View a markdown version of this page

Modify a policy table entry in AWS Transit Gateway - Amazon VPC

Modify a policy table entry in AWS Transit Gateway

ModifyTransitGatewayPolicyTableEntry is a PATCH-style update. Only the fields you explicitly include in the request are modified. Fields you omit are left unchanged. They are not reset to Any (*).

Important

To change a field back to match any value (Any), you must explicitly pass * for that field. Omitting the field has no effect on its current value. For example, if a rule has "SourceCidrBlock": "10.0.0.0/16" and you want it to match any source IP, you must pass "SourceCidrBlock": "*". Omitting SourceCidrBlock leaves the 10.0.0.0/16 restriction in place.

At least one of --target-route-table-id or --policy-rule must be included in the request.

To modify a policy table entry using the console

  1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/.

  2. In the navigation pane, under Transit Gateways, choose Transit Gateway Policy Tables.

  3. In Transit Gateway Policy Tables, select the policy table.

  4. Choose the Entries tab.

  5. Select the entry you want to modify. System entries (rule number *) are read-only and cannot be selected for editing.

  6. Choose Modify entry.

  7. The Rule number is displayed as read-only — it identifies the entry and cannot be changed. To change a rule number, delete the entry and recreate it with the new number.

  8. Update only the fields you want to change. All other fields are pre-populated with current values. CIDR fields provide an autosuggest dropdown with common prefixes.

    1. To reset a field to Any (match any), clear the field — the console substitutes * for any empty field. Leaving it as-is retains the current value.

  9. Choose Save changes.

The console returns the fully merged entry, reflecting both updated and retained field values.

To modify a policy table entry using the AWS CLI

Use the modify-transit-gateway-policy-table-entry command.

aws ec2 modify-transit-gateway-policy-table-entry \
    --transit-gateway-policy-table-id tgw-ptb-0ca78a549EXAMPLE \
    --policy-rule-number 100 \
    --policy-rule '{"SourceCidrBlock":"11.0.0.0/16","Protocol":"17"}' \
    --target-route-table-id tgw-rtb-0a823edbdeEXAMPLE

The response returns the fully merged entry. Only SourceCidrBlock, Protocol, and TargetRouteTableId were updated — SourcePortRange, DestinationCidrBlock, and DestinationPortRange retain their previous values unchanged:

{
    "TransitGatewayPolicyTableEntry": {
        "PolicyRuleNumber": "100",
        "PolicyRule": {
            "SourceCidrBlock": "11.0.0.0/16",
            "SourcePortRange": "1024-65535",
            "DestinationCidrBlock": "192.168.0.0/16",
            "DestinationPortRange": "443",
            "Protocol": "17"
        },
        "TargetRouteTableId": "tgw-rtb-0a823edbdeEXAMPLE",
        "State": "active"
    }
}
Example: Reset a field to Any (match any)

To remove the destination port restriction set in the example above and allow any destination port, explicitly pass * for DestinationPortRange. Omitting the field would leave 443 in place.

aws ec2 modify-transit-gateway-policy-table-entry \
    --transit-gateway-policy-table-id tgw-ptb-0ca78a549EXAMPLE \
    --policy-rule-number 100 \
    --policy-rule '{"DestinationPortRange":"*"}'
{
    "TransitGatewayPolicyTableEntry": {
        "PolicyRuleNumber": "100",
        "PolicyRule": {
            "SourceCidrBlock": "11.0.0.0/16",
            "SourcePortRange": "1024-65535",
            "DestinationCidrBlock": "192.168.0.0/16",
            "DestinationPortRange": "*",
            "Protocol": "17"
        },
        "TargetRouteTableId": "tgw-rtb-0a823edbdeEXAMPLE",
        "State": "active"
    }
}