CODEWITHSUNDEEP
amazon-web-servicesaws-cloudformation
Quinten Scheppermans
Quinten Scheppermans

Reputation: 1094

Security group sg-xxxxx and subnet subnet-xxxxx belong to different networks

I'm trying to automate the launch of my instances with a Cloudformation template. When the stack is being created I get the following error :

Security group sg-xxxxx and subnet subnet-xxxxx belong to different networks.

This is my current template :

{
  "Description": "AWS Cloudformation template to launch a Docker Swarm cluster of two nodes.",
  "Resources" : {
    "TwitterappVPC": {
      "Type": "AWS::EC2::VPC",
      "Properties" : {
        "CidrBlock" : "10.0.0.0/16",
        "EnableDnsSupport" : "true",
        "EnableDnsHostnames" : "true",
        "InstanceTenancy" : "dedicated"
      }
    },
    "PublicSubnet" : {
      "Type" : "AWS::EC2::Subnet",
      "Properties" : {
        "VpcId" : { "Ref" : "TwitterappVPC" },
        "CidrBlock" : "10.0.0.0/16",
        "AvailabilityZone": {
          "Fn::Select" : [ "0", { "Fn::GetAZs" : "" } ]
        }
      }
    },
    "InternetGateway" : {
      "Type" : "AWS::EC2::InternetGateway"
    },
    "AttachGateway" : {
      "Type" : "AWS::EC2::VPCGatewayAttachment",
      "Properties" : {
        "VpcId" : { "Ref" : "TwitterappVPC" },
        "InternetGatewayId" : { "Ref" : "InternetGateway" }
      }
    },
    "TwitterappSecurityGroup" : {
      "Type" : "AWS::EC2::SecurityGroup",
      "Properties" : {
        "GroupDescription" : "Enable all Swarm, Microservices and SSH traffic ports",
        "SecurityGroupIngress" : [
          {"IpProtocol" : "tcp", "FromPort" : "22", "ToPort" : "22", "CidrIp" : "0.0.0.0/0"},
          {"IpProtocol" : "tcp", "FromPort" : "2377", "ToPort" : "2377", "CidrIp" : "0.0.0.0/0"},
          {"IpProtocol" : "tcp", "FromPort" : "4789", "ToPort" : "4789", "CidrIp" : "0.0.0.0/0"},
          {"IpProtocol" : "udp", "FromPort" : "4789", "ToPort" : "4789", "CidrIp" : "0.0.0.0/0"},
          {"IpProtocol" : "tcp", "FromPort" : "7946", "ToPort" : "7946", "CidrIp" : "0.0.0.0/0"},
          {"IpProtocol" : "udp", "FromPort" : "7946", "ToPort" : "7946", "CidrIp" : "0.0.0.0/0"},
          {"IpProtocol" : "tcp", "FromPort" : "3306", "ToPort" : "3306", "CidrIp" : "0.0.0.0/0"},
          {"IpProtocol" : "tcp", "FromPort" : "8080", "ToPort" : "8095", "CidrIp" : "0.0.0.0/0"}
        ],
        "VpcId" : {"Ref" : "TwitterappVPC"}
      }
    },
    "PublicRouteTable" : {
      "Type" : "AWS::EC2::RouteTable",
      "Properties" : {
        "VpcId" : {"Ref" : "TwitterappVPC"}
      }
    },
    "PublicRoute" : {
      "Type" : "AWS::EC2::Route",
      "DependsOn" : "AttachGateway",
      "Properties" : {
        "RouteTableId" : { "Ref" : "PublicRouteTable" },
        "DestinationCidrBlock" : "0.0.0.0/0",
        "GatewayId" : { "Ref" : "InternetGateway" }
      }
    },
    "PublicSubnetRouteTableAssociation" : {
      "Type" : "AWS::EC2::SubnetRouteTableAssociation",
      "Properties" : {
        "SubnetId" : { "Ref" : "PublicSubnet" },
        "RouteTableId" : { "Ref" : "PublicRouteTable" }
      }
    },
    "TwitterappMasterNode": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "AvailabilityZone": {
          "Fn::Select" : [ "0", { "Fn::GetAZs" : "" } ]
        },
        "InstanceType": "t2.medium",
        "KeyName": "keypair-xxxx",
        "ImageId": "ami-ac442ac3",
        "SecurityGroupIds": [{"Ref" : "TwitterappSecurityGroup"}]
      }
    }
  }
}

Which led me to the following stackoverflow question

The suggested solution was to add some Network interface properties to the EC2 instance properties:

"NetworkInterfaces": [
            {
                "SubnetId": {"Ref": "PublicSubnet"},
                "AssociatePublicIpAddress": "true",
                "DeviceIndex": "0",
                "GroupSet": [{ "Ref" : "TwitterappSecurityGroup" }]
            }
        ]

This gave me the following error:

Network interfaces and an instance-level security groups may not be specified on the same request

What am I doing wrong?

Upvotes: 3

Views: 3369

Answers (1)

Quinten Scheppermans
Quinten Scheppermans

Reputation: 1094

Rather stupid of me...

The issue was fixed after removing 

"SecurityGroupIds": [{"Ref" : "TwitterappSecurityGroup"}]

From the EC2-instance properties.

And adding the the networkinterfaces properties

"NetworkInterfaces": [
        {
            "SubnetId": {"Ref": "PublicSubnet"},
            "AssociatePublicIpAddress": "true",
            "DeviceIndex": "0",
            "GroupSet": [{ "Ref" : "TwitterappSecurityGroup" }]
        }
    ]

Upvotes: 2

Related Questions