Update subnets in existing VPC using cloudformation

Question

I have an existing VPC is with 2 public and 2 private  subnets.
 Private subnets had reached 100% IP uitilization. So I added couple of extra subnets in my cloudfomation file, with all other requirements like NAT, routes etc.
Here is what my CIDR looks like for VPC:    
VpcBlock:
      Type: String
      Default: 10.0.0.0/16
      Description: The CIDR range for the VPC. This should be a valid private (RFC 1918) CIDR range.
      AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
      ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
  
    PublicSubnet01Block:
      Type: String
      Default: 10.0.10.0/24
      Description: CidrBlock for public subnet 01 within the VPC.
      AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
      ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
  
    PublicSubnet02Block:
      Type: String
      Default: 10.0.11.0/24
      Description: CidrBlock for public subnet 02 within the VPC.
      AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
      ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.
    
    PublicSubnet03Block:
      Type: String
      Default: 10.0.12.0/24
      Description: CidrBlock for public subnet 03 within the VPC.
      AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
      ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.

PublicSubnet04Block:
      Type: String
      Default: 10.0.13.0/24
      Description: CidrBlock for public subnet 04 within the VPC.
      AllowedPattern: (\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})/(\d{1,2})
      ConstraintDescription: must be a valid IP CIDR range of the form x.x.x.x/x.

PrivateSubnet01Block:
      Type: String
      Default: 10.0.20.0/24
      Description: CidrBlock for private subnet 01 within the VPC

PrivateSubnet02Block:
      Type: String
      Default: 10.0.21.0/24
      Description: CidrBlock for private subnet 02 within the VPC
    
    PrivateSubnet03Block:
      Type: String
      Default: 10.0.22.0/24
      Description: CidrBlock for private subnet 03 within the VPC
    
    PrivateSubnet04Block:
      Type: String
      Default: 10.0.23.0/24
      Description: CidrBlock for private subnet 04 within the VPC
  
When I apply this cloudformation, it gives me error for PublicSubnet02
"Resource handler returned message: "The CIDR '10.0.11.0/24' conflicts with another subnet  "

I would like to know if I can update VPC subnets using cloudformation script ? If yes, then any help to correct procedure would be really appriciated.

Answer

Does a subnet with the same address range as PublicSubnet02 already exist, and was created outside of this CloudFormation stack? If so then don't try to create it again here, but import it https://aws.amazon.com/blogs/aws/new-import-existing-resources-into-a-cloudformation-stack/

Answer

It could be lot easier to answer this question, if you'd have mentioned CIDR ranges for already existing subnets. Most likely this error is coming because of CIDR conflicts with existing subnet CIDR ranges and there would be some overlap, which is why you are seeing this message.

Make sure that the subnets you are creating, have CIDR ranges without any overlap with existing subnets.

Hope you find this helpful.

Comment here if you have additional question, happy to help.

Answer

Hi

You have shared the Parameter part of the Template and not the actual creation of the Subnets in the Template. Have you changed how you create the Subnets in the Template? Do you override the default values? Are you changing CIDR on any existing Subnets in the updated Template?

Answer

Did you try to change/reuse the logical IDs of the subnets? If so, this could potentially cause your problem because CloudFormation will not be able to recognize that difference between new and old. That is, if you had a resource in your stack named Subnet01 with a given CIDR, and then you try to apply that CIDR to Subnet02, CloudFormation doesn't know that you "moved" the Subnet. Instead, it will recognize this as an "additional" Subnet with identical configuration. This will create a CIDR conflict when AWS begins to create your new Subnet without first deleting the old.

Update subnets in existing VPC using cloudformation

Relevant content