IPAM VPC

[fradetjulien]

Hello, I want to deploy the following ec2.Vpc with a CIDR allocation done with IPAM.

ec2.Vpc(
    self,
    "VPC",
    vpc_name=f"vpc-{uuid4()}",
    ip_addresses=ec2.IpAddresses.aws_ipam_allocation(
        ipv4_ipam_pool_id=ipam_pool_id,
        ipv4_netmask_length=16,
        default_subnet_ipv4_netmask_length=21,
    ),
    nat_gateway_provider=ec2.NatProvider.gateway(),
    nat_gateways=1,
    max_azs=3,
    subnet_configuration=[
        ec2.SubnetConfiguration(
            name="public1",
            subnet_type=ec2.SubnetType.PUBLIC,
            cidr_mask=24,
        ),
        ec2.SubnetConfiguration(
            name="private1",
            subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS,
            cidr_mask=24,
        ),
        ec2.SubnetConfiguration(
            name="transit1",
            subnet_type=ec2.SubnetType.PRIVATE_ISOLATED,
            cidr_mask=28,
        ),
    ],
    gateway_endpoints={
        "S3": ec2.GatewayVpcEndpointOptions(
            service=ec2.GatewayVpcEndpointAwsService.S3
        ),
        "DynamoDB": ec2.GatewayVpcEndpointOptions(
            service=ec2.GatewayVpcEndpointAwsService.DYNAMODB
        ),
    },
)

However, it is impossible for me to have a successful deployment if the ipv4_netmask_length is < 20.

I can successfully deploy the vpc using an ec2.IpAddresses.aws_ipam_allocation resource with an ipv4_netmask_length >= 20

I receive the following error :

Error: Fn::Cidr's count attribute must be between 1 and 256, 4096 was provided.
      at new FnCidr (/private/var/folders/s8/t9pzpf1s2b19qg675763jwgc0000gn/T/jsii-kernel-1CU08O/node_modules/aws-cdk-lib/core/lib/cfn-fn.js:618:19)
      at Fn.cidr (/private/var/folders/s8/t9pzpf1s2b19qg675763jwgc0000gn/T/jsii-kernel-1CU08O/node_modules/aws-cdk-lib/core/lib/cfn-fn.js:166:37)
      at /private/var/folders/s8/t9pzpf1s2b19qg675763jwgc0000gn/T/jsii-kernel-1CU08O/node_modules/aws-cdk-lib/aws-ec2/lib/ip-addresses.js:95:64
      at Array.map (<anonymous>)
      at AwsIpam.allocateSubnetsCidr (/private/var/folders/s8/t9pzpf1s2b19qg675763jwgc0000gn/T/jsii-kernel-1CU08O/node_modules/aws-cdk-lib/aws-ec2/lib/ip-addresses.js:93:44)
      at Vpc.createSubnets (/private/var/folders/s8/t9pzpf1s2b19qg675763jwgc0000gn/T/jsii-kernel-1CU08O/node_modules/aws-cdk-lib/aws-ec2/lib/vpc.js:674:55)
      at new Vpc (/private/var/folders/s8/t9pzpf1s2b19qg675763jwgc0000gn/T/jsii-kernel-1CU08O/node_modules/aws-cdk-lib/aws-ec2/lib/vpc.js:570:14)
      at Kernel._create (/private/var/folders/s8/t9pzpf1s2b19qg675763jwgc0000gn/T/tmpx0t0nvxv/lib/program.js:9964:29)
      at Kernel.create (/private/var/folders/s8/t9pzpf1s2b19qg675763jwgc0000gn/T/tmpx0t0nvxv/lib/program.js:9693:29)
      at KernelHost.processRequest (/private/var/folders/s8/t9pzpf1s2b19qg675763jwgc0000gn/T/tmpx0t0nvxv/lib/program.js:11544:36)

It seems that the count variable computed here is greater than the maximum allowed value 256 defined here. Causing an error when calling the Fn.cidr method here.

This looks normal to me because :

const count = Math.pow(2, netmask - rootNetmask);
math.pow(2, 28 - 16) = 4096
math.pow(2, 24 - 16) = 256
math.pow(2, 28 - 20) = 256

In my case, I think I need to generate the following CIDRs :

- !Cidr 10.0.0.0/16, 256, 24
- !Cidr 10.0.0.0/16, 4096, 28

But the range limitation from the Fn.cidr method forbids it. I don't understand why..

When I use the ec2.IpAddresses.cidr resource, I have no problem because the allocateSubnetsCidr it is not using the Fn.cidr method. See here.

ec2.Vpc(
    self,
    "VPC",
    vpc_name=f"vpc-{uuid4()}",
    ip_addresses=ec2.IpAddresses.cidr("10.0.0.0/16"),
    nat_gateway_provider=ec2.NatProvider.gateway(),
    nat_gateways=1,
    max_azs=3,
    subnet_configuration=[
        ec2.SubnetConfiguration(
            name="public1",
            subnet_type=ec2.SubnetType.PUBLIC,
            cidr_mask=24,
        ),
        ec2.SubnetConfiguration(
            name="private1",
            subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS,
            cidr_mask=24,
        ),
        ec2.SubnetConfiguration(
            name="transit1",
            subnet_type=ec2.SubnetType.PRIVATE_ISOLATED,
            cidr_mask=28,
        ),
    ],
    gateway_endpoints={
        "S3": ec2.GatewayVpcEndpointOptions(
            service=ec2.GatewayVpcEndpointAwsService.S3
        ),
        "DynamoDB": ec2.GatewayVpcEndpointOptions(
            service=ec2.GatewayVpcEndpointAwsService.DYNAMODB
        ),
    },
)

I'm sure I must have misunderstood certain notions or functions, sorry in advance. Any help would be really appreciated!

[fradetjulien]

Issue open : #25537

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.