AWS CDK: tagging existing subnets

Question

I am trying to build an AWS EKS Cluster with AWS cdk in Java.

We have an existing VPC and subnets which need to get some Kubernetes tags like kubernetes.io/role/internal-elb=1 etc.

I can get the ISubnets by getting the vpc with:

IVpc vpc = Vpc.fromVpcAttributes(this, "my-vpc", vpcAttributes);
List<ISubnet> subnets = vpc.getPrivateSubnets();

subnets.forEach(iSubnet -> Tag.add(iSubnet, "kubernetes.io/role/internal-elb", "1"));

but awscdk.core.Tag.add() is expecting a Construct, which I am not creating because the subnet already exists.

Also tried the example here: https://docs.aws.amazon.com/de_de/cdk/latest/guide/tagging.html

private void addTagToAllVPCSubnets(Tag tag) {
    TagProps includeOnlySubnets = TagProps.builder()
        .includeResourceTypes(singletonList("AWS::EC2::Subnet"))
        .build();

    Tag.add(this, tag.getKey(), tag.getValue(), includeOnlySubnets);
}

... but still i can not see any of the new tags in the CF yaml of the cdk synth.

Any help will be appreciated!

Answer 1

You can do it automatically using lambda-supported custom resources.

Answer 2

It seems like this is a limitation in CDK at the moment. This is something that the EKS construct in CDK should deal with, but which is currently not possible as indicated by a warning during a CDK deployment:

[Warning at /stack/some-project-EKS-cluster] Could not auto-tag private subnets with "kubernetes.io/role/internal-elb=1", please remember to do this manually

For the same reason that this can't be done automatically, you can't do it by using Tag.add().

Since the EKS module in CDK is still experimental/development preview, you have three options right now:

1. Wait for a full release, which perhaps includes automatic subnet tagging.
2. Create your own VPC through CDK, which allows you to tag your own subnets.
3. Manually edit existing subnets through the VPC service interface in the AWS console

A good idea would probably be to create an issue on the AWS CDK Github and request tagging existing subnets (and other existing constructs in general) as a feature. I could not find other issues regarding this on their Github.