I have the following network ELB networking resources config, in order to route outbound traffic through a single elastic ip.
I get the following error:
"AWS::EC2::Route PublicRoute CREATE_FAILED: route table rtb-zzzeb and network gateway igw-xxx belong to different networks"
What does this mean exactly in the context of my below configuration? Is there an issue with my resource labelled "PublicRoute"?
Resources:
VPC:
Type: AWS::EC2::VPC
Properties:
CidrBlock: "10.0.0.0/24"
Public1aSBN:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPC
CidrBlock: "10.0.0.128/27"
AvailabilityZone: "eu-west-2a"
Public1cSBN:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPC
CidrBlock: "10.0.0.160/27"
AvailabilityZone: "eu-west-2c"
Public1bSBN:
Type: AWS::EC2::Subnet
Properties:
VpcId: !Ref VPC
CidrBlock: "10.0.0.192/27"
AvailabilityZone: "eu-west-2b"
InternetGateway:
Type: "AWS::EC2::InternetGateway"
AttachGateway:
Type: AWS::EC2::VPCGatewayAttachment
Properties:
VpcId: !Ref VPC
InternetGatewayId: !Ref InternetGateway
EIPNatGateway:
Type: AWS::EC2::EIP
Properties:
Domain: vpc
NAT:
DependsOn: EIPNatGateway
Type: AWS::EC2::NatGateway
Properties:
AllocationId:
Fn::GetAtt:
- EIPNatGateway
- AllocationId
SubnetId: !Ref Public1aSBN
RouteTablePublic:
Type: AWS::EC2::RouteTable
Properties:
VpcId: !Ref VPC
Public1aSubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref Public1aSBN
RouteTableId: !Ref RouteTablePublic
Public1cSubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref Public1cSBN
RouteTableId: !Ref RouteTablePublic
Public1bSubnetRouteTableAssociation:
Type: AWS::EC2::SubnetRouteTableAssociation
Properties:
SubnetId: !Ref Public1bSBN
RouteTableId: !Ref RouteTablePublic
PublicRoute:
Type: AWS::EC2::Route
DependsOn: InternetGateway
Properties:
RouteTableId: !Ref RouteTablePublic
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref InternetGateway
TargetSG:
Type: AWS::EC2::SecurityGroup
Properties:
VpcId: !Ref VPC
InboundRule:
Type: AWS::EC2::SecurityGroupIngress
DependsOn: TargetSG
Properties:
IpProtocol: -1
FromPort: '0'
ToPort: '65535'
CidrIp: "0.0.0.0/0"
GroupId:
Fn::GetAtt:
- TargetSG
- GroupId
According to the docs,
Some resources in a VPC require a gateway (either an Internet or VPN gateway). If your AWS CloudFormation template defines a VPC, a gateway, and a gateway attachment, any resources that require the gateway are dependent on the gateway attachment.
This means you have to add your AttachGateway to the DependsOn attribute of your PublicRoute resource:
PublicRoute:
Type: AWS::EC2::Route
DependsOn:
- InternetGateway
- AttachGateway
Properties:
RouteTableId: !Ref RouteTablePublic
DestinationCidrBlock: 0.0.0.0/0
GatewayId: !Ref InternetGateway
This ensures that your resources are built in the proper order so your route won't be created until the gateway has been attached to the vpc
You will get this error if the route table and Internet gateway are in different VPCs.