[ec2-vpc]: SubnetSelection with AZs with vpc contruct in same application

Describe the issue

Hello team,

We identified an issue: the .selectSubnets() method doesn't function with availabilityZones when the VPC is within the same application, example snippet:

  const supportedAZs = ['us-east-1d', 'us-east-1a', 'us-east-1c'];
  const selectedSubnets = vpc.selectSubnets({
          availabilityZones: supportedAZs,
          subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS
      });

Upon verification, it's apparent that the AZ value acts as the TOKEN placeholder during the stack's synthesis, leading the above selectedSubnets to return empty. Notably, this operates correctly if the VPC is imported from an existing one.

Should this be intended behavior, might we request an update to the documentation, specifically regarding the availabilityZones parameter within the SubnetSelection interface, to prevent future confusion?

Links

e

const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 3 });
const supportedAZs = ['us-east-1d', 'us-east-1a', 'us-east-1c'];
const selectedSubnets = vpc.selectSubnets({
		availabilityZones: supportedAZs,
		subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS
});

new CfnOutput(this, 'selectedSubnets', { value: selectedSubnets.subnetIds.join(',')})

If you create a new VPC in the app, you will not now the selected subnetIds until deployment so you will only get the tokens.

Can you specify which document statement should be improved?

Hi pahud,
Thanks for confirmation.
I would suggest add this in the availibilityZones prop description in this doc https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SubnetSelection.html#availabilityzones

const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 3 });
const supportedAZs = ['us-east-1d', 'us-east-1a', 'us-east-1c'];
const selectedSubnets = vpc.selectSubnets({
		availabilityZones: supportedAZs,
		subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS
});

new CfnOutput(this, 'selectedSubnets', { value: selectedSubnets.subnetIds.join(',')})

If you create a new VPC in the app, you will not now the selected subnetIds until deployment so you will only get the tokens.

I'm still quite confused here. What is the correct solution then to select subnets by availabilityZones? I am creating a VPC in one stack and then trying to do subnet selection in a separate stack so the VPC and subnets should already be created at this point.

Can you specify which document statement should be improved?

In addition to documentation, shouldn't this throw an error at compile time letting you know you're doing something wrong using the Token.isUnresolved function? Other constructs will throw: ValidationError: All arguments to TK must be concrete (no Tokens)

Potentially related issues:

I found the answer - it turns out that if we are using intrinsics (i.e. Fn::GetAZs) then we cannot use vpc.selectSubnets with availabilityZones. Instead, use explicit AZ names as strings.

Implemented in #39283.

Documents synthesis-time matching of literal AZ names against subnet AZs, and shows an explicit-AZ VPC example. Verified both the working example and the unresolved-token empty selection; Rosetta and all 187 VPC tests pass.

The PR includes a closing reference for this issue; closure will follow merge.

Navigation Menu

Repository navigation

[ec2-vpc]: SubnetSelection with AZs with vpc contruct in same application #27540

Describe the issue

Links

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[ec2-vpc]: SubnetSelection with AZs with vpc contruct in same application #27540

Description

Describe the issue

Links

Activity

pahud commented on Oct 17, 2023

annguyen36 commented on Oct 17, 2023

AlJohri commented on May 24, 2025

AlJohri commented on May 27, 2025

caglarkc commented on Oct 15, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions