Open laserpedro opened 1 week ago
Voting for Prioritization
Volunteering to Work on This Issue
Hey @laserpedro 👋 Thank you for taking the time to raise this! It looks like this has come up before in #16452, where a couple of workarounds were offered. Can you review that report (and/or the PR that closed it, #31452) and let us know if the options discussed there resolve the issue for you?
Hey @justinretzolk thank you very much for your assistance on this: I used the PR https://github.com/hashicorp/terraform-provider-aws/pull/31452 and it performed exactly what I wanted. The vpc tgw attachment is no longer associated by default to the default tgw route tables. However, by reading at the doc for the tgw vpc attachment:
transit_gateway_default_route_table_association - (Optional) Boolean whether the VPC Attachment should be associated with the EC2 Transit Gateway association default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: true. transit_gateway_default_route_table_propagation - (Optional) Boolean whether the VPC Attachment should propagate routes with the EC2 Transit Gateway propagation default route table. This cannot be configured or perform drift detection with Resource Access Manager shared EC2 Transit Gateways. Default value: true.
I am bit confused: I let those parameters to their default value and declare the route table association this way:
resource "aws_ec2_transit_gateway_route_table_association" "route_table_association" {
provider = aws.network
count = var.create_tgw_attachment ? 1 : 0
transit_gateway_attachment_id = resource.aws_ec2_transit_gateway_vpc_attachment.vpc_attachment[count.index].id
transit_gateway_route_table_id = var.transit_gateway_association_route_table_id
replace_existing_association = true
}
Originally I thought that those two arguments would have been enough to prevent the association to the default route table. From the route table association documentation:
replace_existing_association - (Optional) Boolean whether the Gateway Attachment should remove any current Route Table association before associating with the specified Route Table. Default value: false. This argument is intended for use with EC2 Transit Gateways shared into the current account, otherwise the transit_gateway_default_route_table_association argument of the aws_ec2_transit_gateway_vpc_attachment resource should be used.
My understanding is that the transit_gateway_default_route_table_propagation and transit_gateway_default_route_table_association set to false work if the tgw is in the same account and NOT shared. if the tgw is shared then there are not relevant and we need to use the argument replace_existing_association
and in my case set it to false to prevent the auto attachment ?
Terraform Core Version
1.9.5
AWS Provider Version
5.61.0
Affected Resource(s)
Expected Behavior
Target: create a vpc tgw attachment to a regional tgw. Associate the tgw attachment to an inspection route table / propagate the tgw attachment to a spoke route table.
Plan at tf apply:
Actual Behavior
Relevant Error/Panic Output Snippet
IMPORTANT: once the vpc tgw attachment association to the tgw default route table is deleted we can apply and create the tgw vpc attachment association to the inspection route table as displayed in the original tf plan.
Terraform Configuration Files
Steps to Reproduce
create a tgw with a 2 non default route tables and apply the tf configuration above with hard coded values for the association route table (the inspection route table) and for the propagation route table (the spoke route table).
Debug Output
No response
Panic Output
No response
Important Factoids
No response
References
No response
Would you like to implement a fix?
None