VPC Creation fails with 1.4.0

🐛 Bug Report

What is the problem?

I am getting an error when I take one of the examples and deploy a simple VPC using CDK 1.4.0.

    "ExitusVpcexitusdevisolatedSubnet2Subnet32F7F7C1": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "CidrBlock": "10.0.160.0/19",
        "VpcId": {
          "Ref": "ExitusVpcD13CB330"
        },
        "AvailabilityZone": {
          "Fn::Select": [
            1,
            {
              "Fn::GetAZs": ""
            }
          ]
        },

Error is:

Template error: Subnet32F7F7C1) Template error: Fn::Select cannot select nonexistent value at index 1

Reproduction Steps

I am using the following code in Typescript.

class VPCStack extends Stack {
    vpc: Vpc;
    constructor(scope: App, id: string, props?: StackProps) {
        super(scope, id, props);
        // Network to run everything in
        this.vpc = new Vpc(this, `${appName}Vpc`, {
            cidr: "10.0.0.0/16",
            maxAzs: 2,
            natGateways: 1,
            subnetConfiguration: [
                {
                    name: `${appName.toLowerCase()}-${envName}-public`,
                    subnetType: SubnetType.PUBLIC,
                },
                {
                    name: `${appName.toLowerCase()}-${envName}-private`,
                    subnetType: SubnetType.PRIVATE,
                },
                {
                    name: `${appName.toLowerCase()}-${envName}-isolated`,
                    subnetType: SubnetType.ISOLATED,
                },
            ]
        });
    }
}

Verbose Log

  0/29 | 7:58:57 PM | CREATE_IN_PROGRESS   | AWS::CDK::Metadata                    | CDKMetadata 
  0/29 | 7:58:57 PM | CREATE_IN_PROGRESS   | AWS::EC2::InternetGateway             | ExitusVpc/IGW (ExitusVpcIGWC05543FA) 
  0/29 | 7:58:58 PM | CREATE_IN_PROGRESS   | AWS::EC2::EIP                         | ExitusVpc/exitus-dev-publicSubnet1/EIP (ExitusVpcexitusdevpublicSubnet1EIP929BF818) 
  0/29 | 7:58:58 PM | CREATE_IN_PROGRESS   | AWS::EC2::InternetGateway             | ExitusVpc/IGW (ExitusVpcIGWC05543FA) Resource creation Initiated
  0/29 | 7:58:58 PM | CREATE_IN_PROGRESS   | AWS::EC2::VPC                         | ExitusVpc (ExitusVpcD13CB330) 
  0/29 | 7:58:58 PM | CREATE_IN_PROGRESS   | AWS::EC2::EIP                         | ExitusVpc/exitus-dev-publicSubnet1/EIP (ExitusVpcexitusdevpublicSubnet1EIP929BF818) Resource creation Initiated
  0/29 | 7:58:58 PM | CREATE_IN_PROGRESS   | AWS::EC2::VPC                         | ExitusVpc (ExitusVpcD13CB330) Resource creation Initiated
Stack exitus-vpc-dev is still not stable (CREATE_IN_PROGRESS)
  0/29 | 7:58:59 PM | CREATE_IN_PROGRESS   | AWS::CDK::Metadata                    | CDKMetadata Resource creation Initiated
  1/29 | 7:58:59 PM | CREATE_COMPLETE      | AWS::CDK::Metadata                    | CDKMetadata 
Stack exitus-vpc-dev is still not stable (CREATE_IN_PROGRESS)
Stack exitus-vpc-dev is still not stable (CREATE_IN_PROGRESS)
  2/29 | 7:59:13 PM | CREATE_COMPLETE      | AWS::EC2::InternetGateway             | ExitusVpc/IGW (ExitusVpcIGWC05543FA) 
  3/29 | 7:59:13 PM | CREATE_COMPLETE      | AWS::EC2::EIP                         | ExitusVpc/exitus-dev-publicSubnet1/EIP (ExitusVpcexitusdevpublicSubnet1EIP929BF818) 
  4/29 | 7:59:15 PM | CREATE_COMPLETE      | AWS::EC2::VPC                         | ExitusVpc (ExitusVpcD13CB330) 
Stack exitus-vpc-dev is still not stable (CREATE_IN_PROGRESS)
  5/29 | 7:59:16 PM | CREATE_FAILED        | AWS::EC2::Subnet                      | ExitusVpc/exitus-dev-isolatedSubnet2/Subnet (ExitusVpcexitusdevisolatedSubnet2Subnet32F7F7C1) Template error: Fn::Select  cannot select nonexistent value at index 1
	new Subnet (/home/username/Code/somewhere/infra/node_modules/@aws-cdk/aws-ec2/lib/vpc.ts:1167:20)
	\_ new PrivateSubnet (/home/username/Code/somewhere/infra/node_modules/@aws-cdk/aws-ec2/lib/vpc.ts:1285:5)
	\_ /home/username/Code/somewhere/infra/node_modules/@aws-cdk/aws-ec2/lib/vpc.ts:1045:34

Environment

• CDK CLI Version:
• Module Version:
• OS:
• Language:

CDK: 1.4.0 Node: v12.8.0 OS: Ubuntu 19.04 Language: TypeScript

Other information

[dstroppa]

@wolfeidau Can you confirm if the Region you are deploying to has a default subnet in all the AZs?

From the docs: " […] the Fn::GetAZs function returns only Availability Zones that have a default subnet unless none of the Availability Zones has a default subnet; in that case, all Availability Zones are returned. "

[wolfeidau]

Spot on @dstroppa someone created a default VPC in our account and it has 3 subnets but only one is marked as a default subnet.

Moved to another region with a correctly configured default vpc / subnets and it works 💯

I now recall having this happen a long time a ago.

Hopefully everyone files this under FAQ, traps for the unwitting Cloudformation/CDK developer 😉