Problem with finding NAT AMI

[qubetzl]

Hello,

Recently, I ran into a problem with finding an AMI for NAT instance creation.

I've already spent some time on this and figured out that Amazon has changed the naming convention for their NAT AMIs. They are no longer including the virtualization type in the AMI name.

Example:

• old name: "amzn-ami-vpc-nat-hvm-2018.03.0.20181116-x86_64-ebs"
• new name: "amzn-ami-vpc-nat-2018.03.0.20220705.1-x86_64-ebs"

This caused the newer AMIs to be filtered out by the filter applied here: https://github.com/smoketurner/serverless-vpc-plugin/blob/adb0494162ce79613f540d016c18e3d211951ff7/src/index.js#L396-L399

I have a patch ready, which seems to solve the problem. It finds: ami-027ec8cf931500e04 (name: amzn-ami-vpc-nat-2018.03.0.20220705.1-x86_64-ebs) in eu-central-1, which looks like the latest one.

I don't know enough to be able to tell for certain that this should be the selected image. I only assume it is the correct one, based on its name.

Before patch:

Serverless: Getting managed prefix lists in eu-central-1...
Serverless: Generating a VPC in eu-central-1 (10.0.0.0/16) across 2 AZs: eu-central-1a,eu-central-1b
Serverless: Finding latest VPC NAT Instance AMI...

 Serverless Error ----------------------------------------

  Could not find an available VPC NAT Instance AMI in eu-central-1

  Get Support --------------------------------------------
     Docs:          docs.serverless.com
     Bugs:          github.com/serverless/serverless/issues
     Issues:        forum.serverless.com

  Your Environment Information ---------------------------
     Operating System:          linux
     Node Version:              14.18.0
     Framework Version:         2.72.2 (local)
     Plugin Version:            5.5.4
     SDK Version:               4.3.1
     Components Version:        3.18.2

After patch:

Serverless: Getting managed prefix lists in eu-central-1...
Serverless: Generating a VPC in eu-central-1 (10.0.0.0/16) across 2 AZs: eu-central-1a,eu-central-1b
Serverless: Finding latest VPC NAT Instance AMI...
Serverless: Provisioning Network ACLs
Serverless: Provisioning NAT Instance using AMI ami-027ec8cf931500e04
Serverless: Provisioning VPC endpoints for: s3
Serverless: Updating Lambda VPC configuration
...

In regards to contributing:

I created this issue to explain the problem with more detail and because I did not find specific instructions on how to contribute. I ran your test suite, but it seems to be failing even without my changes. I assume that is related to #571 and have ignored it. I've forked this repository and have pushed my changes here: https://github.com/qubetzl/serverless-vpc-plugin

I guess, when creating the PR it should be enough for me to provide a shorter description of the problem and a reference to this issue. Is there anything else I should be aware of?

[harmjan85]

Hello,

AWS has started to hide old AMI's: https://aws.amazon.com/about-aws/whats-new/2022/03/amazon-machine-images-public-visibility-two-years/

You can still find the AMI if you use IncludeDeprecated when calling describeImages.

[harmjan85]

This issue is fixed with Pull Request #997

@jplock When will this be released?

[qubetzl]

Is there a good reason to prefer an image built in November 2018, instead of one built in July 2022 for this?

I have been using my patch for the past week and have not ran into issues with internet connectivity. Since I did not have any problems, I am no longer concerned about the selected AMI.

I don't think that allowing deprecated images would be the right call here.

[qubetzl]

@harmjan85 If you are interested, I have solved the problem in CI by applying my patch after installing the plugins and before running serverless.

vpc-plugin-nat-ami-name-filter.patch:

--- node_modules/serverless-vpc-plugin/src/index.js 2022-08-29 10:06:34.369588202 +0300
+++ node_modules/serverless-vpc-plugin/src/index.js 2022-08-29 10:06:28.022416017 +0300
@@ -165,7 +165,7 @@
     if (createNatInstance) {
       this.serverless.cli.log('Finding latest VPC NAT Instance AMI...');

-      const images = await this.getImagesByName('amzn-ami-vpc-nat-hvm*');
+      const images = await this.getImagesByName('amzn-ami-vpc-nat*');
       if (Array.isArray(images) && images.length > 0) {
         [vpcNatAmi] = images;
       } else {

Applying the patch:

patch --forward -p0 < vpc-plugin-nat-ami-name-filter.patch

The --forward would not apply the patch if it is already applied (i.e. the patch is upstreamed). This allows your CI to not fail for not being able to apply the patch.