fixing integ test for cross account

aws · Nov 14, 2024 · a85eca7 · a85eca7
1 parent 999f4de
commit a85eca7
Show file tree

Hide file tree

Showing 16 changed files with 236 additions and 211 deletions.
diff --git a/packages/@aws-cdk/aws-ec2-alpha/README.md b/packages/@aws-cdk/aws-ec2-alpha/README.md
@@ -298,15 +298,19 @@ const acceptorVpc = new VpcV2(this, 'VpcA', {
 const acceptorRoleArn = acceptorVpc.createAcceptorVpcRole('000000000000') // Requestor account ID
 ```
 
-After creating an IAM role in the acceptor account, we can initiate the peering connection request from the requestor VPC.
+After creating an IAM role in the acceptor account, we can initiate the peering connection request from the requestor VPC. Import accpeptorVpc to the stack using `fromVpcV2Attributes` method, it is recommended to specify owner account id of the acceptor VPC in case of cross account peering connection, if acceptor VPC is hosted in different region provide region value for import as well. 
+The following code snippet demonstrates how to set up VPC peering between two VPCs in different AWS accounts using CDK:
 
 ```ts
 const stack = new Stack();
 
-// TODO: Import acceptorVpc into the requestor stack
-const acceptorVpc = new VpcV2(this, 'VpcA', {
-  primaryAddressBlock: IpAddresses.ipv4('10.0.0.0/16'),
-});
+const acceptorVpc = vpc.fromVpcV2Attributes(this, 'acceptorVpc', {
+      //Replace VPC Id before running integ test again
+      vpcId: 'vpc-XXXX',
+      vpcCidrBlock: '10.0.0.0/16',
+      region: 'us-east-2',
+      ownerAccountId: acceptorAccount,
+    });
 
 const acceptorRoleArn = 'arn:aws:iam::111111111111:role/VpcPeeringRole';
 

diff --git a/packages/@aws-cdk/aws-ec2-alpha/lib/vpc-v2-base.ts b/packages/@aws-cdk/aws-ec2-alpha/lib/vpc-v2-base.ts
@@ -1,6 +1,4 @@
 import { Aws, Resource, Annotations } from 'aws-cdk-lib';
-import { IVpc, ISubnet, SubnetSelection, SelectedSubnets, EnableVpnGatewayOptions, VpnGateway, VpnConnectionType, CfnVPCGatewayAttachment, CfnVPNGatewayRoutePropagation, VpnConnectionOptions, VpnConnection, ClientVpnEndpointOptions, ClientVpnEndpoint, InterfaceVpcEndpointOptions, InterfaceVpcEndpoint, GatewayVpcEndpointOptions, GatewayVpcEndpoint, FlowLogOptions, FlowLog, FlowLogResourceType, SubnetType, SubnetFilter, CfnVPCCidrBlock } from 'aws-cdk-lib/aws-ec2';
-import { Resource, Annotations } from 'aws-cdk-lib';
 import { IVpc, ISubnet, SubnetSelection, SelectedSubnets, EnableVpnGatewayOptions, VpnGateway, VpnConnectionType, CfnVPCGatewayAttachment, CfnVPNGatewayRoutePropagation, VpnConnectionOptions, VpnConnection, ClientVpnEndpointOptions, ClientVpnEndpoint, InterfaceVpcEndpointOptions, InterfaceVpcEndpoint, GatewayVpcEndpointOptions, GatewayVpcEndpoint, FlowLogOptions, FlowLog, FlowLogResourceType, SubnetType, SubnetFilter } from 'aws-cdk-lib/aws-ec2';
 import { allRouteTableIds, flatten, subnetGroupNameFromConstructId } from './util';
 import { IDependable, Dependable, IConstruct, DependencyGroup } from 'constructs';
@@ -205,16 +203,6 @@ export abstract class VpcV2Base extends Resource implements IVpcV2 {
   */
   public abstract readonly isolatedSubnets: ISubnet[];
 
-  /**
-  * Region for this VPC
-  */
-  public abstract readonly region?: string;
-
-  /**
-  * Identifier of the owner for this VPC
-  */
-  public abstract readonly ownerAccountId?: string;
-
   /**
   * AZs for this VPC
   */

diff --git a/packages/@aws-cdk/aws-ec2-alpha/lib/vpc-v2.ts b/packages/@aws-cdk/aws-ec2-alpha/lib/vpc-v2.ts
@@ -401,16 +401,6 @@ export class VpcV2 extends VpcV2Base {
    */
   public readonly privateSubnets: ISubnet[];
 
-  /**
-  * Region for this VPC
-  */
-  public readonly region?: string;
-
-  /**
-  * Identifier of the owner for this VPC
-  */
-  public readonly ownerAccountId?: string;
-
   /**
    * To define dependency on internet connectivity
    */

diff --git a/...faultTestDeployAssertB5B8DCA8.assets.json → ...faultTestDeployAssertB5B8DCA8.assets.json b/...faultTestDeployAssertB5B8DCA8.assets.json → ...faultTestDeployAssertB5B8DCA8.assets.json
diff --git a/...ultTestDeployAssertB5B8DCA8.template.json → ...ultTestDeployAssertB5B8DCA8.template.json b/...ultTestDeployAssertB5B8DCA8.template.json → ...ultTestDeployAssertB5B8DCA8.template.json
diff --git a/...cdk/aws-ec2-alpha/test/integ.peering-cross-account.js.snapshot/acceptor-stack.assets.json b/...cdk/aws-ec2-alpha/test/integ.peering-cross-account.js.snapshot/acceptor-stack.assets.json
diff --git a/....js.snapshot/acceptor-stack.template.json → ....js.snapshot/acceptor-stack.template.json b/....js.snapshot/acceptor-stack.template.json → ....js.snapshot/acceptor-stack.template.json
@@ -18,7 +18,7 @@
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
-        "AWS": "arn:aws:iam::234567890123:root"
+        "AWS": "arn:aws:iam::12345678:root"
        }
       }
      ],
@@ -44,7 +44,7 @@
           {
            "Ref": "AWS::Partition"
           },
-          ":ec2:us-east-1:234567890123:vpc/",
+          ":ec2:us-east-2:916743627080:vpc/",
           {
            "Fn::GetAtt": [
             "acceptorVpc5B7D1670",
@@ -67,7 +67,7 @@
             {
              "Ref": "AWS::Partition"
             },
-            ":ec2:us-east-1:234567890123:vpc/",
+            ":ec2:us-east-2:916743627080:vpc/",
             {
              "Fn::GetAtt": [
               "acceptorVpc5B7D1670",
@@ -88,7 +88,7 @@
           {
            "Ref": "AWS::Partition"
           },
-          ":ec2:us-east-1:234567890123:vpc-peering-connection/*"
+          ":ec2:us-east-2:916743627080:vpc-peering-connection/*"
          ]
         ]
        }
@@ -103,6 +103,34 @@
      }
     ]
    }
+  },
+  "requestorVpcSameAccountF27E91F7": {
+   "Type": "AWS::EC2::VPC",
+   "Properties": {
+    "CidrBlock": "10.1.0.0/16",
+    "EnableDnsHostnames": true,
+    "EnableDnsSupport": true,
+    "InstanceTenancy": "default"
+   }
+  },
+  "requestorVpcSameAccountsameAccountPeeringVPCPeeringConnection4E07C8CD": {
+   "Type": "AWS::EC2::VPCPeeringConnection",
+   "Properties": {
+    "PeerOwnerId": "916743627080",
+    "PeerRegion": "us-east-2",
+    "PeerVpcId": {
+     "Fn::GetAtt": [
+      "acceptorVpc5B7D1670",
+      "VpcId"
+     ]
+    },
+    "VpcId": {
+     "Fn::GetAtt": [
+      "requestorVpcSameAccountF27E91F7",
+      "VpcId"
+     ]
+    }
+   }
   }
  },
  "Parameters": {

diff --git a/...lpha/test/integ.vpcpc.js.snapshot/cdk.out → ...peering-cross-account.js.snapshot/cdk.out b/...lpha/test/integ.vpcpc.js.snapshot/cdk.out → ...peering-cross-account.js.snapshot/cdk.out
diff --git a/...a/test/integ.vpcpc.js.snapshot/integ.json → ...ring-cross-account.js.snapshot/integ.json b/...a/test/integ.vpcpc.js.snapshot/integ.json → ...ring-cross-account.js.snapshot/integ.json
diff --git a/...est/integ.vpcpc.js.snapshot/manifest.json → ...g-cross-account.js.snapshot/manifest.json b/...est/integ.vpcpc.js.snapshot/manifest.json → ...g-cross-account.js.snapshot/manifest.json
diff --git a/...dk/aws-ec2-alpha/test/integ.peering-cross-account.js.snapshot/requestor-stack.assets.json b/...dk/aws-ec2-alpha/test/integ.peering-cross-account.js.snapshot/requestor-stack.assets.json
diff --git a/...js.snapshot/requestor-stack.template.json → ...js.snapshot/requestor-stack.template.json b/...js.snapshot/requestor-stack.template.json → ...js.snapshot/requestor-stack.template.json
@@ -1,27 +1,6 @@
 {
  "Resources": {
-  "requestorVpcFFA7DDD4": {
-   "Type": "AWS::EC2::VPC",
-   "Properties": {
-    "CidrBlock": "10.1.0.0/16",
-    "EnableDnsHostnames": true,
-    "EnableDnsSupport": true,
-    "InstanceTenancy": "default"
-   }
-  },
-  "requestorVpcTempBlock78E0B4F4": {
-   "Type": "AWS::EC2::VPCCidrBlock",
-   "Properties": {
-    "CidrBlock": "10.3.0.0/16",
-    "VpcId": {
-     "Fn::GetAtt": [
-      "requestorVpcFFA7DDD4",
-      "VpcId"
-     ]
-    }
-   }
-  },
-  "VpcB98A08B07": {
+  "requestorVpcCrossAccount6372A252": {
    "Type": "AWS::EC2::VPC",
    "Properties": {
     "CidrBlock": "10.2.0.0/16",
@@ -30,20 +9,16 @@
     "InstanceTenancy": "default"
    }
   },
-  "VpcBacceptorAccountCrossRegionPeeringVPCPeeringConnection8510BFF3": {
+  "requestorVpcCrossAccountacceptorAccountCrossRegionPeeringVPCPeeringConnection3605B6B0": {
    "Type": "AWS::EC2::VPCPeeringConnection",
    "Properties": {
-    "PeerOwnerId": "12345678",
-    "PeerRegion": "us-east-1",
-    "PeerVpcId": {
-     "Fn::GetAtt": [
-      "requestorVpcFFA7DDD4",
-      "VpcId"
-     ]
-    },
+    "PeerOwnerId": "916743627080",
+    "PeerRegion": "us-east-2",
+    "PeerRoleArn": "arn:aws:iam::916743627080:role/VpcPeeringRole",
+    "PeerVpcId": "vpc-09b9235d8a3195ba3",
     "VpcId": {
      "Fn::GetAtt": [
-      "VpcB98A08B07",
+      "requestorVpcCrossAccount6372A252",
       "VpcId"
      ]
     }
@@ -54,7 +29,7 @@
    "Properties": {
     "VpcId": {
      "Fn::GetAtt": [
-      "VpcB98A08B07",
+      "requestorVpcCrossAccount6372A252",
       "VpcId"
      ]
     }
@@ -72,13 +47,13 @@
     },
     "VpcPeeringConnectionId": {
      "Fn::GetAtt": [
-      "VpcBacceptorAccountCrossRegionPeeringVPCPeeringConnection8510BFF3",
+      "requestorVpcCrossAccountacceptorAccountCrossRegionPeeringVPCPeeringConnection3605B6B0",
       "Id"
      ]
     }
    },
    "DependsOn": [
-    "VpcBacceptorAccountCrossRegionPeeringVPCPeeringConnection8510BFF3"
+    "requestorVpcCrossAccountacceptorAccountCrossRegionPeeringVPCPeeringConnection3605B6B0"
    ]
   }
  },