vpc: make subnet IP allocation pluggable

[phaniram]

Usecase is to be able to expand to multiple AZs in future. Ex: VPC can be first created only in one AZ, and later requires it to be available in few more AZs, without the Subnets going through ip re-numbering.

Currently we can have maxAZs : https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ec2.Vpc.html#maxazs to have subnets in all available AZs in the system.

const vpc = new ec2.Vpc(this, 'Vpc', {
   cidr: '10.0.0.0/16',
    maxAzs: props.stage == 'prod' ? 99 : 1,
    natGateways: 1
});

and also use following

https://docs.aws.amazon.com/cdk/api/latest/docs/aws-ec2-readme.html#reserving-subnet-ip-space

to reserve subnet ip-space.

What would be ideal is to also reserve the ip space across AZs.

Currently if someone have to

• Increase maxAZs

or

• Change in availabilityZones https://github.com/aws/aws-cdk/blob/v1.31.0/packages/@aws-cdk/aws-ec2/lib/vpc.ts#L1225

Subnets will get IP Renumbered and is treated as a replacement and when there're dependent resources it fails.

Another way is to swap VPC, but it is not really easy to just swap, and requires a lot of tweaks, hacks, workarounds, and a nightmare procedure.

Reproduction Steps

Error Log

Environment

• CLI Version :
• Framework Version:
• OS :
• Language :

Other

---

This is 🐛 Bug Report

[rix0rrr]

I think I see what you're saying.

Feels like the best forward-looking solution here is to have a pluggable component called IAddressSpaceAllocator (or similar) which is responsible for allocating IP space, and everyone can plug in their own implementation if they need something different from the defaults.

[rix0rrr]

Somewhat related to #5927

[johnschultz]

Another use case here is when creating VPCs in separate accounts in which services are supposed to communicate via PrivateLink.

For example, if you deploy to us-east-1 with maxAzs=3 then it is entirely possible for two VPCs in separate accounts to be unable to form PrivateLink connections. This is due to PrivateLinks being intra-AZ only and how logical AZ names are randomized across physical AZs on a per account basis.

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.