aws / aws/aws-cdk

vpc: when `natGateways` Inconsistent Route Table Configuration for Private Subnets in VPC with Multiple NAT Gateways

Open
#30,643 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-ec2 bug effort/small p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When creating a VPC with multiple NAT Gateways using the AWS CDK, the automatic route table configuration for private subnets does not consistently assign routes for internet access (0.0.0.0/0) to the corresponding NAT Gateways.

### Expected Behavior

All private subnets should have a route (0.0.0.0/0) pointing to their corresponding NAT Gateway

### Current Behavior

Only one of the private subnets had the correct route to the NAT Gateway. The other private subnets lacked this route, causing connectivity issues.

![image](https://github.com/aws/aws-cdk/assets/74988/db12e208-21a2-4c0c-8418-80d297f978bf)

![image](https://github.com/aws/aws-cdk/assets/74988/c6758aa3-76c4-41b1-a0b5-bc67e16e5817)

### Reproduction Steps

Define a VPC with multiple private and public subnets.
Configure the VPC to use multiple NAT Gateways (one per AZ) with property `natGateways`
Deploy the stack.
Here is the relevant CDK code used to create the VPC:

```typescript
import * as cdk from 'aws-cdk-lib';
import { Vpc, SubnetType, IpAddresses } from 'aws-cdk-lib/aws-ec2';
import { Construct } from 'constructs';
import { ExtendedStackProps } from '../constants';

export class VPCStack extends cdk.Stack {
constructor(scope: Construct, id: string, props: ExtendedStackProps) {
super(scope, id, props);

new Vpc(this, props.envConfig.BackendVpc.name, {
ipAddresses: IpAddresses.cidr(props.envConfig.BackendVpc.cidr),
maxAzs: props.envConfig.BackendVpc.maxAzs,
natGateways: props.envConfig.BackendVpc.natGateways,
subnetConfiguration: [
{
cidrMask: props.envConfig.BackendVpc.publicSubnetMask,
name: 'pab-public',
subnetType: SubnetType.PUBLIC,
},
{
cidrMask: props.envConfig.BackendVpc.privateSubnetMask,
name: 'pab-private',
subnetType: SubnetType.PRIVATE_WITH_EGRESS,
},
],
});
}
}
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.144.0 (build 5fb15bc)

### Framework Version

_No response_

### Node.js Version

Node.js v20.14.0

### OS

Linux avril 6.5.0-41-generic #41-Ubuntu SMP PREEMPT_DYNAMIC Mon May 20 15:55:15 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the reproduced Vpc configuration using multiple natGateways and private subnets, then deploy or synthesize it to inspect the generated route tables. Trace the CDK Vpc subnet and NAT Gateway configuration to determine why routes differ between private subnets. Done means every private subnet has a 0.0.0.0/0 route to its corresponding NAT Gateway, with coverage for multiple Availability Zones.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.