[@aws-cdk/aws-ec2] VpnConnection does not support unresolved tokens

[dreamstride]

I am attempting to create a target group using IP addresses returned from a created construct in the same stack. Unfortunately when attempting to create the target group I'm getting the following error:

The IP address '#{Token[Token.200]}' is not a valid Ipv4 address...

This makes sense because this tokenized string definitely is not an Ipv4 address. However, it seems to me that this validation should happen after the token is resolved.

Reproduction Steps

const broker = new CfnBroker(this 'CfnBroker', {
    ....
});

const targets = broker.attrIpAddresses.map(ip => new IpTarget(ip, port, az))
const targetGroup = new NetworkTargetGroup(this, 'NetworkTargetGroup', {
    ....
    targets: targets
});

What did you expect to happen?

I expected that my construct would be created and the tokens would be resolved/validated after it was created.

What actually happened?

The following error returned and the stack creation failed.
The IP address '#{Token[Token.200]}' is not a valid Ipv4 address...

Environment

• **CDK CLI Version : 1.74.0
• **Framework Version: 1.74.0
• **Node.js Version: v12.18.2
• **OS : OSX
• **Language (Version): Typescript (3.7.2)

---

This is 🐛 Bug Report

[njlynch]

The only culprit for this error message appears to be here:

aws-cdk/packages/@aws-cdk/aws-ec2/lib/vpn.ts

Lines 227 to 229 in d2b637e

	if (!net.isIPv4(props.ip)) {
	throw new Error(`The \`ip\` ${props.ip} is not a valid IPv4 address.`);
	}

From a quick trace of the code, I'm not sure this is ELB-specific. Are you creating an ec2.VpnConnection directly, or creating an ec2.Vpc with vpnConnections?

Either way, the fix is the same -- just need to add a check for Token.isUnresolved as part of the IPV4 check above.

[jwoehrle]

can we get a status of this?

Either way, the fix is the same -- just need to add a check for Token.isUnresolved as part of the IPV4 check above.

That sounds rather simple... Happy to submit a PR if necessary

[njlynch]

@jwoehrle - A PR would be greatly appreciated! I agree this should be relatively simple; change the above check to only validate the IP if the string isn't an unresolved Token. Then add a test to validate the new behavior, by using a reference of some kind as the IP input to the VpnConnection.

[jwoehrle]

I submitted the PR and it was released as part of 1.89.0.

@deadlymustard can you update to the latest version and try again?

[github-actions]

This issue has not received any attention in 1 year. If you want to keep this issue open, please leave a comment below and auto-close will be canceled.