Skip to content

Commit d59dae0

Browse files
archit017archit017
authored
Merge pull request #80 from Azure/connect
feat: Add Azure Virtual Network Gateway Connection construct
2 parents 91957ed + 39d5afc commit d59dae0

File tree

9 files changed

+8187
-3185
lines changed

9 files changed

+8187
-3185
lines changed

‎API.md‎

Lines changed: 5771 additions & 3185 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/azure-virtualnetworkgatewayconnection/README.md‎

Lines changed: 343 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,343 @@
1+
# Azure Virtual Network Gateway Connection Construct
2+
3+
This construct provides a CDK for Terraform (CDKTF) implementation of Azure Virtual Network Gateway Connection using the AzapiResource framework.
4+
5+
## Overview
6+
7+
Azure Virtual Network Gateway Connection establishes connectivity between Virtual Network Gateways and other networking endpoints. It supports three connection types:
8+
9+
- **IPsec (Site-to-Site)**: Connect VPN Gateway to on-premises networks via Local Network Gateway
10+
- **VNet-to-VNet**: Connect two Azure virtual networks via their VPN Gateways
11+
- **ExpressRoute**: Connect ExpressRoute Gateway to ExpressRoute circuits for private connectivity
12+
13+
## Features
14+
15+
- ✅ Automatic latest API version resolution
16+
- ✅ Explicit version pinning for stability
17+
- ✅ Schema-driven validation and transformation
18+
- ✅ Type-safe discriminated unions for connection types
19+
- ✅ Full backward compatibility
20+
- ✅ JSII compliance for multi-language support
21+
- ✅ Comprehensive TypeScript type definitions
22+
23+
## Supported API Versions
24+
25+
- `2024-01-01` (Active)
26+
- `2024-05-01` (Active, Latest - Default)
27+
28+
## Installation
29+
30+
```bash
31+
npm install @cdktf-constructs/azure-virtualnetworkgatewayconnection
32+
```
33+
34+
## Basic Usage
35+
36+
### Site-to-Site (IPsec) Connection
37+
38+
```typescript
39+
import { VirtualNetworkGatewayConnection } from '@cdktf-constructs/azure-virtualnetworkgatewayconnection';
40+
import { ResourceGroup } from '@cdktf-constructs/azure-resourcegroup';
41+
42+
// Create resource group
43+
const resourceGroup = new ResourceGroup(this, 'rg', {
44+
name: 'rg-network',
45+
location: 'eastus',
46+
});
47+
48+
// Create Site-to-Site VPN connection
49+
const s2sConnection = new VirtualNetworkGatewayConnection(this, 's2s-connection', {
50+
name: 'conn-onprem',
51+
location: 'eastus',
52+
resourceGroupId: resourceGroup.id,
53+
connectionType: 'IPsec',
54+
virtualNetworkGateway1: {
55+
id: vpnGateway.id // Your VPN Gateway
56+
},
57+
localNetworkGateway2: {
58+
id: localGateway.id // Your Local Network Gateway
59+
},
60+
sharedKey: 'YourSecureSharedKey123!',
61+
tags: {
62+
environment: 'production'
63+
}
64+
});
65+
```
66+
67+
### VNet-to-VNet Connection
68+
69+
```typescript
70+
const vnetConnection = new VirtualNetworkGatewayConnection(this, 'vnet-connection', {
71+
name: 'conn-vnet-to-vnet',
72+
location: 'eastus',
73+
resourceGroupId: resourceGroup.id,
74+
connectionType: 'Vnet2Vnet',
75+
virtualNetworkGateway1: {
76+
id: vpnGateway1.id
77+
},
78+
virtualNetworkGateway2: {
79+
id: vpnGateway2.id
80+
},
81+
sharedKey: 'YourSecureSharedKey123!',
82+
enableBgp: true,
83+
tags: {
84+
environment: 'production',
85+
purpose: 'vnet-peering'
86+
}
87+
});
88+
```
89+
90+
### ExpressRoute Connection
91+
92+
```typescript
93+
const erConnection = new VirtualNetworkGatewayConnection(this, 'er-connection', {
94+
name: 'conn-expressroute',
95+
location: 'eastus',
96+
resourceGroupId: resourceGroup.id,
97+
connectionType: 'ExpressRoute',
98+
virtualNetworkGateway1: {
99+
id: erGateway.id
100+
},
101+
peer: {
102+
id: expressRouteCircuit.id
103+
},
104+
authorizationKey: 'optional-if-cross-subscription',
105+
tags: {
106+
environment: 'production',
107+
purpose: 'expressroute'
108+
}
109+
});
110+
```
111+
112+
## Advanced Configuration
113+
114+
### IPsec Connection with Custom Policies
115+
116+
```typescript
117+
const customConnection = new VirtualNetworkGatewayConnection(this, 'custom-ipsec', {
118+
name: 'conn-custom-ipsec',
119+
location: 'eastus',
120+
resourceGroupId: resourceGroup.id,
121+
connectionType: 'IPsec',
122+
virtualNetworkGateway1: {
123+
id: vpnGateway.id
124+
},
125+
localNetworkGateway2: {
126+
id: localGateway.id
127+
},
128+
sharedKey: 'YourSecureSharedKey123!',
129+
connectionProtocol: 'IKEv2',
130+
ipsecPolicies: [{
131+
dhGroup: 'DHGroup14',
132+
ikeEncryption: 'AES256',
133+
ikeIntegrity: 'SHA256',
134+
ipsecEncryption: 'AES256',
135+
ipsecIntegrity: 'SHA256',
136+
pfsGroup: 'PFS2048',
137+
saLifeTimeSeconds: 3600,
138+
saDataSizeKilobytes: 102400000
139+
}],
140+
usePolicyBasedTrafficSelectors: true,
141+
dpdTimeoutSeconds: 45
142+
});
143+
```
144+
145+
### Connection with BGP and Routing Configuration
146+
147+
```typescript
148+
const bgpConnection = new VirtualNetworkGatewayConnection(this, 'bgp-connection', {
149+
name: 'conn-bgp',
150+
location: 'eastus',
151+
resourceGroupId: resourceGroup.id,
152+
connectionType: 'Vnet2Vnet',
153+
virtualNetworkGateway1: {
154+
id: vpnGateway1.id
155+
},
156+
virtualNetworkGateway2: {
157+
id: vpnGateway2.id
158+
},
159+
sharedKey: 'YourSecureSharedKey123!',
160+
enableBgp: true,
161+
routingWeight: 10,
162+
connectionMode: 'Default'
163+
});
164+
```
165+
166+
### Connection with NAT Rules
167+
168+
```typescript
169+
const natConnection = new VirtualNetworkGatewayConnection(this, 'nat-connection', {
170+
name: 'conn-nat',
171+
location: 'eastus',
172+
resourceGroupId: resourceGroup.id,
173+
connectionType: 'IPsec',
174+
virtualNetworkGateway1: {
175+
id: vpnGateway.id
176+
},
177+
localNetworkGateway2: {
178+
id: localGateway.id
179+
},
180+
sharedKey: 'YourSecureSharedKey123!',
181+
egressNatRules: [{
182+
id: `${vpnGateway.id}/natRules/egress-rule`
183+
}],
184+
ingressNatRules: [{
185+
id: `${vpnGateway.id}/natRules/ingress-rule`
186+
}]
187+
});
188+
```
189+
190+
## Configuration Options
191+
192+
### VirtualNetworkGatewayConnectionProps
193+
194+
#### Base Properties (All Connection Types)
195+
196+
| Property | Type | Required | Default | Description |
197+
|----------|------|----------|---------|-------------|
198+
| `name` | string | Yes | - | Name of the connection |
199+
| `location` | string | Yes | - | Azure region |
200+
| `resourceGroupId` | string | Yes | - | Resource group ID |
201+
| `connectionType` | "IPsec" \| "Vnet2Vnet" \| "ExpressRoute" | Yes | - | Type of connection |
202+
| `virtualNetworkGateway1` | GatewayReference | Yes | - | First virtual network gateway |
203+
| `connectionProtocol` | "IKEv2" \| "IKEv1" | No | "IKEv2" | Connection protocol |
204+
| `enableBgp` | boolean | No | false | Enable BGP |
205+
| `routingWeight` | number | No | - | Routing weight |
206+
| `dpdTimeoutSeconds` | number | No | - | DPD timeout in seconds |
207+
| `ipsecPolicies` | IpsecPolicy[] | No | - | Custom IPsec policies |
208+
| `usePolicyBasedTrafficSelectors` | boolean | No | false | Use policy-based traffic selectors |
209+
| `connectionMode` | "Default" \| "ResponderOnly" \| "InitiatorOnly" | No | "Default" | Connection mode |
210+
| `egressNatRules` | NatRuleReference[] | No | - | Egress NAT rules |
211+
| `ingressNatRules` | NatRuleReference[] | No | - | Ingress NAT rules |
212+
| `tags` | Record<string, string> | No | {} | Resource tags |
213+
| `apiVersion` | string | No | "2024-05-01" | API version to use |
214+
| `ignoreChanges` | string[] | No | [] | Properties to ignore |
215+
216+
#### IPsec Connection (Site-to-Site) Specific
217+
218+
| Property | Type | Required | Description |
219+
|----------|------|----------|-------------|
220+
| `localNetworkGateway2` | GatewayReference | Yes | Local network gateway reference |
221+
| `sharedKey` | string | Yes | Shared key for the connection |
222+
223+
#### Vnet2Vnet Connection Specific
224+
225+
| Property | Type | Required | Description |
226+
|----------|------|----------|-------------|
227+
| `virtualNetworkGateway2` | GatewayReference | Yes | Second virtual network gateway |
228+
| `sharedKey` | string | Yes | Shared key for the connection |
229+
230+
#### ExpressRoute Connection Specific
231+
232+
| Property | Type | Required | Description |
233+
|----------|------|----------|-------------|
234+
| `peer` | PeerReference | Yes | ExpressRoute circuit reference |
235+
| `authorizationKey` | string | No | Authorization key (for cross-subscription) |
236+
237+
### IPsec Policy Configuration
238+
239+
```typescript
240+
interface IpsecPolicy {
241+
dhGroup: string; // DHGroup14, DHGroup2048, ECP256, ECP384
242+
ikeEncryption: string; // AES128, AES192, AES256, GCMAES128, GCMAES256
243+
ikeIntegrity: string; // SHA256, SHA384, GCMAES128, GCMAES256
244+
ipsecEncryption: string; // AES128, AES192, AES256, GCMAES128, GCMAES192, GCMAES256
245+
ipsecIntegrity: string; // SHA256, GCMAES128, GCMAES192, GCMAES256
246+
pfsGroup: string; // None, PFS1, PFS2, PFS2048, ECP256, ECP384, PFS24, PFS14, PFSMM
247+
saLifeTimeSeconds: number; // e.g., 3600
248+
saDataSizeKilobytes: number; // e.g., 102400000
249+
}
250+
```
251+
252+
## Important Notes
253+
254+
### Connection Type Requirements
255+
256+
#### IPsec (Site-to-Site)
257+
- Requires a VPN Gateway (`gatewayType: "Vpn"`)
258+
- Requires a Local Network Gateway representing on-premises network
259+
- Requires a shared key
260+
- Typically uses IKEv2 protocol
261+
- Can use custom IPsec policies
262+
263+
#### VNet-to-VNet
264+
- Requires two VPN Gateways in different virtual networks
265+
- Both gateways must be route-based VPN gateways
266+
- Requires a shared key (must match on both sides)
267+
- Can enable BGP for dynamic routing
268+
- Faster than VNet peering for encrypted traffic
269+
270+
#### ExpressRoute
271+
- Requires an ExpressRoute Gateway (`gatewayType: "ExpressRoute"`)
272+
- Requires a provisioned ExpressRoute circuit
273+
- Optional authorization key for cross-subscription scenarios
274+
- Does not use shared keys or IPsec
275+
- Provides private, dedicated connectivity
276+
277+
### Deployment Time
278+
279+
- **Connection Provisioning**: Typically 5-10 minutes
280+
- **Gateway Provisioning** (prerequisite): 30-45 minutes per gateway
281+
- Plan accordingly in CI/CD pipelines
282+
283+
### Shared Keys
284+
285+
- Must be strong and unique
286+
- Must match on both ends for IPsec and VNet-to-VNet
287+
- Store securely (use Azure Key Vault in production)
288+
- Can be rotated without recreating the connection
289+
290+
### BGP Configuration
291+
292+
- Available for IPsec and VNet-to-VNet connections
293+
- Required for ExpressRoute connections
294+
- Enables dynamic routing and automatic failover
295+
- ASN must be coordinated between endpoints
296+
297+
### Connection Modes
298+
299+
- **Default**: Standard bidirectional connection
300+
- **ResponderOnly**: Connection only accepts incoming requests
301+
- **InitiatorOnly**: Connection only initiates outgoing requests
302+
- Useful for specific security requirements
303+
304+
## Outputs
305+
306+
The construct provides the following outputs:
307+
308+
```typescript
309+
connection.id // Connection resource ID
310+
connection.name // Connection name
311+
connection.location // Connection location
312+
connection.resourceId // Alias for id
313+
connection.subscriptionId // Extracted subscription ID
314+
```
315+
316+
## API Version Support
317+
318+
To use a specific API version:
319+
320+
```typescript
321+
const connection = new VirtualNetworkGatewayConnection(this, 'connection', {
322+
apiVersion: '2024-01-01',
323+
// ... other properties
324+
});
325+
```
326+
327+
## Related Resources
328+
329+
- [Azure Virtual Network Gateway](../azure-virtualnetworkgateway)
330+
- [Azure Resource Group](../azure-resourcegroup)
331+
- [Azure Virtual Network](../azure-virtualnetwork)
332+
333+
## Azure Documentation
334+
335+
- [VPN Gateway Connections Overview](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings#connection)
336+
- [Site-to-Site Connections](https://learn.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal)
337+
- [VNet-to-VNet Connections](https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal)
338+
- [ExpressRoute Connections](https://learn.microsoft.com/en-us/azure/expressroute/expressroute-howto-linkvnet-portal-resource-manager)
339+
- [IPsec/IKE Policy](https://learn.microsoft.com/en-us/azure/vpn-gateway/ipsec-ike-policy-howto)
340+
341+
## License
342+
343+
This construct is part of the CDKTF Azure Constructs library.

‎src/azure-virtualnetworkgatewayconnection/index.ts‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
/**
2+
* Azure Virtual Network Gateway Connection package
3+
*
4+
* This package provides constructs for managing Azure Virtual Network Gateway Connections.
5+
*/
6+
7+
export * from "./lib";

‎src/azure-virtualnetworkgatewayconnection/lib/index.ts‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
/**
2+
* Azure Virtual Network Gateway Connection module exports
3+
*
4+
* This module provides constructs for managing Azure Virtual Network Gateway Connections
5+
* using the AzapiResource framework.
6+
*/
7+
8+
export * from "./virtual-network-gateway-connection";
9+
export * from "./virtual-network-gateway-connection-schemas";

0 commit comments

Comments
 (0)