ec2: "[WARNING] aws-cdk-lib.aws_ec2.InstanceProps#keyName is deprecated" appears when there are no references to keyName in the stack

[paulgear]

Describe the bug

When building a VPC stack, the following deprecation warning appears:

[WARNING] aws-cdk-lib.aws_ec2.InstanceProps#keyName is deprecated.

• Use keyPair instead - https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2-readme.html#using-an-existing-ec2-key-pair
  This API will be removed in the next major release.

The stack does not reference any EC2 instance or InstanceProps or keyName or keyPair directly. I think this is coming from a call to aws_ec2.NatProvider.instance_v2, but I can't be certain because there appears to be no reference to keyName or key_name in that module, nor can I find any evidence that there is a default value for keyName.

Expected Behavior

1. We should not get deprecation warnings for features we aren't using.
2. We should get deprecation warnings with more context so that we can log more accurate bug reports.

Current Behavior

When building a VPC stack, the following deprecation warning appears:

[WARNING] aws-cdk-lib.aws_ec2.InstanceProps#keyName is deprecated.

• Use keyPair instead - https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2-readme.html#using-an-existing-ec2-key-pair
  This API will be removed in the next major release.

Reproduction Steps

I'll attempt to provide one of these at a later time.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.148.0 (build e5740c0)

Framework Version

No response

Node.js Version

v18.20.3

OS

Linux (Ubuntu 24.04 LTS in docker)

Language

Python

Language Version

3.12.3

Other information

No response

[paulgear]

Here is a minimal reproducer stack:

import aws_cdk as cdk

from constructs import Construct

class TestStack(cdk.Stack):
  def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
    super().__init__(scope, construct_id, **kwargs)

    nat_gateway_provider = cdk.aws_ec2.NatProvider.instance_v2(
        instance_type=cdk.aws_ec2.InstanceType.of(
            instance_class=cdk.aws_ec2.InstanceClass.BURSTABLE3_AMD,
            instance_size=cdk.aws_ec2.InstanceSize.MICRO,
        ),
        # Disable default incoming allow all ingress
        default_allowed_traffic=cdk.aws_ec2.NatTrafficDirection.OUTBOUND_ONLY,
    )
    self.vpc = cdk.aws_ec2.Vpc(
        self,
        "testvpc",
        ip_addresses=cdk.aws_ec2.IpAddresses.cidr("10.1.0.0/16"),
        max_azs=1,
        nat_gateway_provider=nat_gateway_provider,
        subnet_configuration=[
            cdk.aws_ec2.SubnetConfiguration(
                name="public",
                subnet_type=cdk.aws_ec2.SubnetType.PUBLIC,
                cidr_mask=24,
            ),
            cdk.aws_ec2.SubnetConfiguration(
                name="private",
                subnet_type=cdk.aws_ec2.SubnetType.PRIVATE_WITH_EGRESS,
                cidr_mask=24,
            ),
        ],
    )

[ashishdhingra]

Reproducible using below TypeScript CDK code:

import * as cdk from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';

export class Issue30806Stack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const natGatewayProvider = ec2.NatProvider.instanceV2({
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3_AMD, ec2.InstanceSize.MICRO),
      defaultAllowedTraffic: ec2.NatTrafficDirection.OUTBOUND_ONLY
    });

    const vpc = new ec2.Vpc(this, 'testvpc', {
      ipAddresses: ec2.IpAddresses.cidr('10.1.0.0/16'),
      maxAzs: 1,
      natGatewayProvider: natGatewayProvider,
      subnetConfiguration: [
        {
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 24
        },
        {
          name: 'private',
          subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
          cidrMask: 24
        }
      ]
    });
  }
}

Running cdk synth prints the below deprecation warning at the beginning:

[WARNING] aws-cdk-lib.aws_ec2.InstanceProps#keyName is deprecated.
  - Use `keyPair` instead - https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2-readme.html#using-an-existing-ec2-key-pair
  This API will be removed in the next major release.

Initial Analysis:

• Looks like keyName is used in NatInstanceProviderV2.configureNat()
  • NatInstanceProviderV2 is initialized via NatProvider.instanceV2()
• In Vpc::constructor(),
  • NatGatewayProvider is used while invoking createNatGateways() here.
  • createNatGateways() invokes NatGatewayProvider.configureNat() here which uses keyName property here.