Way to auto-approve for pending acceptance state after TG attachment is added?

Question

Is there an auto-approve for pending acceptance state after TG attachment is added except for using resource aws_ec2_transit_gateway_vpc_attachment_accepter ?

I have a variable, which I obtain from aws api for regions with TGW IDs except the current region

For e.g i am in us-east-2 my variable is,

TGW_PEERS = [{"id": "tgw-xxx", "region": "eu-west-1", "name": "TGW0001_EUW1"}, {"id": "tgw-xxx", "region": "us-west-2", "cidr": "", "name": "TGW0001_USW2"}]

I have a resource aws_ec2_transit_gateway_peering_attachment

resource "aws_ec2_transit_gateway_peering_attachment" "TGW-PEERS" {
  count = length(var.TGW_PEERS) 
  peer_region             = var.TGW_PEERS[count.index].region 
  peer_transit_gateway_id = var.TGW_PEERS[count.index].id 
  transit_gateway_id      = data.aws_ec2_transit_gateway.TGW.id
  tags = {
    Name = format("PEER_%s", var.TGW_PEERS[count.index].name)
    Side = "Initiator"    
  }
}

But when I apply the above, TGW attachments go in pending acceptance state and enabling "Auto-accept shared attachments" does not help either

A way to fix it is i will have to do this for every region and create aliases, resource statements for all the other regions except itself. Which I dont want to do :)

provider "aws" {
  alias = "us-west-2"
  region     = "us-west-2"
}

resource "aws_ec2_transit_gateway_vpc_attachment_accepter" "TGW-ACCEPTOR" {
  provider = aws.us-west-2 
  transit_gateway_attachment_id = data.aws_ec2_transit_gateway.TGW.id
  tags = {
    Name = "Yo"
    Side = "Accepter"
  }
}

Marcin Marcin · Accepted Answer · 2021-03-19T02:45:20

"Auto-accept shared attachments" applies for TG VPC attachments . However you are trying to do TG peering attachment. For such attachments, there is no auto-accept:

To activate the peering attachment, the owner of the accepter transit gateway must accept the peering attachment request. This is required even if both transit gateways are in the same account. The peering attachment must be in the pendingAcceptance state. Accept the peering attachment request from the Region that the accepter transit gateway is located in.

The aws_ec2_transit_gateway_vpc_attachment_accepter you are trying to use applies to TG VPC attachments, not TG peering ones.

Way to auto-approve for pending acceptance state after TG attachment is added?

1 Answers