AWS solutions documentation change
Summary
Updated documentation to reflect migration from nested stack to consolidated spoke stack structure, including new role handling and upgrade instructions.
Security assessment
Changes focus on stack architecture improvements and role management workflows. No security vulnerabilities, exploits, or security features are mentioned. The deletion failure handling for TransitGatewayServiceLinkedRole is operational, not security-related.
Diff
diff --git a/solutions/latest/network-orchestration-aws-transit-gateway/update-the-spoke-stacks.md b/solutions/latest/network-orchestration-aws-transit-gateway/update-the-spoke-stacks.md index 3719db175..d072c77c5 100644 --- a//solutions/latest/network-orchestration-aws-transit-gateway/update-the-spoke-stacks.md +++ b//solutions/latest/network-orchestration-aws-transit-gateway/update-the-spoke-stacks.md @@ -5 +5 @@ -Spoke stackService-linked role for Transit Gateway spoke stack +Spoke stackUpgrade from nested stack to consolidated spoke stack. @@ -15 +15 @@ Follow the step-by-step instructions in this section to update the spoke stacks. -To mitigate the `AlreadyExists` error code for the service-linked role (**AWSServiceRoleForVPCTransitGateway**) in the spoke stack, we moved the role to a separate stack. This way, you can upgrade the spoke stack in multiple Regions. You must deploy the service-linked role stack _after_ updating the spoke stack. +The service-linked role for Transit Gateway (`AWSServiceRoleForVPCTransitGateway`) has been consolidated into the spoke stack. During the stack update, a custom resource checks whether the role already exists. If the role exists, creation is skipped. If the role does not exist, it is created automatically. @@ -54 +54 @@ You can view the status of the stack in the AWS CloudFormation console in the ** -## Service-linked role for Transit Gateway spoke stack +## Upgrade from nested stack to consolidated spoke stack. @@ -56 +56 @@ You can view the status of the stack in the AWS CloudFormation console in the ** -The spoke stack attempts to delete the **AWSServiceRoleForVPCTransitGateway** service-linked role. If there are existing transit gateway attachments, the following events occur while updating the spoke stack: +If you are upgrading to the latest version from any version between 3.3.11 and 3.3.22, follow these steps to migrate the spoke template from a nested stack to a consolidated spoke stack. @@ -58 +58 @@ The spoke stack attempts to delete the **AWSServiceRoleForVPCTransitGateway** se - * The role deletion fails + 1. Delete the spoke stack. @@ -60 +60,7 @@ The spoke stack attempts to delete the **AWSServiceRoleForVPCTransitGateway** se - * You receive `AlreadyExists` error code + * If the role is in use, the deletion fails. Select **Retain resource** for `TransitGatewayServiceLinkedRole` and delete the stack. + + + + * If the role is not in use, the stack deletion cleans up the role. + + 2. Deploy the spoke template with the latest version. For details, see [Step 4: Launch the spoke stack(s)](./step-4-launch-the-spoke-stacks.html).