将子网修改为 VPC 终端节点

Question

I recently turned my two AWS public subnets into private subnets and added a public subnet that's got a NAT gateway. The private subnet routing table routs traffic to the NAT gateway and the public one routs it to the Internet Gateway. However, it isn't working and I don't get response to my API calls.

I think this is due to the fact that my VPC endpoint has the two private subnets associated with it instead of the public subnet. I tried to change the associated private subnets to the public one but got the AWS error:

Error modifying subnets
Can't change subnets of a requester-managed endpoint for the service ...

What would be the way to get around this error and add my public subnet to the VPC endpoint?

Additional info: Each private subnet has an EC2 auto-scaling group instance and a serverless aurora DB instance in it.

Cheers, Kris

Answer 1

I also had this annoying problem. The error messages are not really helpful here. They do not reveal which service exactly created those interfaces. So I went to Cloudtrail, listed all events, and searched for the VPC Endpoint name (vpce-1234567890xxx) that refused to be deleted to find out who created it. In my case, it turned out to be the RDS proxy service. So I went to RDS and deleted the proxy.

Answer 2

Since it is requester-managed VPC endpoint :

You cannot modify or detach a requester-managed network interface.

This means that you have to delete the resource that created the endpoint in the first place:

If you delete the resource that the network interface represents, the AWS service detaches and deletes the network interface for you.