Skip to content

Commit d31abc1

Browse files
oliviergaumondoliviergaumond
committed
sync latest lza-upgrade
1 parent a5e2724 commit d31abc1

File tree

4 files changed

+959
-1
lines changed

4 files changed

+959
-1
lines changed

‎reference-artifacts/Custom-Scripts/lza-upgrade/src/resource-mapping.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,8 +86,9 @@ export class ResourceMapping {
8686
repositoryName: this.configRepositoryName,
8787
defaultRegion: this.region,
8888
});
89-
if (!this.localUpdateOnly)
89+
if (!this.localUpdateOnly) {
9090
await this.validateS3Bucket(this.mappingBucketName);
91+
}
9192
const enabledRegions = configFile['global-options']['supported-regions'];
9293
const accountList = await this.getAccountListFromDDB(this.parametersTableName);
9394
const environments = this.getEnvironments(accountList, enabledRegions);

‎reference-artifacts/Custom-Scripts/lza-upgrade/tools/network-drift-detection/README.md‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
# Network Drift Detection
2+
3+
This script supplements the CloudFormation drift detection step during the ASEA to LZA upgrade preparation phase. It performs additional comparisons between the ASEA configuration file and the current state of VPC resources.
4+
5+
The script operates by:
6+
1. Reading the raw ASEA configuration file to identify all defined VPCs
7+
2. Calling EC2 APIs to describe:
8+
- VPCs
9+
- Subnets
10+
- Route tables
11+
- Transit Gateways
12+
- Transit Gateway Attachments
13+
- Transit Gateway Route Tables
14+
3. Comparing the current state with the configuration
15+
4. Generating JSON files that identify configuration drift and document the current state of resources for reference during the upgrade process
16+
17+
18+
## Prerequisites
19+
20+
### Python Requirements
21+
- Python 3.9 or later
22+
- Virtual environment setup
23+
24+
#### Setting up the Python Environment
25+
26+
1. Create and activate a virtual environment:
27+
```bash
28+
python -m venv .venv
29+
source .venv/bin/activate
30+
```
31+
32+
2. Install required dependencies:
33+
```
34+
pip install -r requirements.txt
35+
```
36+
37+
### AWS Permissions
38+
39+
Required permissions:
40+
- Access to an IAM Role in the ASEA management account
41+
- Permission to read the ASEA-Parameters DynamoDB Table
42+
- Ability to assume a role in all AWS accounts containing ASEA-deployed networking resources
43+
44+
Note: While the `ASEA-PipelineRole` satisfies these requirements, it has elevated permissions. We recommend using a least-privilege role with read-only access. See the Sample Policy in the Appendix for the minimum required EC2 permissions.
45+
46+
## Usage
47+
48+
Prerequisites:
49+
- Valid credentials for your ASEA management account
50+
- Local copy of the raw ASEA raw/config.json configuration file from your CodeCommit repository
51+
52+
Execute the script:
53+
```bash
54+
python lza-upgrade-check.py <path_to_raw_ASEA_config> [options]
55+
```
56+
57+
Configuration options
58+
|Flag|Description|Default|
59+
|----|-----------|-------|
60+
|--accel-prefix|Prefix of your ASEA installation|ASEA|
61+
|--home-region|Your AWS Home Region|ca-central-1|
62+
|--role-to-assume|Role to assume in each account|{accel_prefix}-PipelineRole|
63+
|--output-dir|Local directory where to save the output|outputs|
64+
65+
The script provides output both in the console and as files in the specified output directory.
66+
67+
## Understanding the Results
68+
69+
### Drift Analysis (consolidate_drift.json)
70+
This file documents differences between the ASEA configuration and the current state of AWS networking resources.
71+
72+
#### Subnet Drift Analysis
73+
This section details drift in subnets and their route tables. Careful inspection is required as LZA will create and replace route tables based on the ASEA configuration during the upgrade.
74+
75+
|Key|Description|Notes and upgrade impact|
76+
|---|-----------|------------------------|
77+
|route_tables_not_deployed|Route tables found in the ASEA config, but not in the AWS account|These route tables may have been manually removed and **will be re-created during the upgrade**|
78+
|route_tables_not_in_config|Route tables not found in the ASEA config, but are present in the AWS account|This is for information, these route tables won't be modified during the upgrade. See note below.|
79+
|subnet_route_table_mismatches|There is a configuration difference between the ASEA config and the current state of the route table|These route tables may have been manually modified, **the changes will be overwritten during the upgrade**|
80+
|subnets_not_associated|The association between subnet and route table is different between ASEA config and in the AWS account|A different route table may have been manually associated with a subnet. **The association will be reverted during the upgrade**|
81+
|subnets_not_deployed|Subnet not found in the ASEA config, but are present in the AWS account|This is for information, these subnets won't be modified during the upgrade|
82+
|vpcs_not_in_config|VPC not found in the ASEA config, but are present in the AWS account|This is for information, these VPC won't be modified during the upgrade|
83+
84+
Note: The script will probably output one route table per VPC with only the route table identifier as a reference (e.g. `Route table rtb-xxxxxxxxxx exists in VPC Central_vpc but not in config`). Those are more likely the default route tables that were automatically created at VPC creation, this can be ignored as long as those default route tables are not associated to any subnet.
85+
86+
#### Transit Gateway Drift Analysis
87+
This section details drift in Transit Gateway Attachments and Route Tables. These changes are primarily informational, highlighting modifications made outside the accelerator. During the upgrade, existing TGW attachments and route tables remain unmodified. We strongly recommend reviewing these changes both before and after the upgrade to prevent unexpected impacts.
88+
89+
|Key|Description|
90+
|---|-----------|
91+
|tgw_attachments_not_deployed|TGW attachments present in ASEA config but missing from AWS account|
92+
|tgw_attachments_not_in_config|TGW attachments present in AWS account but not in ASEA config|
93+
|tgw_route_tables_not_deployed|TGW route tables present in ASEA config but missing from AWS account|
94+
|tgw_route_tables_not_in_config|TGW route tables present in AWS account but not in ASEA config|
95+
96+
### Resource Inventory
97+
The script generates inventory files documenting the current state of resources. These files can be used as a reference for the current state of resources before the upgrade. One sub-directory will be created in the output folder for each region where you have networking resources deployed.
98+
99+
|File Name|Description|
100+
|---------|-----------|
101+
|tgw_config.json|Summary of Transit Gateway configuration from ASEA|
102+
|tgw_inventory.json|Detailed Transit Gateway resource state, including raw API responses|
103+
|vpc_config.json|Summary of VPC, Subnet, and Route Table configurations from ASEA|
104+
|vpc_inventory.json|Detailed state of VPC resources, including raw API responses|
105+
106+
## Limitations
107+
108+
This script assists in identifying drift and manual modifications outside the accelerator. However, it should not replace a comprehensive analysis of your landing zone networking configuration.
109+
110+
Current limitations:
111+
- Tested only with sample ASEA configurations; may not support all customizations
112+
113+
114+
## Appendix - Sample policy
115+
116+
Sample minimal IAM Policy to describe networking resources
117+
118+
```
119+
{
120+
"Version": "2012-10-17",
121+
"Statement":
122+
[
123+
{
124+
"Sid": "Ec2ViewOnly",
125+
"Effect": "Allow",
126+
"Action": [
127+
"ec2:DescribeAccountAttributes",
128+
"ec2:DescribeAddresses",
129+
"ec2:DescribeAvailabilityZones",
130+
"ec2:DescribeCarrierGateways",
131+
"ec2:DescribeClassicLinkInstances",
132+
"ec2:DescribeCustomerGateways",
133+
"ec2:DescribeDhcpOptions",
134+
"ec2:DescribeFlowLogs",
135+
"ec2:DescribeInternetGateways",
136+
"ec2:DescribeLocalGatewayRouteTableVirtualInterfaceGroupAssociations",
137+
"ec2:DescribeLocalGatewayRouteTableVpcAssociations",
138+
"ec2:DescribeLocalGatewayRouteTables",
139+
"ec2:DescribeLocalGatewayVirtualInterfaceGroups",
140+
"ec2:DescribeLocalGatewayVirtualInterfaces",
141+
"ec2:DescribeLocalGateways",
142+
"ec2:DescribeMovingAddresses",
143+
"ec2:DescribeNatGateways",
144+
"ec2:DescribeNetwork*",
145+
"ec2:DescribePrefixLists",
146+
"ec2:DescribeRegions",
147+
"ec2:DescribeReserved*",
148+
"ec2:DescribeRouteTables",
149+
"ec2:DescribeSecurityGroupRules",
150+
"ec2:DescribeSecurityGroups",
151+
"ec2:DescribeSubnets",
152+
"ec2:DescribeTags",
153+
"ec2:DescribeVpc*",
154+
"ec2:DescribeVpnGateways",
155+
"ec2:DescribeVpnConnections",
156+
"ec2:SearchLocalGatewayRoutes",
157+
"ec2:DescribeTransitGateway*",
158+
"ec2:GetTransitGatewayRouteTableAssociations",
159+
"ec2:GetTransitGatewayRouteTablePropagations",
160+
"ec2:GetTransitGatewayPrefixListReferences",
161+
"ec2:SearchTransitGatewayRoutes"
162+
],
163+
"Resource": "*"
164+
}
165+
]
166+
}
167+
```

0 commit comments

Comments
 (0)