-
Notifications
You must be signed in to change notification settings - Fork 4.5k
(aws-ec2): Why are NAT gateways required for private subnets? #15929
Copy link
Copy link
Closed
Labels
@aws-cdk/aws-ec2Related to Amazon Elastic Compute CloudRelated to Amazon Elastic Compute CloudbugThis issue is a bug.This issue is a bug.effort/smallSmall work item – less than a day of effortSmall work item – less than a day of effortp1
Description
❓ General Issue
The Question
I'm very curious why this check is in place:
aws-cdk/packages/@aws-cdk/aws-ec2/lib/vpc.ts
Lines 2036 to 2039 in 283ed02
| if (count === 0 && hasPrivateSubnets) { | |
| // eslint-disable-next-line max-len | |
| throw new Error('If you do not want NAT gateways (natGateways=0), make sure you don\'t configure any PRIVATE subnets in \'subnetConfiguration\' (make them PUBLIC or ISOLATED instead)'); | |
| } |
NAT gateways are, if I'm not mistaken, only required if resources within your private subnets need to access the Internet through an Internet gateway. In this case, I'm unable to use CDK to create a ServerlessCluster, because the SubnetGroup can't be defined without giving it a VPC with private subnets, which strangely require NAT Gateways. If I try to create a SubnetGroup using a VPC with public & isolated subnets, it complains and says I need to use private subnets: Error: There are no 'Private' subnet groups in this VPC. Available types: Isolated,Public
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
@aws-cdk/aws-ec2Related to Amazon Elastic Compute CloudRelated to Amazon Elastic Compute CloudbugThis issue is a bug.This issue is a bug.effort/smallSmall work item – less than a day of effortSmall work item – less than a day of effortp1