(aws_ec2): Unable to create dual-stack VPC if no subnets are defined

[tpflueger]

Describe the bug

Our initial CDK setup uses the VPC construct but delays the creation of subnets until later. Note, this worked but it may not be the way CDK is intended to be used. Switching to dual stack IPV4/IPV6, the construct now requires subnets to be defined.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

An ipv6 cidr block to be created that I could use for later subnet creation.

Current Behavior

CDK throws an exception.
Unhandled exception. System.Exception: Fn::Cidr's count attribute must be between 1 and 256, 0 was provided.

Reproduction Steps

new Vpc(parent.Construct, Name, new VpcProps
        {
            IpProtocol = IpProtocol.DUAL_STACK,
            VpcName = _name,
            IpAddresses = IpAddresses.Cidr(_cidrBlock.ToString()),
            DefaultInstanceTenancy = DefaultInstanceTenancy.DEFAULT,
            Ipv6Addresses = Ipv6Addresses.AmazonProvided(),
            EnableDnsHostnames = true,
            EnableDnsSupport = true,
            SubnetConfiguration = Array.Empty<SubnetConfiguration>()
        })

Possible Solution

Is subnet now a requirement? If not, it might be useful to allow specifying the Ipv6 CIDR block size.

Additional Information/Context

No response

CDK CLI Version

2.160.0

Framework Version

No response

Node.js Version

v22.1.0

OS

Windows 11

Language

.NET

Language Version

.NET 8.0.402

Other information

No response

[ashishdhingra]

The error is thrown at Ipv6Addresses.amazonProvided() > AmazonProvided.createIpv6CidrBlocks() (invoked from here > Fn.cidr() > FnCidr().

Since AmazonProvided Ipv6Addresses is used, it expects subnet configuration to be created.

[pahud]

yes subnet configuration is like the topology definition of your subnets for this vpc which tells the subnet cidr, subnet count as well as the mask, which is required for createIpv6CidrBlocks.

aws-cdk/packages/aws-cdk-lib/aws-ec2/lib/ip-addresses.ts

Lines 513 to 517 in d0c99d8

	createIpv6CidrBlocks(input: CreateIpv6CidrBlocksRequest): string[] {
	const sizeMask = input.sizeMask ?? '64'; // 128 - 64
	return Fn.cidr(input.ipv6SelectedCidr, input.subnetCount, sizeMask);
	}

[ashishdhingra]

@pahud Thanks for elaborating the design.

[tpflueger]

@pahud Is there a way to delay specifying subnets for IPv6? The creation of the VPC without subnets works until you try to use dual stack. For example, what we are doing is creating the VPC and then separately creating each subnet which works with IPv4. Dual stack puts a requirement of specifying subnets up front.

var vpc = new Vpc(parent.Construct, Name, new VpcProps
        {
            IpProtocol = IpProtocol.DUAL_STACK,
            VpcName = _name,
            IpAddresses = IpAddresses.Cidr(_cidrBlock.ToString()),
            DefaultInstanceTenancy = DefaultInstanceTenancy.DEFAULT,
            Ipv6Addresses = Ipv6Addresses.AmazonProvided(),
            EnableDnsHostnames = true,
            EnableDnsSupport = true,
            SubnetConfiguration = Array.Empty<SubnetConfiguration>()
        })
new CfnSubnet(parent.Construct, $"Subnet-{cidrBlockName}", new CfnSubnetProps
        {
            CidrBlock = _cidrBlock.ToString(),
            AvailabilityZone = _availabilityZone.ToString(),
            VpcId = vpc .RefId,
            MapPublicIpOnLaunch = _isPublic
        })

[pahud]

Can you share your use case why you need to delay the subnet creation?

I guess we just need to understand your use case and hopefully figure out a way to address that through a PR or a workaround.

[tpflueger]

The current implementation I am working on made constructs of everything and limited the VPC construct to only create the VPC. Subnets were being handled by a separate construct. I can make the changes to allow the VPC construct to create the subnets instead. I was unsure if this was intended behavior due to IPv4 VPC working without specifying subnets initially.

[ashishdhingra]

The current implementation I am working on made constructs of everything and limited the VPC construct to only create the VPC. Subnets were being handled by a separate construct. I can make the changes to allow the VPC construct to create the subnets instead. I was unsure if this was intended behavior due to IPv4 VPC working without specifying subnets initially.

@tpflueger Thanks for the details. Please confirm if we could close this issue since you might have mitigated your use case.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.