Be able to change AZ count on already deployed VPC (constructs need to be able to keep state) #6683

ranrotx · 2020-03-11T23:15:02Z

When (in my case) increasing the maxAzs specified using the VPC construct from 3 to 4 and running cdk deploy, the CloudFormation stack update fails with an error code of InvalidSubnet.Conflict;

Reproduction Steps

Changing

const vpc = new ec2.Vpc(this, 'VPC', {
      cidr: "172.21.0.0/16",
      maxAzs: 3,
      natGateways: 1,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,
        },
        {
          cidrMask: 24,
          name: 'private',
          subnetType: ec2.SubnetType.PRIVATE,
        }
      ]
    });

to

const vpc = new ec2.Vpc(this, 'VPC', {
      cidr: "172.21.0.0/16",
      maxAzs: 4,
      natGateways: 1,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,
        },
        {
          cidrMask: 24,
          name: 'private',
          subnetType: ec2.SubnetType.PRIVATE,
        }
      ]
    });

produces the error below.

Error Log

1/28 | 5:55:19 PM | CREATE_FAILED        | AWS::EC2::Subnet                      | VPC/publicSubnet4/Subnet (VPCpublicSubnet4Subnet46529D45) The CIDR '172.21.3.0/24' conflicts with another subnet (Service: AmazonEC2; Status Code: 400; Error Code: InvalidSubnet.Conflict; Request ID: 41f1d4ed-b249-4cfa-bb1e-c0148a4ddc30)
        new Subnet (/Users/username/workspace/cdk-vpc-transitgateway/node_modules/@aws-cdk/aws-ec2/lib/vpc.ts:1373:20)
        \_ new PublicSubnet (/Users/username/workspace/cdk-vpc-transitgateway/node_modules/@aws-cdk/aws-ec2/lib/vpc.ts:1588:5)
        \_ /Users/username/workspace/cdk-vpc-transitgateway/node_modules/@aws-cdk/aws-ec2/lib/vpc.ts:1239:32
        \_ Array.forEach (<anonymous>)
        \_ Vpc.createSubnetResources (/Users/username/workspace/cdk-vpc-transitgateway/node_modules/@aws-cdk/aws-ec2/lib/vpc.ts:1221:28)
        \_ Vpc.createSubnets (/Users/username/workspace/cdk-vpc-transitgateway/node_modules/@aws-cdk/aws-ec2/lib/vpc.ts:1210:12)
        \_ new Vpc (/Users/username/workspace/cdk-vpc-transitgateway/node_modules/@aws-cdk/aws-ec2/lib/vpc.ts:1076:10)
        \_ new CdkVpcTransitgatewayStack (/Users/username/workspace/cdk-vpc-transitgateway/lib/cdk-vpc-transitgateway-stack.ts:8:17)
        \_ Object.<anonymous> (/Users/username/workspace/cdk-vpc-transitgateway/bin/cdk-vpc-transitgateway.ts:10:1)
        \_ Module._compile (internal/modules/cjs/loader.js:1147:30)
        \_ Module.m._compile (/Users/username/workspace/cdk-vpc-transitgateway/node_modules/ts-node/src/index.ts:814:23)
        \_ Module._extensions..js (internal/modules/cjs/loader.js:1167:10)
        \_ Object.require.extensions.<computed> [as .ts] (/Users/username/workspace/cdk-vpc-transitgateway/node_modules/ts-node/src/index.ts:817:12)
        \_ Module.load (internal/modules/cjs/loader.js:996:32)
        \_ Function.Module._load (internal/modules/cjs/loader.js:896:14)
        \_ Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:71:12)
        \_ main (/Users/username/workspace/cdk-vpc-transitgateway/node_modules/ts-node/src/bin.ts:226:14)
        \_ Object.<anonymous> (/Users/username/workspace/cdk-vpc-transitgateway/node_modules/ts-node/src/bin.ts:485:3)
        \_ Module._compile (internal/modules/cjs/loader.js:1147:30)
        \_ Object.Module._extensions..js (internal/modules/cjs/loader.js:1167:10)
        \_ Module.load (internal/modules/cjs/loader.js:996:32)
        \_ Function.Module._load (internal/modules/cjs/loader.js:896:14)
        \_ Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:71:12)
        \_ /usr/local/lib/node_modules/npm/node_modules/libnpx/index.js:268:14

Environment

CLI Version : 1.27.0 (build a98c0b3)
Framework Version: node --version v13.10.1
OS : macOS 10.14.6
Language : us-english

Other

At first glance, it appears that on subsequent deployments the VPC construct is not aware of what CIDR ranges may already be in-use.

This is 🐛 Bug Report

The text was updated successfully, but these errors were encountered:

rix0rrr · 2020-04-01T09:25:17Z

This is true, and solving this will require CDK applications to be able to keep state between runs.

We can use this use case as a motivating example for that feature.

joeyaurel · 2020-05-21T09:08:51Z

Got the same issue today, while setting my maxAzs from 1 to 2 for the CIDR 10.1.0.0/16 using the CLI in version 1.39.0.

Any updates on this? @rix0rrr

ghost · 2020-06-30T09:35:48Z

It looks like that the same happens if you increase the number of subnets in the following way

const vpc = new Vpc(this, `base-vpc`, {
    cidr: "11.0.0.0/16",
    subnetConfiguration: [
        {
            name: "public",
            subnetType: SubnetType.PUBLIC,
        },
        {
            name: "myPrivateSubnet",
            subnetType: SubnetType.PRIVATE,
        },
    ],
    maxAzs,
});

if you add another subnet after a deployment like

const vpc = new Vpc(this, `base-vpc`, {
    cidr: "11.0.0.0/16",
    subnetConfiguration: [
        {
            name: "public",
            subnetType: SubnetType.PUBLIC,
        },
        {
            name: "myPrivateSubnet",
            subnetType: SubnetType.PRIVATE,
        },
        {
            name: "myOtherPrivateSubnet",
            subnetType: SubnetType.PRIVATE,
        },
    ],
    maxAzs,
});

=> conflicts with another subnet error

rix0rrr · 2020-08-12T12:33:26Z

Related to #5927 (and other issues in that area)

carlomorelli · 2021-04-08T15:06:32Z

this happened to me today, when reducing maxazs from 2 to 1.
Is there a workaround to do this ?

sunshineo · 2021-04-15T05:33:38Z

Happened to me when set maxAzs to 1. I had to destroy the stack and create again. Good thing we have nothing else in the VPC. I guess in production, one have to create a new VPC and move everything

chadnash · 2021-07-02T07:25:24Z

This is true, and solving this will require CDK applications to be able to keep state between runs.

We can use this use case as a motivating example for that feature.

that state is held in AWS and it should be cloudformations to job to cope

patones · 2021-07-02T16:03:41Z

suffering from the same issue. increase or decrease :(

Jordhan-Carvalho · 2021-08-22T14:09:02Z

Having the same problem adding another subnet

tobias-nawa · 2021-08-22T23:19:41Z

I'm trying to remove my Isolated subnet and am running into the same issue. CDK deployment wants to create all subnets from scratch, rather than just removing the one I want to get rid of. This causes the issue with the CIDRs already in use.

This is the code where I just removed the first subnet:


            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="Isolated",
                    cidr_mask=24,
                    reserved=False,
                    subnet_type=ec2.SubnetType.ISOLATED,
                ),
                ec2.SubnetConfiguration(
                    name="Private",
                    cidr_mask=22,
                    reserved=False,
                    subnet_type=ec2.SubnetType.PRIVATE,
                ),
                ec2.SubnetConfiguration(
                    name="Public",
                    cidr_mask=23,
                    reserved=False,
                    subnet_type=ec2.SubnetType.PUBLIC,
                ),
            ],

SoccerBoyMalloy · 2021-10-02T01:14:25Z

Different but related, I received the same error when trying to change NatGateways from 1 to 0.

carlomorelli · 2021-10-02T09:19:41Z

It's unfortunate that devs don't give priority to fix this Vpc construct; without these problems fixed, relying on it is very dangerous.

benjaminwhire · 2022-02-15T09:27:14Z

Is there any workaround? I encountered the same issue without tweaking the AZ.

zachgoll · 2022-04-29T11:39:18Z

I've encountered this issue several times. It doesn't really matter what you're changing--if you attempt to change the subnet structure of an already-created VPC with CDK, you'll get this error.

Has anyone come up with a workaround, or even an order of operations for making changes to a VPC? My thought is that the previous VPC subnets would have to be completely destroyed prior to an update (since the CIDR reservations are not editable, even in the console)

damshenas · 2022-07-26T18:10:42Z

+1

comcalvi · 2023-01-25T22:32:10Z

Related to the tracking state between deployments issue: #13676.

zippocage · 2023-02-11T11:58:27Z

Would also like to be able to change AZ count.

joeyvmason · 2023-04-11T19:32:14Z

Also experiencing this issue. Not uncommon to need to tweak VPC and if that means having to tear down your entire stack that is a huge dealbreaker for using this in production

mikelane · 2023-09-27T22:12:52Z

I just ran into this issue today too. Would be nice to not have to destroy the stack in order to update this.

bataras · 2024-07-07T02:47:20Z

same issue here. has aws ever phsically added an AZ to a Region? I would think if they did that, lots of CDK users would not be happy

ran-isenberg · 2024-12-16T07:19:17Z

bumping this again. This is a major issue for us. I can't destroy the VPC as it's connected to an Aurora DB.

ranrotx added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Mar 11, 2020

SomayaB assigned rix0rrr Mar 31, 2020

SomayaB added the @aws-cdk/aws-ec2 Related to Amazon Elastic Compute Cloud label Mar 31, 2020

rix0rrr added effort/large Large work item – several weeks of effort @aws-cdk/core Related to core CDK functionality and removed bug This issue is a bug. labels Apr 1, 2020

rix0rrr changed the title ~~Modifying increasing maxAzs results in InvalidSubnet.Conflict error on subsequent cdk deploy~~ Be able to change AZ count on already deployed VPC (constructs need to be able to keep state) Apr 1, 2020

SomayaB removed the needs-triage This issue or PR still needs to be triaged. label May 19, 2020

SomayaB added the feature-request A feature should be added or improved. label Jun 22, 2020

rix0rrr added the p1 label Aug 12, 2020

ericzbeard unassigned rix0rrr Jun 17, 2021

yogeshchopra mentioned this issue Oct 19, 2022

feat(ec2): support reserving azs space in VPCs #22553

Closed

4 tasks

yogeshchopra mentioned this issue Oct 30, 2022

feat(ec2): Vpc supports reserving space for future AZs #22705

Merged

4 tasks

comcalvi mentioned this issue Jan 25, 2023

VPC construct with full control #5927

Open

2 tasks

peterwoodworth removed the @aws-cdk/core Related to core CDK functionality label May 15, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Be able to change AZ count on already deployed VPC (constructs need to be able to keep state) #6683

Be able to change AZ count on already deployed VPC (constructs need to be able to keep state) #6683

ranrotx commented Mar 11, 2020

rix0rrr commented Apr 1, 2020

joeyaurel commented May 21, 2020 •

edited by SomayaB

Loading

ghost commented Jun 30, 2020

rix0rrr commented Aug 12, 2020

carlomorelli commented Apr 8, 2021

sunshineo commented Apr 15, 2021

chadnash commented Jul 2, 2021 •

edited

Loading

patones commented Jul 2, 2021

Jordhan-Carvalho commented Aug 22, 2021

tobias-nawa commented Aug 22, 2021 •

edited

Loading

SoccerBoyMalloy commented Oct 2, 2021

carlomorelli commented Oct 2, 2021

benjaminwhire commented Feb 15, 2022

zachgoll commented Apr 29, 2022 •

edited

Loading

damshenas commented Jul 26, 2022

comcalvi commented Jan 25, 2023

zippocage commented Feb 11, 2023

joeyvmason commented Apr 11, 2023

mikelane commented Sep 27, 2023

bataras commented Jul 7, 2024

ran-isenberg commented Dec 16, 2024

Be able to change AZ count on already deployed VPC (constructs need to be able to keep state) #6683

Be able to change AZ count on already deployed VPC (constructs need to be able to keep state) #6683

Comments

ranrotx commented Mar 11, 2020

Reproduction Steps

Error Log

Environment

Other

rix0rrr commented Apr 1, 2020

joeyaurel commented May 21, 2020 • edited by SomayaB Loading

ghost commented Jun 30, 2020

rix0rrr commented Aug 12, 2020

carlomorelli commented Apr 8, 2021

sunshineo commented Apr 15, 2021

chadnash commented Jul 2, 2021 • edited Loading

patones commented Jul 2, 2021

Jordhan-Carvalho commented Aug 22, 2021

tobias-nawa commented Aug 22, 2021 • edited Loading

SoccerBoyMalloy commented Oct 2, 2021

carlomorelli commented Oct 2, 2021

benjaminwhire commented Feb 15, 2022

zachgoll commented Apr 29, 2022 • edited Loading

damshenas commented Jul 26, 2022

comcalvi commented Jan 25, 2023

zippocage commented Feb 11, 2023

joeyvmason commented Apr 11, 2023

mikelane commented Sep 27, 2023

bataras commented Jul 7, 2024

ran-isenberg commented Dec 16, 2024

joeyaurel commented May 21, 2020 •

edited by SomayaB

Loading

chadnash commented Jul 2, 2021 •

edited

Loading

tobias-nawa commented Aug 22, 2021 •

edited

Loading

zachgoll commented Apr 29, 2022 •

edited

Loading