fix(ec2): warn when a VPC has no availability zones

[caglarkc]

Issue # (if applicable)

Closes #32451.

Description of changes

An explicit empty availability-zone list silently creates no subnets and can produce misleading downstream errors. Add a suppressible synthesis warning without rejecting existing VPC configurations. Tokenized lists and normal AZ defaults remain accepted. The warning only applies to an explicitly empty availabilityZones list when subnets are requested; intentional subnetConfiguration: [] and maxAzs: 0 do not receive this warning.

Validation: 193 tests passed on this independent branch; changed TypeScript files passed ESLint. Strict JSII/TypeScript compilation passed with all five independent changes combined on a local validation branch.

Integration test exemption requested: this change only adds synth-time metadata. Unit tests cover empty, omitted, explicit nonempty, and tokenized AZ lists; no deployed resource behavior changes.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[caglarkc]

The validate-pr job failed while installing dependencies from the base branch, before the PR validation ran: npm returned 502 Bad Gateway for constant-case-3.0.4.tgz.

Failed job. I attempted to rerun it, but GitHub requires repository administrator access. Could a maintainer rerun the failed job?

Could you also consider pr-linter/exempt-integ-test for this synthesis-warning change? The independent branch passes 193 VPC tests, including explicit empty/nonempty, omitted and tokenized AZ lists, plus intentionally empty subnet configurations. The change adds diagnostic metadata and does not alter deployed resources.

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Fixes must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

[maintainer-for-aws]

Automated review

A maintainer will still review this — treat the notes below as a starting point.

📌 Commit ccf88c4

This PR adds a suppressible synthesis-time warning to the ec2.Vpc L2 construct: when a VPC is given an explicitly empty, non-token availabilityZones: [] while subnets are still being requested, the constructor now emits Annotations.of(this).addWarningV2('@aws-cdk/aws-ec2:emptyAvailabilityZonesInVpc', ...) to steer users away from a configuration that would silently create no subnets. It also adds four unit tests covering the empty, omitted, populated, intentionally-subnetless, and tokenized cases.

The change is clean and backward-compatible. It warns rather than throws, so no previously-valid stack is rejected; the guard keys off the explicit prop and short-circuits on tokens (!Token.isUnresolved) so a tokenized AZ list is not mistaken for an empty one. It introduces no new public API surface, no template or logical-ID change, and no security-relevant change, and it follows the namespaced warning-id convention already used in the same constructor. Test coverage exercises each branch of the guard with assertions that fire on regression, and the warning-only nature makes the integ-test exemption appropriate. No issues found on this change.

🔴 0 blocking · 🟡 0 recommended · ⚪ 0 optional

---

Generated automatically. React 👍 or 👎 to tell us whether this review helped, so we can improve these reviews.

[caglarkc]

The latest validate-pr run has now passed after the PR description update triggered a new run. No rerun is needed for the earlier npm 502 failure. The integration-test exemption request above remains for maintainer consideration.