[VMC on AWS] CloudFormation Stack Creation Fails While Attempting to Deploy New SDDC

Products

• VMware Cloud on AWS

Issue/Introduction

To detail the AWS-level Service Control Policies (SCP) which could prevent VMC from successfully creating a CloudFormation stack in the specified AWS region.

Symptoms:
When trying to link an AWS account to a new VMC SDDC upon creation, the following error appears:
"HTTP Error 500: - An internal error has occurred. We could not load your AWS VPCs and subnets, please try again"

Cause

A Service Control Policies (SCP) in the AWS account is denying communication between AWS regions which will prevent the CloudFormation template from deploying properly in AWS.

Resolution

Disable any SCPs from the AWS account preventing communications across AWS regions while deploying the SDDC. Such SCPs can be re-enabled after the SDDC has been linked to an AWS account and deployed successfully.

Workaround:
Deploy a single node SDDC, and skip linking to AWS temporarily. If the SDDC is scaled-up to 2+ nodes, an AWS Account Link will be required. Single Node SDDCs expire after 60 days time.