Describe the feature

There is currently a cyclic dependency between Security Groups and VPCs within NatInstanceProvider.

The dependency chain looks something like this:

Vpc
constructor props: VpcProps
natGatewayProvider: NatProvider
NatInstanceProvider -> NatProvider
constructor props: NatInstanceProps
securityGroup: ISecurityGroup
SecurityGroup -> ISecurityGroup
constructor props: SecurityGroupProps
vpc: IVpc

As discussed during the office hours session, I believe you could replicate the design used for subnet selection to create named security groups. You could add a property to VpcProps that allows the definition of Security groups to be created, which would include some identifying name property in addition to the other parameters. And then you could create a NatInstanceProps parameter that accepts the security group by the identifying name instead of as an ISecurityGroup, or perhaps some other NatProvider class that would integrate such options to construct NAT Gateway instances.

Use Case

The use case is creating NatGateways on VPC construction as appears to be possible given the existing API, but doesn't seem to be fully fleshed out. Currently that feature seems to be broken around the security group assignment for the NAT gateways creating a cyclic dependency on the need for a security group to be assigned a VPC.

Proposed Solution

As discussed during the office hours session, I believe you could replicate the design used for subnet selection to create named security groups. You could add a property to VpcProps that allows the definition of Security groups to be created, which would include some identifying name property in addition to the other parameters. And then you could create a NatInstanceProps parameter that accepts the security group by identifying name instead of as an ISecurityGroup, or perhaps some other NatProvider class that would integrate such options to construct NAT Gateway instances.

Other Information

I think we're constrained by the limitations of the corresponding CloudFormation constructs here, so creating security groups without needing a VPC, such that they may be passed as arguments to the NAT Gateway instance providers and subsequently assigned the VPC doesn't seem to be an option.
Currently the only workarounds seem to include:

• using entirely L1 constructs
• dropping the NAT Gateway feature from VPC construction entirely
• ignoring the NAT Gateway Vpc-construction-time feature and manually adding security groups and NAT gateways after the fact (after the VPC is constructed)

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.99.1

Environment details (OS name and version, etc.)

Any, MacOS/AL2