vpc: when `natGateways` Inconsistent Route Table Configuration for Private Subnets in VPC with Multiple NAT Gateways
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
When creating a VPC with multiple NAT Gateways using the AWS CDK, the automatic route table configuration for private subnets does not consistently assign routes for internet access (0.0.0.0/0) to the corresponding NAT Gateways.
### Expected Behavior
All private subnets should have a route (0.0.0.0/0) pointing to their corresponding NAT Gateway
### Current Behavior
Only one of the private subnets had the correct route to the NAT Gateway. The other private subnets lacked this route, causing connectivity issues.


### Reproduction Steps
Define a VPC with multiple private and public subnets.
Configure the VPC to use multiple NAT Gateways (one per AZ) with property `natGateways`
Deploy the stack.
Here is the relevant CDK code used to create the VPC:
```typescript
import * as cdk from 'aws-cdk-lib';
import { Vpc, SubnetType, IpAddresses } from 'aws-cdk-lib/aws-ec2';
import { Construct } from 'constructs';
import { ExtendedStackProps } from '../constants';
export class VPCStack extends cdk.Stack {
constructor(scope: Construct, id: string, props: ExtendedStackProps) {
super(scope, id, props);
new Vpc(this, props.envConfig.BackendVpc.name, {
ipAddresses: IpAddresses.cidr(props.envConfig.BackendVpc.cidr),
maxAzs: props.envConfig.BackendVpc.maxAzs,
natGateways: props.envConfig.BackendVpc.natGateways,
subnetConfiguration: [
{
cidrMask: props.envConfig.BackendVpc.publicSubnetMask,
name: 'pab-public',
subnetType: SubnetType.PUBLIC,
},
{
cidrMask: props.envConfig.BackendVpc.privateSubnetMask,
name: 'pab-private',
subnetType: SubnetType.PRIVATE_WITH_EGRESS,
},
],
});
}
}
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.144.0 (build 5fb15bc)
### Framework Version
_No response_
### Node.js Version
Node.js v20.14.0
### OS
Linux avril 6.5.0-41-generic #41-Ubuntu SMP PREEMPT_DYNAMIC Mon May 20 15:55:15 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
### Language
TypeScript
### Language Version
_No response_
### Other information
_No response_
Contributor guide
Research direction
Start with the reproduced Vpc configuration using multiple natGateways and private subnets, then deploy or synthesize it to inspect the generated route tables. Trace the CDK Vpc subnet and NAT Gateway configuration to determine why routes differ between private subnets. Done means every private subnet has a 0.0.0.0/0 route to its corresponding NAT Gateway, with coverage for multiple Availability Zones.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100