AWS CloudFormation deployment of AWS Network Firewall

0

I am deploying a Network Firewall setup (VPC, protected subnet, NAT subnet, firewall subnet, NAT GW, Network Firewall, IGW, route tables and routes) with CloudFormation.

How can I setup a needed route in the route table?

The route points to Network Firewall VPC endpoint in a specific subnet and I have to setup the route usingthe CloudFormation Type: AWS::EC2::Route:

IGWIngressRoute:
    Type: AWS::EC2::Route
    DependsOn: NetworkFirewall
    Properties:
      RouteTableId: !Ref IGWIngressRouteTable
      DestinationCidrBlock: !Ref NATGatewaySubnetCIDR
      VpcEndpointId: <<<<<< here comes a specific Network Firewall endpoint 

The property VpcEndpointId should be set to a specific Network Firewall endpoint for a particular subnet. The Network Firewall resource contains the EndpointIds attribute with the list of all endpoints. I can get that list with !GetAtt NetworkFirewall.EndpointIds

The problem: how should I proceed correctly to setup the route pointing to a Network Firewall endpoint? So far I have not found any sample CloudFormation snippet doing that.

I understand, that the route setup can be done via CFN custom resource or post-deployment etc. But is it doable with CloudFormation template only?

AWS
已提问 3 年前965 查看次数
1 回答
2
已接受的回答

You will have to use a Custom Resource (or possibly a Macro). Passing in the EndpointIds and either sorting them or returning a structure that can be selected from.

There's an open issue on the public resource provider which is worth tracking or contributing to.

AWS
专家
Raphael
已回答 3 年前
profile pictureAWS
专家
已审核 2 年前

您未登录。 登录 发布回答。

一个好的回答可以清楚地解答问题和提供建设性反馈,并能促进提问者的职业发展。

回答问题的准则