chore(ec2): add missing vpc endpoints #29524

msambol · 2024-03-18T03:25:17Z

I used this doc for the "friendly" names and tried to make them as close as possible to the AWS service names.

Closes #29523.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

msambol · 2024-03-18T03:26:11Z

@nmussy Here's another thing you could automate with your tool. :)

nmussy · 2024-03-18T04:52:22Z

Thanks for letting me know! I'll probably release the first version later today or tomorrow

nmussy · 2024-03-18T07:52:51Z

@msambol Just did a quick run of using DescribeVpcEndpointServices, and there are quite a few more missing:

appmesh
b2bi
bedrock
bedrock-agent
bedrock-agent-runtime
bedrock-runtime
cleanrooms
codewhisperer
console
data-servicediscovery
data-servicediscovery-fips
datazone
ds
dynamodb
eks-auth
emrwal.prod
entityresolution
guardduty-data
guardduty-data-fips
iot.credentials
iot.fleethub.api
iotfleetwise
license-manager-user-subscriptions
managedblockchain-query
managedblockchain.bitcoin.mainnet
managedblockchain.bitcoin.testnet
mediaconnect
medical-imaging
neptune-graph
networkmonitor
organizations
organizations-fips
payment-cryptography.controlplane
payment-cryptography.dataplane
pca-connector-ad
personalize
personalize-events
personalize-runtime
pinpoint
runtime-medical-imaging
s3express
scn
servicediscovery
servicediscovery-fips
signin
simspaceweaver
streaming-rekognition
streaming-rekognition-fips
swf
swf-fips
thinclient.api
timestream-influxdb
tnb
trustedadvisor
vpc-lattice

I haven't validated them yet, but if you want to wait until the CLI is available, you can complete this PR with it? If not, I'll just open another one later 👍

msambol · 2024-03-18T14:38:10Z

@nmussy I'll knock it out quickly, thanks for the list. 👍🏼

One note for you tool.. Make sure you check GatewayVpcEndpointAwsService. DynamoDB is there.

nmussy · 2024-03-18T14:43:17Z

No worries, and thanks for the heads up!

…

On Mon, Mar 18, 2024, 15:38 Michael Sambol ***@***.***> wrote: @nmussy <https://github.com/nmussy> I'll knock it out quickly, thanks for the list. 👍🏼 One note for you tool.. Make sure you check GatewayVpcEndpointAwsService. DynamoDB is there. — Reply to this email directly, view it on GitHub <#29524 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AATDXYFIDF7CTPYIKVAY5VDYY336TAVCNFSM6AAAAABE2ZQVOSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDAMBUGA4TMNZXGQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

msambol · 2024-03-18T15:31:38Z

packages/aws-cdk-lib/aws-ec2/lib/vpc-endpoint.ts

@@ -265,6 +266,7 @@ export class InterfaceVpcEndpointAwsService implements IInterfaceVpcEndpointServ
  public static readonly AIRFLOW_OPS = new InterfaceVpcEndpointAwsService('airflow.ops');
  public static readonly APIGATEWAY = new InterfaceVpcEndpointAwsService('execute-api');
  public static readonly APP_MESH = new InterfaceVpcEndpointAwsService('appmesh-envoy-management');
+  public static readonly APP_MESH_OPS = new InterfaceVpcEndpointAwsService('appmesh');


This one is named weird but I don't have much choice.

Might be worth deprecating APP_MESH and recreating APP_MESH_ENVOY_MANAGEMENT, or even APPMESH_ENVOY_MANAGEMENT

Updated this as well

msambol · 2024-03-18T15:32:49Z

packages/aws-cdk-lib/aws-ec2/lib/vpc-endpoint.ts

+  public static readonly PERSONALIZE = new InterfaceVpcEndpointAwsService('personalize');
+  public static readonly PERSONALIZE_EVENTS = new InterfaceVpcEndpointAwsService('personalize-events');
+  public static readonly PERSONALIZE_RUNTIME = new InterfaceVpcEndpointAwsService('personalize-runtime');
+  public static readonly PINPOINT_V1 = new InterfaceVpcEndpointAwsService('pinpoint');


I don't like this name either but I don't have much choice.

Same here, deprecate PINPOINT, and point to a correctly renamed PINPOINT_SMS_VOICE_V2

But then call InterfaceVpcEndpointAwsService('pinpoint'); what?

I guess PINPOINT_V1 or something similar, but with both PINPOINT and PINPOINT_V1 being valid, I would expect PINPOINT to be InterfaceVpcEndpointAwsService('pinpoint');. I feel like also renaming it would lower the chances of confusion.

let me know what you think of that...

Yeah I think this is the solution less likely to cause pitfalls for future users, even if it doesn't feel great. Thanks 👍

nmussy · 2024-03-20T14:03:25Z

Hey @msambol, I found a few more missing, some only available in certain regions:

Available in us-east-2:

codecatalyst.git
codecatalyst.packages
repostspace
sagemaker-geospatial

Available in eu-central-1:

inspector-scan

I couldn't find any documentation about this service, but it's currently being listed, might be worth adding it with the io.spotinst.vpce prefix:

io.spotinst.vpce.us-east-1.privatelink-api

Finally, I am unable to list the two following endpoints. They should still be available according to the docs, so no need to deprecate them. I'm unsure if they're never supposed to be listed by DescribeVpcEndpointServices, or if my account isn't set up to access these services

migrationhub-strategy (docs)

$ aws ec2 describe-vpc-endpoint-services --region=us-east-1 --service-names=com.amazonaws.us-east-1.migrationhub-strategy

An error occurred (InvalidServiceName) when calling the DescribeVpcEndpointServices operation: The Vpc Endpoint Service 'com.amazonaws.us-east-1.migrationhub-strategy' does not exist

sms-fips (docs)

aws ec2 describe-vpc-endpoint-services --region=us-east-1 --service-names=com.amazonaws.us-east-1.sms-fips

An error occurred (InvalidServiceName) when calling the DescribeVpcEndpointServices operation: The Vpc Endpoint Service 'com.amazonaws.us-east-1.sms-fips' does not exist

nmussy · 2024-03-20T15:01:20Z

We also have an issue with global endpoints, e.g. S3_MULTI_REGION_ACCESS_POINTS. They are not supposed to have a region prefix (docs), but currently do in the CDK:

$ aws ec2 describe-vpc-endpoint-services --region=us-east-1 --service-names=com.amazonaws.s3-global.accesspoint | jq '.ServiceDetails[] | .ServiceName'

"com.amazonaws.s3-global.accesspoint"

new CfnOutput(this, "endpoint", {
	value: ec2.InterfaceVpcEndpointAwsService.S3_MULTI_REGION_ACCESS_POINTS.name,
});

// TestDeployStack.endpoint = com.amazonaws.eu-west-1.s3-global.accesspoint

The region is currently always prefixed:

aws-cdk/packages/aws-cdk-lib/aws-ec2/lib/vpc-endpoint.ts

Line 510 in 0fee99b

    
           this.name = `${prefix || defaultEndpointPrefix}.${region}.${name}${defaultEndpointSuffix}`;

I haven't checked if there are other existing cases, but aws.api.global.codecatalyst is currently missing from the endpoint list, and will run into the same issue (docs)

msambol · 2024-03-20T15:31:45Z

I'll get the other ones added. Let's save the global endpoints work for another PR.

msambol · 2024-03-20T15:51:52Z

@nmussy Mind checking this again? Also, io.spotinst.vpce.us-east-1.privatelink-api is an AWS Marketplace service. I don't think we should add that?

nmussy · 2024-03-20T16:15:58Z

@nmussy Mind checking this again?

LGTM 👍

Also, io.spotinst.vpce.us-east-1.privatelink-api is an AWS Marketplace service. I don't think we should add that?

io.spotinst.vpce.us-east-1.privatelink-api is definitely being listed by DescribeVpcEndpointServices, no idea why. I agree though, it probably should be ignored, I'll add an exception for it to my tool.

$ aws ec2 describe-vpc-endpoint-services --region=us-east-1 --service-names=io.spotinst.vpce.us-east-1.privatelink-api | jq '.ServiceDetails[] | .ServiceName'

"io.spotinst.vpce.us-east-1.privatelink-api"

paulhcsun

Thanks @msambol! And thanks for reviewing @nmussy!

paulhcsun · 2024-03-21T22:52:24Z

packages/aws-cdk-lib/aws-ec2/lib/vpc-endpoint.ts

@@ -366,14 +390,22 @@ export class InterfaceVpcEndpointAwsService implements IInterfaceVpcEndpointServ
  public static readonly GRAFANA = new InterfaceVpcEndpointAwsService('grafana');
  public static readonly GRAFANA_WORKSPACE = new InterfaceVpcEndpointAwsService('grafana-workspace');
  public static readonly GROUNDSTATION = new InterfaceVpcEndpointAwsService('groundstation');
+  public static readonly GUARDDUTY_DATA = new InterfaceVpcEndpointAwsService('guardduty-data');
+  public static readonly GUARDDUTY_DATA_FIPS = new InterfaceVpcEndpointAwsService('guardduty-data-fips');
+  public static readonly HEALTH_IMAGING = new InterfaceVpcEndpointAwsService('medical-imaging');


mildly annoying that the naming doesn't match up here but it is what it is 🤷‍♂️

paulhcsun · 2024-03-21T22:55:15Z

@Mergifyio update

mergify · 2024-03-21T22:55:38Z

update

✅ Branch has been successfully updated

mergify · 2024-03-21T22:55:40Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2024-03-21T23:23:29Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 66af188
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2024-03-21T23:23:53Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

I used [this doc](https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html) for the "friendly" names and tried to make them as close as possible to the AWS service names. Closes aws#29523. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

aws-cdk-automation requested a review from a team March 18, 2024 03:25

github-actions bot added feature-request A feature should be added or improved. p2 distinguished-contributor [Pilot] contributed 50+ PRs to the CDK labels Mar 18, 2024

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Mar 18, 2024

msambol force-pushed the 29523 branch from c4b2301 to 3a435b1 Compare March 18, 2024 15:30

msambol commented Mar 18, 2024

View reviewed changes

msambol changed the title ~~chore(ec2): add bedrock vpc endpoints~~ chore(ec2): add missing vpc endpoints Mar 18, 2024

tim-finnigan mentioned this pull request Mar 18, 2024

aws_ec2: InterfaceVpcEndpointAwsService not supported for bedrock-runtime and bedrock #29523

Closed

2 tasks

msambol added 5 commits March 20, 2024 09:38

chore(ec2): add bedrock vpc endpoints

7cc36bd

add other missing endpoints

1cd8de9

docstring

39e48a9

deprecate some

7248838

add others found by Jimmy

6f1821a

msambol force-pushed the 29523 branch from 9e49417 to 6f1821a Compare March 20, 2024 15:49

remove trailing space

faf38b2

nmussy approved these changes Mar 20, 2024

View reviewed changes

This was referenced Mar 20, 2024

ec2: Missing and invalid global VPC endpoints #29560

Closed

fix(ec2): global vpc endpoint support #29563

Merged

paulhcsun approved these changes Mar 21, 2024

View reviewed changes

Merge branch 'main' into 29523

66af188

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Mar 21, 2024

mergify bot merged commit f63656e into aws:main Mar 21, 2024
12 checks passed

github-actions bot mentioned this pull request Mar 25, 2024

Weekly PR metrics report #29602

Closed

github-actions bot mentioned this pull request Apr 1, 2024

Monthly PR metrics report #29668

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(ec2): add missing vpc endpoints #29524

chore(ec2): add missing vpc endpoints #29524

msambol commented Mar 18, 2024 •

edited

msambol commented Mar 18, 2024

nmussy commented Mar 18, 2024

nmussy commented Mar 18, 2024

msambol commented Mar 18, 2024

nmussy commented Mar 18, 2024 via email

msambol Mar 18, 2024 •

edited

nmussy Mar 18, 2024

msambol Mar 18, 2024

msambol Mar 18, 2024

nmussy Mar 18, 2024

msambol Mar 18, 2024

nmussy Mar 18, 2024

msambol Mar 18, 2024

nmussy Mar 18, 2024

nmussy commented Mar 20, 2024

nmussy commented Mar 20, 2024 •

edited

msambol commented Mar 20, 2024

msambol commented Mar 20, 2024

nmussy commented Mar 20, 2024

paulhcsun left a comment

paulhcsun Mar 21, 2024

paulhcsun commented Mar 21, 2024

mergify bot commented Mar 21, 2024

mergify bot commented Mar 21, 2024

aws-cdk-automation commented Mar 21, 2024

mergify bot commented Mar 21, 2024

chore(ec2): add missing vpc endpoints #29524

chore(ec2): add missing vpc endpoints #29524

Conversation

msambol commented Mar 18, 2024 • edited

msambol commented Mar 18, 2024

nmussy commented Mar 18, 2024

nmussy commented Mar 18, 2024

msambol commented Mar 18, 2024

nmussy commented Mar 18, 2024 via email

msambol Mar 18, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nmussy commented Mar 20, 2024

nmussy commented Mar 20, 2024 • edited

msambol commented Mar 20, 2024

msambol commented Mar 20, 2024

nmussy commented Mar 20, 2024

paulhcsun left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

paulhcsun commented Mar 21, 2024

mergify bot commented Mar 21, 2024

✅ Branch has been successfully updated

mergify bot commented Mar 21, 2024

aws-cdk-automation commented Mar 21, 2024

AWS CodeBuild CI Report

mergify bot commented Mar 21, 2024

msambol commented Mar 18, 2024 •

edited

msambol Mar 18, 2024 •

edited

nmussy commented Mar 20, 2024 •

edited