Multiple failed during deployment using the solution launch

[rsiripan]

I have attempted to deploy the solution several times. Most of the time, it appears that the OpenSearchStack is taking too long to deploy. On a few occasions, the deployment failed at the SearchResolversStack, specifically during the creation of the OpenSearchSetupFunction and the SearchApiAppSyncFunction. Additionally, I encountered a create_failed error at the GremlinResolversStack.

Do you have any recommendations to overcome this issue? I have already increased the timeout to 180 at the Stack creation options, but this hasn’t resolved the problem. Should I amend the timeout directly in the CloudFormation template for the OpenSearchStack?

[svozza]

Are you attempting to deploy this to an existing VPC? I'm guessing you're seeing an error like the following:

Embedded stack arn:aws:cloudformation:<region>::stack/<stack-name>-SearchResolversStack-<ID-string>7/<guid> was not successfully created: Stack creation time exceeded the specified timeout.

The reason for this is that private subnets provided as CloudFormation parameters do not have the ability to route to S3. The SearchResolversStack stack has a custom resource that creates an index in the OpenSearch cluster. This custom resource runs in the same VPC as the cluster. Custom resources must write the result of their execution to an S3 bucket owned by the CloudFormation team and if there is no route to S3 they will time out. There are generally two reasons for this:

• The private subnets do not have NAT gateways associated with them so there is no access to the internet
• The VPC intentionally does not have NAT gateways but does not have an S3 gateway endpoint or the gateway endpoint is not configured correctly

Resolution:

• Provision NAT gateways for both private subnets, either using CloudFormation or the AWS CLI as per the documentation.

or

• Ensure that S3 endpoint has been provisioned and ensure the route tables for the subnets have been updated for the S3 VPC endpoint as documented here

Also note that if your VPC will not have a NAT gateway, for the solution to function properly after deployment you must ensure that you have VPC endpoints for all the AWS services listed in the AWS APIs section of the documentation.

The VPC requirements are fully documented in the implementation guide.

[rsiripan]

Due to company security restrictions, we need to deploy in an existing private VPC. Thank you for the hint; I will ensure it reaches either through a VPC endpoint or NAT gateway.

Regarding the S3 bucket created by the stack, does it default to “Block all public access” mode, or is public access enabled? Thank you.

[svozza]

Block all public access is the default setting when creating S3 buckets so you're fine there.

[rsiripan]

Thank you