Subnet validation inhibits use of NAT instances

[ChrisLahaye]

Creating a VPC with public and private subnets results in an error when natGateways is zero. This inhibits the use of NAT instances (https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html).

Reproduction Steps

    const vpc = new ec2.Vpc(this, 'VPC', {
      maxAzs: 2,
      natGateways: 0,
      subnetConfiguration: [
        {
          subnetType: ec2.SubnetType.PUBLIC,
          name: 'ingress',
          cidrMask: 24,
        },
        {
          cidrMask: 24,
          name: 'application',
          subnetType: ec2.SubnetType.PRIVATE,
        }],
    });

Error Log

If you do not want NAT gateways (natGateways=0), make sure you don't configure any PRIVATE subnets in 'subnetConfiguration' (make them PUBLIC or ISOLATED instead)

Other

Introduced by https://github.com/aws/aws-cdk/pull/4668/files#diff-9454c0a15b2246a5b9b2267f5266e3ebR1573

---

This is 🐛 Bug Report

[rix0rrr]

As a work around, you should be able to make them ISOLATED from the PoV of the Vpc construct, and modify the routes manually afterwards.

But I'm on this.