Help requested: awsx.ec2.Vpc.getDefault() causes `no matching VPC found` error

[jcity]

I was following this guide: https://www.pulumi.com/blog/get-started-with-docker-on-aws-fargate-using-pulumi/

and started to the the no matching VPC found error

I slimmed the code down to the following:

import * as awsx from '@pulumi/awsx';
import * as pulumi from '@pulumi/pulumi';

const vpc = awsx.ec2.Vpc.getDefault();

export const vpcId: pulumi.Output<string> = vpc.id;

And it still results in the following error:

Error: invocation of aws:ec2/getVpc:getVpc returned an error: invoking aws:ec2/getVpc:getVpc: no matching VPC found

Based on this article: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_VPC.FindDefaultVPC.html

It looks like I'm an EC2-Classic user and don't have a default VPC.

Is there any workaround for this issue? Should I just create a new VPC and use that?

Would the following be the correct way to accomplish that?

import * as awsx from '@pulumi/awsx';
import * as pulumi from '@pulumi/pulumi';

const vpc = new awsx.ec2.Vpc('fargateTestVPC');

const cluster = new awsx.ecs.Cluster('cluster', {
  vpc,
});

const alb = new awsx.lb.ApplicationLoadBalancer('net-lb', {
  external: true,
  securityGroups: cluster.securityGroups,
  vpc,
});

const web = alb.createListener('web', {
  port: 80,
  external: true,
});

const img = awsx.ecs.Image.fromPath('app-img', './app');

// eslint-disable-next-line @typescript-eslint/ban-ts-ignore
// @ts-ignore: appService is declared by never read
const appService = new awsx.ecs.FargateService('app-svc', {
  cluster,
  taskDefinitionArgs: {
    container: {
      image: img,
      cpu: 128 /* ~10% */,
      memory: 50 /* MB */,
      portMappings: [web],
    },
  },
  desiredCount: 2,
});

export const vpcId: pulumi.Output<string> = vpc.id;
export const webUrl: pulumi.Output<string> = web.endpoint.hostname;

Final question: What's the correct way to "import" and existing VPC? I tried the following:

const vpc = new awsx.ec2.Vpc('fargateTestVPC', {}, { import: 'vpc-40b38f25' });

But the plan said it was going to create a new one instead of import that vpc with the provided id

Thanks in advance

[kll]

I get the exact same error, even if I create and specify a new VPC. It only happens when trying out FargateService. I did something similar with an EKS cluster and it did not throw the error.

[pbn4]

Did you figure it out?

[lukehoban]

Is there any workaround for this issue? Should I just create a new VPC and use that?

Yes - AWS accounts that support EC2-Classic cannot have default VPCs, so you'll need to create one yourself. You can do that fully with Pulumi (just like your code example above), or can reuse an existing VPC.

What's the correct way to "import" and existing VPC?

To use an existing VPC, you can do something like this:

const vpc = awsx.ec2.Vpc.fromExistingIds("my-vpc", {
    vpcId: "vpc-40b38f25",
    // publicSubnetIds: [],
    // privateSubnetIds: [],
});

Using import would adopt the VPC under management of the Pulumi program (so that you could make permanent changes to the existing VPC from Pulumi). That may or may not be what you want here. That's a little harder via awsx since there are a lot of individual resource involved that need to be adopted. Your best bet there is likely to adopt each individual resource (VPC, Subnets, InternetGateways, RouteTables, etc.) and then use the fromExistingIds above to create the awsx.ec2.Vpc wrapper over those.

[lukehoban]

Note that it would be nice for the awsx library to report a better error message in case the default VPC cannot be found - pointing users at either creating their own or using fromExistingIds.

[ericpardee]

I created a VPC and I'm still getting no matching VPC found

import pulumi
import pulumi_aws as aws
import pulumi_awsx as awsx

vpc = awsx.ec2.Vpc("custom", cidr_block="172.16.8.0/24")

pulumi.export("vpcId", vpc.vpc_id)
pulumi.export("publicSubnetIds", vpc.public_subnet_ids)
pulumi.export("privateSubnetIds", vpc.private_subnet_ids)

securityGroup = aws.ec2.SecurityGroup("EverythingFromHome", vpc_id=vpc.vpc_id)
cluster = aws.ecs.Cluster("default-cluster")

lb = awsx.lb.ApplicationLoadBalancer("nginx-lb")

service = awsx.ecs.FargateService("nginx",
    cluster=cluster.arn,
    network_configuration=awsx.ecs.ServiceNetworkConfiguration(
        subnets=vpc.private_subnet_ids,
        security_groups=[securityGroup.id]
    ),
    desired_count=2,
    task_definition_args=awsx.ecs.FargateServiceTaskDefinitionArgs(
        container=awsx.ecs.TaskDefinitionContainerDefinitionArgs(
            image="nginx:latest",
            cpu=512,
            memory=512,
            essential=True,
            port_mappings=[awsx.ecs.TaskDefinitionPortMappingArgs(
                target_group=lb.default_target_group
            )],
        )
    )
)

I just followed this to create the VPC and then added this to create an ECS Cluster in a VPC

Output here

[stack72]

Hi @ericpardee

Please can you tell me what version of pulumi-awsx you are using and I will try and recreate this to see where the problem may lay

Paul

[ericpardee]

pulumi_awsx-1.0.0b7

[stack72]

Thanks @ericpardee - I'll try and work out the issue here! Sorry this old bug is causing problems

[MitchellGerdisch]

I worked with @ericpardee on this and the root cause was that there isn't a default VPC in the account and the line lb = awsx.lb.ApplicationLoadBalancer("nginx-lb") causes getVpc() to be invoked looking for the default VPC. When it can't find it, it throws the given error.

Referring back to https://github.com/pulumi/pulumi-awsx/issues/430#issuecomment-543247136 an error message that clearly states something like "no default VPC found" would go a long way to steering the user in the right direction.

And if possible, context specific error message like in this case for the load balancer that said something like "no default VPC found, specify subnet Ids to use" or some hint that the resource needs to have additional properties specified to address the issue would be really great.

[asselinpaul]

@ericpardee did you ever figure this out?

[ericpardee]

I did, thanks. As @MitchellGerdisch mentioned, it was related to not having a default VPC.

[chaffees]

@MitchellGerdisch based on your investigation here is there a way to specify the VPC created as part of a stack? For example, as part of my stack, I created a VPC for my lb. How do I specify a VPC so Pulumi understands not to look for a default VPC but rather put the resources in the VPC I created?

Thanks.

[MitchellGerdisch]

@chaffees If you pass subnetIds or subnetMappings or subnets to the LB declaration, it will use those (and the related VPC) instead of looking for the default VPC.

https://www.pulumi.com/registry/packages/awsx/api-docs/lb/applicationloadbalancer/#subnetids_nodejs

[chaffees]

Thanks @MitchellGerdisch that worked.

[lambdakris]

Ran into this issue as well and what really helped me was reading through the pulumi ELB docs and the section on custom VPCs in particular. While a better error message is always nice, for me the issue revolved around some of the pulumi ECS articles in the docs not mentioning the situation around default vs custom VPCs and the dependency with ALBs, leaving one adrift if one is not too familiar with AWS and is just trying to follow the docs verbatim.