Skip to content

Commit

Permalink
docs(ec2): update aws-ec2 README to include workaround for using a …
Browse files Browse the repository at this point in the history
…service principal in VPCEService `allowedPrincipals` (#29512)

`VpcEndpointService` has the member `allowedPrincipals` which is of type `ArnPrincipal[]`. However, `ServicePrincipal` is also valid and works in the AWS console. This documentation update includes a workaround for including service principals in the `allowedPrincipals`.

### Issue #29478

Closes #29478

### Reason for this change

`VpcEndpointService` has the member `allowedPrincipals` which is of type `ArnPrincipal[]`. However, if you use the AWS console, allowlisting a service principal is supported as well. Users are not able to use the type `ServicePrincipal` in `allowedPrincipals` in CDK. This is a feature gap.

I brought this up in #29478, and was told that the type couldn't be changed, but the workaround I was using could be added to the documentation.

### Description of changes

Documentation update for the `aws-ec2` module which includes a workaround for including service principals in the `allowedPrincipals`.

### Description of how you validated changes

N/A - minor documentation changes only

### Checklist
- [X] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md)

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
  • Loading branch information
7e11 authored Mar 21, 2024
1 parent c918210 commit 07ce8ec
Show file tree
Hide file tree
Showing 9 changed files with 246 additions and 188 deletions.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Original file line number Diff line number Diff line change
Expand Up @@ -18,9 +18,6 @@
"VPCPublicSubnet1SubnetB4246D30": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "VPCB9E5F0B4"
},
"AvailabilityZone": {
"Fn::Select": [
0,
Expand All @@ -44,21 +41,24 @@
"Key": "Name",
"Value": "aws-cdk-ec2-vpc-endpoint-service/VPC/PublicSubnet1"
}
]
],
"VpcId": {
"Ref": "VPCB9E5F0B4"
}
}
},
"VPCPublicSubnet1RouteTableFEE4B781": {
"Type": "AWS::EC2::RouteTable",
"Properties": {
"VpcId": {
"Ref": "VPCB9E5F0B4"
},
"Tags": [
{
"Key": "Name",
"Value": "aws-cdk-ec2-vpc-endpoint-service/VPC/PublicSubnet1"
}
]
],
"VpcId": {
"Ref": "VPCB9E5F0B4"
}
}
},
"VPCPublicSubnet1RouteTableAssociation0B0896DC": {
Expand All @@ -75,12 +75,12 @@
"VPCPublicSubnet1DefaultRoute91CEF279": {
"Type": "AWS::EC2::Route",
"Properties": {
"RouteTableId": {
"Ref": "VPCPublicSubnet1RouteTableFEE4B781"
},
"DestinationCidrBlock": "0.0.0.0/0",
"GatewayId": {
"Ref": "VPCIGWB7E252D3"
},
"RouteTableId": {
"Ref": "VPCPublicSubnet1RouteTableFEE4B781"
}
},
"DependsOn": [
Expand All @@ -102,15 +102,15 @@
"VPCPublicSubnet1NATGatewayE0556630": {
"Type": "AWS::EC2::NatGateway",
"Properties": {
"SubnetId": {
"Ref": "VPCPublicSubnet1SubnetB4246D30"
},
"AllocationId": {
"Fn::GetAtt": [
"VPCPublicSubnet1EIP6AD938E8",
"AllocationId"
]
},
"SubnetId": {
"Ref": "VPCPublicSubnet1SubnetB4246D30"
},
"Tags": [
{
"Key": "Name",
Expand All @@ -126,9 +126,6 @@
"VPCPublicSubnet2Subnet74179F39": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "VPCB9E5F0B4"
},
"AvailabilityZone": {
"Fn::Select": [
1,
Expand All @@ -152,21 +149,24 @@
"Key": "Name",
"Value": "aws-cdk-ec2-vpc-endpoint-service/VPC/PublicSubnet2"
}
]
],
"VpcId": {
"Ref": "VPCB9E5F0B4"
}
}
},
"VPCPublicSubnet2RouteTable6F1A15F1": {
"Type": "AWS::EC2::RouteTable",
"Properties": {
"VpcId": {
"Ref": "VPCB9E5F0B4"
},
"Tags": [
{
"Key": "Name",
"Value": "aws-cdk-ec2-vpc-endpoint-service/VPC/PublicSubnet2"
}
]
],
"VpcId": {
"Ref": "VPCB9E5F0B4"
}
}
},
"VPCPublicSubnet2RouteTableAssociation5A808732": {
Expand All @@ -183,12 +183,12 @@
"VPCPublicSubnet2DefaultRouteB7481BBA": {
"Type": "AWS::EC2::Route",
"Properties": {
"RouteTableId": {
"Ref": "VPCPublicSubnet2RouteTable6F1A15F1"
},
"DestinationCidrBlock": "0.0.0.0/0",
"GatewayId": {
"Ref": "VPCIGWB7E252D3"
},
"RouteTableId": {
"Ref": "VPCPublicSubnet2RouteTable6F1A15F1"
}
},
"DependsOn": [
Expand All @@ -210,15 +210,15 @@
"VPCPublicSubnet2NATGateway3C070193": {
"Type": "AWS::EC2::NatGateway",
"Properties": {
"SubnetId": {
"Ref": "VPCPublicSubnet2Subnet74179F39"
},
"AllocationId": {
"Fn::GetAtt": [
"VPCPublicSubnet2EIP4947BC00",
"AllocationId"
]
},
"SubnetId": {
"Ref": "VPCPublicSubnet2Subnet74179F39"
},
"Tags": [
{
"Key": "Name",
Expand All @@ -234,9 +234,6 @@
"VPCPrivateSubnet1Subnet8BCA10E0": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "VPCB9E5F0B4"
},
"AvailabilityZone": {
"Fn::Select": [
0,
Expand All @@ -260,21 +257,24 @@
"Key": "Name",
"Value": "aws-cdk-ec2-vpc-endpoint-service/VPC/PrivateSubnet1"
}
]
],
"VpcId": {
"Ref": "VPCB9E5F0B4"
}
}
},
"VPCPrivateSubnet1RouteTableBE8A6027": {
"Type": "AWS::EC2::RouteTable",
"Properties": {
"VpcId": {
"Ref": "VPCB9E5F0B4"
},
"Tags": [
{
"Key": "Name",
"Value": "aws-cdk-ec2-vpc-endpoint-service/VPC/PrivateSubnet1"
}
]
],
"VpcId": {
"Ref": "VPCB9E5F0B4"
}
}
},
"VPCPrivateSubnet1RouteTableAssociation347902D1": {
Expand All @@ -291,21 +291,18 @@
"VPCPrivateSubnet1DefaultRouteAE1D6490": {
"Type": "AWS::EC2::Route",
"Properties": {
"RouteTableId": {
"Ref": "VPCPrivateSubnet1RouteTableBE8A6027"
},
"DestinationCidrBlock": "0.0.0.0/0",
"NatGatewayId": {
"Ref": "VPCPublicSubnet1NATGatewayE0556630"
},
"RouteTableId": {
"Ref": "VPCPrivateSubnet1RouteTableBE8A6027"
}
}
},
"VPCPrivateSubnet2SubnetCFCDAA7A": {
"Type": "AWS::EC2::Subnet",
"Properties": {
"VpcId": {
"Ref": "VPCB9E5F0B4"
},
"AvailabilityZone": {
"Fn::Select": [
1,
Expand All @@ -329,21 +326,24 @@
"Key": "Name",
"Value": "aws-cdk-ec2-vpc-endpoint-service/VPC/PrivateSubnet2"
}
]
],
"VpcId": {
"Ref": "VPCB9E5F0B4"
}
}
},
"VPCPrivateSubnet2RouteTable0A19E10E": {
"Type": "AWS::EC2::RouteTable",
"Properties": {
"VpcId": {
"Ref": "VPCB9E5F0B4"
},
"Tags": [
{
"Key": "Name",
"Value": "aws-cdk-ec2-vpc-endpoint-service/VPC/PrivateSubnet2"
}
]
],
"VpcId": {
"Ref": "VPCB9E5F0B4"
}
}
},
"VPCPrivateSubnet2RouteTableAssociation0C73D413": {
Expand All @@ -360,12 +360,12 @@
"VPCPrivateSubnet2DefaultRouteF4F5CFD2": {
"Type": "AWS::EC2::Route",
"Properties": {
"RouteTableId": {
"Ref": "VPCPrivateSubnet2RouteTable0A19E10E"
},
"DestinationCidrBlock": "0.0.0.0/0",
"NatGatewayId": {
"Ref": "VPCPublicSubnet2NATGateway3C070193"
},
"RouteTableId": {
"Ref": "VPCPrivateSubnet2RouteTable0A19E10E"
}
}
},
Expand All @@ -383,11 +383,11 @@
"VPCVPCGW99B986DC": {
"Type": "AWS::EC2::VPCGatewayAttachment",
"Properties": {
"VpcId": {
"Ref": "VPCB9E5F0B4"
},
"InternetGatewayId": {
"Ref": "VPCIGWB7E252D3"
},
"VpcId": {
"Ref": "VPCB9E5F0B4"
}
}
},
Expand Down Expand Up @@ -458,12 +458,13 @@
"MyVpcEndpointServiceWithPrincipalsPermissions29F9BD5A": {
"Type": "AWS::EC2::VPCEndpointServicePermissions",
"Properties": {
"AllowedPrincipals": [
"arn:aws:iam::123456789012:root",
"ec2.amazonaws.com"
],
"ServiceId": {
"Ref": "MyVpcEndpointServiceWithPrincipals41EE2DF2"
},
"AllowedPrincipals": [
"arn:aws:iam::123456789012:root"
]
}
}
}
},
Expand Down

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading

0 comments on commit 07ce8ec

Please sign in to comment.