Questions[aws-vpc](server)

In a test environment to mockup a larger issue, I have an IAM user with a directly attached IAM profile. I have also tried with the profile attached to an IAM Role which the IAM user has assumed.

The profile allows CloudFormation to create a VPC with IPv6CidrBlock and IPv6Cidr subnet. This cloud stack always is created fine in us-east-1 and some other regions. Upon further testing other regions always fail. The IPv6 subnet creation fails. Investigation found that one additional IAM profile action, "ec2:DescribeNetworkAcls" is needed for some regions. For example us-east-1 and eu-west-2 do not require the additional action. eu-central-1 and several other regions do require the additional IAM profile action.

1. Is there any known reason for this different requirement among the regions? Is there any EC2 or VPC service setting which can be queried to see the difference?
2. Why does CloudTrail not log the failure message when the IAM profile is missing the "ec2:DescribeNetworkAcls" action?
3. For the previous failing regions, when the action is added to IAM profile, upon retest, CloudTrail does not log the successful event named "DescribeNetworkAcls" though it does log all other related events.

The error shown in CloudFormation, though not CloudTrail:

"ResourceStatus": "CREATE_FAILED",
LogicalId: Subnet,
"ResourceStatusReason": 
"Unable to retrieve Ipv6CidrBlocks attribute for AWS::EC2::VPC, with error message You are not authorized to perform this operation. (Service: Ec2, Status Code: 403, Request ID: XXX, Extended Request ID: null)...

When the error occurs, adding the following IAM Policy action resolves the issue. Though still this eventName is never logged by CloudTrail:

"ec2:DescribeNetworkAcls"

Cloudformation Template:

---
AWSTemplateFormatVersion: '2010-09-09'
Description: 'Test stack'
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 172.16.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default

  VPCIPv6:
    Type: AWS::EC2::VPCCidrBlock
    Properties:
      AmazonProvidedIpv6CidrBlock: true
      VpcId: !Ref VPC

  Subnet:
    Type: AWS::EC2::Subnet
    DependsOn:
      - VPCIPv6
    Properties:
      CidrBlock: 172.16.254.0/23
      Ipv6CidrBlock: !Select [0, !Cidr [!Select [0, !GetAtt 'VPC.Ipv6CidrBlocks'], 1, 64]]
      MapPublicIpOnLaunch: false
      VpcId: !Ref VPC

IAM Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "CloudFormationStackActions",
            "Effect": "Allow",
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:UpdateStack",
                "cloudformation:DescribeStacks",
                "cloudformation:DescribeStackEvents",
                "cloudformation:ListStackResources"
            ],
            "Resource": [
                "*"
            ]
        },
        {
        {
            "Sid": "TESTINGVPCIPv6Subnet",
            "Effect": "Allow",
            "Action": [
                "ec2:CreateVpc",
                "ec2:CreateSubnet",
                "ec2:AssociateVpcCidrBlock",
                "ec2:AssociateSubnetCidrBlock",
                "ec2:ModifyVpcAttribute",
                "ec2:DescribeVpcAttribute",
                "ec2:DescribeVpcs",
                "ec2:DescribeSubnets"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}

To reproduce:

• Save the above cloud formation text to a file named "a-test-stack-template.yaml"
• Set the temporary bash variable named aws_cred_profile with the aws credentials profile name to be used for the aws cli commands. The creds should be of the IAM user with the above IAM profile attached. Use default if there is only one set of credentials

aws_cred_profile=default

• AWS CLI Commands to test mockup:

aws_region=eu-central-1

# aws cli create-stack
test_env=$(aws cloudformation create-stack --region $aws_region --no-cli-pager \
--profile $aws_cred_profile --disable-rollback \
--stack-name test-$(date +%Y%b%d-%H%M%S) \
--template-body file://a-test-stack-template.yaml \
| sed -r -e 's/.*:stack\/(.*)\/.*/\1/' | sed '1d' | sed '2d')

echo $test_env

# repeat calls to list-stack-resources until the stack creation is complete
aws cloudformation list-stack-resources --region $aws_region --no-cli-pager \
--stack-name=$test_env --max-items=3

I have a following specific requirement that I need to setup to access on premise server of one of the payment processor vendor that I am trying to access from EC2 instance. I don't have extensive knowledge about networking so please feel to correct me if I have made mistake in the post.

The specific requirement to achieve this is as illustrated in the diagram,

To do this, I have created a site to site VPN connection that allows me to connect from VPC to the on-premise server using Route Tables, virtual private gateway and customer gateway. Customer gateway being the on-premise server IP address.

Problem, that I am now facing is on way to transform the originating IP address as they expect it to come through 10.250.XX.XX/28 instead of the public IP address of EC2 instance.

I tried setting the Local Address and Remote Address CDR to 10.250.XX.XX/28 and 182.93.XX.XX/27 in site to site VPN, but the result is the same. I even tried setting IPTable rules from the ec2 instance as follows,

sudo iptables -t nat -A POSTROUTING -d 182.93.XX.XX/28 -j SNAT --to-source 10.250.XX.XX

but using this stopped any outgoing request through ICMP ping.

I would really appreciate if you can guide me on resolving this issue and provide hint on if there is any way to achieve this using AWS.

We are trying to launch the VM's on the AWS baremetal instances.So hostA has 10.10.0.4 and hostB has IP 10.10.0.5.Now when we launch the KVM VM's using the default mode(NAT) and that works fine and able to connect the VM1(HostA) from the VM2(HostB) by some port mapping.

In our on-prem DC we use the similar setup but with Bridge mode,so any VM can connect to any VM in the network.We need the similar solution in AWS.

My questions are

1. Is it possible to use the bridge or MACvTap mode in the baremetal instance?

2. Is it possible to acquire IP address from VPC for the VM launched from the KVM host?(From VPC design its not possible).But is there any other way that we can use the VPC for the IP addressing and routing so that we can utilize the complete VPC features.

I know about the dedicated hosts,but we don't need that solution.

I have installed and configured EC2 instance with routerOS which I want to use as main point of connection for branch networks. It has 1 interface, resides in subnet 172.20.1.0/24. Subnet 172.21.1.0/24 created within same VPC and has route tables as below: 172.20.1.0/24 - local 172.21.1.0/24 - local 0.0.0.0/0 - eni-xxxxxxxx (interface of routerOS in 172.20.1.0/24)

routerOS instance has elastic IP and works as router. Tunnel to branch configured and works well. Any AWS instance in any subnet reachable from any endpoint in branch network, but not vise-versa. I can't reach anything in branch from AWS VPC. The only instance reaching branch is routerOS itself. Security groups for both networks allowing all traffic from 172.20.0.0/16, 172.21.0.0/16 and 192.168.0.0/16 (branch subnets).

What am I doing wrong in this setup?

I think the answer is no, but I want to make sure that I'm not missing anything. Is it possible for an EC2 instance to have IP addresses in more than one VPC at the same time?

I tried creating 2 VPCs, and then two network interfaces, one in each VPC, but it seems it's not possible to attach them to the same EC2 instance because it's not possible to attach them to an instance that's not on that VPC, is this correct?

For example, I create vpc1 and eni1 (network interface) in vpc1. Then I create vpc2 and eni2 in vpc2. Then I create ec21 (an EC2 instance) and put it in vpc1 with eni1 as its network interface. When I open eni2 and I select attach, I can't select ec21, it says:

No running or stopped instances in us-esat-1f in vpc2.