Skip to content

AWS-Cloudformation: Ipv6 EC2 Route in a Private Nat Subnet - Provide one of DestinationCidrBlock or DestinationIpv6CidrBlock and a valid routeTableId

0

I am currently creating a network infrastructure within my vpc, that has private subnets and has a NAT gateway. I have a Route Table that has the private subnets associated to it and I intend to have 2 ec2 routes for an ipv4 and ipv6. I have successfully deployed the ipv4 but the challenge comes in with the ipv6.

I am aware that for the ipv6 ec2 route, I need an EgressOnlyInternetgateway and this is referenced in my ec2 route as shown below.

While deploying my templates i get this first with only the EgressOnlyInternetGatewayId;

Resource handler returned message: "You must provide one of destinationCidrBlock or destinationIpv6CidrBlock or destinationPrefixList and a valid routeTableId"

Next I try to add to my template DestinationIpv6CidrBlock: '::/0'. I get this as a new error;

Resource handler returned message: "The request must contain exactly one of gatewayId, localGatewayId, carrierGatewayId, natGatewayId, networkInterfaceId, vpcPeeringConnectionId, egressOnlyInternetGatewayId, transitGatewayId, vpcEndpointId, coreNetworkArn or instanceId

What does aws cloudformation expect in this case, having only EgressOnlyInternetGatewayId or EgressOnlyInternetGatewayId and DestinationIpv6CidrBlock, since neither works.

PrivateNatRouteTable:
    DependsOn: 'NatGateway'
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: 
        Fn::ImportValue:
          !Sub '${Product}-VpcID'
      Tags:
        - Key: Name
          Value: !Sub '${Product}-private-nat-rt'

Ipv6EgressOnlyIgw:
    Type: AWS::EC2::EgressOnlyInternetGateway
    Properties:
      Tags: 
        - Key: Name
          Value: !Sub '${Product}-ipv6-egress-only-igw'

      VpcId: 
        Fn::ImportValue:
          !Sub '${Product}-VpcID'

  PrivateNatRoute1:
    DependsOn: 'Ipv6EgressOnlyIgw'
    Type: AWS::EC2::Route
    Properties:
      DestinationCidrBlock: '0.0.0.0/0'
      NatGatewayId: !Ref NatGateway
      RouteTableId: !Ref PrivateNatRouteTable

  PrivateNatRoute2:
    DependsOn: 'PrivateNatRoute1'
    Type: AWS::EC2::Route
    Properties:
      EgressOnlyInternetGatewayId: !Ref Ipv6EgressOnlyIgw
      NatGatewayId: !Ref NatGateway
      RouteTableId: !Ref PrivateNatRouteTable

I also have to add i have tried manually adding this route manually and was successful and trying to use aws cli to describe the route-table to see the resource once created manually and i see sth similar to what I have in my template.

{
  "DestinationIpv6CidrBlock": "::/0",
  "EgressOnlyInternetGatewayId": "eigw-s0000000",
  "Origin": "CreateRoute",
  "State": "active"
}
1 Answer
0
Accepted Answer

Based on your CloudFormation template and the errors you're encountering, there are two key issues with your PrivateNatRoute2 resource:

  1. You need to specify a destination CIDR block for IPv6 traffic. For IPv6 routes, you must include the DestinationIpv6CidrBlock property with a value of ::/0 (which represents all IPv6 addresses).

  2. You're including both EgressOnlyInternetGatewayId and NatGatewayId in the same route. According to AWS requirements, you must specify exactly one target resource for a route.

Here's how your PrivateNatRoute2 resource should be configured:

PrivateNatRoute2:
DependsOn: 'PrivateNatRoute1'
Type: AWS::EC2::Route
Properties:
DestinationIpv6CidrBlock: '::/0'
EgressOnlyInternetGatewayId: !Ref Ipv6EgressOnlyIgw
RouteTableId: !Ref PrivateNatRouteTable

This configuration correctly specifies:

  • The IPv6 destination CIDR block (::/0)
  • A single target (the Egress-Only Internet Gateway)
  • The route table ID

It's important to note that a route table cannot have the same destination (::/0) pointing to both an internet gateway and an egress-only internet gateway simultaneously. If you're trying to update an existing route table that already has an IPv6 route to an internet gateway, you'll need to remove that route first before adding the route to the egress-only internet gateway.
Sources
AWS::EC2::Route - AWS CloudFormation
AWS::EC2::LocalGatewayRoute - AWS CloudFormation
Add IPv6 support for your VPC - Amazon Virtual Private Cloud

answered 9 months ago

EXPERT

reviewed 9 months ago

  • This worked for me and the issue was as stated, thank you.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.