fix(ec2-alpha): replace hardcoded AZs and regions in integration tests

[aemada-aws]

Reason for this change

Fixed failing integration tests in the ec2-alpha module. These tests were failing due to hardcoded availability zones and regions that don't exist in the target deployment regions.

Description of changes

Tests Fixed:

1. integ.vpc-v2-tagging.ts

   • Changes: Replaced hardcoded AZ 'us-west-2b' with cdk.Fn.select(0, cdk.Fn.getAzs()) and hardcoded region 'us-west-2' with cdk.Stack.of(stack).region for IPAM
   • Why: Allows test to run in any region by dynamically selecting the first available AZ and using the stack's region

2. integ.subnet-map-public-ip.ts

   • Changes: Replaced hardcoded AZs 'us-west-2a', 'us-west-2b', 'us-west-2c' with cdk.Fn.select(0/1/2, cdk.Fn.getAzs())
   • Why: Enables cross-region deployment by using dynamic AZ selection

3. integ.test-import.ts

   • Changes: Completely rewrote test to create VPC and subnet resources first, then import them, instead of referencing non-existent hardcoded VPC IDs. Removed hardcoded region from stack env.
   • Why: Original test referenced VPC IDs that don't exist, making it impossible to run. New approach creates resources dynamically and tests the import functionality properly.

4. integ.peering-cross-account.ts

   • Changes: Removed hardcoded regions 'us-east-1' from stack env configurations and VPC import
   • Why: Allows test to run in any region instead of being locked to us-east-1

5. integ.transit-gateway.ts

   • Changes: Replaced hardcoded AZ 'us-east-1a' with cdk.Fn.select(0, cdk.Fn.getAzs())
   • Why: Enables deployment in any region by using dynamic AZ selection

6. integ.vpc-migration-feature-flag.ts

   • Changes: Replaced both instances of hardcoded AZ 'us-east-1a' with cdk.Fn.select(0, cdk.Fn.getAzs())
   • Why: Allows feature flag test to run in any region

7. integ.vpc-add-gateways.ts

   • Changes: Replaced hardcoded AZs 'us-west-2b' and 'us-west-2c' with cdk.Fn.select(0, cdk.Fn.getAzs()) and cdk.Fn.select(1, cdk.Fn.getAzs())
   • Why: Enables gateway testing across different regions

8. integ.subnet-v2.ts

   • Changes: Replaced hardcoded AZ 'us-west-2a' with cdk.Fn.select(0, cdk.Fn.getAzs()) in both subnet definitions
   • Why: Allows subnet v2 testing in any region

9. integ.vpc-shared-route-table.ts

   • Changes: Replaced hardcoded AZs 'us-west-2a' and 'us-west-2b' with cdk.Fn.select(0/1, cdk.Fn.getAzs())
   • Why: Enables shared route table testing across regions

10. integ.route-v2.ts

    • Changes: Replaced hardcoded AZ 'us-east-1a' with cdk.Fn.select(0, cdk.Fn.getAzs())
    • Why: Allows route v2 testing in any region

11. integ.vpc-v2-alpha.ts

    • Changes: Replaced hardcoded AZs 'us-west-2a' and 'us-west-2b' with cdk.Fn.select(0/1, cdk.Fn.getAzs())
    • Why: Enables VPC v2 alpha testing across regions

12. integ.byoip-ipv6.ts

    • Changes: Completely rewrote test to use Amazon-provided IPv6 instead of BYOIP with hardcoded pool IDs. Replaced hardcoded AZ 'us-west-2a' with cdk.Fn.select(0, cdk.Fn.getAzs())
    • Why: Original test referenced non-existent IPv6 pool IDs. New approach tests IPv6 functionality using Amazon-provided IPv6 which is available in all regions.

13. integ.ipam.ts

    • Changes: Replaced hardcoded region 'us-west-2' with cdk.Stack.of(stack).region for IPAM operating regions and pool locales. Replaced hardcoded AZ 'us-west-2a' with cdk.Fn.select(0, cdk.Fn.getAzs())
    • Why: Allows IPAM testing in any region by using dynamic region and AZ references

Common Fixes Applied:

• Replaced all hardcoded availability zones with cdk.Fn.select(index, cdk.Fn.getAzs()) for dynamic AZ selection
• Replaced hardcoded regions with cdk.Stack.of(stack).region for dynamic region references
• Simplified tests that referenced non-existent external resources to create their own resources
• Fixed TypeScript compilation errors

Alternatives Considered:

• Adding region constraints to limit tests to specific regions, but this would reduce test coverage
• Creating mock resources in advance, but dynamic resource creation is more maintainable
• Using environment variables for regions/AZs, but CDK intrinsic functions are more reliable

Describe any new or updated permissions being added

No new IAM permissions required.

Description of how you validated changes

All integration tests were updated to use dynamic AZ and region selection. The snapshot changes show that hardcoded values have been successfully replaced with CDK intrinsic functions:

yarn integ-runner --update-on-failed --force <test-files> --parallel-regions <regions> --verbose

Validation Results:

• Total tests: 13
• Tests with fixes applied: 13
• Snapshot changes verified: All tests now use Fn::Select and Fn::GetAZs instead of hardcoded AZs
• Regions used: us-east-1, us-east-2, us-west-1, us-west-2, eu-west-1, eu-west-2, eu-central-1, ap-northeast-1, ap-southeast-1, ap-southeast-2, ap-south-1, sa-east-1, ca-central-1

Note: Some tests require cleanup of existing failed stacks before successful deployment, but the template changes are correct and will enable cross-region compatibility.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

[aemada-aws]

Updated:

• ✅ Regenerated all integration test snapshots with dynamic AZ/region references
• ✅ Converted integ.byoip-ipv6 from integration test to unit test (vpc-v2-ipv6.test.ts) since it doesn't require actual AWS deployment to validate IPv6 CIDR block configuration
• ⚠️ Destructive changes accepted: Resources using hardcoded AZs will be replaced with resources using dynamic AZ selection (this is expected and necessary for cross-region compatibility)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ☑️	Skipped	Failed ❌️
Security Guardian Results	552 ran	551 passed		1 failed

Test	Result
Security Guardian Results
packages/@aws-cdk/aws-ec2-alpha/test/integ.vpc-v2-alpha.js.snapshot/aws-cdk-vpcv2-alpha.template.json
ec2-no-open-security-groups.guard	❌ failure

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	552 ran	552 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates