Unable to do Route Table Association in AWS

Terraform CDK for Terraform
1

I’m working on creating a new EKS, I’m using Cilium as CNI instead of using the AWS vpc-cni.
What I’m trying to do is to create a new set of private subnets so I can associate the pod network.

My train of thought is as follow:

  • Create a new set of private subnets for the pod network
  • With my existing subnets, obtain the Route Table Ids.
  • With the Route Table ids, run the Route Table Association with the new Subnets

So, while iterating through a list of Availability Zones, I’m creating the new subnets and obtaining the route table ids.
I save the new subnets in a record and then the route table ids in a different one.

After that, I join both records with a reduce and iterate over it to run the Route Table Association.

But I got the following error:

ekscdktf  ╷
          │ Error: Missing required argument
          │
          │   on cdk.tf.json line 168, in resource.aws_route_table_association.pod-rta (pod-rta):
          │  168:       }
          │
          │ The argument "route_table_id" is required, but no definition was found.
          ╵

⠧  Processing
Error: External Error: Stack failed to plan: ekscdktf. Please check the logs for more information.
make: *** [Makefile:44: diff] Error 1

This is the code I’m using to create everything.

import {
    Fn, TerraformIterator, Token//TerraformLocal

} from "cdktf";
import { EksStack } from "../../main";
import { VpcIpv4CidrBlockAssociation } from "../../../.gen/providers/aws/vpc-ipv4-cidr-block-association";
import { Subnet } from "../../../.gen/providers/aws/subnet";
//import { SecurityGroup } from "../../../.gen/providers/aws/security-group";
import { RouteTableAssociation } from "../../../.gen/providers/aws/route-table-association";
import { DataAwsRouteTable } from "../../../.gen/providers/aws/data-aws-route-table";
import { DataAwsSubnet } from "../../../.gen/providers/aws/data-aws-subnet";
//import { DataAwsAvailabilityZones } from "../../../.gen/providers/aws/data-aws-availability-zones";

export class podNetworkCreation {
    constructor(scope: EksStack, clusterName: string, vpcId: string,subnetIds: string[]

    ) {

        console.log(subnetIds)
        const azs = ["eu-central-1a", "eu-central-1b", "eu-central-1c"]

        new VpcIpv4CidrBlockAssociation(scope, `vpc-secondary-${clusterName}`, {
            vpcId: vpcId,
            cidrBlock: "100.64.0.0/16",
        });

        // Create per‑AZ pod subnets from the secondary block
        const { podSubnetsByAz, rtByAz } = azs.reduce(
            (acc, az, i) => {
                acc.podSubnetsByAz[az] = new Subnet(scope, `pod-subnet-${az}`, {
                    vpcId,
                    availabilityZone: az,
                    cidrBlock: Fn.cidrsubnet("100.64.0.0/16", 8, i),
                    tags: {
                        Name: `pod-${az}`,
                        [`kubernetes.io/cluster/${clusterName}`]: "shared",
                        "pod-subnet": "true",
                    },
                });

                const existingSubnet = new DataAwsSubnet(scope, `subnet-rt-${az}`, {
                    availabilityZone: az,
                    filter: [
                        {
                            name: "tag:Name",
                            values: ["*priv*"],
                        },
                    ],
                })

                const rt = new DataAwsRouteTable(scope, `node-rt-${az}`, {
                    subnetId: existingSubnet.id,
                });
                acc.rtByAz[az] = rt.id;

                return acc;
            },
            { podSubnetsByAz: {} as Record<string, Subnet>, rtByAz: {} as Record<string, string> }
        );

        const rowsByAz = azs.reduce<Record<string, { subnetId: string; routeTableId: string }>>(
            (acc, az) => {
                acc[az] = {
                    subnetId: podSubnetsByAz[az].id, 
                    routeTableId: rtByAz[az],
                };
                return acc;
            },
            {}
        );

        // Single iterator
        const iter = TerraformIterator.fromMap(rowsByAz);

        // One resource expanded by for_each
        new RouteTableAssociation(scope, "pod-rta", {
            forEach: iter,
            subnetId: iter.value.subnetId,
            routeTableId: iter.value.routeTableId,
        });

        // Security group for Pod ENIs (tighten to your needs)
        //        new SecurityGroup(scope, `sg-pods-${clusterName}`, {
        //            name: `${clusterName}-pods`,
        //            vpcId,
        //            description: "SG attached to Cilium-created pod ENIs",
        //            egress: [{ fromPort: 0, toPort: 0, protocol: "-1", cidrBlocks: ["0.0.0.0/0"] }],
        //        });
    }
}

I think, I’m overthinking the code and it should be much easier. But I don’t see how.

Any help will be appreciated.