Unable to use deploy-time parameters for privateSubnetIds for Vpc.fromVpcAttributes

[amwill04]

Unable to pass CommaDelimitedList CfnParameter to VPC.fromVpcAttributes privateSubnetIds

Reproduction Steps

When trying to use existing VPC for a lambda function

const vpcSubnetId = new CfnParameter(this, 'VPCSubnetId', {
            description: 'VPC Subnet Id',
            type: 'CommaDelimitedList',
});
const vpc = Vpc.fromVpcAttributes(this, 'GeoVPC', {
       vpcId: vpcId.valueAsString,
       availabilityZones: ['eu-west-2a', 'eu-west-2b', 'eu-west-2c'],
       privateSubnetIds: vpcSubnetId.valueAsList,
});

When runing npn run build npx synth for a stack with the above in it it will declare the following error:

Number of privateSubnetIds (1) must be a multiple of availability zones (3).

Environment

• **CLI Version :**1.8.0
• **Framework Version:**1.8.0
• **OS :**MacOs 10.14.6
• **Language :**typescript

[rix0rrr]

It would work for now if you made the AZs an argument as well.

[rix0rrr]

The solution is for the VPC construct to not validate anything about subnets if the input is a token.

[amwill04]

@rix0rrr - thanks.

I actually stumbled by accident across doing that last night and the following works.

const mapping = new CfnMapping(this, 'StackMapping', {
    mapping: {
        VPC: {
            vpcAvailabilityZones: ['eu-west-2a', 'eu-west-2b', 'eu-west-2c'],
        },
    },
});

const vpc = Vpc.fromVpcAttributes(this, 'GeoVPC', {
    vpcId: vpcId.valueAsString,
     availabilityZones: [...Token.asList(mapping.findInMap('VPC', 'vpcAvailabilityZones'))],
     privateSubnetIds: [...Token.asList(vpcSubnetId.valueAsList)],
 });

[rix0rrr]

Ha, that works as well. The [...list] part shouldn't be necessary btw.

[john-tipper]

I see the same error for publicSubnetIds:

IVpc vpc = Vpc.fromVpcAttributes(this, "VPC", VpcAttributes.builder()
                .vpcId(vpcId.getValueAsString())
                .publicSubnetIds(publicSubnetIds.getValueAsList())
                .availabilityZones(List.of("eu-west-2a", "eu-west-2b", "eu-west-2c"))
                .build());

[TiltedTower]

I have gotten this to work by using the cdk.Fn.getAzs() function instead of creating the mapping

[rix0rrr]

This does not work, and the reason it does not work is that a lot of the CDK makes assumptions that subnets can be represented an Subnet[] (that is: an array of Subnet objects), and that afterwards we can do things like:

subnets.map(s => s.subnetId)
subnets.map(s => s.routeTableId)

And so on.

Obviously the function that will have to translate:

importSubnets(Fn.importValue('subnetIds')) // => ISubnet[] ????

Is going to be hard to write.

---

It may accidentally work today. That is because the token:

// Encoded list token
const subnetIds = Token.asList(Fn.importValue('someValue'))
// [ '#{Token[1234]}' ]

// Gets parsed to a singleton `Subnet` list:
const subnets = subnetIds.map(s => Subnet.fromSubnetAttributes({ subnetId: s }));
// [ Subnet({ subnetId: '#{Token[1234]}' }) ]

// This 'subnetId' is illegal by itself, and if yould try to use it for,
// say, an ec2.Instance it would fail. However, if you treat this single
// subnet as a GROUP of subnets:
new CfnAutoScalingGroup({ subnetIds: subnets.map(s => s.subnetId) })
// [ '#{Token[1234]}' ]

// And this resolves back to:
resolve(cfnSubnetIds)
// SubnetIds: { Fn::ImportValue: 'someValue' }

// Again! This is not a feature but an accident.

---

This needs a lot of hacky code to make work in the current design, but more properly we should take it up as part of the Vpc redesign and introduce a class represent Subnets. This class can have two different implementaions: a ConcreteSubnets class that actually has a list of Subnet objects as today, or a DeployTimeSubnets class that only holds on to the CFN parameter and spits it back out again.

Tackle as part of #5927

[eruvanos]

Hi,

we faced this issue multiple times, as a workaround we wrap the subnetIds with select statements:

const vpcSubnetIdsRef = Token.asList(Fn.Split(",", Fn.importValue('VPCSubnetId')))
// or
// const vpcSubnetIdsRef = new CfnParameter(this, 'VPCSubnetId', {
//            description: 'VPC Subnet Id',
//            type: 'CommaDelimitedList',
// });

const azs = ['eu-west-2a', 'eu-west-2b', 'eu-west-2c']

const subnetIds = [];
azs.forEach((_, index) => {
        subnetIds.push(Fn.select(index, vpcSubnetIdsRef))
});

const vpc = Vpc.fromVpcAttributes(this, 'GeoVPC', {
       vpcId: vpcId.valueAsString,
       availabilityZones: azs,
       privateSubnetIds: subnetIds,
});

This will create a list with three tokens, which will be resolved in cfn later.

[HannesHasselbring]

and it can also be used with higher level constructs like rds.ServerlessCluster

[TiltedTower]

Hi,

we faced this issue multiple times, as a workaround we wrap the subnetIds with select statements:

const vpcSubnetIdsRef = Token.asList(Fn.Split(",", Fn.importValue('VPCSubnetId')))
// or
// const vpcSubnetIdsRef = new CfnParameter(this, 'VPCSubnetId', {
//            description: 'VPC Subnet Id',
//            type: 'CommaDelimitedList',
// });

const azs = ['eu-west-2a', 'eu-west-2b', 'eu-west-2c']

const subnetIds = [];
azs.forEach((_, index) => {
        subnetIds.push(Fn.select(index, vpcSubnetIdsRef))
});

const vpc = Vpc.fromVpcAttributes(this, 'GeoVPC', {
       vpcId: vpcId.valueAsString,
       availabilityZones: azs,
       privateSubnetIds: subnetIds,
});

This will create a list with three tokens, which will be resolved in cfn later.

This worked beautifully. A real lifesaver, thank you!

[wchaws]

Here is another nice workaround

const vpcIdParam = new CfnParameter(this, 'YourVpcId', { type: 'AWS::EC2::VPC::Id' });
const pubSubnetsParam = new CfnParameter(this, 'PubSubnets', { type: 'List<AWS::EC2::Subnet::Id>' });
const privSubnetsParam = new CfnParameter(this, 'PrivSubnets', { type: 'List<AWS::EC2::Subnet::Id>' });

const azs = ['eu-west-2a', 'eu-west-2b', 'eu-west-2c'];

const vpc = ec2.Vpc.fromVpcAttributes(this, 'VpcAttr', {
  vpcId: vpcIdParam.valueAsString,
  vpcCidrBlock: Aws.NO_VALUE,
  availabilityZones: azs,
  publicSubnetIds: azs.map((_, index) => Fn.select(index, pubSubnetsParam.valueAsList)),
  privateSubnetIds: azs.map((_, index) => Fn.select(index, privSubnetsParam.valueAsList)),
});

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.

[namdevmrathod]

I got resolved this issue by using below code in cdk for lambda function in vpc

import * as iam from 'aws-cdk-lib/aws-iam';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as cdk from 'aws-cdk-lib';
import * as path from 'path';
import * as ec2 from '@aws-cdk/aws-ec2'
import { Vpc } from 'aws-cdk-lib/aws-ec2';

export class VpcStack extends cdk.Stack {
constructor(scope: cdk.App, id: string, props?: cdk.StackProps) {
super(scope, id, props);

//get VPC Info form AWS account, FYI we are not rebuilding we are referencing
const DefaultVpc = Vpc.fromVpcAttributes(this, 'vpcdev', {
vpcId: 'vpc-0e0e20c7600fd9b59',
availabilityZones: ['ap-south-1a', 'ap-south-1b'],
privateSubnetIds: ['subnet-0148d982d214587dd', 'subnet-0a68e97507e0c7fae'],
});

//  lambda function definition

const lambdaFunction = new lambda.Function(this, 'lambda-function', {
functionName: 'lambda-function',
runtime: lambda.Runtime.NODEJS_14_X,
vpc: DefaultVpc,
memorySize: 512,
timeout: cdk.Duration.seconds(10),
handler: 'index.handler',
code: lambda.Code.fromAsset(path.join(__dirname, '/../src/')),
environment: {},
});
}
}