aws / aws/aws-cdk

(aws-cdk-lib/aws-ec2): selectSubnets not handling CloudWAN Subnet correctly

Open
#32,488 7 comments 0 reactions 1 assignee Claimed by @samson-keung View on GitHub
@aws-cdk/aws-ec2 bug effort/small p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

[CloudWAN](https://aws.amazon.com/cloud-wan/) create a global network for VPC, Data Centres, and branch offices.

When configuring VPC to join the network, we create [VPC Attachment](https://docs.aws.amazon.com/network-manager/latest/cloudwan/cloudwan-vpc-attachment.html), then configure Subnet Route Table to direct traffic to the CloudWAN network.

![image](https://github.com/user-attachments/assets/bb3aff61-7a4d-4bf2-8db4-6626ad9732be)

This set up is similar to using TGW, where we create an [attachment](https://docs.aws.amazon.com/vpc/latest/tgw/tgw-vpc-attachments.html) and configure Subnet Route Table.

However, when using the [selectSubnets function](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Vpc.html#selectwbrsubnetsselection) to query subnets from VPC, the ***CloudWAN Subnet*** is being considered as `PRIVATE_ISOLATED `, instead of `PRIVATE_WITH_EGRESS ` which categorizes the ***TGW Subnet***.

Refer to the related source code, it appears that the selectSubnets function does not take `CloudWAN` into consideration, but only `IGW`, `NAT Gateway`, and `TGW`.

```typescript
const subnets: Subnet[] = listedSubnets.map((subnet) => {
let type = getTag('aws-cdk:subnet-type', subnet.Tags);
if (type === undefined && subnet.MapPublicIpOnLaunch) {
type = SubnetType.Public;
}
if (type === undefined && routeTables.hasRouteToIgw(subnet.SubnetId)) {
type = SubnetType.Public;
}
if (type === undefined && routeTables.hasRouteToNatGateway(subnet.SubnetId)) {
type = SubnetType.Private;
}
if (type === undefined && routeTables.hasRouteToTransitGateway(subnet.SubnetId)) {
type = SubnetType.Private;
}
if (type === undefined) {
type = SubnetType.Isolated;
}
...
```
https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk/lib/context-providers/vpcs.ts#L79

Please advice whether this behaviour is expected, or not CloudWAN is missed from the current subnet selection logic.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

Latest, as appeared the main branch

### Expected Behavior

"CloudWAN Subnet" to be categorized as `PRIVATE_WITH_EGRESS`

### Current Behavior

"CloudWAN Subnet" being categorized as `PRIVATE_ISOLATED`

### Reproduction Steps

### Deploy a CloudWAN and Configure a "CloudWAN Subnet"
Here I use Terraform
- CloudWAN
```terraform
resource "aws_networkmanager_global_network" "global_network" {
tags = {
Name = local.name
}
}

resource "aws_networkmanager_core_network" "core_network" {
global_network_id = aws_networkmanager_global_network.global_network.id
}

data "aws_networkmanager_core_network_policy_document" "policy" {
core_network_configuration {
asn_ranges = ["65022-65534"]

edge_locations {
location = local.region
asn = "65500"
}
}

segments {
name = "segment"
}
}
resource "aws_networkmanager_core_network_policy_attachment" "policy" {
core_network_id = aws_networkmanager_core_network.core_network.id
policy_document = data.aws_networkmanager_core_network_policy_document.policy.json
}

resource "aws_networkmanager_vpc_attachment" "attachment" {
core_network_id = aws_networkmanager_core_network.core_network.id
vpc_arn = module.vpc.vpc_arn
subnet_arns = [aws_subnet.cloudwan.arn]

depends_on = [
aws_networkmanager_core_network_policy_attachment.policy
]
}
```
- Subnet
```terraform
resource "aws_subnet" "cloudwan" {
vpc_id = module.vpc.vpc_id
cidr_block = "10.0.103.0/24"
map_public_ip_on_launch = false
tags = {
Name = "${local.name}-cloudwan"
}
}

resource "aws_route_table" "cloudwan-rt" {
vpc_id = module.vpc.vpc_id
}

resource "aws_route_table_association" "cloudwan-rt-assoication" {
route_table_id = aws_route_table.cloudwan-rt.id
subnet_id = aws_subnet.cloudwan.id
}

resource "aws_route" "cloudwan-route" {
route_table_id = aws_route_table.cloudwan-rt.id
destination_cidr_block = "0.0.0.0/0"
core_network_arn = aws_networkmanager_core_network.core_network.arn
}
```

Note that the above created a subnet with ID `subnet-0acf41adc9e62d5e7`

Use AWS CDK to query VPC subnets
```typescript
const vpc = ec2.Vpc.fromLookup(this, "Vpc", {
vpcId: '...'
})

var private_isolated_subnet;
try {
console.log("private_isolated_subnet")

private_isolated_subnet = vpc.selectSubnets({
subnetType: ec2.SubnetType.PRIVATE_ISOLATED
})

console.log(private_isolated_subnet.subnetIds);
} catch (e) {
console.log(e)
}

new cdk.CfnOutput(this, 'PRIVATE_ISOLATED', {
value: JSON.stringify(private_isolated_subnet!.subnetIds)
})
```

Test:
CDK version:
```sh
$ npx cdk version
2.172.0 (build 0f666c5)
```

CDK clear context value
```sh
npx cdk context --clear
```

Run CDK Synthesize to query subnets
```sh
npx cdk synthesize

private_isolated_subnet
[ 'subnet-0acf41adc9e62d5e7' ]
```

As shown above, the subnet-0acf41adc9e62d5e7 is being considered as `PRIVATE_ISOLATED`

### Possible Solution

Implement an additional function in [RouteTable](https://github.com/aws/aws-cdk/blob/c23be8c24457e03001c16d3a8804ab558e62e899/packages/aws-cdk/lib/context-providers/vpcs.ts#L186) class `hasRouteToCloudWAN`, use this function in [readVpcProps](https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk/lib/context-providers/vpcs.ts#L48) to check subnet CloudWAN config, and set subnet type as `SubnetType.Private`.

### Additional Information/Context

_No response_

### CDK CLI Version

2.172.0 (build 0f666c5)

### Framework Version

_No response_

### Node.js Version

v20.11.1

### OS

macOS

### Language

TypeScript

### Language Version

5.3.3

### Other information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.