-
Notifications
You must be signed in to change notification settings - Fork 4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(vpcv2): implementation of add gateway method #31224
Changes from 44 commits
31d3f48
727b164
cb8c941
d21be53
42830e7
2f48ab2
f904a97
b52d498
1aef528
9b15a4b
bc56a77
cc8db35
285da27
98f9d53
b3e08c1
1211fde
ca9c385
eaa7ccb
a25bb78
1721026
bc393c2
aed940f
499c6c8
f296f3e
0002de5
909f7da
1b907c1
0dba8bb
8ca0a3c
f42666d
36a9511
5bd279b
6023ecd
85eafa2
09d3ae0
c5f2b96
5a05757
391ae8e
aba5e66
aeba62b
2f1e60c
e060278
74adb43
d136789
5d63c6c
669c735
a9096f5
5c7548c
4b4fb6b
dcb11e6
f30e1da
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -23,10 +23,10 @@ To create a VPC with both IPv4 and IPv6 support: | |
```ts | ||
|
||
const stack = new Stack(); | ||
new vpc_v2.VpcV2(this, 'Vpc', { | ||
primaryAddressBlock: vpc_v2.IpAddresses.ipv4('10.0.0.0/24'), | ||
new VpcV2(this, 'Vpc', { | ||
primaryAddressBlock: IpAddresses.ipv4('10.0.0.0/24'), | ||
secondaryAddressBlocks: [ | ||
vpc_v2.IpAddresses.amazonProvidedIpv6({cidrBlockName: 'AmazonProvidedIpv6'}), | ||
IpAddresses.amazonProvidedIpv6({cidrBlockName: 'AmazonProvidedIpv6'}), | ||
], | ||
}); | ||
``` | ||
|
@@ -43,17 +43,17 @@ This new construct can be used to add subnets to a `VpcV2` instance: | |
```ts | ||
|
||
const stack = new Stack(); | ||
const myVpc = new vpc_v2.VpcV2(this, 'Vpc', { | ||
const myVpc = new VpcV2(this, 'Vpc', { | ||
secondaryAddressBlocks: [ | ||
vpc_v2.IpAddresses.amazonProvidedIpv6({ cidrBlockName: 'AmazonProvidedIp'}), | ||
IpAddresses.amazonProvidedIpv6({ cidrBlockName: 'AmazonProvidedIp'}), | ||
], | ||
}); | ||
|
||
new vpc_v2.SubnetV2(this, 'subnetA', { | ||
new SubnetV2(this, 'subnetA', { | ||
vpc: myVpc, | ||
availabilityZone: 'us-east-1a', | ||
ipv4CidrBlock: new vpc_v2.IpCidr('10.0.0.0/24'), | ||
ipv6CidrBlock: new vpc_v2.IpCidr('2a05:d02c:25:4000::/60'), | ||
ipv4CidrBlock: new IpCidr('10.0.0.0/24'), | ||
ipv6CidrBlock: new IpCidr('2a05:d02c:25:4000::/60'), | ||
subnetType: ec2.SubnetType.PRIVATE_ISOLATED, | ||
}) | ||
``` | ||
|
@@ -73,28 +73,28 @@ const ipam = new Ipam(this, 'Ipam', { | |
operatingRegion: ['us-west-1'] | ||
}); | ||
const ipamPublicPool = ipam.publicScope.addPool('PublicPoolA', { | ||
addressFamily: vpc_v2.AddressFamily.IP_V6, | ||
addressFamily: AddressFamily.IP_V6, | ||
awsService: AwsServiceName.EC2, | ||
locale: 'us-west-1', | ||
publicIpSource: vpc_v2.IpamPoolPublicIpSource.AMAZON, | ||
publicIpSource: IpamPoolPublicIpSource.AMAZON, | ||
}); | ||
ipamPublicPool.provisionCidr('PublicPoolACidrA', { netmaskLength: 52 } ); | ||
|
||
const ipamPrivatePool = ipam.privateScope.addPool('PrivatePoolA', { | ||
addressFamily: vpc_v2.AddressFamily.IP_V4, | ||
addressFamily: AddressFamily.IP_V4, | ||
}); | ||
ipamPrivatePool.provisionCidr('PrivatePoolACidrA', { netmaskLength: 8 } ); | ||
|
||
new vpc_v2.VpcV2(this, 'Vpc', { | ||
primaryAddressBlock: vpc_v2.IpAddresses.ipv4('10.0.0.0/24'), | ||
new VpcV2(this, 'Vpc', { | ||
primaryAddressBlock: IpAddresses.ipv4('10.0.0.0/24'), | ||
secondaryAddressBlocks: [ | ||
vpc_v2.IpAddresses.amazonProvidedIpv6({ cidrBlockName: 'AmazonIpv6' }), | ||
vpc_v2.IpAddresses.ipv6Ipam({ | ||
IpAddresses.amazonProvidedIpv6({ cidrBlockName: 'AmazonIpv6' }), | ||
IpAddresses.ipv6Ipam({ | ||
ipamPool: ipamPublicPool, | ||
netmaskLength: 52, | ||
cidrBlockName: 'ipv6Ipam', | ||
}), | ||
vpc_v2.IpAddresses.ipv4Ipam({ | ||
IpAddresses.ipv4Ipam({ | ||
ipamPool: ipamPrivatePool, | ||
netmaskLength: 8, | ||
cidrBlockName: 'ipv4Ipam', | ||
|
@@ -112,11 +112,11 @@ Since `VpcV2` does not create subnets automatically, users have full control ove | |
|
||
```ts | ||
|
||
const myVpc = new vpc_v2.VpcV2(this, 'Vpc'); | ||
const routeTable = new vpc_v2.RouteTable(this, 'RouteTable', { | ||
const myVpc = new VpcV2(this, 'Vpc'); | ||
const routeTable = new RouteTable(this, 'RouteTable', { | ||
vpc: myVpc, | ||
}); | ||
const subnet = new vpc_v2.SubnetV2(this, 'Subnet', { | ||
const subnet = new SubnetV2(this, 'Subnet', { | ||
vpc: myVpc, | ||
routeTable, | ||
availabilityZone: 'eu-west-2a', | ||
|
@@ -129,47 +129,65 @@ const subnet = new vpc_v2.SubnetV2(this, 'Subnet', { | |
|
||
```ts | ||
const stack = new Stack(); | ||
const myVpc = new vpc_v2.VpcV2(this, 'Vpc'); | ||
const routeTable = new vpc_v2.RouteTable(this, 'RouteTable', { | ||
const myVpc = new VpcV2(this, 'Vpc'); | ||
const routeTable = new RouteTable(this, 'RouteTable', { | ||
vpc: myVpc, | ||
}); | ||
const subnet = new vpc_v2.SubnetV2(this, 'Subnet', { | ||
const subnet = new SubnetV2(this, 'Subnet', { | ||
vpc: myVpc, | ||
availabilityZone: 'eu-west-2a', | ||
ipv4CidrBlock: new IpCidr('10.0.0.0/24'), | ||
subnetType: ec2.SubnetType.PRIVATE_ISOLATED }); | ||
|
||
const igw = new vpc_v2.InternetGateway(this, 'IGW', { | ||
const igw = new InternetGateway(this, 'IGW', { | ||
vpc: myVpc, | ||
}); | ||
new vpc_v2.Route(this, 'IgwRoute', { | ||
new Route(this, 'IgwRoute', { | ||
routeTable, | ||
destination: '0.0.0.0/0', | ||
target: { gateway: igw }, | ||
}); | ||
``` | ||
|
||
Alternatively, `Route`s can be created via a method in the `RouteTable` class. An example using the `EgressOnlyInternetGateway` construct can be seen below: | ||
Note: `EgressOnlyInternetGateway` can only be used to set up outbound IPv6 routing. | ||
|
||
```ts | ||
import * as vpc_v2 from '@aws-cdk/aws-ec2-alpha'; | ||
|
||
const myVpc = new VpcV2(stack, 'Vpc', {...}); | ||
const routeTable = new RouteTable(stack, 'RouteTable', { | ||
vpc: vpc.myVpc, | ||
}); | ||
const subnet = new SubnetV2(stack, 'Subnet', {...}); | ||
|
||
const eigw = new EgressOnlyInternetGateway(stack, 'EIGW', { | ||
vpcId: vpc.myVpc, | ||
}); | ||
routeTable.addRoute('::/0', { gateway: eigw }); | ||
``` | ||
|
||
Other route targets may require a deeper set of parameters to set up properly. For instance, the example below illustrates how to set up a `NatGateway`: | ||
|
||
```ts | ||
|
||
const myVpc = new vpc_v2.VpcV2(this, 'Vpc'); | ||
const routeTable = new vpc_v2.RouteTable(this, 'RouteTable', { | ||
const myVpc = new VpcV2(this, 'Vpc'); | ||
const routeTable = new RouteTable(this, 'RouteTable', { | ||
vpc: myVpc, | ||
}); | ||
const subnet = new vpc_v2.SubnetV2(this, 'Subnet', { | ||
const subnet = new SubnetV2(this, 'Subnet', { | ||
vpc: myVpc, | ||
availabilityZone: 'eu-west-2a', | ||
ipv4CidrBlock: new IpCidr('10.0.0.0/24'), | ||
subnetType: ec2.SubnetType.PRIVATE_ISOLATED }); | ||
|
||
const natgw = new vpc_v2.NatGateway(this, 'NatGW', { | ||
const natgw = new NatGateway(this, 'NatGW', { | ||
subnet: subnet, | ||
vpc: myVpc, | ||
connectivityType: NatConnectivityType.PRIVATE, | ||
privateIpAddress: '10.0.0.42', | ||
}); | ||
new vpc_v2.Route(this, 'NatGwRoute', { | ||
new Route(this, 'NatGwRoute', { | ||
routeTable, | ||
destination: '0.0.0.0/0', | ||
target: { gateway: natgw }, | ||
|
@@ -180,11 +198,11 @@ It is also possible to set up endpoints connecting other AWS services. For insta | |
|
||
```ts | ||
|
||
const myVpc = new vpc_v2.VpcV2(this, 'Vpc'); | ||
const routeTable = new vpc_v2.RouteTable(this, 'RouteTable', { | ||
const myVpc = new VpcV2(this, 'Vpc'); | ||
const routeTable = new RouteTable(this, 'RouteTable', { | ||
vpc: myVpc, | ||
}); | ||
const subnet = new vpc_v2.SubnetV2(this, 'Subnet', { | ||
const subnet = new SubnetV2(this, 'Subnet', { | ||
vpc: myVpc, | ||
availabilityZone: 'eu-west-2a', | ||
ipv4CidrBlock: new IpCidr('10.0.0.0/24'), | ||
|
@@ -195,9 +213,37 @@ const dynamoEndpoint = new ec2.GatewayVpcEndpoint(this, 'DynamoEndpoint', { | |
vpc: myVpc, | ||
subnets: [subnet], | ||
}); | ||
new vpc_v2.Route(this, 'DynamoDBRoute', { | ||
new Route(this, 'DynamoDBRoute', { | ||
routeTable, | ||
destination: '0.0.0.0/0', | ||
target: { endpoint: dynamoEndpoint }, | ||
}); | ||
``` | ||
|
||
## Adding Egress-Only Internet Gateway to VPC | ||
|
||
An egress-only internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows outbound communication over IPv6 from instances in your VPC to the internet, and prevents the internet from initiating an IPv6 connection with your instances. For more information see@ https://docs.aws.amazon.com/vpc/latest/userguide/egress-only-internet-gateway.html | ||
shikha372 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
VPCv2 supports adding an egress only internet gateway to VPC with the help of `addEgressOnlyInternetGateway` method as well. | ||
shikha372 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
|
||
By Default, it sets up a route to all outbound IPv6 Address ranges unless specified to a specific destination by the user. It can only be set up for IPv6 enabled VPCs. | ||
shikha372 marked this conversation as resolved.
Show resolved
Hide resolved
shikha372 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
`Subnets` takes in value of `SubnetFilter` which can be based on a SubnetType in VPCV2. A new route will be added to route tables of all subnets filtered out with this property. | ||
shikha372 marked this conversation as resolved.
Show resolved
Hide resolved
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. You explained There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Selecting a type of subnet is a |
||
|
||
```ts | ||
|
||
const myVpc = new VpcV2(this, 'Vpc'); | ||
const routeTable = new RouteTable(this, 'RouteTable', { | ||
vpc: myVpc, | ||
}); | ||
const subnet = new SubnetV2(this, 'Subnet', { | ||
vpc: myVpc, | ||
availabilityZone: 'eu-west-2a', | ||
ipv4CidrBlock: new IpCidr('10.0.0.0/24'), | ||
subnetType: ec2.SubnetType.PRIVATE }); | ||
|
||
myVpc.addEgressOnlyInternetGateway({ | ||
subnets: [{SubnetType.PUBLIC}], | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Haven't looked into implementation but this already looks weird to me. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. This is as per the current implementations we have in place for addInterfaceEndpoint and addgatewayEndpoint and provides a better way for the users to select multiple subnets at once without forming an array list first and then pass it. This seems to be the best option for specifying multiple subnets as an input. |
||
destination: '::/60', | ||
}) | ||
|
||
``` |
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -2,6 +2,7 @@ | |
"exclude": [ | ||
"from-method:@aws-cdk/aws-ec2-alpha.VpcV2", | ||
"attribute-tag:@aws-cdk/aws-ec2-alpha.RouteTable.routeTableId", | ||
"from-method:@aws-cdk/aws-ec2-alpha.SubnetV2" | ||
"from-method:@aws-cdk/aws-ec2-alpha.SubnetV2", | ||
"from-method:@aws-cdk/aws-ec2-alpha.Route" | ||
Comment on lines
+5
to
+6
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. For my knowledge, what does these two lines do? There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. this is enforced from |
||
] | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Route
s looks weird.routeTable.addRoute. Right now it's immediately followed with
An example using Egress...which doesn't have anything to do with
Routes can be created via ...`There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
routeTable.addRoute('::/0', { gateway: eigw });
To make it more clear mentioned the method name