fix: support Amazon Linux 2023 for NAT instance

[konokenj]

Summary

CDK's NatInstanceProviderV2 uses the route command in its default user data, which requires the net-tools package. However, Amazon Linux 2023 (the default AMI for NatInstanceProviderV2) doesn't have net-tools pre-installed, causing NAT instances to fail silently.

Problem

The default user data in CDK contains:

sudo /sbin/iptables -t nat -A POSTROUTING -o $(route | awk '/^default/{print $NF}') -j MASQUERADE

This fails on AL2023 because the route command is not available.

Solution

This change provides custom user data that uses ip route instead of route to determine the default network interface:

IFACE=$(ip route show default | awk '{print $5}')
/sbin/iptables -t nat -A POSTROUTING -o $IFACE -j MASQUERADE

Reference

• CDK source code: https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-ec2/lib/nat.ts

Testing

• Deployed the stack with the fix and verified NAT instance works correctly
• Application accessible via CloudFront (returns 307 redirect to sign-in page as expected)

[tmokmss]

Hi, the NatInstanceProviderV2 is intended to use AL2023, so if it does not work, it's a bug.

The instance uses Amazon Linux 2023 as the operating system.

Can you open an issue in the aws-cdk repo?

[konokenj]

Reported aws/aws-cdk#36912

[tmokmss]

The route command is included in the net-tools package (source), which is installed by default on both the AL2023 standard AMI and Minimal AMI (AL2023 image comparison) (except the container image.)

I found another case that the initialization of NAT instance fails (which you also mentioned), and the PR is in review: aws/aws-cdk#36717