EC2.CfnNetworkAclEntry: can't specify IPv6 rule because "cidrBlock" required instead of optional

[mrcrowl]

NetworkACLEntry docs indicates that only CidrBlock or Ipv6CidrBlock is required.

The TypeScript definition for CfnNetworkAclEntryProps has cidrBlock as required.

Reported error is:

Error: CfnNetworkAclEntry [ep/vpc/IPv6InboundACL] is missing required property: cidrBlock
    at Object.requireProperty (C:\WF\LP\cdk\node_modules\@aws-cdk\cdk\lib\runtime.js:319:15)
    at new CfnNetworkAclEntry (C:\WF\LP\cdk\node_modules\@aws-cdk\aws-ec2\lib\ec2.generated.js:4608:13)
    at VpcConstruct.configureNetworkACLs (C:\WF\LP\cdk\lib\vpc-construct.js:82:9)
    at new VpcConstruct (C:\WF\LP\cdk\lib\vpc-construct.js:17:14)
    at new EPStack (C:\WF\LP\cdk\lib\ep\ep-stack.js:8:9)
    at Object.<anonymous> (C:\WF\LP\cdk\bin\cdk.js:8:1)
    at Module._compile (module.js:652:30)
    at Object.Module._extensions..js (module.js:663:10)
    at Module.load (module.js:565:32)
    at tryModuleLoad (module.js:505:12)

If cidrBlock is ommitted, the error is:

C:\WF\LP\cdk\node_modules\@aws-cdk\cdk\lib\cloudformation\resource.js:163
            throw e;
            ^
While synthesizing ep/vpc/IPv6InboundACL: Supplied properties not correct for "CfnNetworkAclEntryProps"
  cidrBlock: required but missing
  --- resource created at ---

[rix0rrr]

Interesting. Well the CloudFormation schema definitely says that CidrBlock is required, so we're going to have to patch that. Thanks for the report.

In the mean time, you should be able to specify a value for the property and then remove it again via CloudFormation overrides to work around this.