aws_cdk.ec2.VPC: Confusing error for valid CIDR range, but using /28

[nikolic-milan]

Describe the bug

I am trying to configure a VPC for my kubernetes cluster. As I want to use the Amazon VPC CNI plugin per the user guide (https://docs.aws.amazon.com/eks/latest/userguide/cni-increase-ip-addresses.html) I need /28 CIDR. So I tried creating the vpc with the fallowing code

vpc = ec2.Vpc(
            self,
            "some-id",
            ip_addresses=ec2.IpAddresses.cidr("10.100.0.0/28"),
            vpc_name="some-name",
        )

But I get an error:
RuntimeError: x.x.x.x/31 is not a valid VPC CIDR range (must be between /16 and /28)

What's happening? Should I configure my VPC with /25 and expect it add 3 to it, if yes it seems wierd, why?

Expected Behavior

To create a /28 VPC.

Current Behavior

GIves an error: RuntimeError: x.x.x.x/31 is not a valid VPC CIDR range (must be between /16 and /28)

Reproduction Steps

aws-cdk-lib==2.98.0
aws-cdk.asset-awscli-v1==2.2.200
aws-cdk.asset-kubectl-v20==2.1.2
aws-cdk.asset-node-proxy-agent-v6==2.0.1
aws-cdk.lambda-layer-kubectl-v27==2.0.0

Above versions. And try to create a /28 VPC.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.98.0

Framework Version

No response

Node.js Version

18.15.0

OS

Windows

Language

Python

Language Version

3.11.5

Other information

No response

[msambol]

I was able to confirm this. VPC size can be between /16 and /28 but the minimum size for a subnet is /28, so when multiple subnets are provisioned it fails. This could be a code or documentation change IMO. @mrgrain thoughts? Happy to take this issue with some input from you.

[indrora]

This is a constraint enforced by EC2 VPCs themselves, not the CDK: https://docs.aws.amazon.com/vpc/latest/userguide/vpc-cidr-blocks.html

The Minimum size for a subnet is the smallest subnet possible within an EC2 VPC, /28.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[msambol]

@indrora right but I think the error message is confusing. it says VPC CIDR range (must be between /16 and /28), but if you put in a /28 VPC CIDR, it can result in a smaller than /28 subnet.

[indrora]

If you would like to file a a ticket against the service itself (which is the source of this message), please take it up with the SDK tracker: https://github.com/aws/aws-sdk/issues

[msambol]

@indrora I think it's coming from this line? IMO the error is confusing because the supplied VPC CIDR was /28 but the code is dividing the CIDR into smaller ranges for subnets which also have to be minimum /28. I'd like to update the error message to also say that subnets must be a minimum size of /28.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.