Skip to content

(aws-ec2): Why are NAT gateways required for private subnets? #15929

@ffxsam

Description

@ffxsam

❓ General Issue

The Question

I'm very curious why this check is in place:

if (count === 0 && hasPrivateSubnets) {
// eslint-disable-next-line max-len
throw new Error('If you do not want NAT gateways (natGateways=0), make sure you don\'t configure any PRIVATE subnets in \'subnetConfiguration\' (make them PUBLIC or ISOLATED instead)');
}

NAT gateways are, if I'm not mistaken, only required if resources within your private subnets need to access the Internet through an Internet gateway. In this case, I'm unable to use CDK to create a ServerlessCluster, because the SubnetGroup can't be defined without giving it a VPC with private subnets, which strangely require NAT Gateways. If I try to create a SubnetGroup using a VPC with public & isolated subnets, it complains and says I need to use private subnets: Error: There are no 'Private' subnet groups in this VPC. Available types: Isolated,Public

Metadata

Metadata

Assignees

No one assigned

    Labels

    @aws-cdk/aws-ec2Related to Amazon Elastic Compute CloudbugThis issue is a bug.effort/smallSmall work item – less than a day of effortp1

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions