VpcPeeringConnection failed to stabilize | Resolved

Is “VpcPeeringConnection failed to stabilize” error causing trouble? Read on to find out what our Support Engineers suggest to resolve this issue.

At Bobcares, similar queries often come in as a part of our AWS Support Services. Let’s take a look at the solution suggested by our Support Team.

Dealing with VpcPeeringConnection failed to stabilize

The VpcPeeringConnection failed to stabilize error is a common error when dealing with AWS. It often appears when you attempt to create an Amazon VPC peering connection between a requester VPC and an accepter VPC.

Some of the commonly seen reasons behind this error include:

• The AWS::EC2::VPCPeeringConnection was created through an accepter account.
• The IAM role in the accepter account does not have the required permissions.
• PeerRoleArn property has not passed correctly while creating the VPC peering connection among the VPCs in different accounts.
• The PeerRegion property is not passed correctly during VPC peering connection creation among the VPCs in different AWS Regions.
• The IPv4 CIDR ranges overlap.

How do I fix VpcPeeringConnection failed to stabilize error?

Solution 1: AWS::EC2::VPCPeeringConnection resource created in the accepter account
Our Support Engineers recommend creating AWS::EC2::VPCPeeringConnection resource in the requester account rather than the accepter account. This will resolve the error.

Solution 2: IAM role in the accepter account does not have permissions
We will include the following permissions to enable the IAM role to accept the VPC peering connection in the accepter account:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": "ec2:AcceptVpcPeeringConnection",
            "Resource": "arn:${Partition}:ec2:${Region}:${Account}:vpc-peering-connection/${VpcPeeringConnectionId}",
            "Effect": "Allow"
        }
    ]
}

 

We will also have to configure a trust relationship for the IAM role to allow the requester account to accept the IAM role. For instance:

{ "Version": "2008-10-17", 
"Statement": [
     { 
	"Effect": "Allow",
 	"Principal": { "AWS": "arn:aws:iam::Requester-Account-ID:root"	}, 
	"Action": "sts:AssumeRole" 
     } 
  ] 
 }

 

Solution 3: PeerRoleArn property not passed correctly when creating a VPC peering connection among VPCs in different accounts
The PeerRoleArn property passes the cross-account IAM role from the accepter account in the AWS CloudFormation template.

If this property is not passed correctly, you will wind up with “VpcPeeringConnection failed to stabilize” error.

For instance, in JSON:

{
    "myVPCPeeringConnection": {
        "Type": "AWS::EC2::VPCPeeringConnection",
        "Properties": {
            ......
            "PeerRoleArn": "arn:aws:iam::Accepter-Account-ID:role/PeerRole"
        }
    }
}

 

For instance,  in YAML:

myVPCPeeringConnection: 
Type: 'AWS::EC2::VPCPeeringConnection' 
Properties: 
....... PeerRoleArn: 'arn:aws:iam::Accepter-Account-ID:role/PeerRole'

Solution 4: PeerRegion property not passed correctly while creating VPC peering connection among VPCs in different AWS Regions

Here, we will include the PeerRegion property in the AWS CloudFormation template if the VPCs are in different AWS Regions. Our Support Engineers then suggest specifying the AWS Region of the accepter account VPC as seen in the example below:

In JSON:

{
    "myVPCPeeringConnection": {
        "Type": "AWS::EC2::VPCPeeringConnection",
        "Properties": {
            ......
            "PeerRegion": Accepter-VPC-Region-Code
        }
    }
}

In YAML:

myVPCPeeringConnection: 
Type: 'AWS::EC2::VPCPeeringConnection' 
Properties: 
...... PeerRegion: Accepter-VPC-Region-Code

Solution 5: IPv4 CIDR ranges overlap
Using different Ipv4 CIDR blocks for the VPCs in the accepter account as well as the requester account will resolve the error.

Based on the cause behind the error message, one of these solutions from our Support Techs is bound to resolve the error.

[Have more AWS related queries? We are here at your service.]

Conclusion

At the end of the day, we learned about different ways to resolve the “VpcPeeringConnection failed to stabilize” error in AWS CloudFormation. The skilled Support Engineers at Bobcares also demonstrated how the reasons behind the error, making it easier to decide which solution to try out.