aws / aws/aws-cdk

(aws-ec2): NAT Gateway error while CIDR replacement in VPC

Open
#16,869 12 comments 4 reactions 0 assignees View on GitHub
@aws-cdk/aws-ec2 blocked bug effort/small needs-cfn p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### What is the problem?

NAT Gateway not attached while CIDR changed and causing CloudFormation stack update failed.

> Failed resources:
UPDATE_FAILED | AWS::EC2::NatGateway | vpc/publicSubnet1/NATGateway (vpcpublicSubnet1NATGateway) NatGateway nat-xxxxxxxx is in state failed and hence failed to stabilize. Detailed failure message: Network vpc-xxxxxx has no Internet gateway attached

### Reproduction Steps

replace the CIDR with something else like 10.20.0.0/16 then run deploy will trigger this issue.

```
const cidr = '10.10.0.0/16';
this.vpc = new ec2.Vpc(this, 'vpc', {
cidr: cidr,
enableDnsHostnames: true,
enableDnsSupport: true,
maxAzs: 2,
natGateways: 1,
flowLogs: {
FlowLog: {
destination: ec2.FlowLogDestination.toS3(s3Bucket),
},
},
subnetConfiguration: [
{
name: 'public',
subnetType: ec2.SubnetType.PUBLIC,
cidrMask: 24,
},
{
name: 'private',
subnetType: ec2.SubnetType.PRIVATE_WITH_NAT,
cidrMask: 24,
},
],
});
```

### What did you expect to happen?

This should creating a new NAT Gateway and switch from old resource to the new one.

### What actually happened?

the following error message.

> Failed resources:
UPDATE_FAILED | AWS::EC2::NatGateway | vpc/publicSubnet1/NATGateway (vpcpublicSubnet1NATGateway) NatGateway nat-xxxxxxxx is in state failed and hence failed to stabilize. Detailed failure message: Network vpc-xxxxxx has no Internet gateway attached

### CDK CLI Version

1.53.0 (build 6c326cb)

### Framework Version

_No response_

### Node.js Version

v15.13.0

### OS

MacOS 10.14.6

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the TypeScript ec2.Vpc construct and its public-subnet NAT Gateway configuration, then reproduce the CIDR replacement deployment described in the issue. Done means the update creates and switches to a new NAT Gateway without failing because the VPC lacks an Internet Gateway.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.