Currently, AWS backend uses the default VPC in each configured region or vpc_name/vpc_ids if specified, so users always have to configure VPCs themselves. Usually, when public_ips is unset to set to true, the default VPC works fine since default VPCs have subnets with a route to Internet Gateway, and nothing else is needed. But public_ips: False requires private subnets with a route to NAT Gateways and this has to be configured outside of dstack. As of now, public_ips: False is required to use multiple EFA interfaces, so this is a common setup.
dstack can offer managed VPCs that are created and deleted automatically by dstack with all the necessary resources such as subnets and NAT Gateways configured. For example via vpc_autocreated: true property:
type: aws
public_ips: false
vpc_autocreated: true
regions: [us-east-1, eu-north-1, us-west-2]
creds:
type: defaultOn backend init, dstack would create a VPC with public subnets for all AZs in all configured regions, Internet Gateway, and routes (standard AWS configuration). It should also create private subnets with a regional NAT gateway either unconditionally or if public_ips: false. Users should be able to clean up the resources via dstack. For example, dstack can check all regions for autocreated VPC and clean them up if they are not in regions. So regions: [] can be used to clean up the resources. No regions means default regions as it does now.
The new AWS permissions should be listed for vpc_autocreated: true mode.
Realistically, production deployments won't use vpc_autocreated: true since typically organizations pre-configure VPCs with all the necessary resources, connections, and security policies. But it could be useful for testing or quick deployments.
Currently, AWS backend uses the default VPC in each configured region or
vpc_name/vpc_idsif specified, so users always have to configure VPCs themselves. Usually, whenpublic_ipsis unset to set totrue, the default VPC works fine since default VPCs have subnets with a route to Internet Gateway, and nothing else is needed. Butpublic_ips: Falserequires private subnets with a route to NAT Gateways and this has to be configured outside of dstack. As of now,public_ips: Falseis required to use multiple EFA interfaces, so this is a common setup.dstackcan offer managed VPCs that are created and deleted automatically bydstackwith all the necessary resources such as subnets and NAT Gateways configured. For example viavpc_autocreated: trueproperty:On backend init,
dstackwould create a VPC with public subnets for all AZs in all configured regions, Internet Gateway, and routes (standard AWS configuration). It should also create private subnets with a regional NAT gateway either unconditionally or ifpublic_ips: false. Users should be able to clean up the resources via dstack. For example,dstackcan check all regions for autocreated VPC and clean them up if they are not inregions. Soregions: []can be used to clean up the resources. Noregionsmeans default regions as it does now.The new AWS permissions should be listed for
vpc_autocreated: truemode.Realistically, production deployments won't use
vpc_autocreated: truesince typically organizations pre-configure VPCs with all the necessary resources, connections, and security policies. But it could be useful for testing or quick deployments.