diff --git a/packages/@aws-cdk/aws-apprunner/test/integ.service-vpc-connector.ts b/packages/@aws-cdk/aws-apprunner/test/integ.service-vpc-connector.ts
index 37694456c404f..5a3aa23eb8008 100644
--- a/packages/@aws-cdk/aws-apprunner/test/integ.service-vpc-connector.ts
+++ b/packages/@aws-cdk/aws-apprunner/test/integ.service-vpc-connector.ts
@@ -15,7 +15,8 @@ const vpc = new ec2.Vpc(stack, 'Vpc', {
 const securityGroup = new ec2.SecurityGroup(stack, 'SecurityGroup', { vpc });
 
 const vpcConnector = new VpcConnector(stack, 'VpcConnector', {
-  subnets: vpc.publicSubnets,
+  vpc,
+  vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PUBLIC }),
   securityGroups: [securityGroup],
   vpcConnectorName: 'MyVpcConnector',
 });
diff --git a/packages/@aws-cdk/aws-apprunner/test/service-vpc-connector.integ.snapshot/integ-apprunner.template.json b/packages/@aws-cdk/aws-apprunner/test/service-vpc-connector.integ.snapshot/integ-apprunner.template.json
index eb81319cee31e..dd82250830dd0 100644
--- a/packages/@aws-cdk/aws-apprunner/test/service-vpc-connector.integ.snapshot/integ-apprunner.template.json
+++ b/packages/@aws-cdk/aws-apprunner/test/service-vpc-connector.integ.snapshot/integ-apprunner.template.json
@@ -399,7 +399,7 @@
     }
    }
   },
-  "VpcConnectorCF6E3C30": {
+  "VpcConnectorE3A78531": {
    "Type": "AWS::AppRunner::VpcConnector",
    "Properties": {
     "Subnets": [
@@ -440,7 +440,7 @@
       "EgressType": "VPC",
       "VpcConnectorArn": {
        "Fn::GetAtt": [
-        "VpcConnectorCF6E3C30",
+        "VpcConnectorE3A78531",
         "VpcConnectorArn"
        ]
       }
@@ -467,7 +467,7 @@
       "EgressType": "VPC",
       "VpcConnectorArn": {
        "Fn::GetAtt": [
-        "VpcConnectorCF6E3C30",
+        "VpcConnectorE3A78531",
         "VpcConnectorArn"
        ]
       }
diff --git a/packages/@aws-cdk/aws-apprunner/test/service-vpc-connector.integ.snapshot/manifest.json b/packages/@aws-cdk/aws-apprunner/test/service-vpc-connector.integ.snapshot/manifest.json
index a652d6c38f4d6..3f7ab502b43a0 100644
--- a/packages/@aws-cdk/aws-apprunner/test/service-vpc-connector.integ.snapshot/manifest.json
+++ b/packages/@aws-cdk/aws-apprunner/test/service-vpc-connector.integ.snapshot/manifest.json
@@ -159,10 +159,10 @@
             "data": "SecurityGroupDD263621"
           }
         ],
-        "/integ-apprunner/VpcConnector/VpcConnector": [
+        "/integ-apprunner/VpcConnector/Resource": [
           {
             "type": "aws:cdk:logicalId",
-            "data": "VpcConnectorCF6E3C30"
+            "data": "VpcConnectorE3A78531"
           }
         ],
         "/integ-apprunner/Service6/Resource": [
diff --git a/packages/@aws-cdk/aws-apprunner/test/service-vpc-connector.integ.snapshot/tree.json b/packages/@aws-cdk/aws-apprunner/test/service-vpc-connector.integ.snapshot/tree.json
index 135a2f4e69ee8..7639465033d25 100644
--- a/packages/@aws-cdk/aws-apprunner/test/service-vpc-connector.integ.snapshot/tree.json
+++ b/packages/@aws-cdk/aws-apprunner/test/service-vpc-connector.integ.snapshot/tree.json
@@ -697,9 +697,9 @@
             "id": "VpcConnector",
             "path": "integ-apprunner/VpcConnector",
             "children": {
-              "VpcConnector": {
-                "id": "VpcConnector",
-                "path": "integ-apprunner/VpcConnector/VpcConnector",
+              "Resource": {
+                "id": "Resource",
+                "path": "integ-apprunner/VpcConnector/Resource",
                 "attributes": {
                   "aws:cdk:cloudformation:type": "AWS::AppRunner::VpcConnector",
                   "aws:cdk:cloudformation:props": {
@@ -759,7 +759,7 @@
                         "egressType": "VPC",
                         "vpcConnectorArn": {
                           "Fn::GetAtt": [
-                            "VpcConnectorCF6E3C30",
+                            "VpcConnectorE3A78531",
                             "VpcConnectorArn"
                           ]
                         }
@@ -820,7 +820,7 @@
                         "egressType": "VPC",
                         "vpcConnectorArn": {
                           "Fn::GetAtt": [
-                            "VpcConnectorCF6E3C30",
+                            "VpcConnectorE3A78531",
                             "VpcConnectorArn"
                           ]
                         }
diff --git a/packages/@aws-cdk/aws-apprunner/test/service.test.ts b/packages/@aws-cdk/aws-apprunner/test/service.test.ts
index aebbdf5d85943..2bef83769fff5 100644
--- a/packages/@aws-cdk/aws-apprunner/test/service.test.ts
+++ b/packages/@aws-cdk/aws-apprunner/test/service.test.ts
@@ -658,7 +658,8 @@ test('specifying a vpcConnector should assign the service to it and set the egre
 
   const vpcConnector = new VpcConnector(stack, 'VpcConnector', {
     securityGroups: [securityGroup],
-    subnets: vpc.publicSubnets,
+    vpc,
+    vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PUBLIC }),
     vpcConnectorName: 'MyVpcConnector',
   });
   // WHEN
@@ -675,7 +676,7 @@ test('specifying a vpcConnector should assign the service to it and set the egre
         EgressType: 'VPC',
         VpcConnectorArn: {
           'Fn::GetAtt': [
-            'VpcConnectorCF6E3C30',
+            'VpcConnectorE3A78531',
             'VpcConnectorArn',
           ],
         },
diff --git a/packages/@aws-cdk/aws-apprunner/test/vpc-connector.test.ts b/packages/@aws-cdk/aws-apprunner/test/vpc-connector.test.ts
index 17363da55b033..80b2fd4a3d523 100644
--- a/packages/@aws-cdk/aws-apprunner/test/vpc-connector.test.ts
+++ b/packages/@aws-cdk/aws-apprunner/test/vpc-connector.test.ts
@@ -16,7 +16,8 @@ test('create a vpcConnector with all properties', () => {
   // WHEN
   new VpcConnector(stack, 'VpcConnector', {
     securityGroups: [securityGroup],
-    subnets: vpc.publicSubnets,
+    vpc,
+    vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PUBLIC }),
     vpcConnectorName: 'MyVpcConnector',
   });
   // THEN
@@ -54,7 +55,8 @@ test('create a vpcConnector without a name', () => {
   // WHEN
   new VpcConnector(stack, 'VpcConnector', {
     securityGroups: [securityGroup],
-    subnets: vpc.publicSubnets,
+    vpc,
+    vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PUBLIC }),
   });
   // THEN
   Template.fromStack(stack).hasResourceProperties('AWS::AppRunner::VpcConnector', {
@@ -75,4 +77,39 @@ test('create a vpcConnector without a name', () => {
       },
     ],
   });
+});
+
+test('create a vpcConnector without a security group should create one', () => {
+  // GIVEN
+  const app = new cdk.App();
+  const stack = new cdk.Stack(app, 'demo-stack');
+
+  const vpc = new ec2.Vpc(stack, 'Vpc', {
+    cidr: '10.0.0.0/16',
+  });
+
+  // WHEN
+  new VpcConnector(stack, 'VpcConnector', {
+    vpc,
+    vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PUBLIC }),
+  });
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::AppRunner::VpcConnector', {
+    Subnets: [
+      {
+        Ref: 'VpcPublicSubnet1Subnet5C2D37C4',
+      },
+      {
+        Ref: 'VpcPublicSubnet2Subnet691E08A3',
+      },
+    ],
+    SecurityGroups: [
+      {
+        'Fn::GetAtt': [
+          'VpcConnectorSecurityGroup33FAF25D',
+          'GroupId',
+        ],
+      },
+    ],
+  });
 });
\ No newline at end of file