AWS::EC2::Route CloudFormation resource does not verify the gateway type

Question

I was playing with CloudFormation trying to create a private subnet that uses a NAT gateway. When declaring routes, I made a typo in the template and used `GatewayId` property instead of `NatGatewayId` when defining a `AWS::EC2::Route` pointing to the NAT gateway:

PrivateSubnetRoute:
      Type: AWS::EC2::Route
      Properties:
        DestinationCidrBlock: 0.0.0.0/0
        GatewayId: !Ref NatGateway 
        RouteTableId: !Ref PrivateSubnetRouteTable

When I tried to create a CloudFormation stack with this template, CloudFormation did not report any errors about an invalid gateway. Instead, the PrivateSubnetRoute resource remained in CREATE_IN_PROGRESS state for about 20 minutes, and then creation failed with the following error:

*Resource handler returned message: "Exceeded attempts to wait" (RequestToken: bcf33526-b64a-9781-7e22-f4330a941fa2, HandlerErrorCode: NotStabilized)*

I'd prefer CloudFormation to check the type of the specified gateway and return a meaningful error if it's not correct.

Here's the full CloudFormation stack to reproduce the error:

Resources:
      Vpc: 
        Type: AWS::EC2::VPC
        Properties: 
          CidrBlock: 10.0.0.0/24
          EnableDnsHostnames: True
          EnableDnsSupport: True
          Tags: 
            - Key: Name
              Value: NatVpc

PublicSubnet:
        Type: AWS::EC2::Subnet   
        Properties: 
          AvailabilityZone: !Select [0, !GetAZs "" ]
          CidrBlock: 10.0.0.0/25     
          VpcId: !Ref Vpc
          
      InternetGateway:
        Type: AWS::EC2::InternetGateway
      
      InternetGatewayAttachment:  
        Type: AWS::EC2::VPCGatewayAttachment
        Properties: 
          InternetGatewayId: !Ref InternetGateway
          VpcId: !Ref Vpc 
          
      ElasticIp:
        Type: AWS::EC2::EIP 
        DependsOn:
          - InternetGatewayAttachment
        Properties:
          Domain: vpc
    
      NatGateway:
        Type: AWS::EC2::NatGateway
        Properties: 
          AllocationId: !GetAtt ElasticIp.AllocationId
          SubnetId: !Ref PublicSubnet     
    
      PublicSubnetRouteTable:
        Type: AWS::EC2::RouteTable
        Properties: 
          VpcId: !Ref Vpc 
    
      PublicSubnetIpv4Route:
        Type: AWS::EC2::Route
        Properties:
          DestinationCidrBlock: 0.0.0.0/0
          GatewayId: !Ref InternetGateway
          RouteTableId: !Ref PublicSubnetRouteTable
          
      PublicSubnetRouteTableAssociation:    
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties: 
          RouteTableId: !Ref PublicSubnetRouteTable
          SubnetId: !Ref PublicSubnet 
    
      PrivateSubnet:
        Type: AWS::EC2::Subnet   
        Properties: 
          AvailabilityZone: !Select [0, !GetAZs "" ]
          CidrBlock: 10.0.0.128/25
          VpcId: !Ref Vpc  
          
      PrivateSubnetRouteTable:
        Type: AWS::EC2::RouteTable
        Properties: 
          VpcId: !Ref Vpc  
          
      PrivateSubnetRoute:
        Type: AWS::EC2::Route
        Properties:
          DestinationCidrBlock: 0.0.0.0/0
          # Here's the typo, the property should be NatGatewayId
          GatewayId: !Ref NatGateway 
          RouteTableId: !Ref PrivateSubnetRouteTable
        
      PrivateSubnetRouteTableAssociation:    
        Type: AWS::EC2::SubnetRouteTableAssociation
        Properties: 
          RouteTableId: !Ref PrivateSubnetRouteTable
          SubnetId: !Ref PrivateSubnet

Didier_Durand · Accepted Answer

Hi, you are right. 
Yes, an additional validation could probably be done by CFN when launching this stack to make sure that the id of the proper kind of object is provided

But, re:Post is not the right place for such bug report / feature report: it is usually not monitored by service teams like the one for CFN. So, you should open a Support case via the console of your AWS account to have this case worked on.

Best,

Didier

secondabhi_aws · Answer

**AWS::EC2::Route** is used to specify a route in a route table.

With this, you can have local gateway, internet gateway, NAT gateway, virtual private gateway added to route. I understand you wanted to create PrivateSubnetRoute, so you will need to have NATFatewayId specified there but cloudformation doesn't know by your resource name that you want to create private subnet.

![Enter image description here](/media/postImages/original/IMdrtpaTUaQbao48z_IQBpgA)

Cloudfromation tried to add route for Internet Gateway with NATGW id, which failed after a while as GatewayId is used to specify Internetgateway.

Please refer [AWS::EC2::Route](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-route.html).

Hope this explanation helps.

Comment here if you have additional questions, happy to help.

Abhishek

AWS::EC2::Route CloudFormation resource does not verify the gateway type

Relevant content