fix(ec2): throw useful error when using lazy CIDR in VPC (#3739)

We can't use lazy (or deploy-time) CIDRs when creating a VPC, since we
need to subdivide the CIDR for all the subnets. Throw a descriptive
error message to inform users when they try to do this.

Fixes #3617.

Author: rix0rrr

packages/@aws-cdk/aws-ec2/lib/vpc.ts

@@ -825,6 +825,10 @@ export class Vpc extends VpcBase {
     }
 
     const cidrBlock = ifUndefined(props.cidr, Vpc.DEFAULT_CIDR_RANGE);
+    if (Token.isUnresolved(cidrBlock)) {
+      throw new Error(`'cidr' property must be a concrete CIDR string, got a Token (we need to parse it for automatic subdivision)`);
+    }
+
     this.networkBuilder = new NetworkBuilder(cidrBlock);
 
     const enableDnsHostnames = props.enableDnsHostnames == null ? true : props.enableDnsHostnames;

packages/@aws-cdk/aws-ec2/test/test.vpc.ts

@@ -1,5 +1,5 @@
 import { countResources, expect, haveResource, haveResourceLike, isSuperObject } from '@aws-cdk/assert';
-import { Stack, Tag } from '@aws-cdk/core';
+import { Lazy, Stack, Tag } from '@aws-cdk/core';
 import { Test } from 'nodeunit';
 import { CfnVPC, DefaultInstanceTenancy, SubnetType, Vpc } from '../lib';
 
@@ -552,6 +552,17 @@ export = {
 
       test.done();
     },
+
+    'CIDR cannot be a Token'(test: Test) {
+      const stack = new Stack();
+      test.throws(() => {
+        new Vpc(stack, 'Vpc', {
+          cidr: Lazy.stringValue({ produce: () => 'abc' })
+        });
+      }, /property must be a concrete CIDR string/);
+
+      test.done();
+    },
   },
 
   "When creating a VPC with a custom CIDR range": {