https://pulumi.com logo
#general
Title
# general
r

rhythmic-megabyte-99595

11/28/2023, 6:51 PM
Hi folks, I running into trouble when peer connecting cross-account VPCs. It shows VPC in another account cannot be found. Please advice.
Copy code
connection_id = ec2.VpcPeeringConnection(
            f"vpcPeering-{loca_vpc}->{remote_vpc}",
            opts=pulumi.ResourceOptions(provider=local_provider),
            vpc_id=local_vpc.id,
            peer_vpc_id=remote_vpc_id,
            peer_owner_id=local_account_id,
            auto_accept=False,
)
and the error is
Copy code
The vpc ID 'vpc-remote' does not exist
I further changed
peer_owner_id
to
remote_account_id
(which diverged from the example here and does not make sense), then the peer_connection works but now the accepter has issues. Following is the code:
Copy code
connection_id = ec2.VpcPeeringConnection(
            f"vpcPeering-{loca_vpc}->{remote_vpc}",
            opts=pulumi.ResourceOptions(provider=local_provider),
            vpc_id=local_vpc.id,
            peer_vpc_id=remote_vpc_id,
            peer_owner_id=remote_account_id,
            auto_accept=False,
).id

ec2.VpcPeeringConnectionAccepter(
            "peer-accepter",
            vpc_peering_connection_id=connection_id,
            auto_accept=True,
            opts=pulumi.ResourceOptions(provider=remote_provider),
        )
now it gave me this:
The vpc peering connection identified by <connection_id> already exists
Both
local
and
remote
are AWS accounts. The
VpcPeeringConnectionAccepter
suppose to 'adopt' the peer-connection as the doc says, but now it says 'peer-connection already exists'.
l

little-cartoon-10569

11/28/2023, 9:44 PM
What are you using as the ID? It should be the ID of a VPC object. Have you used Vpc.get() or similar to load the VPC object?
r

rhythmic-megabyte-99595

11/28/2023, 9:56 PM
Hi @little-cartoon-10569 for the local_vpc, I created this vpc in the same .py file. For the remote vpc, I exported the vpc ID and refered it in this .py file to get its ID.
l

little-cartoon-10569

11/28/2023, 10:02 PM
Are you creating them in the same project and stack? And are you destroying all resources after every failed
up
? If not, you'll have a very hard time figuring out the issue. VPC peering is a hand-shake-y process, and (I think) you're trying to create code to support that hand shaking. If you're running
up
which creates some resources then fails, your next
up
is potentially starting part-way through the hand shake. So you may think you've fixed a problem, but actually something in AWS changed state, and you're just avoiding the problem.
VPC peering can be done in Pulumi, but in order to develop it iteratively, you probably need to destroy your VPCs and partially-created peering after each failed attempt.
As to your initial post: if the error message is really saying "The vpc ID 'vpc-remote' does not exist", then you need to figure out where vpc-remote is coming from, because that's not a valid VPC ID. Whatever string you're putting there is wrong.
r

rhythmic-megabyte-99595

11/28/2023, 11:07 PM
Hi @little-cartoon-10569, the two VPCs are in two aws accounts and from different stack. And I did remove all resources (by
pulumi up
with the early version of my Pulumi code). For your third question, the vpc-remote is from another stack, I use pulumi.export to firstly export it, and then refer it in _local-vpc_'s stack. cc: @rich-whale-93740
l

little-cartoon-10569

11/28/2023, 11:11 PM
So the string really says vpc-remote? If it does, then you're either exporting the wrong thing, or importing the wrong thing. Because that's the wrong value. It's not a VPC ID.
r

rhythmic-megabyte-99595

11/28/2023, 11:12 PM
With pure
ec2.VpcPeeringConnection
, I can actually create a peering-connection from local_vpc to remote_vpc, but it needs me to click 'accept peering' in remote_vpc's console. That's why I introduced
VpcPeeringConnectionAccepter
and tried to make it in full-auto. The
VpcPeeringConnectionAccepter
suppose to 'adopt' the peering connection (for
VpcPeeringConnection
, it creates peering connection on both local_vpc and remote_vpc) on the remote_vpc side, but strangely, it gave me the 'peering connection already exists' error I illustrated before .
No, the error of not found is like this:
l

little-cartoon-10569

11/28/2023, 11:13 PM
Ah ok, then that's fine, that's a valid VPC id.
r

rhythmic-megabyte-99595

11/28/2023, 11:14 PM
And the accepter's error is like this:
l

little-cartoon-10569

11/28/2023, 11:14 PM
So the only problem now is that you're not referring to the remote VPC id correctly? Or maybe you're creating some resource(s) in the wrong AWS account?
r

rhythmic-megabyte-99595

11/28/2023, 11:15 PM
For the remote vpc not found issue, I worked around by change the
peer_owner_id
to the remote_vpc's account id.
l

little-cartoon-10569

11/28/2023, 11:15 PM
Yes, that's not a workaround, that's the correct solution
r

rhythmic-megabyte-99595

11/28/2023, 11:16 PM
But for the accepter, I have 'The vpc peering connection identified by pcx-0c63ab4afee3f2800 already exists' error as illustrated above.
The accepter suppose to
adopt
the peering connection, but why it throws 'already exists' error?
l

little-cartoon-10569

11/28/2023, 11:17 PM
Yes. That's because the accepter object is like an ACM certificate validation: it's not a real object, it's Pulumi's way of recording that it has taken an action.
And it's one of the reasons that deleting resources from state (via destroy or state rm) is helpful.
In this case, the thing to delete is probably the AWS resource - usually it's a Pulumi resource, but this is a special case.
Since I don't have access I can't be sure. but it looks like you need to delete the accepter in AWS. You might double-check which providers your passing to each constructor, but it looks like that's probably right.
r

rhythmic-megabyte-99595

11/28/2023, 11:20 PM
OK, so I need to delete both
VpcPeeringConnection
and
VpcPeeringConnectionAccepter
, or the entire stack?
OK, let me start with the accepter first
l

little-cartoon-10569

11/28/2023, 11:20 PM
I can't tell. I think, based on the error messages, that you don't need to delete any Pulumi resources, only the AWS accepter, via the Console
Have you read up the AWS docs on how peering works? Understanding the hand shake is helpful.
r

rhythmic-megabyte-99595

11/28/2023, 11:21 PM
OK, I'm trying this now. Thanks @little-cartoon-10569, will update you once it's done.
Hi @little-cartoon-10569, still, the accepter threw out 'the vpc peering connection already exists' error.
l

little-cartoon-10569

11/29/2023, 1:12 AM
Bum. This is likely because it's not a real resource, or somesuch. Without access to the system, it's very difficult to debug. I would delete the connection from AWS (not using Pulumi), and then deal with the fall-out.
r

rhythmic-megabyte-99595

11/29/2023, 1:15 AM
Yes, I've deleted everything related to the peering connection from both AWS and Pulumi (except the VPCs), but still got this issue.
l

little-cartoon-10569

11/29/2023, 1:15 AM
Have you checked both accounts?
r

rhythmic-megabyte-99595

11/29/2023, 1:16 AM
Yes, both accounts
image.png
image.png
l

little-cartoon-10569

11/29/2023, 1:17 AM
Then I guess that the thing you're doing is creating the connection a 2nd time in your code.
Maybe you're doing something in one account and think you're doing it in the other one.. maybe a code review would help?
r

rhythmic-megabyte-99595

11/29/2023, 1:17 AM
Seems like the VpcPeeringConnectionAccepter cannot
adopt
the existing peering connection request. Instead, it tries to create one, so it throws 'already exist' error
l

little-cartoon-10569

11/29/2023, 1:19 AM
Maybe. It can work though. I set up peering in one of my projects.
r

rhythmic-megabyte-99595

11/29/2023, 1:20 AM
I use
opts=pulumi.ResourceOptions(provider=self._provider)
and
opts=pulumi.ResourceOptions(provider=peer_provider)
to separates the operations on two accounts, where self._provider is for the local vpc whereas the peer_provider is for the remote one
l

little-cartoon-10569

11/29/2023, 1:20 AM
Yep. I'm just wondering if the wrong provider is being used once.
Are you accepting in the peer account?
r

rhythmic-megabyte-99595

11/29/2023, 1:21 AM
Well, let me attach the code here for your inspection
l

little-cartoon-10569

11/29/2023, 1:23 AM
You can use Text Snippet for collapsible text bits. Better than backticks
r

rhythmic-megabyte-99595

11/29/2023, 1:26 AM
Sure.
local_
prefix indicates things in Account A, while
remote_
in Account B:
Copy code
connection_id = ec2.VpcPeeringConnection(
            "vpcPeering-local-to-remote",
            opts=pulumi.ResourceOptions(provider=local_provider),
            vpc_id=local_vpc_id,
            peer_vpc_id=remote_vpc_id,
            peer_owner_id=remote_account_id,
            auto_accept=False,
            tags={
               ...
            },
        ).id

        ec2.VpcPeeringConnectionAccepter(
            "peer-accepter-in-remote-vpc-account",
            vpc_peering_connection_id=connection_id,
            auto_accept=True,
            tags={
                ...
            },
            opts=pulumi.ResourceOptions(provider=remote_provider),
        )
l

little-cartoon-10569

11/29/2023, 1:35 AM
That looks exactly the same as my code. Except, y'know, Python.
r

rhythmic-megabyte-99595

11/29/2023, 1:36 AM
😂
l

little-cartoon-10569

11/29/2023, 1:37 AM
When you see the error message, is it for an existing (old) connection? Maybe note all the existing connections (the ones marked deleted), delete everything you think you ought to, and run it again? If the error message complains about an already-deleted connection, then that's a problem.
You'd need to resolve that in AWS. Force a purge of old connections or something.
r

rhythmic-megabyte-99595

11/29/2023, 1:40 AM
Let me check how to purge those deleted connections in AWS
Today we removed 'tags' in both
VpcPeeringConnection
and
VpcPeeringConnectionAccepter
, it finally worked. It turned out to be if the tag
Tag.NAME
have the different values in
VpcPeeringConnection
and
VpcPeeringConnectionAccepter
, it comes the 'connection already exist' error. Is it a bug or intentionally design? cc: @little-cartoon-10569
Hi @little-cartoon-10569, I assume you work for Pulumi. I wonder if I need to create an Issue in Git?
l

little-cartoon-10569

11/30/2023, 1:43 AM
I don't work for Pulumi 🙂 I'd imagine this is unrelated to Pulumi and it's an AWS feature. Would need to trawl the docs though.
I'll see what I can see.
Hmm. No, the AWS docs imply that tags on a connection can be different on each side. Not sure.
I can't see any AWS docs that imply that tags are relevant to connection creation or acceptance. Maybe it is a Pulumi thing.