(ec2): (Cannot access the subnet's CIDR)

Describe the bug

Cannot access the CIDR clock after selecting the subnets from an imported VPC. Error: You cannot reference an imported Subnet’s IPv4 CIDR if it was not supplied. Add the ipv4CidrBlock when importing using Subnet.fromSubnetAttributes()

Expected Behavior

I should be able to access the CIDRblock of the subnet since it’s one of the properties so that I can use it to pass it as a source to the Security Group

Current Behavior

It returns an error.

You cannot reference an imported Subnet’s IPv4 CIDR if it was not supplied. Add the ipv4CidrBlock when importing using Subnet.fromSubnetAttributes()

Subprocess exited with error 1

Reproduction Steps

`const vpcId = Fn.importValue(‘ExistingVPC’) const subnet1a = Fn.importValue(‘Subnet1a’) const subnet1b = Fn.importValue(‘Subnet1a’) // Vpc const vpc = Vpc.fromVpcAttributes(this, ‘ExistingVPC’, { vpcId, availabilityZones: Fn.getAzs() }) // Subnets const privateSubnets = vpc.selectSubnets({ subnets: [subnet1a, subnet1b].map(id => Subnet.fromSubnetAttributes(this, id, { subnetId: id, })), availabilityZones: Fn.getAzs(), }).subnets

const postgresPort = Port.tcpRange(5432, 5432) const databaseSecurityGroup = new SecurityGroup(this, 'DatabaseSG`, { vpc, allowAllOutbound: true, securityGroupName: ‘DatabaseSecurityGroup’, }) const postgresConnectionPorts = [ { port: postgresPort, description: ‘tcp5432 PostgreSQL’ }, ]

for (let privateSubnet of privateSubnets) { for (let connectionPort of postgresConnectionPorts) { rdsSecurityGroup.addIngressRule(Peer.ipv4(privateSubnet.ipv4CidrBlock), connectionPort.port, connectionPort.description) } }`

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.26.0

Framework Version

No response

Node.js Version

16

OS

macOS Monterey

Language

Typescript

Language Version

No response

Other information

No response

[peterwoodworth]

This is something that is pretty unclear to a lot of users - I’m working on documentation to improve clarity on what the purposes of different import methods are.

As cory said, please use Vpc.fromLookup() to make calls to your account and that should work 🙂

[corymhall]

fromSubnetAttributes does not perform any lookups on your behalf, it simply allows you to import some data into a CDK native object. In order to have the CDK perform lookups for you, you would need to use the Vpc.fromLookup() method instead.