Transit gateway attachments to a VPC - Amazon Virtual Private Cloud

Transit gateway attachments to a VPC

When you attach a VPC to a transit gateway, you must specify one subnet from each Availability Zone to be used by the transit gateway to route traffic. Specifying one subnet from an Availability Zone enables traffic to reach resources in every subnet in that Availability Zone.

Limits

When you attach a VPC to a transit gateway, any resources in Availability Zones where there is no transit gateway attachment cannot reach the transit gateway. If there is a route to the transit gateway in a subnet route table, traffic is forwarded to the transit gateway only when the transit gateway has an attachment in a subnet in the same Availability Zone.

The resources in a VPC attached to a transit gateway cannot access the security groups of a different VPC that is also attached to the same transit gateway.

A transit gateway does not support DNS resolution for custom DNS names of attached VPCs set up using private hosted zones in Amazon Route 53. To configure the name resolution for private hosted zones for all VPCs attached to a transit gateway, see Centralized DNS management of hybrid cloud with Amazon Route 53 and AWS Transit Gateway.

You cannot create an attachment for a VPC subnet that resides in a Local Zone.

VPC attachment lifecycle

A VPC attachment goes through various stages, starting when the request is initiated. At each stage, there may be actions that you can take, and at the end of its lifecycle, the VPC attachment remains visible in the Amazon VPC Console and in API or command line output, for a period of time.

The following diagram shows the states an attachment can go through in a single account configuration, or a cross-account configuration that has Auto accept shared attachments turned on.


                     VPC attachment lifecycle
  • Pending: A request for a VPC attachment has been initiated and is in the provisioning process. At this stage, the attachment can fail, or can go to available.

  • Failing: A request for a VPC attachment is failing. At this stage, the VPC attachment goes to failed.

  • Failed: The request for the VPC attachment has failed. While in this state, it cannot be deleted. The failed VPC attachment remains visible for 2 hours, and then is no longer visible.

  • Available: The VPC attachment is available, and traffic can flow between the VPC and the transit gateway. At this stage, the attachment can go to modifying, or go to deleting.

  • Deleting: A VPC attachment that is in the process of being deleted. At this stage, the attachment can go to deleted.

  • Deleted: An available VPC attachment has been deleted. While in this state, the VPC attachment cannot be modified. The VPC attachment remains visible for 2 hours, and then is no longer visible.

  • Modifying: A request has been made to modify the properties of the VPC attachment. At this stage, the attachment can go to available, or go to rolling back.

  • Rolling back: The VPC attachment modification request cannot be completed, and the system is undoing any changes that were made. At this stage, the attachment can go to available.

The following diagram shows the states an attachment can go through in a cross-account configuration that has Auto accept shared attachments turned off.


                    Cross-account VPC attachment lifecycle that has Auto accept
                            shared attachments turned off
  • Pending-acceptance: The VPC attachment request is awaiting acceptance. At this stage, the attachment can go to pending, to rejecting, or to deleting.

  • Rejecting: A VPC attachment that is in the process of being rejected. At this stage, the attachment can go to rejected.

  • Rejected: A pending acceptance VPC attachment has been rejected. While in this state, the VPC attachment cannot be modified. The VPC attachment remains visible for 2 hours, and then is no longer visible.

  • Pending: The VPC attachment has been accepted and is in the provisioning process. At this stage, the attachment can fail, or can go to available.

  • Failing: A request for a VPC attachment is failing. At this stage, the VPC attachment goes to failed.

  • Failed: The request for the VPC attachment has failed. While in this state, it cannot be deleted. The failed VPC attachment remains visible for 2 hours, and then is no longer visible.

  • Available: The VPC attachment is available, and traffic can flow between the VPC and the transit gateway. At this stage, the attachment can go to modifying, or go to deleting.

  • Deleting: A VPC attachment that is in the process of being deleted. At this stage, the attachment can go to deleted.

  • Deleted: An available or pending acceptance VPC attachment has been deleted. While in this state, the VPC attachment cannot be modified. The VPC attachment remains visible 2 hours, and then is no longer visible.

  • Modifying: A request has been made to modify the properties of the VPC attachment. At this stage, the attachment can go to available, or go to rolling back.

  • Rolling back: The VPC attachment modification request cannot be completed, and the system is undoing any changes that were made. At this stage, the attachment can go to available.

Create a transit gateway attachment to a VPC

To create a VPC attachment using the console

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

  2. On the navigation pane, choose Transit Gateway Attachments.

  3. Choose Create Transit Gateway Attachment.

  4. For Transit Gateway ID, choose the transit gateway for the attachment. You can choose a transit gateway that you own or a transit gateway that was shared with you.

  5. For Attachment type, choose VPC.

  6. Under VPC Attachment, optionally enter a name for Attachment name tag.

  7. Choose whether to enable DNS Support and IPv6 Support.

  8. For VPC ID, choose the VPC to attach to the transit gateway.

    This VPC must have at least one subnet associated with it.

  9. For Subnet IDs, select one subnet for each Availability Zone to be used by the transit gateway to route traffic. You must select at least one subnet. You can select only one subnet per Availability Zone.

  10. Choose Create attachment.

To create a VPC attachment using the AWS CLI

Use the create-transit-gateway-vpc-attachment command.

Modify your VPC attachment

To modify your VPC attachments using the console

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

  2. On the navigation pane, choose Transit Gateway Attachments.

  3. Select the VPC attachment, and then choose Actions, Modify.

  4. To enable DNS support, select DNS support.

  5. To add a subnet to the attachment, next to the subnet, select the box.

  6. Choose Modify attachment.

To modify your VPC attachments using the AWS CLI

Use the modify-transit-gateway-vpc-attachment command.

Modify your VPC attachment tags

To modify your VPC attachment tags using the console

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

  2. On the navigation pane, choose Transit Gateway Attachments.

  3. Select the VPC attachment, and then choose Actions, Add/Edit tags.

  4. [Add a tag] Choose Add tag and do the following:

    • For Key, enter the key name.

    • For Value, enter the key value.

  5. [Remove a tag] Next to the tag, choose Delete ("X").

  6. Choose Modify attachment.

View your VPC attachments

To view your VPC attachments using the console

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

  2. On the navigation pane, choose Transit Gateway Attachments.

  3. Choose the search bar, select Resource type from the menu, and then select VPC.

  4. The VPC attachments are displayed. Choose an attachment to view its details.

To view your VPC attachments using the AWS CLI

Use the describe-transit-gateway-vpc-attachments command.

Delete a VPC attachment

To delete a VPC attachment using the console

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

  2. On the navigation pane, choose Transit Gateway Attachments.

  3. Select the VPC attachment.

  4. Choose Actions, Delete.

  5. When prompted for confirmation, choose Delete.

To delete a VPC attachment using the AWS CLI

Use the delete-transit-gateway-vpc-attachment command.

Troubleshoot VPC attachment creation

The following topic can help you troubleshoot problems that you might have when you create a VPC attachment.

Problem

The VPC attachment failed.

Cause

The cause might be one of the following:

  1. The user that is creating the VPC attachment does not have correct permissions to create service-linked role.

  2. There is a throttling issue because of too many IAM requests, for example you are using AWS CloudFormation to create permissions and roles.

  3. The account has the service-linked role, and the service-linked role has been modified.

  4. The transit gateway is not in the available state.

Solution

Depending on the cause, try the following:

  1. Verify that the user has the correct permissions to create service-linked roles. For more information, see Service-linked role permissions in the IAM User Guide. After the user has the permissions, create the VPC attachment.

  2. Create the VPC attachment manually through the console or API. For more information, see Create a transit gateway attachment to a VPC.

  3. Verify that the service-linked role has the correct permissions. For more information, see Transit gateway service-linked role.

  4. Verify that the transit gateway is in the available state. For more information, see View your transit gateways.