aws-native.cidr function does not match CloudFormation's Fn::Cidr

[thefloweringash]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Issue details

I tried to use aws-native.cidr by assuming it corresponded to the CloudFormation function Fn::Cidr. However, it always failed immediately for more than one subnet. I dug into the implementation and found that it was a very different function. I assume this is an implementation oversight, but it might be a documentation issue.

The CloudFormation function Fn::Cidr:

• takes a larger subnet to divide into smaller subnets (ipBlock)
• interprets cidrBits as the size of the resulting subnet (the inverse of the prefix length)

The aws-native.cidr function:

• takes a base subnet to find siblings (ipBlock)
• interprets cidrBits as the prefix length (the inverse of the size the resulting subnet)

Also the aws-native.cidr function seems to interpret gocidr.NextSubnet's "overflow" return value as an "ok" value, so it always immediately fails for more than one subnet with:

    error: Error: invocation of aws-native:index:cidr returned an error: could not create 3 subnets

Affected area/feature

Assuming cidr function is intended to correspond to the CloudFormation version, then I believe the required change is in provider/pkg/provider/provider_intrinsics.go.

[stack72]

Hi @thefloweringash

We need to have a look at this and see what we would need to do here - this may be a potentially breaking change or we'd need to provider an alternative

More to come here

Paul

[gunzy83]

I just ran into this same issue as well. I am unsure what the intention of this function was but it does not seem to do anything useful.

When count is set to 3 or greater, I get the error in OP. When it is set to 2 it seems to return a list with the original block as the first element and the second element is null. cidrBits does not seem to do anything to change the behaviour.

I find it highly unlikely that changes to this function would be a breaking change for anyone given its current broken state and lack of documentation.