ec2: Upgrade NatInstanceProvider

[tmokmss]

Describe the feature

The current NatInstanceProvider uses the AWS official NAT instance AMI, which has already reached EOL on Dec 31 2023.

NAT AMI is built on the last version of the Amazon Linux AMI, 2018.03, which reached the end of standard support on December 31, 2020 and end of maintenance support on December 31, 2023. For more information, see the following blog post: Amazon Linux AMI end of life.

If NAT instances are a better match for your use case than NAT gateways, you can create your own NAT AMI from a current version of Amazon Linux as described in Create a NAT AMI.

https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html

It'd be great if CDK provides an easy way to configure a modern NAT instance.

Use Case

NAT Instances are still popular since they can be much cheaper than NAT Gateways.

Proposed Solution

We can create a NAT instance from AL2023 AMI by using these commands in this doc.

I think CDK can internally use ec2 userdata to configure them and abstract all the complexities away from users.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.124.0

Environment details (OS name and version, etc.)

macOS

[pahud]

Yes this is very important. Thank you @tmokmss

[GavinZZ]

I would like to work on this issue if it's not been worked on yet.

But I have some clarifying questions before I can get started with the implementation. Reading the description, it seems that the default nat instance machine image is using a EOL machine image. Are you suggesting that this should be update to a newer & supported image?

We can create a NAT instance from AL2023 AMI by using these commands in this doc

I'm a bit confused on how it relates to the commands you linked in this doc.

[tmokmss]

@GavinZZ The old NAT instance AMI is published from AWS and it's based on the deprecated Amazon Linux. We were able to use the AMI to launch an NAT instance without additional configuration. Now, however, there is currently no official "NAT instance AMI" that is under maintenance.

Instead we can probably just launch an instance from AL2023 AMI and configure it via EC2 userdata using the commands in the doc.

To prevent breaking changes, I guess the old NAT AMI should still remain unchanged. Maybe we need NatInstanceProviderV2?

[GavinZZ]

Makes sense. Thanks for the clarification.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.