How to make VPC changes in CDK without breaking the stack?

When making changes to VPC configurations in AWS CDK, you need to be careful to avoid conflicts with existing resources. Here are some approaches to handle VPC changes without breaking your stack:

Option 1: Use Vpc.fromLookup() for Existing VPCs

If you need to modify a VPC that's already deployed, the safest approach is to use Vpc.fromLookup() to reference the existing VPC rather than trying to modify it directly. This avoids creating CloudFormation exports and gives you more flexibility when stacks need to be updated independently:

vpc = ec2.Vpc.fromLookup(
self,
"ExistingVpc",
# You can use various lookup options like vpc_id, tags, etc.
vpc_id="vpc-12345"  # or use other lookup criteria
)

Then you can create new subnets or other resources within this VPC without modifying the VPC definition itself.

Option 2: Plan Your Subnet CIDR Blocks Carefully

When initially creating your VPC, plan your CIDR allocations to accommodate future growth. For example, reserve specific CIDR ranges for different subnet types:

vpc = ec2.Vpc(
self,
'TestVpc',
max_azs=3,
subnet_configuration=[
ec2.SubnetConfiguration(
name='PublicSubnet',
subnet_type=ec2.SubnetType.PUBLIC,
cidr_mask=24,
# Specify exact CIDR ranges if needed
),
ec2.SubnetConfiguration(
name="PrivateSubnetWithEgress",
subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS,
cidr_mask=24,
),
ec2.SubnetConfiguration(
name='PrivateIsolated',
subnet_type=ec2.SubnetType.PRIVATE_ISOLATED,
cidr_mask=24,
)
],
ip_addresses=ec2.IpAddresses.cidr('10.18.0.0/16'),
)

Option 3: Create Subnets Manually

For more control, you can create the VPC with subnetConfiguration: [] and then manually create and configure subnets:

# Create VPC without automatic subnet configuration
vpc = ec2.Vpc(
self,
'TestVpc',
ip_addresses=ec2.IpAddresses.cidr('10.18.0.0/16'),
# Disable standard subnet configuration
subnet_configuration=[]
)

# Manually create subnets with specific CIDR blocks
public_subnet = ec2.PublicSubnet(
self,
'PublicSubnet1',
vpc_id=vpc.vpc_id,
availability_zone='us-east-1a',
cidr_block='10.18.100.0/24',  # Use a different CIDR range
map_public_ip_on_launch=True
)

private_subnet = ec2.PrivateSubnet(
self,
'PrivateSubnet1',
vpc_id=vpc.vpc_id,
availability_zone='us-east-1a',
cidr_block='10.18.200.0/24'  # Use a different CIDR range
)

Option 4: Create Separate Stacks

Consider separating your VPC infrastructure into multiple stacks:

1. A base VPC stack that creates the VPC and core networking
2. Additional stacks that add resources to the VPC

This approach allows you to modify resources in the dependent stacks without affecting the base VPC.

The error you're seeing occurs because CDK is trying to create new subnets with CIDR blocks that conflict with existing subnets. When you initially created the VPC with PRIVATE_ISOLATED subnets, they were assigned CIDR blocks starting from the beginning of your VPC CIDR range (10.18.0.0/24, 10.18.1.0/24, etc.). When you try to add PUBLIC subnets later, CDK tries to use the same CIDR blocks, causing the conflict.

For existing VPCs that need modification, the safest approach is to use Vpc.fromLookup() and then add new resources manually with carefully chosen CIDR blocks that don't conflict with existing ones.
Sources
aws-cdk-lib.aws_ec2 module · AWS CDK
VPC Route tables in CDK | AWS re:Post
class Vpc (construct) · AWS CDK
AWS CDK: Create a Subnet and Launch Instance in it With Existing VPC | AWS re:Post