CODEWITHSUNDEEP
amazon-web-servicesaws-cloudformation
Justin808
Justin808

Reputation: 21510

cloudformation failing with security group mismatch

I'm trying to setup my cloudformation for my database:

"VPC" : {
  "Type" : "AWS::EC2::VPC",
  "Properties" : {
    "CidrBlock" : "10.0.0.0/16",
    "EnableDnsSupport" : "false",
    "EnableDnsHostnames" : "false",
    "InstanceTenancy" : "default",
    "Tags" : [ { "Key" : "Name", "Value" : "DomainName" } ]
  }
},

"Subnet" : {
  "Type" : "AWS::EC2::Subnet",
  "Properties" : {
    "VpcId" : { "Ref" : "VPC" },
    "CidrBlock" : "10.0.0.0/16",
    "AvailabilityZone" : { "Fn::Select": [ "0", { "Fn::GetAZs" : { "Ref" : "AWS::Region" } }]},
    "Tags" : [ { "Key" : "Name", "Value" : "DomainName" } ]
  }
},

"SecurityGroup" : {
  "Type" : "AWS::EC2::SecurityGroup",
  "Properties" : {
    "GroupDescription" : "Allow http to client host",
    "VpcId" : {"Ref" : "VPC"},
    "SecurityGroupIngress" : [{
      "IpProtocol" : "tcp",
      "FromPort" : "3306",
      "ToPort" : "3306",
      "CidrIp" : "10.0.0.0/16"
    }],
    "Tags" : [ { "Key" : "Name", "Value" : "DomainName" } ]
  }
},

"Database" : {
  "Type" : "AWS::RDS::DBInstance",
  "Properties" : {
    "DBName" : { "Fn::Join": ["", { "Fn::Split": [".", { "Ref" : "DomainName" }]}]},
    "AllocatedStorage" : "5",
    "DBInstanceClass" : "db.t2.micro",
    "Engine" : "MySQL",
    "EngineVersion" : "5.5",
    "MasterUsername" : { "Ref": "DBUsername" },
    "MasterUserPassword" : { "Ref": "DBPassword" },
    "VPCSecurityGroups" : [ { "Fn::GetAtt": [ "SecurityGroup", "GroupId" ] } ],
    "Tags" : [ { "Key" : "Name", "Value" : "DomainName" } ]
  },
  "DeletionPolicy" : "Snapshot"
},

Should be setting up a VPC for the database. But when I run the cloudformation template I get the following error:

UPDATE_FAILED AWS::RDS::DBInstance Database Database is in vpc-3081245b, but Ec2 Security Group sg-b122ffca is in vpc-f7173290

How do I get my database in the VPC properly?

Upvotes: 3

Views: 557

Answers (1)

John Rotenstein
John Rotenstein

Reputation: 269091

As part of your Database definition, you can specify a DBSubnetGroupName.

A DB Subnet Group provides a list of subnets in which the Database is allowed to run. Each subnet in a DB Subnet Group belongs to a VPC.

Therefore, you need to do the following to your Amazon CloudFormation template:

  • Add a AWS::RDS::DBSubnetGroup, specifying the Subnet already defined in your template
  • Add a DBSubnetGroupName parameter to your AWS::RDS::DBInstance definition

Upvotes: 3

Related Questions