From 2f9324e352724062ecbc1604ddcf7e6c1bb37279 Mon Sep 17 00:00:00 2001 From: kinchit Date: Tue, 27 Oct 2026 14:59:44 +0530 Subject: [PATCH] feat: add skipDefaultNatRoute option to subnet groups By default every private subnet gets an automatic 0.0.0.0/0 route to the NAT gateway in its own AZ. Add `skipDefaultNatRoute` so a subnet group can opt out and declare its own 0.0.0.0/0 route (e.g. NAT_GATEWAY with a routerId), allowing all AZs of a group to egress via a single NAT gateway. Defaults to false, so existing stacks are unaffected. Co-Authored-By: Claude Sonnet 5.5 --- API.md | 14 ++++++++++++++ src/constructs/network.ts | 11 ++++++++++- 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/API.md b/API.md index 1f5a8e2..bf09cd0 100644 --- a/API.md +++ b/API.md @@ -3581,6 +3581,7 @@ public readonly routeTableId: string; | ingressNetworkACL | NetworkACL[] | *No description.* | | routes | AddRouteOptions[] | *No description.* | | routeTableStringFormat | boolean | *No description.* | +| skipDefaultNatRoute | boolean | Do not add the automatic default route (0.0.0.0/0) to the same-AZ NAT gateway for the private subnets of this group. Declare your own 0.0.0.0/0 route in `routes` (e.g. RouterType.NAT_GATEWAY with a routerId) to pin egress to a specific NAT gateway. | | tags | {[ key: string ]: string} | *No description.* | | useNestedStacks | boolean | *No description.* | | useSubnetForNAT | boolean | *No description.* | @@ -3667,6 +3668,19 @@ public readonly routeTableStringFormat: boolean; --- +##### `skipDefaultNatRoute`Optional + +```typescript +public readonly skipDefaultNatRoute: boolean; +``` + +- *Type:* boolean +- *Default:* false + +Do not add the automatic default route (0.0.0.0/0) to the same-AZ NAT gateway for the private subnets of this group. Declare your own 0.0.0.0/0 route in `routes` (e.g. RouterType.NAT_GATEWAY with a routerId) to pin egress to a specific NAT gateway. + +--- + ##### `tags`Optional ```typescript diff --git a/src/constructs/network.ts b/src/constructs/network.ts index 73c722e..48ef478 100644 --- a/src/constructs/network.ts +++ b/src/constructs/network.ts @@ -70,6 +70,15 @@ export interface ISubnetsProps { readonly routeTableStringFormat?: boolean; readonly tags?: Record; readonly useSubnetForNAT?: boolean; + /** + * Do not add the automatic default route (0.0.0.0/0) to the same-AZ NAT gateway + * for the private subnets of this group. Declare your own 0.0.0.0/0 route in + * `routes` (e.g. RouterType.NAT_GATEWAY with a routerId) to pin egress to a + * specific NAT gateway. + * + * @default false + */ + readonly skipDefaultNatRoute?: boolean; readonly useNestedStacks?: boolean; } export interface VPCProps { @@ -157,7 +166,7 @@ export class Network extends Construct { subnet.forEach((sb) => { if (sb instanceof ec2.PublicSubnet) { this.pbSubnets.push(sb); - } else if (sb instanceof ec2.PrivateSubnet) { + } else if (sb instanceof ec2.PrivateSubnet && !subnetProps.skipDefaultNatRoute) { this.pvSubnets.push(sb); } if (