aws-ec2: Delete default VPC

[Conklin-Spencer-bah]

Describe the feature

New AWS accounts are provisioned with a default vpc with a default security group. It is best practice not to use the default VPC. It would be nice to be able to have the VPC removed via CDK.

Use Case

• Mitigation of SecurityHub controls related to default VPC and default security group findings.
• Alignment with AWS best practices.

Proposed Solution

Create a context parameter that allows deletion of the default VPC for the account.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.147.3 (build 32f0fdb)

Environment details (OS name and version, etc.)

OSx 23.5.0

[khushail]

Hi @Conklin-Spencer-bah , thanks for reaching out.

Deleting a dafault VPC might have repercussions as there might be impact on gateway attachment or other underlying resources being used. Here is a link to delete the default VPC using console or CLI outside CDK. Please verify that it doesn't have any resources or running services. After you delete the VPC, services or resources on the default VPC are no longer available.

However given the usecase, if default VPC is deleted, one would need to always create the VPC manually and get the subnets to launch it with other instances.

For now, I am marking this as P2 as it won't be immediately addressed by the team but would reach out to core team for their inputs on this request. Please feel free to submit a PR though. TIA.

[shikha372]

Default VPC is not something that is created by CDK. So, allowing deletion of a resource that is created outside of it might introduce serious implications and unwanted failures in customer accounts. Since deletion of default VPC is also not something that can be achieved using Cloudformation template, don't see any reason for why we need it to be a part of CDK.

You can always choose not to deploy any resources inside default VPC to address security concerns and implement AWS best practices using custom VPC.