LZA: Network Associations Failure

Building on Florian's root cause analysis — this is exactly right, and the reason the standard CloudFormation resource import path doesn't apply here is that LZA manages TGW static routes through a Lambda-backed custom resource (not the native AWS::EC2::TransitGatewayRoute in all cases), which tracks its own composite PhysicalResourceId (route-table-id|CIDR). Resource import only works for native CFN resources, so it's not an option for this kind of drift.

Before removing the route from network-config.yaml, I'd suggest two quick sanity checks:

1. Confirm no dependent resources reference this route table entry — check for TGW route table associations/propagations in your config that might be affected if you temporarily remove the route.
2. Check CloudTrail for the delete event on the route table (DeleteTransitGatewayRoute or similar) to confirm it was a deliberate manual change and not something else deleting it repeatedly (e.g., another automation). If something keeps deleting it, re-adding it via LZA will just drift again.

Once confirmed, Florian's remediation path is correct:

1. Comment out the route from network-config.yaml
2. Deploy — this lets the custom resource's internal state (and the stack) reconcile to "route removed"
3. Re-add the route in the config
4. Deploy again — LZA recreates the route cleanly with a fresh state

Stack is currently UPDATE_ROLLBACK_COMPLETE, which is a stable, updatable state — no need for continue-update-rollback first, you can go straight to the next pipeline run once the config change is committed.

The error you're encountering indicates that the Landing Zone Accelerator pipeline is failing during the Network Associations stack deployment due to a resource conflict. The stack is in UPDATE_ROLLBACK_COMPLETE state, which means a previous update attempt failed and CloudFormation rolled back to the previous stable state.

The specific issue is that CloudFormation believes the Transit Gateway route table resource (tgw-rtb-0fcce89595db4b140|0.0.0.0/0) already exists in the stack, but since you manually deleted it outside of CloudFormation, there's now a mismatch between what CloudFormation expects and the actual state of your AWS resources.

To resolve this issue:

1. Navigate to the AWS CodePipeline console and locate the AWSAccelerator-Pipeline to identify the exact stage that failed.

2. Access the CodeBuild project details by selecting the "Details" link under the failed status indicator, then choose "Link to execution details."

3. Review the Build logs tab for the complete error message and context around the failure.

Since you manually deleted the route table outside of the LZA deployment process, you'll need to either:

• Recreate the manually deleted resource so it matches what CloudFormation expects, or
• Update your LZA configuration files to reflect the current state of your infrastructure

Manual changes to resources managed by Landing Zone Accelerator can cause deployment conflicts. Going forward, any infrastructure changes should be made through the LZA configuration files rather than directly in the AWS console to maintain consistency between your desired state and actual deployed resources.
Sources
Problem: Core pipeline failure - Landing Zone Accelerator on AWS