Can't figure out how to connect cross-region peer with vpc-peering

[kenshih]

Can't figure out how to connect cross-region Peer with vpc-peering

Given a module like this with an intended peering connection with peer "XXXX" in us-west-2 with a vpc "YYYY" in us-east-1:

module "vpc_peering_test" {
  source = "cloudposse/vpc-peering/aws"
  version = "0.9.2"

  providers = {
    aws = aws.west
  }
  name             = "api-west-to-api-east"
  requestor_vpc_id = "XXXX"
  acceptor_vpc_id  = "YYYY"
}

It can't detect the "YYYY" vpc_id in the other region, when running terraform plan, so returns something like

│ Error: no matching EC2 VPC found
│ 
│   with module.vpc_peering_test.data.aws_vpc.acceptor[0],
│   on .terraform/modules/my_vpc_name/main.tf line 33, in data "aws_vpc" "acceptor":
│   33: data "aws_vpc" "acceptor" {

Apologies if this is just be my inexperience & not understanding how to configure this. Is there something I should be providing in attributes, provider, or in the acceptor_vpc_id itself? Or is there a missing configuration option in this module?

I am trying to import an existing vpc-peer into terraform. I've imported one with VPCs in the same region & this is my 1st attempt at getting cross-regional VPC peer.

Expected Behavior

The VPC visible to terraform plan & appropriate "to add" messages are returned
.

Steps to Reproduce

Steps to reproduce the behavior:

1. Go to a tf with a provider setup with east and west configs:

provider "aws" {
  alias = "west"
  region = "us-west-2"
  profile = "prod"
}

provider "aws" {
  alias   = "east"
  region  = "us-east-1"
  profile = "prod"
}

and a module like "vpc_peering_test" in bug description above, with requestor vpc in us-west-2 and acceptor vpc in us-east-1
2. Run terraform init
3. Enter 'terraform plan`
4. See error

│ Error: no matching EC2 VPC found
│ 
│   with module.vpc_peering_groups.data.aws_vpc.acceptor[0],
│   on .terraform/modules/my_vpc_name/main.tf line 33, in data "aws_vpc" "acceptor":
│   33: data "aws_vpc" "acceptor" {

Environment (please complete the following information):

Anything that will help us triage the bug will help. Here are some ideas:

• OS: macOs Monterey 12.6
• terraform : 1.2.9

Thank you so much for your consideration and for writing terraform-aws-vpc-peering!

[shinenelson]

Apologies if this is just be my inexperience & not understanding how to configure this. Is there something I should be providing in attributes, provider, or in the acceptor_vpc_id itself? Or is there a missing configuration option in this module?

Your configuration is correct. I had the same problem myself.

I looked into the code of this module and realised that it does not support cross-region VPC peering. I think it might be tricky to implement and support with the way that this module is designed.

However, that being said, there is another module by cloudposse that supports multi-region, multi-account VPC peering.¹²

It requires passing in credentials to the accounts where the resources are being provisioned. I have tested the module and got it to work as expected.
Since we are attempting to peer VPCs within the same account, we could use the same set of credentials for both sides of the peering connection. The module accepts most of the authentication options that is accepted by the provider.

If you are security-conscious, you could set up separate IAM Roles with bare minimum permissions that are required and pass them to the module to assume and create the resources. But that is involved and complicated if you are only trying to import an existing peering connection into your terraform state.

Footnotes

1. https://registry.terraform.io/modules/cloudposse/vpc-peering-multi-account/aws/latest ↩

2. https://github.com/cloudposse/terraform-aws-vpc-peering-multi-account ↩

[RomansWorks]

Same issue here, this is still unresolved.

[aknysh]

this module works both cross-region and cross-account https://github.com/cloudposse/terraform-aws-vpc-peering-multi-account

You can use it in the same account, but cross-region as well

[aknysh]

the accepter and requester both use separate AWS providers, e.g. https://github.com/cloudposse/terraform-aws-vpc-peering-multi-account/blob/master/accepter.tf

provider "aws" {
  alias                   = "accepter"
  region                  = var.accepter_region
  profile                 = var.accepter_aws_profile
  skip_metadata_api_check = var.skip_metadata_api_check

  dynamic "assume_role" {
    for_each = local.enabled && var.accepter_aws_assume_role_arn != "" ? ["true"] : []
    content {
      role_arn = var.accepter_aws_assume_role_arn
    }
  }

  access_key = var.accepter_aws_access_key
  secret_key = var.accepter_aws_secret_key
  token      = var.accepter_aws_token
}

you can set the regions to be diff - in this case it will be cross-region. Or the same, in which case it will be in the same region

You can set assume_role to diff roles, in which case it will be cross-account.
You can set assume_role to the same role, in which case it will be in the same account.

So cross-account and cross-region can be controlled separately