aws-ec2: VPC Construct - Use of vpc.vpcIpv6CidrBlocks does not model VPCCidrBlock dependency in CFN

[kkpezesh]

Describe the bug

When using the VPC construct to model a dual-stack VPC, one cannot guarantee references to the VPC's underlying IPv6 CIDR block(s) exist at deployment time (no direct references available to mark AWS::EC2::VPCCidrBlock as a dependency).

During CFN deployments, this may cause race conditions between CIDR creation and dependent resource creation (ex: a security group).

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

When referencing the vpcIpv6CidrBlocks field of a CDK VPC, one expects the underlying AWS::EC2::VPCCidrBlock to exist already. One can use vpcIpv6CidrBlocks to model security groups (and other relevant resources).

Current Behavior

When referencing the vpcIpv6CidrBlocks field of a CDK VPC to model another resource (ex: security group), one may encounter deployment failures.

Logical ID: SecurityGroupIpv6XXX
Status: CREATE_FAILED
Status Reason: Template error: Fn::Select cannot select nonexistent value at index 0

Generated CFN JSON for AWS::EC2::SecurityGroup contains reference to AWS::EC2::VPC resource, not the AWS::EC2::VPCCidrBlock resource

{
  "DualStackVpcXXX": {
    "Type": "AWS::EC2::VPC",
    "Properties": {
      "CidrBlock": "10.0.0.0/16",
      "EnableDnsHostnames": true,
      "EnableDnsSupport": true,
      "InstanceTenancy": "default",
      "Tags": [
        {
          "Key": "Name",
          "Value": "XXX/DualStackVpc"
        }
      ]
    },
    "Metadata": {
      "aws:cdk:path": "XXX/DualStackVpc/Resource"
    }
  },
  ...
  "DualStackVpcipv6cidrXXX": {
    "Type": "AWS::EC2::VPCCidrBlock",
    "Properties": {
      "AmazonProvidedIpv6CidrBlock": true,
      "VpcId": {
        "Ref": "DualStackVpcXXX"
      }
    },
    "Metadata": {
      "aws:cdk:path": "XXX/DualStackVpc/ipv6cidr"
    }
  },
  ...
  "SecurityGroupIpv6XXX": {
    "Type": "AWS::EC2::SecurityGroup",
    "Properties": {
      "GroupDescription": "Security group for IPv6 PrivateLinks",
      "SecurityGroupEgress": [
        {
          "CidrIp": "255.255.255.255/32",
          "Description": "Disallow all traffic",
          "FromPort": 252,
          "IpProtocol": "icmp",
          "ToPort": 86
        }
      ],
      "SecurityGroupIngress": [
        {
          "CidrIpv6": {
            "Fn::Select": [
              0,
              {
                "Fn::GetAtt": [
                  "DualStackVpcXXX",
                  "Ipv6CidrBlocks"
                ]
              }
            ]
          },
          "Description": "Allow IPv6 traffic from within VPC",
          "FromPort": 443,
          "IpProtocol": "tcp",
          "ToPort": 443
        }
      ],
      "VpcId": {
        "Ref": "DualStackVpcXXX"
      }
    },
    "Metadata": {
      "aws:cdk:path": "XXX/SecurityGroupIpv6XXX/Resource"
    }
  }
}
...

Reproduction Steps

1. Model a dual-stack VPC and a security group using the VPC's vpcIpv6CidrBlocks field

const dualStackVpc: ec2.Vpc = new ec2.Vpc(this, 'DualStackVpc', {
  ipProtocol: ec2.IpProtocol.DUAL_STACK
});

const privatelinkSecurityGroup: ec2.SecurityGroup = new ec2.SecurityGroup(this, 'SecurityGroupIpv6', {
  vpc: vpc,
  allowAllOutbound: false,
  allowAllIpv6Outbound: false,
  description: 'Security group for IPv6 PrivateLinks',
});

// possible race condition; CREATE_FAILED for reason Fn::Select cannot select nonexistent value at index 0
privatelinkSecurityGroup.addIngressRule(
  Peer.ipv6(Fn.select(0, dualStackVpc.vpcIpv6CidrBlocks)),
  Port.tcp(443),
  'Allow IPv6 traffic from within VPC'
);

2. Attempt to deploy the CFN stack
3. Observe create failure for SecurityGroup during CFN deployment

Please note failures depend on server-side conditions. If the IPv6 CIDR is allocated quickly, the deployment may succeed

Possible Solution

No response

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

2.221.1

AWS CDK CLI version

2.1100.3

Node.js Version

20

OS

Amazon Linux 2

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

                  CloudFormation Deployment
                    ========================

    ┌─────────────────────────────────────────────────────────────┐
    │                    CURRENT BEHAVIOR (BUG)                   │
    └─────────────────────────────────────────────────────────────┘

         ┌──────────────┐
         │  AWS::EC2::  │
         │     VPC      │──────────────────────────────────┐
         │              │                                  │
         └──────┬───────┘                                  │
                │                                          │
                │ VpcId (implicit dep)                     │ Fn::GetAtt
                ▼                                          │ Ipv6CidrBlocks
         ┌──────────────┐                                  │
         │ AWS::EC2::   │                                  │
         │ VPCCidrBlock │  ◄── IPv6 CIDR allocated here    │
         │   (ipv6)     │      (takes time!)               │
         └──────────────┘                                  │
                                                           │
                ❌ NO DEPENDENCY! ❌                        │
                                                           ▼
                                                  ┌──────────────┐
                                                  │ AWS::EC2::   │
                                                  │SecurityGroup │
                                                  │              │
                                                  │ CidrIpv6:    │
                                                  │ Fn::Select(0,│
                                                  │  VPC.Ipv6...)│
                                                  └──────────────┘

    ┌─────────────────────────────────────────────────────────────┐
    │                      RACE CONDITION                         │
    ├─────────────────────────────────────────────────────────────┤
    │                                                             │
    │   Time ──────────────────────────────────────────────────►  │
    │                                                             │
    │   VPC Created ─────┐                                        │
    │                    │                                        │
    │   VPCCidrBlock ────┼──────────────────────► IPv6 Ready      │
    │   (still creating) │                                        │
    │                    │                                        │
    │   SecurityGroup ───┼──► Fn::Select(0, [])                   │
    │   (created early)  │         │                              │
    │                    │         ▼                              │
    │                    │    💥 CREATE_FAILED                    │
    │                    │    "cannot select nonexistent          │
    │                    │     value at index 0"                  │
    │                                                             │
    └─────────────────────────────────────────────────────────────┘

    ┌─────────────────────────────────────────────────────────────┐
    │                   EXPECTED BEHAVIOR (FIX)                   │
    └─────────────────────────────────────────────────────────────┘

         ┌──────────────┐
         │  AWS::EC2::  │
         │     VPC      │
         └──────┬───────┘
                │
                │ VpcId
                ▼
         ┌──────────────┐
         │ AWS::EC2::   │
         │ VPCCidrBlock │
         │   (ipv6)     │
         └──────┬───────┘
                │
                │ ✅ EXPLICIT DependsOn
                ▼
         ┌──────────────┐
         │ AWS::EC2::   │
         │SecurityGroup │
         └──────────────┘

         SecurityGroup waits for VPCCidrBlock to complete
         before trying to read Ipv6CidrBlocks

Hi @kkpezesh,

Thank you for reporting this race condition issue with dual-stack VPC deployments. I haven't reproduced this issue yet but from what I can read in the source, this is seems to be a valid bug in the CDK VPC construct.

From my analysis, the problem occurs because the vpcIpv6CidrBlocks property references the VPC resource's Ipv6CidrBlocks attribute directly, without establishing a dependency on the separate AWS::EC2::VPCCidrBlock resource that actually creates the IPv6 CIDR block.

Workaround for now:
You can work around this by manually adding a dependency:

const dualStackVpc = new ec2.Vpc(this, 'DualStackVpc', {
  ipProtocol: ec2.IpProtocol.DUAL_STACK
});

const privatelinkSecurityGroup = new ec2.SecurityGroup(this, 'SecurityGroupIpv6', {
  vpc: dualStackVpc,
  allowAllOutbound: false,
  allowAllIpv6Outbound: false,
  description: 'Security group for IPv6 PrivateLinks',
});

// Add explicit dependency on the IPv6 CIDR block
const vpcCidrBlock = dualStackVpc.node.findChild('ipv6cidr') as CfnVPCCidrBlock;
privatelinkSecurityGroup.node.addDependency(vpcCidrBlock);

privatelinkSecurityGroup.addIngressRule(
  Peer.ipv6(Fn.select(0, dualStackVpc.vpcIpv6CidrBlocks)),
  Port.tcp(443),
  'Allow IPv6 traffic from within VPC'
);

Proposed Fix:
We should modify the Vpc class to ensure proper dependencies are established when IPv6 CIDR blocks are referenced.

Would you be interested in contributing a fix for this issue? The change would involve updating the VPC construct to handle IPv6 CIDR dependencies properly. We'd be happy to provide guidance on the implementation approach!