fix(ec2): dual-stack vpc without private subnets creates EgressOnlyInternetGateway (under feature flag) #34437

maharajhaider · 2025-05-12T16:39:23Z

Issue # (if applicable)

Closes #30981.

Reason for this change

-> EgressOnlyInternetGateway was been created even without any private subnets

Description of changes

-> Fixed the condition that determins if a EgressOnlyInternetGateway will be created
-> Added feature flag

Describe any new or updated permissions being added

N/A

Description of how you validated changes

I added two new unit tests that checks if EgressOnlyInternetGateway is created without a private subnet

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

aws-cdk-automation · 2025-05-13T00:25:41Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: d157dce
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

paulhcsun · 2025-05-13T21:13:56Z

For the PR title please change it to describe the bug and not the actual fix.

paulhcsun

Nice work with this change! Just a few comments regarding the naming of the feature flag.

paulhcsun · 2025-05-13T21:18:14Z

packages/aws-cdk-lib/cx-api/lib/features.ts

@@ -137,6 +137,7 @@ export const DYNAMODB_TABLE_RETAIN_TABLE_REPLICA = '@aws-cdk/aws-dynamodb:retain
 export const LOG_USER_POOL_CLIENT_SECRET_VALUE = '@aws-cdk/cognito:logUserPoolClientSecretValue';
 export const PIPELINE_REDUCE_CROSS_ACCOUNT_ACTION_ROLE_TRUST_SCOPE = '@aws-cdk/pipelines:reduceCrossAccountActionRoleTrustScope';
 export const S3_TRUST_KEY_POLICY_FOR_SNS_SUBSCRIPTIONS = '@aws-cdk/s3-notifications:addS3TrustKeyPolicyForSnsSubscriptions';
+export const ENABLE_E2_REMOVE_EGRESSONLYGATEWAY_FROM_PUBLIC_SUBNET_VPC = '@aws-cdk/ec2:removeEgressOnlyGatewayFromPublicSubnetVPC';


nit: I know it's not consistent but the convention is to prefix the service here with aws-. Also we should prefix the constant with the module name EC2- and update the name of the feature flag to more accurately reflect the behaviour.

Suggested change

export const ENABLE_E2_REMOVE_EGRESSONLYGATEWAY_FROM_PUBLIC_SUBNET_VPC = '@aws-cdk/ec2:removeEgressOnlyGatewayFromPublicSubnetVPC';

export const EC2_REQUIRE_PRIVATE_SUBNETS_FOR_EGRESSONLYINTERNETGATEWAY = '@aws-cdk/aws-ec2:requirePrivateSubnetsForEgressOnlyInternetGateway';

paulhcsun · 2025-05-13T21:22:15Z

packages/aws-cdk-lib/cx-api/lib/features.ts

@@ -1576,6 +1577,17 @@ export const FLAGS: Record<string, FlagInfo> = {
  },

  //////////////////////////////////////////////////////////////////////
+  [ENABLE_E2_REMOVE_EGRESSONLYGATEWAY_FROM_PUBLIC_SUBNET_VPC]: {
+    type: FlagType.BugFix,
+    summary: 'Remove EgressOnlyGateway resource when a a double stack vpc has only public subnets',


This doesn't seem entirely correct. Rather than "removing EgressOnlyGateway when a stack only has public subnets", a more accurate summary could be "When enabled, the EgressOnlyGateway resource is only created if private subnets are defined in the VPC."

paulhcsun · 2025-05-13T21:36:36Z

packages/aws-cdk-lib/aws-ec2/lib/vpc.ts

@@ -1649,7 +1649,13 @@ export class Vpc extends VpcBase {
    }

    // Create an Egress Only Internet Gateway and attach it if necessary
-    if (this.useIpv6 && this.privateSubnets) {
+
+    const redundantEgressOnlyGatewayRemovalFeatureFlag =


nit: variable name

Suggested change

const redundantEgressOnlyGatewayRemovalFeatureFlag =

const isRequirePrivateSubnetsForEgressOnlyIgw =

paulhcsun · 2025-05-13T21:53:13Z

packages/aws-cdk-lib/aws-ec2/test/vpc.test.ts

@@ -2747,6 +2747,90 @@ describe('vpc', () => {
      },
    });
  });
+  test('(default)EgressOnlyInternetGateWay is created when no private subnet configured in dual stack', () => {


Instead of (default) EgressOnlyIGW.... maybe change this to say "EgressOnlyIGW is created when....in dual stack when feature flag is enabled."

paulhcsun · 2025-05-13T21:53:35Z

packages/aws-cdk-lib/aws-ec2/test/vpc.test.ts

+    // THEN
+    Template.fromStack(stack).resourceCountIs('AWS::EC2::EgressOnlyInternetGateway', 1);
+  });
+  test('(default)EgressOnlyInternetGateWay is created when private subnet configured in dual stack', () => {


Same as above test.

paulhcsun · 2025-05-13T21:54:36Z

packages/aws-cdk-lib/aws-ec2/test/vpc.test.ts

+    Template.fromStack(stack).resourceCountIs('AWS::EC2::EgressOnlyInternetGateway', 1);
+  });
+
+  test('(feature flag ENABLE_E2_REMOVE_EGRESSONLYGATEWAY_FROM_PUBLIC_SUBNET_VPC)EgressOnlyInternetGateWay is created when private subnet configured in dual stack', () => {


nit:

Suggested change

test('(feature flag ENABLE_E2_REMOVE_EGRESSONLYGATEWAY_FROM_PUBLIC_SUBNET_VPC)EgressOnlyInternetGateWay is created when private subnet configured in dual stack', () => {

test('EgressOnlyInternetGateWay is created when private subnet configured in dual stack when feature flag is enabled', () => {

paulhcsun · 2025-05-13T21:55:33Z

packages/aws-cdk-lib/aws-ec2/test/vpc.test.ts

+    // THEN
+    Template.fromStack(stack).resourceCountIs('AWS::EC2::EgressOnlyInternetGateway', 1);
+  });
+  test(' (feature flag ENABLE_E2_REMOVE_EGRESSONLYGATEWAY_FROM_PUBLIC_SUBNET_VPC)EgressOnlyInternetGateWay is not created when private subnet configured in dual stack', () => {


Suggested change

test(' (feature flag ENABLE_E2_REMOVE_EGRESSONLYGATEWAY_FROM_PUBLIC_SUBNET_VPC)EgressOnlyInternetGateWay is not created when private subnet configured in dual stack', () => {

test(' (feature flag ENABLE_E2_REMOVE_EGRESSONLYGATEWAY_FROM_PUBLIC_SUBNET_VPC)EgressOnlyInternetGateWay is not created when no private subnets are configured in dual stack', () => {

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

github-actions bot added bug This issue is a bug. effort/small Small work item – less than a day of effort p2 labels May 12, 2025

aws-cdk-automation requested a review from a team May 12, 2025 16:39

mergify bot added the contribution/core This is a PR that came from AWS. label May 12, 2025

aws-cdk-automation previously requested changes May 12, 2025

View reviewed changes

maharajhaider changed the title ~~Fix ec2 dual stack redundant egress~~ [Fix] Condition fixed to prevent redundant EgressOnlyInternetGateway creation May 12, 2025

maharajhaider changed the title ~~[Fix] Condition fixed to prevent redundant EgressOnlyInternetGateway creation~~ fix (ec2): Condition fixed to prevent redundant EgressOnlyInternetGateway creation May 12, 2025

maharajhaider force-pushed the fix-ec2-dual-stack-redundant-egress branch from 82ac2e3 to a0d833f Compare May 12, 2025 17:36

paulhcsun self-assigned this May 12, 2025

Maharaj Haider added 8 commits May 12, 2025 15:56

adding unit test to check for EgressOnlyInternetGateWay

a0d2af6

check for privateSubnet to create EgressOnlyInternetGateWay

13bd3c0

reformatted vpc.test.ts

526ec3e

reformatted vpc.test.ts

ee737a4

reformatted vpc.test.ts

9b44c78

reformatted vpc.test.ts

e1d3f5a

add feature flag to vpc dual stack change

6b8d59f

added feature flag to vpc dual stack change

427b4a2

maharajhaider force-pushed the fix-ec2-dual-stack-redundant-egress branch from 7332c64 to 427b4a2 Compare May 12, 2025 22:56

Maharaj Haider added 2 commits May 12, 2025 16:02

removed default value

ec230db

reformmated

f5ef6fa

maharajhaider changed the title ~~fix (ec2): Condition fixed to prevent redundant EgressOnlyInternetGateway creation~~ fix (ec2): Condition fixed to prevent redundant EgressOnlyInternetGateway creation(under feature flag) May 12, 2025

Maharaj Haider and others added 4 commits May 12, 2025 16:26

built

264f2cd

updated-md

3d5ce70

Merge branch 'main' into fix-ec2-dual-stack-redundant-egress

6dedf32

resolved merge conflict

d157dce

paulhcsun changed the title ~~fix (ec2): Condition fixed to prevent redundant EgressOnlyInternetGateway creation(under feature flag)~~ fix(ec2): condition fixed to prevent redundant EgressOnlyInternetGateway creation(under feature flag) May 13, 2025

paulhcsun changed the title ~~fix(ec2): condition fixed to prevent redundant EgressOnlyInternetGateway creation(under feature flag)~~ fix(ec2): condition fixed to prevent redundant EgressOnlyInternetGateway creation (under feature flag) May 13, 2025

maharajhaider changed the title ~~fix(ec2): condition fixed to prevent redundant EgressOnlyInternetGateway creation (under feature flag)~~ fix(ec2): dual-stack vpc without private subnets creates EgressOnlyInternetGateway (under feature flag) May 13, 2025

paulhcsun reviewed May 13, 2025

View reviewed changes

paulhcsun added the pr-linter/exempt-integ-test The PR linter will not require integ test changes label May 13, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(ec2): dual-stack vpc without private subnets creates EgressOnlyInternetGateway (under feature flag) #34437

fix(ec2): dual-stack vpc without private subnets creates EgressOnlyInternetGateway (under feature flag) #34437

maharajhaider commented May 12, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

aws-cdk-automation commented May 13, 2025

paulhcsun commented May 13, 2025

paulhcsun left a comment

paulhcsun May 13, 2025

paulhcsun May 13, 2025

paulhcsun May 13, 2025

paulhcsun May 13, 2025

paulhcsun May 13, 2025

paulhcsun May 13, 2025

paulhcsun May 13, 2025

	export const ENABLE_E2_REMOVE_EGRESSONLYGATEWAY_FROM_PUBLIC_SUBNET_VPC = '@aws-cdk/ec2:removeEgressOnlyGatewayFromPublicSubnetVPC';
	export const EC2_REQUIRE_PRIVATE_SUBNETS_FOR_EGRESSONLYINTERNETGATEWAY = '@aws-cdk/aws-ec2:requirePrivateSubnetsForEgressOnlyInternetGateway';

	const redundantEgressOnlyGatewayRemovalFeatureFlag =
	const isRequirePrivateSubnetsForEgressOnlyIgw =

	test('(feature flag ENABLE_E2_REMOVE_EGRESSONLYGATEWAY_FROM_PUBLIC_SUBNET_VPC)EgressOnlyInternetGateWay is created when private subnet configured in dual stack', () => {
	test('EgressOnlyInternetGateWay is created when private subnet configured in dual stack when feature flag is enabled', () => {

	test(' (feature flag ENABLE_E2_REMOVE_EGRESSONLYGATEWAY_FROM_PUBLIC_SUBNET_VPC)EgressOnlyInternetGateWay is not created when private subnet configured in dual stack', () => {
	test(' (feature flag ENABLE_E2_REMOVE_EGRESSONLYGATEWAY_FROM_PUBLIC_SUBNET_VPC)EgressOnlyInternetGateWay is not created when no private subnets are configured in dual stack', () => {

fix(ec2): dual-stack vpc without private subnets creates EgressOnlyInternetGateway (under feature flag) #34437

Are you sure you want to change the base?

fix(ec2): dual-stack vpc without private subnets creates EgressOnlyInternetGateway (under feature flag) #34437

Conversation

maharajhaider commented May 12, 2025 • edited Loading

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

aws-cdk-automation left a comment • edited Loading

Choose a reason for hiding this comment

aws-cdk-automation commented May 13, 2025

AWS CodeBuild CI Report

paulhcsun commented May 13, 2025

paulhcsun left a comment

Choose a reason for hiding this comment

paulhcsun May 13, 2025

Choose a reason for hiding this comment

paulhcsun May 13, 2025

Choose a reason for hiding this comment

paulhcsun May 13, 2025

Choose a reason for hiding this comment

paulhcsun May 13, 2025

Choose a reason for hiding this comment

paulhcsun May 13, 2025

Choose a reason for hiding this comment

paulhcsun May 13, 2025

Choose a reason for hiding this comment

paulhcsun May 13, 2025

Choose a reason for hiding this comment

maharajhaider commented May 12, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading