[VMC] Change the Connected VPC subnet or AWS account of a VMC on AWS SDDC

Products

• VMware Cloud on AWS

Issue/Introduction

This article provides guidance on:

1. Modifying the Subnet associated with the Connected VPC of a VMC on AWS SDDC (Single or Multi AZ) 
2. Change the AWS Account of the SDDC to a new AWS Account (different VPC and subnet)

Environment

VMware Cloud on AWS

Cause

Once a SDDC is deployed, you can’t change the AWS Connected VPC subnet or the AWS Account associated with it from the VMware Cloud Console. You’ll need to engage VMC on AWS SRE to assist with this request.

Resolution

Scenario 1: Modifying the Subnet associated with the Connected VPC of a VMC on AWS SDDC (Single or Multi AZ) 

Contact VMC on AWS support with the following information.

• AWS Account number
• Connected VPC ID
• New Connected VPC Subnet 
• VMC on AWS Organisation ID
• VMC on AWS SDDC ID
• Desired Maintenance Window (Date and Time) for the change

Scenario 2: Change the AWS Account of the SDDC to a new AWS Account (different VPC and subnet)

This is a two-step process which requires you to perform an AWS account re-linking during the SDDC deployment process and invoking the AWS Cloud Formation stack in the new AWS account.

1. Login to VMware Cloud Console
2. Select "VMware Cloud on AWS"
3. Click "CREATE SDDC" button
4. Enter a temporary name in "SDDC Name" field and click "NEXT" button
5. Select "Connect to AWS now" and choose "Connect to a new AWS account"
6. Click "OPEN AWS CONSOLE WITH CLOUDFORMATION TEMPLATE" button
7. Login to AWS console after the page transition
8. Select "I acknowledge that AWS CloudFormation might create IAM resources" and click "Create" button
9. Wait for the stack creation to be completed

     Note: You don't have to create a new SDDC. You can quit the Wizard after the stack creation is completed on the AWS side.

Contact VMC on AWS support with the following information after you have performed the Steps 1-9 under Scenario 2.

• AWS Account numbers (Current and New)
• Connected VPC ID (Current and New)
• New Connected VPC Subnet 
• VMC on AWS Organisation ID
• VMC on AWS SDDC ID
• Desired Maintenance Window (Date and Time) for the change

Notes:

1. The new subnet must be in the same AWS Availability Zone as the current one. In case of Multi-AZ SDDC, provide two Connected VPC Subnets.
2. You can fetch the VMC on AWS Organisation and SDDC details by following the Get Support page.
3. This process requires at least one week advance notice prior to the date of the change and a maintenance window of  minimum 3 hours.

Additional Information

Impacts and Risks

This is a disruptive change and would impact any VM (Management or Workload) that utilises the Connected VPC network path to access native AWS resources inside the Connected VPC (e.g. Amazon RDS, EC2 instances, or S3 endpoints routed through the ENI). 

Local SDDC Traffic should remain unaffected. Workload VMs talking to other workload VMs within the SDDC, and local management infrastructure (like vCenter or NSX Manager interacting within the cluster), would continue to function normally.