aws / aws/aws-cdk

(aws-cdk-lib/aws-ec2): Misleading error "There are no <SubnetType> subnet groups in this VPC. Available types:" when no availability zones are provided

Open
#32,451 2 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-ec2 bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When one uses the `ec2.Vpc` construct and supplies an empty list of `availabilityZones`, this results in no subnets actually being created in the VPC due to the loop [here](https://github.com/aws/aws-cdk/blob/06cdaacbd3385df51e4632aa8d943ce647855e82/packages/aws-cdk-lib/aws-ec2/lib/vpc.ts#L1749-L1754). If one then tries to create a VPC Endpoint or NAT Gateway in one of the VPCs they have configured, they will get an error such as `There are no 'Private' subnet groups in this VPC. Available types:`, which can be a bit confusing since there were private subnets configured (but they didn't end up being created).

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

When someone provides an empty availabilityZones list along with a subnet configuration, this should probably result in an error being thrown since this is a nonsensical configuration, which may lead to either missing subnets or misleading errors in further infra configuration down the line.

### Current Behavior

The nonsensical configuration is silently accepted and leads to CDK not acting on the customer's configured subnets, or a different misleading error when later trying to create things in one of these subnets.

### Reproduction Steps

The following VPC construct reproduces the error:

```
new ec2.Vpc(this, 'VPC', {
vpcName: 'Test VPC',
ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
defaultInstanceTenancy: ec2.DefaultInstanceTenancy.DEFAULT,
availabilityZones: [],
enableDnsHostnames: true,
enableDnsSupport: true,
subnetConfiguration: [
{
cidrMask: 24,
name: 'public',
subnetType: SubnetType.PUBLIC,
},
{
cidrMask: 24,
name: 'private',
subnetType: SubnetType.PRIVATE_WITH_EGRESS,
},
],
gatewayEndpoints: {
S3: {
service: ec2.GatewayVpcEndpointAwsService.S3,
subnets: [{ subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS }, { subnetType: ec2.SubnetType.PUBLIC }],
},
},
});
```

In this case providing `availabilityZones: [],` is explicit and is a clear bug, but the issue is not caught at that point in the construct initialization. Rather it is raised later when trying to create the requested S3 gateway endpoint.

In reality, the code which this example was extracted from retrieves the availability zones to use dynamically, which obscures the real issue from being this obvious.

### Possible Solution

Add validation to throw an error when a `Vpc` is initialized with an empty `availabilityZones` list

### Additional Information/Context

_No response_

### CDK CLI Version

2.171.1 (build a95560c)

### Framework Version

_No response_

### Node.js Version

18.x

### OS

MacOS Sonoma 14.7 (23H124)

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in packages/aws-cdk-lib/aws-ec2/lib/vpc.ts at the availability-zone subnet creation loop linked in the issue, then inspect Vpc initialization and its validation paths. Reproduce the empty availabilityZones configuration with the supplied VPC example; done means the Vpc rejects an empty list during initialization instead of silently omitting subnets and failing later with a misleading endpoint error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.