Is there a way to not allocate an elastic IP (EIP) when creating a VPC using aws-cdk

user_5840937 0
Viewed 1515

I'm using the following code to create subnets that will be imported by another stack and used for a dedicated EFS VPC. If I don't create a PUBLIC subnet I get errors on creation. However the side effect is this code allocates an elastic IP address and I don't want one allocated, they are a precious resource.

How do I get rid of the elastic IP address? None of the methods allow you get anything that has an EIP attribute or method:

const fileSystemVpc = new ec2.Vpc(this, 'vpcForEfs', {
  subnetConfiguration: [
    { 
      cidrMask: 20,
      name: 'nfsisolated',
      subnetType: ec2.SubnetType.ISOLATED,
    },
    { 
      cidrMask: 20,
      name: 'nfsprivate',
      subnetType: ec2.SubnetType.PRIVATE,
    },
    { 
      cidrMask: 20,
      name: 'nfspublic',
      subnetType: ec2.SubnetType.PUBLIC,
    },
  ],
});

If I comment out the PUBLIC section I get the following error on creation:

If you configure PRIVATE subnets in 'subnetConfiguration', you must also
configure PUBLIC subnets to put the NAT gateways into (got 
[{"cidrMask":20,"name":"nfsisolated","subnetType":"Isolated"},
{"cidrMask":20,"name":"nfsprivate","subnetType":"Private"}].

Relevant issues that don't solve the problem but are similar:

https://github.com/aws/aws-cdk/issues/1305 https://github.com/aws/aws-cdk/issues/3704

amazon-vpc aws-cdk
1 Answers

This is the commit that added that check: https://github.com/aws/aws-cdk/commit/9a96c37b225b135c9afbf523ed3fbc67cba5ca50

Essentially if CDK wasn't stopping you with that message it would fail when CloudFormation tried to deploy the stack.

Here is more info from AWS on it as well: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html

You can see the description of the ticket that was referenced in it and the AWS docs, if whatever you want to put in the PRIVATE subnets doesn't require internet access you should be using ISOLATED instead. This is because a PRIVATE subnet requires a NatGateway and a NatGateway is required to exist in a PUBLIC subnet with an elastic IP. Again, if you don't require outbound access to the internet from your PRIVATE subnet just use ISOLATED

user_120934170
Related