The DB instance and EC2 security group are in different VPCs, cloudFormation error

Question

I want to automate the process of creating RDS. I would like to create RDS Aurora.
When deploying the application, stack cloudFormation is validated and I have an error:

An error occurred: DatabaseCluster - The DB instance and EC2 security group are in different VPCs.

Can you say what's wrong?

I followed this post Issue with creating a Postgres RDS in Cloudformation Template but this doesn't work.

Here is part of my serverless.yml file

resources:
  Resources:
    DatabaseCluster:
      Type: AWS::RDS::DBCluster
      Properties:
        DatabaseName: name${opt:stage, self:provider.stage}
        Engine: aurora
        MasterUsername: ${ssm:MasterUsername-${opt:stage, self:provider.stage}}
        MasterUserPassword: ${ssm:MasterUserPassword-${opt:stage, self:provider.stage}}
        Port: "3306"
        VpcSecurityGroupIds:
          - !Ref VpcSecurityGroup

    ServerlessRDS:
      Type: AWS::RDS::DBInstance
      Properties:
        Engine: aurora
        DBClusterIdentifier: !Ref "DatabaseCluster"
        DBInstanceIdentifier: db-name-${opt:stage, self:provider.stage}
        DBInstanceClass: db.t2.medium
        VPCSecurityGroups:
          - !Ref VpcSecurityGroup
        DBSubnetGroupName: !Ref myDBSubnetGroup


    VpcSecurityGroup:
      Type: AWS::EC2::SecurityGroup
      Properties:
        VpcId:
          Ref: ServerlessVPC
        GroupDescription: "Allow all traffic"
        SecurityGroupEgress:
          - IpProtocol: -1
            CidrIp: 0.0.0.0/0
        SecurityGroupIngress:
          - IpProtocol: -1
            CidrIp: 0.0.0.0/0

    ServerlessVPC:
      Type: AWS::EC2::VPC
      Properties:
        CidrBlock: "10.0.0.0/16"

    myDBSubnetGroup:
      Type: "AWS::RDS::DBSubnetGroup"
      Properties:
        DBSubnetGroupDescription: "description"
        SubnetIds:
          - !Ref ServerlessSubnetA
          - !Ref ServerlessSubnetB
    ServerlessSubnetA:
      Type: AWS::EC2::Subnet
      Properties:
        VpcId:
          Ref: ServerlessVPC
        AvailabilityZone: "eu-west-1b"
        CidrBlock: "10.0.0.0/24"
    ServerlessSubnetB:
      Type: AWS::EC2::Subnet
      Properties:
        VpcId:
          Ref: ServerlessVPC
        AvailabilityZone: "eu-west-1a"
        CidrBlock: "10.0.1.0/24"

Asdfg Asdfg · Accepted Answer · 2019-08-16T17:00:00

You need to add DBSubnetGroupName parameter to AWS::RDS::DBCluster Resource.

DatabaseCluster:
  Type: AWS::RDS::DBCluster
  Properties:
    DatabaseName: name${opt:stage, self:provider.stage}
    Engine: aurora
    MasterUsername: ${ssm:MasterUsername-${opt:stage, self:provider.stage}}
    MasterUserPassword: ${ssm:MasterUserPassword-${opt:stage, self:provider.stage}}
    Port: "3306"
    VpcSecurityGroupIds:
      - !Ref VpcSecurityGroup
    DBSubnetGroupName:
      Ref: myDBSubnetGroup

Also you may want to add explicit dependencies on ServerlessSubnetA and ServerlessSubnetB in VpcSecurityGroup Resource to kind of group resource creation by the service and to avoid any race conditions.

VpcSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DependsOn: 
    - ServerlessSubnetA
    - ServerlessSubnetB
    Properties:
      VpcId:
        Ref: ServerlessVPC
      GroupDescription: "Allow all traffic"
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
      SecurityGroupIngress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0

The DB instance and EC2 security group are in different VPCs, cloudFormation error

1 Answers