Subnet selection returns more than one per AZ

Note: for support questions, please first reference our documentation, then use Stackoverflow. This repository’s issues are intended for feature requests and bug reports.

• I’m submitting a …

  • 🪲 bug report
  • 🚀 feature request
  • 📚 construct library gap
  • ☎️ security issue or vulnerability => Please see policy
  • ❓ support request => Please see note at the top of this template.

• What is the current behavior? If the current behavior is a 🪲bug🪲: Please provide the steps to reproduce

Creation of an ALB is failing with an error that it is getting more than one subnet per AZ.

A load balancer cannot be attached to multiple subnets in the same Availability Zone (Service: AmazonElasticLoadBalancingV2; Status Code: 400; Error Code: InvalidConfigurationRequest;

code to reproduce:

      const vpcId = "vpc-xxxxxx";

      const vpc = ec2.Vpc.fromLookup(this, "Vpc", { vpcId: vpcId });

      const alb = new elbv2.ApplicationLoadBalancer(this, id + "LoadBalancer", {
        loadBalancerName: id + 'ALB',
        vpc: vpc,
        internetFacing: false,
        vpcSubnets: {subnetType: ec2.SubnetType.PRIVATE, onePerAz: true}
      });

cdk synth shows a long list of subnets.

console.log(vpc.selectSubnets({subnetType: ec2.SubnetType.PRIVATE, onePerAz: true}).availabilityZones outputs

[
  'us-east-1c', 'us-east-1d',
  'us-east-1d', 'us-east-1d',
  'us-east-1d', 'us-east-1d',
  'us-east-1d', 'us-east-1d',
  'us-east-1d', 'us-east-1d',
  'us-east-1e', 'us-east-1e',
  'us-east-1e', 'us-east-1e',
  'us-east-1e', 'us-east-1e',
  'us-east-1e', 'us-east-1e',
  'us-east-1e', 'us-east-1e',
  'us-east-1e', 'us-east-1e',
  'us-east-1e', 'us-east-1e'
]

Having looked at the implementation, it seems that all private subnets retrieved for the VPC have “Private” returned from subnetName() and the implementation of onePerAz simply filters like this:

subnets = subnets.filter(s => subnetName(s) === subnetName(subnets[0]));

so it returns all the subnets, not just one per AZ.

Selecting by subnetName does not actually seem to use the Name shown in the AWS console.

• What is the expected behavior (or behavior of feature suggested)? onePerAz: true should return exactly one subnet per AZ.

• What is the motivation / use case for changing the behavior or adding this feature? trying to create an ALB inside an existing VPC

• Please tell us about your environment:

  • CDK CLI Version: 0.36.0 (build 6d38487)
  • Module Version: “@aws-cdk/aws-ec2”: “^0.36.0”
  • OS: OSX Mojave
  • Language: TypeScript

• Other information (e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. associated pull-request, stackoverflow, gitter, etc)

[angusfz]

Same issue here. Creating internal ALB with imported VPC which has multiple private subnets in the same AZ, but onePerAz return all subnets. This will interrupt CDK deploy and return error as below

A load balancer cannot be attached to multiple subnets in the same Availability Zone

Here is the workaround and any suggestion will be appreciated.

    // Import Vpc
    const vpc = ec2.Vpc.fromLookup(this, 'VPC', { vpcName: 'EXISTED_VPC_NAME' });

    // Handle one subnet per AZ
    const subnets: ISubnet[] = [] as ISubnet[];
    vpc.privateSubnets.forEach(subnet => {
      if (subnets.length == 0) {
        subnets.push(subnet);
      } else if (
        subnets.length < 2 &&
        subnets.find(v => {
          if (v.availabilityZone == subnet.availabilityZone) {
            return false;
          }
          return true;
        })
      ) {
        subnets.push(subnet);
      }
    });

    // ALB
    const applicationLoadBalancer = new ApplicationLoadBalancer(tagGroup, 'applicationLoadBalancer', {
      vpc,
      internetFacing: false,
      //vpcSubnets: vpc.selectSubnets({ onePerAz: true})
      vpcSubnets: vpc.selectSubnets({ subnets })
    });

[giovannidegani]

Facing the same issue with the latest CDK, onePerAz does not work as expected, in my case are subnets in a VPC that were created by a central team and thus not managed by CDK.