Using ec2.Vpc with ipamPools

[mrpackethead]

I'd like to use ec2.Vpc with IPAM.

This is what I came up with. Please go kind on my typescripting, i'm 1 week into it, but i'd love your comments on this.. Its intended to build a Transit Gateway, VPC + Subnets. ( this will get changed as its clear i'll end up with far too many resources in a single stack. ) but for the time being..

However this did'tn turn out as expected, when synthed, i get the default ip address's in my template. How could i got about this?

I'm first requesting a Cidr block, ( ec2.CfnIPAMAllocation )

const VpcCidr = new ec2.CfnIPAMAllocation(this, `$CIDR${vpc.name}`, 
        {
          ipamPoolId: 'ipamPoolId',
          netmaskLength: vpc.netmaskLength
        }
      );

and then trying to use it here.

const vpc_instance = new ec2.Vpc(this, `VPC${vpc.name}`,{
        cidr: VpcCidr.cidr,
        subnetConfiguration: subnet_configuration,
        ...vpc.vpcProps
      });

When this synths.. I dont' get refs in the VPC's i get absolute IP address's, with the defaults...
like this..

"VPCwebservicesfrontendE909F5A8": {
   "Type": "AWS::EC2::VPC",
   "Properties": {
    "CidrBlock": "10.0.0.0/16",
    "EnableDnsHostnames": true,
    "EnableDnsSupport": true,
    "InstanceTenancy": "default",
    "Tags": [
     {
      "Key": "Name",
      "Value": "webservices_frontend"
     }
    ]
   },
   "Metadata": {
    "aws:cdk:path": "NetworkStack/VPCwebservices_frontend/Resource"
   }
  },

My entire stack code is here.

import * as cdk from 'aws-cdk-lib';
import { Stack, StackProps } from 'aws-cdk-lib';
import { Construct } from 'constructs';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as s3 from 'aws-cdk-lib/aws-s3';


export interface NetworkStackProps extends cdk.StackProps {
  config: {
    transitgateway: {
      transitGateway: ec2.CfnTransitGatewayProps,
      Routing: Array<
        {
          tablename: string,
          routing: Array<{
            cidr: string,
            attachment: string
          }>
        }
      >,
    },
    vpcs: Array<{
      name: string,
      Ipv4IpamPoolId: string,
      netmaskLength: number,
      vpcProps: ec2.VpcProps,
      subnetConfiguration: Array<{
        name: string,
        cidrMask: number, 
        subnetType: string
      }>
    }>
  }
}

interface subnet_cfg {
  name: string,
  cidrMask: number,
  subnetType: any  //TODO how can this be an enum?
}

export class NetworkStack extends Stack {
  constructor(scope: Construct, id: string, props: NetworkStackProps) {
    super(scope, id, props);

    // create a TransitGateway
    const transitgw = new ec2.CfnTransitGateway(this, 'TGW',
      props.config.transitgateway.transitGateway 
    );
 
    // add routing tables to the transitgateway
    props.config.transitgateway.Routing.forEach((routingTable) => {
      var cfnTransitGatewayRouteTable = new ec2.CfnTransitGatewayRouteTable(this, `${routingTable.tablename}TGRouteTable`,
        {
          transitGatewayId: transitgw.attrId,
        }      
      )
    });

    // Create the flow log bucket

    const flowLogBucket = s3.Bucket.fromBucketName(this, 'FlowlogBucket', 'flowbucket')
    
    // iterate over all VPC's
    props.config.vpcs.forEach((vpc) => {
      
      
      // Get an IP Address Allocation from IPAM
      const VpcCidr = new ec2.CfnIPAMAllocation(this, `$CIDR${vpc.name}`, 
        {
          ipamPoolId: 'ipamPoolId',
          netmaskLength: vpc.netmaskLength
        }
      );
      
       // iterate over the subnets to create a subnet Configuration

      const subnet_configuration: subnet_cfg[] = [];
      vpc.subnetConfiguration.forEach((subnet) => {
        var subnetType = ec2.SubnetType.PRIVATE_ISOLATED;
 
        if (subnet.hasOwnProperty("subnetType")) {
          switch (subnet.subnetType) {
            case "PUBLIC":
              var subnetType = ec2.SubnetType.PUBLIC;
              break;
            case "PRIVATE":
              var subnetType = ec2.SubnetType.PRIVATE_ISOLATED;
              break;
            case "PRIVATE_NAT":
              var subnetType = ec2.SubnetType.PRIVATE_WITH_NAT
              break;
          };
        }

        // define subnet and push to Configuration
        subnet_configuration.push({
          name: subnet.name,
          cidrMask: subnet.cidrMask,
          subnetType: subnetType
        });
      }); // end of subnet loop

      // create the vpc with its subnets. 
      const vpc_instance = new ec2.Vpc(this, `VPC${vpc.name}`,{
        cidr: VpcCidr.cidr,
        subnetConfiguration: subnet_configuration,
        ...vpc.vpcProps
      });

      // add flow logs to the vpc.. Flowbucket is and prefix is hardcoded
	  // maybe move out to props

      const flowLogs = new ec2.FlowLog(this, `flowlog${vpc.name}`, {
        resourceType: ec2.FlowLogResourceType.fromVpc(vpc_instance),
        destination: ec2.FlowLogDestination.toS3(
          flowLogBucket,
          `o-xxxxxxx/vpc-logs/${this.account}/${this.region}/${vpc.name}`
        ),
        trafficType: ec2.FlowLogTrafficType.ALL,
        flowLogName: `vpc-flowlog-${vpc.name}`
      });
    
    }); // end of vpc loop
  }; // end of constructor
}; // end of class 

[peterwoodworth]

The unrequired property of any Cfn resources will not be defined unless you explicitly set it. You can see which properties won't be defined - they won't if they are indicated with a ?. And since this property is undefined, and that's what's being passed to the Vpc, the Vpc ends up using the defaults.

These properties won't be defined because our Cfn resources are just copies of the resources CloudFormation has, so there's no additional functionality we provide. They don't give us any way to reference the cidr, so we can't do anything directly with this resource

To get the cidr from this allocation, you could create a custom resource which makes the GetIpamPoolAllocations API call. This will return your allocations, and you should be able to find your allocation with the id, and then identify its cidr in the response.

[dennisfleischmann]

Thanks for the answer I was struggling with that issue

[dennisfleischmann]

This feature might be relevant for some bit of people. Might be a good feature request.