feat(vpcv2): vpc peering connection construct

packages/@aws-cdk/aws-ec2-alpha/lib/route.ts

@@ -1,9 +1,10 @@
-import { CfnEIP, CfnEgressOnlyInternetGateway, CfnInternetGateway, CfnNatGateway, CfnRoute, CfnRouteTable, CfnVPCGatewayAttachment, CfnVPNGateway, CfnVPNGatewayRoutePropagation, GatewayVpcEndpoint, IRouteTable, IVpcEndpoint, RouterType } from 'aws-cdk-lib/aws-ec2';
+import { CfnEIP, CfnEgressOnlyInternetGateway, CfnInternetGateway, CfnNatGateway, CfnVPCPeeringConnection, CfnRoute, CfnRouteTable, CfnVPCGatewayAttachment, CfnVPNGateway, CfnVPNGatewayRoutePropagation, GatewayVpcEndpoint, IRouteTable, IVpcEndpoint, RouterType } from 'aws-cdk-lib/aws-ec2';
 import { Construct, IDependable } from 'constructs';
-import { Annotations, Duration, IResource, Resource } from 'aws-cdk-lib/core';
+import { Aws, Annotations, Duration, IResource, Resource, Stack } from 'aws-cdk-lib/core';
 import { IVpcV2, VPNGatewayV2Options } from './vpc-v2-base';
-import { NetworkUtils, allRouteTableIds } from './util';
+import { CidrBlock, NetworkUtils, allRouteTableIds } from './util';
 import { ISubnetV2 } from './subnet-v2';
+import { AccountPrincipal, Effect, PolicyStatement, Role } from 'aws-cdk-lib/aws-iam';
 
 /**
  * Indicates whether the NAT gateway supports public or private connectivity.
@@ -175,6 +176,47 @@ export interface NatGatewayProps extends NatGatewayOptions {
   readonly vpc?: IVpcV2;
 }
 
+/**
+ * Properties to define a VPC peering connection.
+ */
+export interface VPCPeeringConnectionProps {
+  /**
+   * Indicates whether this is a cross-account VPC peering connection.
+   */
+  readonly isCrossAccount: boolean;
+
+  /**
+   * The VPC that is requesting the peering connection.
+   */
+  readonly requestorVpc: IVpcV2;
+
+  /**
+   * The VPC that is accepting the peering connection.
+   */
+  readonly acceptorVpc: IVpcV2;
+
+  /**
+   * The AWS account ID of the acceptor VPC owner.
+   *
+   * @default - no acceptor account ID needed if not cross account connection
+   */
+  readonly acceptorAccountId?: string;
+
+  /**
+   * The region of the acceptor VPC.
+   *
+   * @default - same region as the requestor VPC
+   */
+  readonly acceptorRegion?: string;
+
+  /**
+   * The resource name of the peering connection.
+   *
+   * @default - peering connection provisioned without any name
+   */
+  readonly vpcPeeringConnectionName?: string;
+}
+
 /**
  * Creates an egress-only internet gateway
  * @resource AWS::EC2::EgressOnlyInternetGateway
@@ -402,6 +444,88 @@ export class NatGateway extends Resource implements IRouteTarget {
   }
 }
 
+/**
+ * Creates a peering connection between two VPCs
+ * @resource AWS::EC2::VPCPeeringConnection
+ */
+export class VPCPeeringConnection extends Resource implements IRouteTarget {
+
+  /**
+   * The type of router used in the route.
+   */
+  readonly routerType: RouterType;
+
+  /**
+   * The ID of the route target.
+   */
+  readonly routerTargetId: string;
+
+  /**
+   * The VPC peering connection CFN resource.
+   */
+  public readonly resource: CfnVPCPeeringConnection;
+
+  constructor(scope: Construct, id: string, props: VPCPeeringConnectionProps) {
+    super(scope, id);
+
+    const region = props.acceptorRegion ? props.acceptorRegion : Stack.of(this).region;
+    let peerRole: Role | undefined;
+    this.routerType = RouterType.VPC_PEERING_CONNECTION;
+
+    if (props.isCrossAccount && props.acceptorAccountId === undefined) {
+      throw new Error('AcceptorAccountId is required for cross-account peering connections');
+    }
+
+    const overlap = validateVpcCidrOverlap(props.requestorVpc, props.acceptorVpc);
+    if (overlap) {
+      throw new Error('CIDR block should not overlap with existing subnet blocks');
+    }
+
+    if (props.isCrossAccount) {
+      peerRole = new Role(this, 'PeerRole', {
+        assumedBy: new AccountPrincipal(Stack.of(this).account),
+        roleName: `VPCPeeringRole-${id}`,
+      });
+
+      peerRole.assumeRolePolicy?.addStatements(
+        new PolicyStatement({
+          effect: Effect.ALLOW,
+          actions: ['sts:AssumeRole'],
+          principals: [new AccountPrincipal(Stack.of(this).account)],
+        }),
+      );
+
+      peerRole.addToPolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ['ec2:acceptVpcPeeringConnection'],
+        resources: [`arn:${Aws.PARTITION}:ec2:${region}:${props.acceptorAccountId}:vpc/${props.acceptorVpc.vpcId}`],
+      }));
+
+      peerRole.addToPolicy(new PolicyStatement({
+        actions: ['ec2:acceptVpcPeeringConnection'],
+        effect: Effect.ALLOW,
+        resources: [`arn:${Aws.PARTITION}:ec2:${region}:${props.acceptorAccountId}:vpc-peering-connection/*`],
+        conditions: {
+          StringEquals: {
+            'ec2:AccepterVpc': `arn:${Aws.PARTITION}:ec2:${region}:${props.acceptorAccountId}:vpc/${props.acceptorVpc.vpcId}`,
+          },
+        },
+      }));
+    }
+
+    this.resource = new CfnVPCPeeringConnection(this, 'PeeringConnection', {
+      vpcId: props.requestorVpc.vpcId,
+      peerVpcId: props.acceptorVpc.vpcId,
+      peerOwnerId: props.acceptorAccountId,
+      peerRegion: region,
+      peerRoleArn: peerRole?.roleArn,
+    });
+
+    this.routerTargetId = this.resource.attrId;
+    this.node.defaultChild = this.resource;
+  }
+}
+
 /**
  * The type of endpoint or gateway being targeted by the route.
  */
@@ -534,7 +658,7 @@ export class Route extends Resource implements IRouteV2 {
   /**
    * The type of router the route is targetting
    */
-  public readonly targetRouterType: RouterType
+  public readonly targetRouterType: RouterType;
 
   /**
    * The route CFN resource.
@@ -663,4 +787,46 @@ function routerTypeToPropName(routerType: RouterType) {
     [RouterType.VPC_PEERING_CONNECTION]: 'vpcPeeringConnectionId',
     [RouterType.VPC_ENDPOINT]: 'vpcEndpointId',
   })[routerType];
+}
+
+/**
+ * Validates if the provided IPv4 CIDR block overlaps with existing subnet CIDR blocks within the given VPC.
+ *
+ * @param requestorVpc The VPC of the requestor.
+ * @param acceptorVpc The VPC of the acceptor.
+ * @returns True if the IPv4 CIDR block overlaps with existing subnet CIDR blocks, false otherwise.
+ * @internal
+ */
+function validateVpcCidrOverlap(requestorVpc: IVpcV2, acceptorVpc: IVpcV2): boolean {
+
+  const requestorCidrs = [requestorVpc.ipv4CidrBlock];
+  const acceptorCidrs = [acceptorVpc.ipv4CidrBlock];
+
+  if (requestorVpc.secondaryCidrBlock) {
+    requestorCidrs.push(...requestorVpc.secondaryCidrBlock
+      .map(block => block.cidrBlock)
+      .filter((cidr): cidr is string => cidr !== undefined));
+  }
+
+  if (acceptorVpc.secondaryCidrBlock) {
+    acceptorCidrs.push(...acceptorVpc.secondaryCidrBlock
+      .map(block => block.cidrBlock)
+      .filter((cidr): cidr is string => cidr !== undefined));
+  }
+
+  for (const requestorCidr of requestorCidrs) {
+    const requestorRange = new CidrBlock(requestorCidr);
+    const requestorIpRange: [string, string] = [requestorRange.minIp(), requestorRange.maxIp()];
+
+    for (const acceptorCidr of acceptorCidrs) {
+      const acceptorRange = new CidrBlock(acceptorCidr);
+      const acceptorIpRange: [string, string] = [acceptorRange.minIp(), acceptorRange.maxIp()];
+
+      if (requestorRange.rangesOverlap(acceptorIpRange, requestorIpRange)) {
+        return true;
+      }
+    }
+  }
+
+  return false;
 }

packages/@aws-cdk/aws-ec2-alpha/test/integ.route-v2.js.snapshot/aws-cdk-routev2-egressonlyigw-alpha.template.json

@@ -35,7 +35,6 @@
   "TestRoottableeigwRouteF867084E": {
    "Type": "AWS::EC2::Route",
    "Properties": {
-    "DestinationCidrBlock": "::/0",
     "DestinationIpv6CidrBlock": "::/0",
     "EgressOnlyInternetGatewayId": {
      "Fn::GetAtt": [
@@ -49,7 +48,10 @@
       "RouteTableId"
      ]
     }
-   }
+   },
+   "DependsOn": [
+    "testEOIGWEIGW54CCAD37"
+   ]
   },
   "eigwSubnetCC28B9F9": {
    "Type": "AWS::EC2::Subnet",

packages/@aws-cdk/aws-ec2-alpha/test/integ.route-v2.js.snapshot/aws-cdk-routev2-igw-alpha.template.json

@@ -48,24 +48,11 @@
       "RouteTableId"
      ]
     }
-   }
-  },
-  "TestRoottableigwRouteGWAttachment4B3E8FD9": {
-   "Type": "AWS::EC2::VPCGatewayAttachment",
-   "Properties": {
-    "InternetGatewayId": {
-     "Fn::GetAtt": [
-      "testIGW8D947AF2",
-      "InternetGatewayId"
-     ]
-    },
-    "VpcId": {
-     "Fn::GetAtt": [
-      "igw127F1970",
-      "VpcId"
-     ]
-    }
-   }
+   },
+   "DependsOn": [
+    "testIGWGWAttachment682A6782",
+    "testIGW8D947AF2"
+   ]
   },
   "igwSubnetF238E402": {
    "Type": "AWS::EC2::Subnet",
@@ -114,6 +101,23 @@
   },
   "testIGW8D947AF2": {
    "Type": "AWS::EC2::InternetGateway"
+  },
+  "testIGWGWAttachment682A6782": {
+   "Type": "AWS::EC2::VPCGatewayAttachment",
+   "Properties": {
+    "InternetGatewayId": {
+     "Fn::GetAtt": [
+      "testIGW8D947AF2",
+      "InternetGatewayId"
+     ]
+    },
+    "VpcId": {
+     "Fn::GetAtt": [
+      "igw127F1970",
+      "VpcId"
+     ]
+    }
+   }
   }
  },
  "Parameters": {

packages/@aws-cdk/aws-ec2-alpha/test/integ.route-v2.js.snapshot/aws-cdk-routev2-privatenatgw-alpha.template.json

@@ -48,7 +48,10 @@
       "RouteTableId"
      ]
     }
-   }
+   },
+   "DependsOn": [
+    "testNATgwNATGateway1533420D"
+   ]
   },
   "natgwprivSubnetE547C5A0": {
    "Type": "AWS::EC2::Subnet",