Deployment of Network Firewall and Resource Sharing in YAML Configuration

[klucmally]

Summary:
Deployment does not properly provision Network Firewall resources and other cross-account resources using shareTargets, causing resources to be missing in specific accounts or regions.

Steps to Reproduce:

Configure the AWS Accelerator deployment with a YAML file specifying:
transitGateways with shareTargets for cross-account sharing.
networkFirewall policies and rules configured with shareTargets.
VPCs and subnets within a transit VPC for network inspection.
Additional centralNetworkServices and gatewayLoadBalancers.
Run the deployment in AWS CodeBuild.
Observe deployment logs for successful execution or differences between expected and deployed resources.

Expected Behavior:
All specified resources, including the network firewall, gateway load balancers, transit gateways, and associated route tables, should be deployed and configured according to the YAML file.
shareTargets should allow resources to be accessible across specified organizational units and accounts without deployment errors.

Actual Behavior:
Deployment completes without critical errors, but network firewall , gatewayLoadBalancers resources and some cross-account sharing configurations do not appear in the expected accounts.

Any insights into dependencies or order-of-declaration requirements for shareTargets and cross-account network resources would be helpful.

homeRegion: &HOME_REGION us-west-2
defaultVpc:
delete: false
excludeAccounts: []
transitGateways:

• name: Transit-Main
  account: Transit
  region: *HOME_REGION
  shareTargets:
  organizationalUnits:
  - Infrastructure
  asn: 65521
  dnsSupport: enable
  vpnEcmpSupport: enable
  defaultRouteTableAssociation: disable
  defaultRouteTablePropagation: disable
  autoAcceptSharingAttachments: enable
  routeTables:
  • name: Transit-Main-Core
    routes: []
  • name: Transit-Main-Segregated
    routes: []
  • name: Transit-Main-Shared
    routes: []
  • name: Transit-Main-Standalone
    routes: []
    endpointPolicies:
• name: Default
  document: vpc-endpoint-policies/default.json
  vpcs:
• name: Transit-Inspection-Vpc
  account: Transit
  region: *HOME_REGION
  cidrs:
  • 10.10.0.0/24
    routeTables:
  • name: Transit-Inspection-GwlbEndpoint-A
    routes: []
  • name: Transit-Inspection-GwlbEndpoint-B
    routes: []
  • name: Transit-Inspection-TgwAttach-A
    routes: []
  • name: Transit-Inspection-TgwAttach-B
    routes: []
  • name: Transit-Inspection-Firewall-A
    routes:
    • name: TgwRoute
      destination: 0.0.0.0/0
      type: transitGateway
      target: Transit-Main
  • name: Transit-Inspection-Firewall-B
    routes:
    • name: TgwRoute
      destination: 0.0.0.0/0
      type: transitGateway
      target: Transit-Main
      subnets:
  • name: Transit-Inspection-Firewall-A
    availabilityZone: a
    routeTable: Transit-Inspection-Firewall-A
    ipv4CidrBlock: 10.10.0.0/28
  • name: Transit-Inspection-Firewall-B
    availabilityZone: b
    routeTable: Transit-Inspection-Firewall-B
    ipv4CidrBlock: 10.10.0.16/28
  • name: Transit-Inspection-TgwAttach-A
    availabilityZone: a
    routeTable: Transit-Inspection-TgwAttach-A
    ipv4CidrBlock: 10.10.0.32/28
  • name: Transit-Inspection-TgwAttach-B
    availabilityZone: b
    routeTable: Transit-Inspection-TgwAttach-B
    ipv4CidrBlock: 10.10.0.48/28
  • name: Transit-Inspection-GwlbEndpoint-A
    availabilityZone: a
    routeTable: Transit-Inspection-GwlbEndpoint-A
    ipv4CidrBlock: 10.10.0.64/28
  • name: Transit-Inspection-GwlbEndpoint-B
    availabilityZone: b
    routeTable: Transit-Inspection-GwlbEndpoint-B
    ipv4CidrBlock: 10.10.0.80/28
    transitGatewayAttachments:
  • name: Transit-Inspection
    transitGateway:
    name: Transit-Main
    account: Transit
    options:
    applianceModeSupport: enable
    routeTableAssociations:
    • Transit-Main-Shared
      routeTablePropagations:
    • Transit-Main-Core
    • Transit-Main-Shared
    • Transit-Main-Segregated
      subnets:
    • Transit-Inspection-TgwAttach-A
    • Transit-Inspection-TgwAttach-B
      gatewayLoadBalancers:
• name: Transit-Gwlb
  subnets:
  • Transit-Inspection-GwlbEndpoint-A
  • Transit-Inspection-GwlbEndpoint-B
    vpc: Transit-Inspection-Vpc
    deletionProtection: true
    endpoints:
  • name: Transit-Gwlb-Endpoint-A
    account: Transit
    subnet: Transit-Inspection-GwlbEndpoint-A
    vpc: Transit-Inspection-Vpc
  • name: Transit-Gwlb-Endpoint-B
    account: Transit
    subnet: Transit-Inspection-GwlbEndpoint-B
    vpc: Transit-Inspection-Vpc
    centralNetworkServices:
    delegatedAdminAccount: Transit
    networkFirewall:
    firewalls:
  • name: Transit-Inspection-FwEndpoint
    description: Firewall Endpoint for traffic inspection in the transit account
    firewallPolicy: Transit-Inspection-FwPolicy
    subnets:
    • Transit-Inspection-Firewall-A
    • Transit-Inspection-Firewall-B
      vpc: Transit-Inspection-Vpc
      tags: []
      policies:
  • name: Transit-Inspection-FwPolicy
    description: Firewall Policy for the transit inspection network firewall
    firewallPolicy:
    statelessDefaultActions: ['aws:forward_to_sfe']
    statelessFragmentDefaultActions: ['aws:forward_to_sfe']
    statefulDefaultActions:
    - 'aws:alert_strict'
    - 'aws:alert_established'
    statefulRuleGroups:
    - name: Transit-Inspection-Fw-Stateful-Group
    priority: 100
    rules:
  • name: Transit-Inspection-Fw-Stateful-Group
    regions:
    • *HOME_REGION
      capacity: 1300
      type: STATEFUL
      ruleGroup:
      rulesSource:
      rulesFile: firewall-rules/rules.txt
      shareTargets:
      organizationalUnits:
      • Infrastructure