(ec2): ipv6AssignAddressOnCreation(true) on isolated subnet configuration produces an error

[disordered]

Describe the bug

Creating isolated subnet configuration for a new VPC with ipv6AssignAddressOnCreation(true), causes an error during first deployment.

Expected Behavior

I'm not entirely sure what is expected behaviour here. I would probably expect this to work, even though IPV6 addresses are public by default, there still won't be a route created to internet. My understanding of this property, would be that I won't have to set similar property when creating EC2 instances that need IPV6 address on isolated subnet.
Curiously, if you deploy without this property first, then add it later, there's no difference in the stack template. Therefore, I'm not sure what this property actually supposed to do.

Current Behavior

The error:

6:39:48 PM | CREATE_FAILED        | AWS::EC2::Subnet                      | vpcisolatedSubnet1Subnet06BBE51F
Template error: Fn::Select  cannot select nonexistent value at index 0

Reproduction Steps

Below code causes deployment error on first deploy:

var subnet = SubnetConfiguration
  .builder()
  .subnetType(SubnetType.PRIVATE_ISOLATED)
  .name("isolated")
  .cidrMask(21)
  .ipv6AssignAddressOnCreation(true)
  .build();
var vpc = Vpc
  .Builder
  .create(stack, "vpc")
  .vpcName("some-vpc")
  .ipProtocol(IpProtocol.DUAL_STACK)
  .ipv6Addresses(Ipv6Addresses.amazonProvided())
  .ipAddresses(IpAddresses.cidr("172.16.0.0/16"))
  .natGateways(0)
  .subnetConfiguration(Collections.singletonList(subnet))
  .build();

Possible Solution

It works if the property is not specified. I believe the cause is a race condition between subnet and ipv6 cidr creation, since dependency is created for other types, but not for isolated subnet: https://github.com/aws/aws-cdk/blob/v2.122.0/packages/aws-cdk-lib/aws-ec2/lib/vpc.ts#L1792

Additional Information/Context

No response

CDK CLI Version

2.121.1 (build d86bb1a)

Framework Version

2.121.1

Node.js Version

18.17.0

OS

OSX 14.2.1

Language

Java

Language Version

OpenJDK Runtime Environment Temurin-17.0.10+7 (build 17.0.10+7)

Other information

No response

[doublecompile]

I ran into this same problem today as well.

The root cause seems to be that the isolated subnets do not depend on the CIDR Block.

Edit: the following workaround should help until this is fixed.

const ipv6CidrBlock = vpc.node.findChild(
  "ipv6cidr"
) as CfnVPCCidrBlock;
vpc.isolatedSubnets.forEach((isolatedSubnet) => {
  if (ipv6CidrBlock !== undefined) {
    isolatedSubnet.node.addDependency(ipv6CidrBlock);
  }
});

[tim-finnigan]

Thanks for reporting this issue and noting the workaround above. Marking this as a p1 bug for tracking.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.