Aws-cdk: ecs-patterns/ApplicationLoadBalancedFargateService fails to deploy in VPC with multiple subnets in same AZ

[fshields]

The ApplicationLoadBalancedFargateService construct (and possibly other related constructs) fails to deploy when there exist multiple public subnets in the same AZ. It appears that the construct selects _all_ public subnets from the provided VPC by default.

Reproduction Steps

I was following the "ECS Example" described at https://docs.aws.amazon.com/cdk/latest/guide/ecs_example.html but utilizing an existing VPC (with 7 pre-existing public subnets) instead of creating a new VPC like the example prescribes.

Error Log

  7/16 | 10:00:14 AM | CREATE_FAILED        | AWS::ElasticLoadBalancingV2::LoadBalancer | DevStack/MyFargateService/LB (MyFargateServiceLBDE830E97) A load balancer cannot be attached to multiple subnets in the same Availability Zone (Service: AmazonElasticLoadBalancingV2; Status Code: 400; Error Code: InvalidConfigurationRequest; Request ID: 4915531e-c85f-40f6-93ff-0a899d948d5e)
        new BaseLoadBalancer (/mnt/c/git-repos/atlassian-backup/node_modules/@aws-cdk/aws-elasticloadbalancingv2/lib/shared/base-load-balancer.ts:138:22)
        \_ new ApplicationLoadBalancer (/mnt/c/git-repos/atlassian-backup/node_modules/@aws-cdk/aws-elasticloadbalancingv2/lib/alb/application-load-balancer.ts:64:5)
        \_ new ApplicationLoadBalancedServiceBase (/mnt/c/git-repos/atlassian-backup/node_modules/@aws-cdk/aws-ecs-patterns/lib/base/application-load-balanced-service-base.ts:300:81)
        \_ new ApplicationLoadBalancedFargateService (/mnt/c/git-repos/atlassian-backup/node_modules/@aws-cdk/aws-ecs-patterns/lib/fargate/application-load-balanced-fargate-service.ts:92:5)
        \_ new AtlassianBackupStack (/mnt/c/git-repos/atlassian-backup/lib/atlassian-backup-stack.ts:24:5)
        \_ Object.<anonymous> (/mnt/c/git-repos/atlassian-backup/bin/atlassian-backup.ts:14:15)
        \_ Module._compile (internal/modules/cjs/loader.js:778:30)
        \_ Module.m._compile (/mnt/c/git-repos/atlassian-backup/node_modules/ts-node/src/index.ts:814:23)
        \_ Module._extensions..js (internal/modules/cjs/loader.js:789:10)
        \_ Object.require.extensions.(anonymous function) [as .ts] (/mnt/c/git-repos/atlassian-backup/node_modules/ts-node/src/index.ts:817:12)
        \_ Module.load (internal/modules/cjs/loader.js:653:32)
        \_ tryModuleLoad (internal/modules/cjs/loader.js:593:12)
        \_ Function.Module._load (internal/modules/cjs/loader.js:585:3)
        \_ Function.Module.runMain (internal/modules/cjs/loader.js:831:12)
        \_ main (/mnt/c/git-repos/atlassian-backup/node_modules/ts-node/src/bin.ts:226:14)
        \_ Object.<anonymous> (/mnt/c/git-repos/atlassian-backup/node_modules/ts-node/src/bin.ts:485:3)
        \_ Module._compile (internal/modules/cjs/loader.js:778:30)
        \_ Object.Module._extensions..js (internal/modules/cjs/loader.js:789:10)
        \_ Module.load (internal/modules/cjs/loader.js:653:32)
        \_ tryModuleLoad (internal/modules/cjs/loader.js:593:12)
        \_ Function.Module._load (internal/modules/cjs/loader.js:585:3)
        \_ Function.Module.runMain (internal/modules/cjs/loader.js:831:12)
        \_ findNodeScript.then.existing (/home/fshields/.nvm/versions/node/v10.18.1/lib/node_modules/npm/node_modules/libnpx/index.js:268:14)

Environment

• CDK Version : 1.21.1 (build 842cc5f)
• Framework Version:
• OS : Debian GNU/Linux 9 (stretch)
• Language : TypeScript 3.7.5

Other

---

This is :bug: Bug Report

[fshields]

While continuing to troubleshoot this, I discovered that it may be related to #3126

[jdavisp3]

Hitting the same issue here, and the one_per_az argument to SubnetSelection doesn't seem to work either.

[xcrezd]

Workaround

```

const albFargetService = new ecsPatterns.ApplicationLoadBalancedFargateService(this, 'Service', {
 ...
});

const cfnLoadBalancer = albFargetService.loadBalancer.node.defaultChild as CfnLoadBalancer
cfnLoadBalancer.subnets = vpc.selectSubnets({ onePerAz: true, subnetType: SubnetType.PUBLIC}).subnetIds

[xai1983kbu]

@xcrezd I used your workaround but deployment are hanging

FirstAppStack: creating CloudFormation changeset...
[█████████████████████████████████████████████████████▏····] (22/24)

11:50:58 | UPDATE_IN_PROGRESS | AWS::CloudFormation::Stack | FirstAppStack
11:54:03 | CREATE_IN_PROGRESS | AWS::ECS::Service | DocumentManagement...ce/Service/Service

[xcrezd]

@xai1983kbu Check your cloudformation logs in AWS console

[xai1983kbu]

@xcrezd thank you! your workaround works well.

I found the problem. Fargate task is stopped due to error - '“CannotPullContainerError: Error response from daemon'
When I added 'assignPublicIp: true,' problem is gone.

const fargateService = new escp.ApplicationLoadBalancedFargateService(this, 'WebserverService', {
            vpc: props.vpc,
            assignPublicIp: true,
            ... 
           });