Solve: Diagnose Broken TGW Attachments in AWS with One Shell Script

Solve: Diagnose Broken TGW Attachments in AWS with One Shell Script

Sometimes the best tools aren’t born in a lab. They’re born in the wild—when a smart cloud engineer runs into something weird, digs deep, and asks the right questions.

That’s what happened this week when a developer noticed that their Transit Gateway (TGW) attachment was stuck in a pendingAcceptance state, but there was no way to accept it. Stranger still, the TGW route table linked to that attachment appeared to have been deleted, even though old attachments still referenced it.

After some careful CLI digging, the root cause became clear: the TGW route table had been owned by a central network account. When that table was deleted—without corresponding cleanup in the spoke account—the attachments became stranded. Adding to the confusion, the service-linked role for TGW had also been considered for deletion, which could have made matters worse.

So we built a tool: tgw_check.sh. It’s a guided CLI diagnostic utility designed to help cloud engineers trace TGW attachment issues step by step—with safe commands, clear output, and session logging.

What the Tool Does

This simple shell script walks through five core diagnostics:

1. Check TGW ownership
2. List TGW route tables (see if one’s missing or deleted)
3. Inspect TGW attachments and find pendingAcceptance cases
4. Create and associate a new route table
5. Run all diagnostics and log everything to a timestamped file

Let’s look at what each step returns—simulated for clarity.

Step 1: Check TGW Ownership 

Bash

+------------------------+------------------+-------------+
|          ID            |      Owner       |    State    |
+------------------------+------------------+-------------+
| tgw-0abc1234def56789   | 123456789012     | available   |
+------------------------+------------------+-------------+   

This tells you who really owns the TGW. You can only manage attachments and route tables from that account.

Step 2: List TGW Route Tables

Bash

+------------------------------+------------+
|             ID               |   State    |
+------------------------------+------------+
| tgw-rtb-0abc1234def567890    | available  |
| tgw-rtb-0xyz9876fed543210    | deleted    |
+------------------------------+------------+   

This shows if the route table your attachments reference has been deleted or is still active.

Step 3: Inspect TGW Attachments

Bash

+-------------------------+--------------------+--------+---------------------+
|           ID            |       State        |  Type  |         TGW         |
+-------------------------+--------------------+--------+---------------------+
| tgw-attach-0a1b...g7h   | pendingAcceptance  |  vpc   | tgw-0abc1234def...  |
| tgw-attach-1x2y...92q   | available          |  vpc   | tgw-0abc1234def...  |
+-------------------------+--------------------+--------+---------------------+   

If pendingAcceptance appears, you’ll need to switch to the owning account to accept those attachments—or fix the route table.

Step 4: Create and Associate a New Route Table

Bash

Created route table: tgw-rtb-0abc1234def567890  
Association and propagation complete.

This generates a clean TGW route table, links it to the attachment, and enables propagation.

Step 5: Run Full Diagnostic 

Bash

✔️ TGW ownership confirmed
✔️ Route table states checked
✔️ Attachments inspected for pending status
📁 Session log saved to: tgw_check_session_20250509_144700.log   

Everything in one go—with a clean, timestamped log you can copy into Slack, attach to a ticket, or paste in an re:Post question.

Why We Built This

Not every engineer has full visibility across multiple AWS accounts. That’s especially true in larger orgs where infrastructure is centrally managed, but development work is happening in spoke accounts.

This tool gives engineers a simple way to answer the big questions quickly:

• Who owns this TGW?
• What happened to my route table?
• Why is this attachment stuck?

And maybe best of all: it shows exactly what’s happening without modifying anything—unless you explicitly choose to create and associate a new route table.

Try the Tool + See the Code

The full tgw_check.sh script is available in this Gist:

👉 Gist: tgw_check Diagnostic Tool

More background on the TGW bug that inspired this tool is here:

👉 Original Blog Post: Solve: When Your Transit Gateway Attachment Stalls

We hope this helps you or someone on your team avoid hours of blind debugging. If you spot something to add, please let us know in a comment on the Gist.

Need AWS Expertise?

We'd love to help you with your AWS projects.  Feel free to reach out to us at info@pacificw.com.

Written by Aaron Rose, software engineer and technology writer at Tech-Reader.blog.