(aws-ec2): Why are NAT gateways required for private subnets?

❓ General Issue

The Question

I’m very curious why this check is in place: https://github.com/aws/aws-cdk/blob/283ed02c64f827161edba3e11c3cead3b54b7ee9/packages/%40aws-cdk/aws-ec2/lib/vpc.ts#L2036-L2039

NAT gateways are, if I’m not mistaken, only required if resources within your private subnets need to access the Internet through an Internet gateway. In this case, I’m unable to use CDK to create a ServerlessCluster, because the SubnetGroup can’t be defined without giving it a VPC with private subnets, which strangely require NAT Gateways. If I try to create a SubnetGroup using a VPC with public & isolated subnets, it complains and says I need to use private subnets: Error: There are no 'Private' subnet groups in this VPC. Available types: Isolated,Public

[njlynch]

@ffxsam:

It’s a fair criticism that our concept of ISOLATED may cause unintentional confusion. I’ve submitted a PR to rename PRIVATE and ISOLATED to PRIVATE_WITH_NAT and PRIVATE_ISOLATED to hopefully make this clearer.

[ffxsam]

Case in point: