Cloudformation error: route table X and network gateway Y belong to different networks

Question

I have the following network ELB networking resources config, in order to route outbound traffic through a single elastic ip.

I get the following error:

"AWS::EC2::Route PublicRoute CREATE_FAILED: route table rtb-zzzeb and network gateway igw-xxx belong to different networks"

What does this mean exactly in the context of my below configuration? Is there an issue with my resource labelled "PublicRoute"?

Resources:
  VPC:
      Type: AWS::EC2::VPC
      Properties:
        CidrBlock: "10.0.0.0/24"
  Public1aSBN:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: "10.0.0.128/27"
      AvailabilityZone: "eu-west-2a"
  Public1cSBN:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: "10.0.0.160/27"
      AvailabilityZone: "eu-west-2c"
  Public1bSBN:
      Type: AWS::EC2::Subnet
      Properties:
        VpcId: !Ref VPC
        CidrBlock: "10.0.0.192/27"
        AvailabilityZone: "eu-west-2b"
  InternetGateway:
    Type: "AWS::EC2::InternetGateway"
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
  EIPNatGateway:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
  NAT:
    DependsOn: EIPNatGateway
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId:
        Fn::GetAtt:
        - EIPNatGateway
        - AllocationId
      SubnetId: !Ref Public1aSBN
  RouteTablePublic:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
  Public1aSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref Public1aSBN
      RouteTableId: !Ref RouteTablePublic
  Public1cSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref Public1cSBN
      RouteTableId: !Ref RouteTablePublic
  Public1bSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref Public1bSBN
      RouteTableId: !Ref RouteTablePublic
  PublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGateway
    Properties:
      RouteTableId: !Ref RouteTablePublic
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  TargetSG:
    Type: AWS::EC2::SecurityGroup
    Properties:
      VpcId: !Ref VPC
  InboundRule:
    Type: AWS::EC2::SecurityGroupIngress
    DependsOn: TargetSG
    Properties:
      IpProtocol: -1
      FromPort: '0'
      ToPort: '65535'
      CidrIp: "0.0.0.0/0"
      GroupId:
        Fn::GetAtt:
          - TargetSG
          - GroupId

Answer 1

According to the docs,

Some resources in a VPC require a gateway (either an Internet or VPN gateway). If your AWS CloudFormation template defines a VPC, a gateway, and a gateway attachment, any resources that require the gateway are dependent on the gateway attachment.

This means you have to add your AttachGateway to the DependsOn attribute of your PublicRoute resource:

PublicRoute:
  Type: AWS::EC2::Route
  DependsOn: 
    - InternetGateway
    - AttachGateway
  Properties:
    RouteTableId: !Ref RouteTablePublic
    DestinationCidrBlock: 0.0.0.0/0
    GatewayId: !Ref InternetGateway

This ensures that your resources are built in the proper order so your route won't be created until the gateway has been attached to the vpc

Answer 2

You will get this error if the route table and Internet gateway are in different VPCs.