Is there a way for cloudformation to query available zones for subnet creation?

Question

I have a cloudformation script that attempts to create a VPC, with one subnet per AZ.

When I run:

aws ec2 describe-availablity-zones

I get 4 zones returned:

"AvailabilityZones": [
    {
        "State": "available", 
        "RegionName": "us-east-1", 
        "Messages": [], 
        "ZoneName": "us-east-1a"
    }, 
    {
        "State": "available", 
        "RegionName": "us-east-1", 
        "Messages": [], 
        "ZoneName": "us-east-1b"
    }, 
    {
        "State": "available", 
        "RegionName": "us-east-1", 
        "Messages": [], 
        "ZoneName": "us-east-1c"
    }, 
    {
        "State": "available", 
        "RegionName": "us-east-1", 
        "Messages": [], 
        "ZoneName": "us-east-1d"
    }
 ]

However, when I try to create my stack, I get an error:

  "ResourceStatusReason": "Value (us-east-1a) for parameter availabilityZone
   is invalid. Subnets can currently only be created in the following 
   availability zones: us-east-1c, us-east-1b, us-east-1d.",

I am specifying the AZ with

      "AvailabilityZone" : {
        "Fn::Select" : [ "0", { "Fn::GetAZs" : "" } ]
      },

Is there a way to check to see if the AZ is really available for the creation of a subnet?

score 9 · Answer 1 · answered Jun 03 '15 at 08:40

9

This may not be helpful for the CLI Approach or your exact scenario - but with AWS Management Console this works smooth.

With the recent updates with the CloudFormation Parameters, you would be able pin-point the AZs pertaining to the specified AZs.

This would be much convenient during the DR / DR Drills and making the CFN template Region Independent.

enter image description here

"Parameters": {
    "SubnetAZ": {
      "Description": "Availability Zone of the Subnet",
      "Type": "AWS::EC2::AvailabilityZone::Name"
    }
}

More Information About the CloudFormation Parameters

answered Jun 03 '15 at 08:40

Naveen Vijay

15,928
7
71
92

3

Fn::GetAZs will provide the available and usable availability zones as long as you have a default vpc with a subnet in each AZ! which by the way all new aws accounts have as long as you don't delete them manually. – hellomichibye Nov 17 '16 at 15:07
@Naveen I think in your snippet you meant : `List` instead of `AWS::EC2::AvailabilityZone::Name` – Souad Feb 15 '17 at 13:43

score 6 · Answer 2 · answered Jan 29 '14 at 20:32

6

Unfortunately I had the same problem. There is no method in CloudFormation to do this and the zones can be different per AWS account. This is a limitation of VPC infrastructure and it is likely not going to change. Your only option will be to hardcode the zones that you have found in your CloudFOrmation template instead of Fn::Select, for example:

"AvailabilityZone" : "us-east-1b"

Alternatively if you leave AvailabilityZone blank, the default behavior would be AWS will automatically pick one for you.

answered Jan 29 '14 at 20:32

Arya

2,135
15
13

Can't leave them blank because we are creating a VPC with subnets in each AZ - the problem is not every AZ that is returned allows subnets! – chris Jan 29 '14 at 22:11
So if one zone does not allow VPC subnets, what is the point of using it it you are hosting in VPC? Simply ignore that zone and deal with the 3 zones that support it. – Arya Jan 31 '14 at 14:03
That is a manual process - If I create subnets based on Fn::Select with index 0, 1 and 2 it will sometimes fail because there are actually 4 AZs, but not every one of them allows subnets – chris Jan 31 '14 at 20:02
You can supply it with the list of AZs instead of using Fn::GetAZs. If you want to make 3 different subnets, then define 3 distinct stack resources each referencing specific zone. – Arya Feb 03 '14 at 19:19
I actually tried that, but moving between accounts can cause it to fail - for example, we have a test account that has shown 1b, 1c and 1d, and when I run it in prod we have 1a, 1b and 1d. It's frustrating. – chris Feb 04 '14 at 21:57
agreed. I have the same problem. I maintain 3 copies, 1 for each account, for these kinds of things. I made the recommendation to CloudFormation team during a call, hopefully at some point they will implement it, but until then, I don't see another option for doing this with cfn. – Arya Feb 06 '14 at 02:13
2

The "solution" I have implemented is to use a Mapping for each of the accounts, with the truly available AZs as one of the values in the mapping. – scientastic Mar 17 '14 at 20:58
I have done something pretty similar to the above comment also. You could always do some logic prior to stack launch and inject params into the template. That seems a little bit bulky though. – David Dec 03 '15 at 11:33
You can also pick a previously automatically selected AZs with `{ "Fn::GetAtt" : [ "subnetPublicSubnetDefinition", "AvailabilityZone" ] }` ( [official documentation](http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-subnet.html)) – herve Mar 08 '16 at 14:18
Fn::GetAZs will provide the available and usable availability zones as long as you have a default vpc with a subnet in each AZ! which by the way all new aws accounts have as long as you don't delete them manually. – hellomichibye Nov 17 '16 at 15:07

score 5 · Answer 3 · answered Nov 17 '16 at 15:07

5

Fn::GetAZs will provide the available and usable availability zones as long as you have a default vpc with a subnet in each AZ! which by the way all new aws accounts have as long as you don't delete them manually.

answered Nov 17 '16 at 15:07

hellomichibye

4,112
2
23
23

1

I have seen Fn::GetAZs return unusable zones. – Tim Bassett Nov 23 '16 at 06:59
1

then you don't have default subnets – hellomichibye Nov 24 '16 at 07:38
1

This is a really interesting _"feature"_. Has this been documented anywhere on AWS Docs? – Felipe Alvarez Jul 05 '17 at 03:56
2

If you're missing a default subnet for an AZ (either because AWS added an AZ or because you deleted an existing default subnet) you can add it back with `aws ec2 create-default-subnet --availability-zone `. [Docs](https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/default-vpc.html#create-default-subnet) – mgalgs Jun 26 '18 at 18:33
You literally saved me from losing my mind, thank you! – Erez Rabih Jul 03 '18 at 14:36

score -3 · Answer 4 · answered Dec 29 '16 at 21:30

I get around the limitation by avoiding json as the medium of expression. I use troposphere to compose my cloudformation templates.(https://github.com/cloudtools/troposphere)

You would however would have to deploy some sort of tooling around the deployment of cloudformation templates to individual regions.

Is there a way for cloudformation to query available zones for subnet creation?

4 Answers4

Linked