[aws-route53] Cannot create InterfaceVpcEndpointTarget from imported InterfaceVpcEndpoint

[jordansafer]

Reproduction Steps

1. Create a VPC endpoint interface manually in the AWS account

val VPC_ENDPOINT_ID = "vpc-0123012301230123"
val SECURITY_GROUP = "sg-0123012301230123"
val vpcEndpoint = InterfaceVpcEndpoint.fromInterfaceVpcEndpointAttributes(this, "vpc-endpoint",
InterfaceVpcEndpointAttributes.builder()
.vpcEndpointId(VPC_ENDPOINT_ID)
.port(443)
.securityGroups(
listOf(SecurityGroup.fromSecurityGroupId(this, "security-group", SECURITY_GROUP)))
.build())
InterfaceVpcEndpointTarget(vpcEndpoint)

What did you expect to happen?

I expected to get a Target to attach a CNAME to.

What actually happened?

This exception was thrown:
Exception in thread "main" software.amazon.jsii.JsiiException: No child with id: 'Resource'
Error: No child with id: 'Resource'
at Node.findChild (/private/var/folders/8b/0yrdf6_15b34kxc_76zdy6yj1c3v1n/T/jsii
-kernel-5L9bZQ/node_modules/constructs/lib/construct.js:86:19)
at ConstructNode.findChild (/private/var/folders/8b/0yrdf6_15b34kxc_76zdy6yj1c3v
1n/T/jsii-kernel-5L9bZQ/node_modules/@aws-cdk/core/lib/construct-compat.js:230:45)
at new InterfaceVpcEndpointTarget (/private/var/folders/8b/0yrdf6_15b34kxc_76zdy
6yj1c3v1n/T/jsii-kernel-5L9bZQ/node_modules/@aws-cdk/aws-route53-targets/lib/interfa
ce-vpc-endpoint-target.js:10:53)
at /private/var/folders/8b/0yrdf6_15b34kxc_76zdy6yj1c3v1n/T/jsii-java-runtime184
1546699463348999/jsii-runtime.js:7932:49
at Kernel._wrapSandboxCode (/private/var/folders/8b/0yrdf6_15b34kxc_76zdy6yj1c3v
1n/T/jsii-java-runtime1841546699463348999/jsii-runtime.js:8408:19)
at Kernel._create (/private/var/folders/8b/0yrdf6_15b34kxc_76zdy6yj1c3v1n/T/jsii
-java-runtime1841546699463348999/jsii-runtime.js:7932:26)
at Kernel.create (/private/var/folders/8b/0yrdf6_15b34kxc_76zdy6yj1c3v1n/T/jsii-
java-runtime1841546699463348999/jsii-runtime.js:7676:21)
at KernelHost.processRequest (/private/var/folders/8b/0yrdf6_15b34kxc_76zdy6yj1c
3v1n/T/jsii-java-runtime1841546699463348999/jsii-runtime.js:7456:28)
at KernelHost.run (/private/var/folders/8b/0yrdf6_15b34kxc_76zdy6yj1c3v1n/T/jsii
-java-runtime1841546699463348999/jsii-runtime.js:7394:14)
at Immediate._onImmediate (/private/var/folders/8b/0yrdf6_15b34kxc_76zdy6yj1c3v1
n/T/jsii-java-runtime1841546699463348999/jsii-runtime.js:7397:37)
at processImmediate (internal/timers.js:439:21)
at software.amazon.jsii.JsiiRuntime.processErrorResponse(JsiiRuntime.java:11
9)
at software.amazon.jsii.JsiiRuntime.requestResponse(JsiiRuntime.java:91)
at software.amazon.jsii.JsiiClient.createObject(JsiiClient.java:88)
at software.amazon.jsii.JsiiEngine.createNewObject(JsiiEngine.java:526)
at software.amazon.awscdk.services.route53.targets.InterfaceVpcEndpointTarge
t.(InterfaceVpcEndpointTarget.java:25)

Environment

• CLI Version : 1.38.0
• Framework Version: CDK 1.23
• Node.js Version: v10.20.1
• OS : OSX 10.13.16
• Language (Version): Java (8), Kotlin 1.3

Other

---

This is 🐛 Bug Report

[flemjame-at-amazon]

The security group import doesn't appear to be related. This happens even with a newly created security group:

        new InterfaceVpcEndpointTarget(InterfaceVpcEndpoint.fromInterfaceVpcEndpointAttributes(this, "vpc-endpoint",
                InterfaceVpcEndpointAttributes.builder()
                        .port(443)
                        .vpcEndpointId("vpc-0123012301230123")
                        .securityGroups(Arrays.asList(new SecurityGroup(this, "sg-01230123012", SecurityGroupProps.builder()
                                .vpc(vpc)
                                .build())))
                        .build()));

[lmichelbacher]

What's the status on this? Is it actively being worked on?

[ssierla]

I'm having this same issue when trying to create A record for AWS Transfer vpc endpoint.

InterfaceVpcEndpoint is imported using vpcEndpointId fetched via custom resource but when trying to create InterfaceVpcEndpointTarget required by Route 53 RecordTarget it fails with No child with id: 'Resource'

Environment

• Framework Version: CDK 1.87.1
• Node.js Version: v12.20.1

[rishab95]

Any update on this issue? This would really helpful if it gets resolved

[wwaterfield]

+1 This bug prevented us from using a cleaner method to reference interface endpoints created by other services in our AWS account.

[nikli2009]

+1

[mwalton21]

Is there any plan to fix this? This is causing our team to manually create an ARecord since we can't use the reference.

[dhanushuUzumaki]

+1

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[grbinho]

I just hit this issue and I don't believe the issue is actually resolved. Above merger request does not fix the real issue which is that using ec2.InterfaceVpcEndpoint.fromInterfaceVpcEndpointAttribututes can not be used to create Route53 target since it returns IInterfaceVpcEndpoint which is not not even being accepted by the targets.InterfaceVpcEndpointTarget.

Using ec2.InterfaceVpcEndpoint.fromInterfaceVpcEndpointAttribututes seems to be the "natural" way to map AWS Transfer Family private Vpc Endpoint to some Route53 name, but It's not possible at the moment.

Did anyone come up with any nice workarounds?

[TaiDinh]

meet the same issue with @grbinho . I'm trying to create Route 53 ARecord for Existing VPC Endpoint from CDK. But CDK don't allow me to do so. Did anyone come up with any solutions ?

[grbinho]

Hi @TaiDinh

Below, you can find our workaround.
You need two custom resources to get this sorted.
One to get you the vpc endpoint id from transfer family and another to get the vpc endpoint description from EC2.
Then you can create Route53 A record to the transfer family.

import * as cr from 'aws-cdk-lib/custom-resources'
import * as route53 from 'aws-cdk-lib/aws-route53'
// and others you might need

const serverDescription = new cr.AwsCustomResource(wrapper, 'ServerDescription', {
    onCreate: {
      action: 'describeServer',
      service: 'Transfer',
      parameters: {
        ServerId: this.sftpTransferFamilyServer.attrServerId,
      },
      physicalResourceId: cr.PhysicalResourceId.of(this.sftpTransferFamilyServer.attrServerId),
    },
    policy: cr.AwsCustomResourcePolicy.fromSdkCalls({ resources: [this.sftpTransferFamilyServer.attrArn] }),
  })

const vpcEndpointId = serverDescription.getResponseField('Server.EndpointDetails.VpcEndpointId')

const vpcEndpointDescription = new cr.AwsCustomResource(wrapper, 'VpcEndpointDescription', {
  onCreate: {
    action: 'describeVpcEndpoints',
    service: 'EC2',
    parameters: {
      Filters: [
        { Name: 'vpc-endpoint-id', Values: [vpcEndpointId] },
        { Name: 'vpc-endpoint-type', Values: ['Interface'] },
      ],
    },
    physicalResourceId: cr.PhysicalResourceId.of(vpcEndpointId),
  },
  policy: cr.AwsCustomResourcePolicy.fromStatements([
    new iam.PolicyStatement({
      actions: ['ec2:DescribeVpcEndpoints'],
      resources: ['*'],
    }),
  ]),
})

const vpcEndpointDnsName = vpcEndpointDescription.getResponseField('VpcEndpoints.0.DnsEntries.0.DnsName')
const vpcEndpointHostedZoneId = vpcEndpointDescription.getResponseField(
  'VpcEndpoints.0.DnsEntries.0.HostedZoneId'
)
const hostedZone = props.vpcEndpointProps.hostedZone

new route53.ARecord(this, 'AliasRecord', {
  recordName: props.vpcEndpointProps.dnsName,
  zone: hostedZone,
  target: route53.RecordTarget.fromAlias({
    bind() {
      return {
        dnsName: vpcEndpointDnsName,
        hostedZoneId: vpcEndpointHostedZoneId,
      }
    },
  }),
})