AWS Cloudformation Stack - Route Table Main

Question

Is it possible to specify in the cloudformation stack template the when adding a route table and set it to main:yes?

On my current stack template there's always a route table associated with my VPC (Also created by the stack) that is set to main:yes but it's not specified route table on my stack template.

user_174777 · Answer

No, this is not possible.

When a VPC is created, a 'Main' Route Table is automatically created, which will be the default route table for all subnets that do not have a Subnet Association specified.

It is not possible to create a subnet via CloudFormation that takes on this property.

user_1744914 · Answer

In order to create similar setup you need to write the whole stack for infra by yourself: VPC, Internet Gateway, Subnet and Route Table. Then you need to explicitly define RouteTableAssociation for the specific subnet and create a public route for the table. YAML example of such a setup

AWSTemplateFormatVersion: '2010-09-09'
Description: Example
Resources:
  myInternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: "Name"
          Value: "a_gateway"

  myVPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/24
      EnableDnsSupport: true
      EnableDnsHostnames: true
      InstanceTenancy: default

  # Attach Internet gateway to created VPC
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId:
        Ref: myVPC
      InternetGatewayId:
        Ref: myInternetGateway

  # Create public routes table for VPC
  myPublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref myVPC
      Tags:
        - Key: "Name"
          Value: "public_routes"

  # Create a route for the table which will forward the traffic
  # from the gateway
  myDefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: AttachGateway
    Properties:
      RouteTableId: !Ref myPublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref myInternetGateway

  # Subnet within VPC which will use route table (with default route)
  # from Internet gateway
  mySubnet:
    Type: AWS::EC2::Subnet
    Properties:
      AvailabilityZone: ""
      CidrBlock: 10.0.0.0/25
      MapPublicIpOnLaunch: true
      VpcId:
        Ref: myVPC

  # Associate route table (which contains default route) to newly created subnet
  myPublicRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref myPublicRouteTable
      SubnetId: !Ref mySubnet

Template is not really short, but to accomplish this simple requirement you have to define everything explicitly.

One way to protect your VPC is to leave the main route table in its original default state (with only the local route), and explicitly associate each new subnet you create with one of the custom route tables you've created. This ensures that you must explicitly control how each subnet's outbound traffic is routed.

AWS Cloudformation Stack - Route Table Main

2 Answers