peer_vpc_id  = var.peer_vpc_id
  this_rts_ids = module.vpc.private_route_table_ids
  peer_rts_ids = var.peer_vpc_rts_ids

  auto_accept_peering = true

  tags = {
    Name        = "Bucardo-VPC-Peering"
    Environment = local.workspace["environment"]
    Terraform   = "True"
  }
}

Thanks for your help, @grem11n !