feat(vpc): additional validation around Subnet Types #4668

rix0rrr · 2019-10-24T13:51:19Z

Try to improve the usability around VPCs and certain Subnet Type
configurations.

Make clear that ISOLATED does not mean "no Internet access at all",
just no Internet access from the point of view of the current VPC.
If people configure natGateways=0, tell them that they probably meant
to configure no PRIVATE subnets.
If people DO configure PRIVATE subnets, make sure they also configure
PUBLIC subnets, otherwise we won't be able to place the NAT gateways
anywhere useful.
If people end up with a VPC without PRIVATE subnets, the default
behavior of selectSubnets is pretty useless, because it can never
work, and that's not what people are used to from the CDK. Dynamically
adjust the selection default to whatever subnet types are available.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

Try to improve the usability around VPCs and certain Subnet Type configurations. - Make clear that ISOLATED does not mean "no Internet access at all", just no Internet access from the point of view of the current VPC. - If people configure natGateways=0, tell them that they probably meant to configure no PRIVATE subnets. - If people DO configure PRIVATE subnets, make sure they also configure PUBLIC subnets, otherwise we won't be able to place the NAT gateways anywhere useful. - If people end up with a VPC without PRIVATE subnets, the default behavior of `selectSubnets` is pretty useless, because it can never work, and that's not what people are used to from the CDK. Dynamically adjust the selection default to whatever subnet types *are* available. Fixes #3704.

mergify · 2019-10-24T13:51:58Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

aws-cdk-automation · 2019-10-24T14:38:30Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

RomainMuller · 2019-10-25T08:46:57Z

packages/@aws-cdk/aws-ec2/lib/vpc.ts

@@ -166,7 +165,7 @@ export interface SubnetSelection {
   *
   * At most one of `subnetType` and `subnetGroupName` can be supplied.
   *
-   * @default SubnetType.PRIVATE
+   * @default SubnetType.PRIVATE (or ISOLATED or PUBLIC if there are no PRIVATE subnets)


I'm not sure this description of @default is super clear... ISOLATED or PUBLIC? I don't think this is a valid value... Do you mean whichever value resolves to a subnet first in that order?

I do mean that. I can come up with a description of that behavior that is super technically correct ("The first one out of PRIVATE, ISOLATED, PUBLIC that has subnets of that type configured"), but not one that's easy to read.

Yes, @rix0rrr I like you proposed change (and the value should be -). It should be something like:

/** * @default - the default subnet type will be the first available type in the following order: PRIVATE, ISOLATE, PUBLIC */ Something like that.

…t-types

aws-cdk-automation · 2019-10-25T12:26:30Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

eladb · 2019-10-27T14:45:05Z

packages/@aws-cdk/aws-ec2/lib/vpc.ts

@@ -166,7 +165,7 @@ export interface SubnetSelection {
   *
   * At most one of `subnetType` and `subnetGroupName` can be supplied.
   *
-   * @default SubnetType.PRIVATE
+   * @default SubnetType.PRIVATE (or ISOLATED or PUBLIC if there are no PRIVATE subnets)


Yes, @rix0rrr I like you proposed change (and the value should be -). It should be something like:

/** * @default - the default subnet type will be the first available type in the following order: PRIVATE, ISOLATE, PUBLIC */ Something like that.

eladb · 2019-10-27T14:45:50Z

packages/@aws-cdk/aws-ec2/test/test.vpc.ts

+        new Vpc(stack, 'VPC', {
+          natGateways: 0,
+        });
+      }, /make sure you don't configure any PRIVATE subnets/);


Perhaps provide the rationale for this in the error message or an accompanying link to an issue or doc

mergify · 2019-10-27T14:47:22Z

Thank you for contributing! Your pull request is now being automatically merged.

mergify · 2019-10-27T14:47:22Z

Thank you for contributing! Your pull request is now being automatically merged.

aws-cdk-automation · 2019-10-27T15:25:36Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

ChrisLahaye · 2019-10-29T09:38:23Z

What about NAT instances (https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html)? They have zero NAT gateways and one or more private subnets, therefore failing this validation.

rix0rrr requested review from RomainMuller, eladb and shivlaks October 24, 2019 13:51

rix0rrr self-assigned this Oct 24, 2019

rix0rrr mentioned this pull request Oct 24, 2019

Creating an ASG with public subnets fails. #3410

Closed

5 tasks

SomayaB added the contribution/core This is a PR that came from AWS. label Oct 24, 2019

RomainMuller reviewed Oct 25, 2019

View reviewed changes

Merge remote-tracking branch 'origin/master' into huijbers/vpcs-subne…

e3053c7

…t-types

eladb approved these changes Oct 27, 2019

View reviewed changes

Merge branch 'master' into huijbers/vpcs-subnet-types

9f760eb

mergify bot merged commit 9a96c37 into master Oct 27, 2019

mergify bot deleted the huijbers/vpcs-subnet-types branch October 27, 2019 15:26

shurmanidze mentioned this pull request Nov 4, 2019

Can't configure an RDS without Private subnets in a VPC #4828

Closed

njlynch mentioned this pull request Aug 10, 2021

(aws-ec2): Why are NAT gateways required for private subnets? #15929

Closed

kauer2 mentioned this pull request Feb 26, 2024

rds: Cannot create DatabaseCluster in PRIVATE_ISOLATED subnets #29256

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(vpc): additional validation around Subnet Types #4668

feat(vpc): additional validation around Subnet Types #4668

rix0rrr commented Oct 24, 2019

mergify bot commented Oct 24, 2019

aws-cdk-automation commented Oct 24, 2019

RomainMuller Oct 25, 2019

rix0rrr Oct 25, 2019

eladb Oct 27, 2019

aws-cdk-automation commented Oct 25, 2019

eladb Oct 27, 2019

eladb Oct 27, 2019

mergify bot commented Oct 27, 2019

mergify bot commented Oct 27, 2019

aws-cdk-automation commented Oct 27, 2019

ChrisLahaye commented Oct 29, 2019

feat(vpc): additional validation around Subnet Types #4668

feat(vpc): additional validation around Subnet Types #4668

Conversation

rix0rrr commented Oct 24, 2019

mergify bot commented Oct 24, 2019

aws-cdk-automation commented Oct 24, 2019

AWS CodeBuild CI Report

RomainMuller Oct 25, 2019

Choose a reason for hiding this comment

rix0rrr Oct 25, 2019

Choose a reason for hiding this comment

eladb Oct 27, 2019

Choose a reason for hiding this comment

aws-cdk-automation commented Oct 25, 2019

AWS CodeBuild CI Report

eladb Oct 27, 2019

Choose a reason for hiding this comment

eladb Oct 27, 2019

Choose a reason for hiding this comment

mergify bot commented Oct 27, 2019

mergify bot commented Oct 27, 2019

aws-cdk-automation commented Oct 27, 2019

AWS CodeBuild CI Report

ChrisLahaye commented Oct 29, 2019