feat(ec2): ClientVpn support #4233

nmussy · 2019-09-25T08:35:48Z

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

mergify · 2019-09-25T08:36:24Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

aws-cdk-automation · 2019-09-25T08:41:23Z

AWS CodeBuild CI Report

Result: FAILED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

nmussy · 2019-09-25T08:48:50Z

packages/@aws-cdk/aws-ec2/lib/client-vpn.ts

+  readonly authenticationOptions: IClientAuthenticationRequest[];
+  readonly clientCidrBlock: string;
+  readonly connectionLogOptions: IConnectionLogOptions;
+  // TODO replace with serverCertificate object?


Unfortunately, I don't think it's possible:

Dependency cycles detected, you should fix these! aws-cdk/aws-certificatemanager -> @aws-cdk/aws-ec2 -> @aws-cdk/aws-lambda -> @aws-cdk/aws-certificatemanager

Any way to work around this?

I'm sorry, where are these dependencies coming from?

On my machine, I'm not seeing any dependency from EC2 to either Lambda or CertificateManager.

I was trying to add @aws-cdk/aws-certificatemanager to EC2 to get access to ICertificates. I haven't committed it because of the previous error

Is it possible to use both IAM and ACM certificates here? I've been thinking about this for a while. A potential solution might be to declare an iam.ICertificate (or iam.ICertificateSource), and have ACM's ICertificate extend that. Since everything depends on IAM already, we wouldn't have any dependency issues.

I don't think it's possible to use IAM certificates in this case, unless I'm missing something:

Getting started:

The server certificate must be provisioned in AWS Certificate Manager (ACM)

Client Authentication and Authorization:

The server and client certificates must be uploaded to AWS Certificate Manager (ACM).

aws-cdk-automation · 2019-09-25T12:57:40Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

aws-cdk-automation · 2019-09-25T13:10:14Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

aws-cdk-automation · 2019-09-25T13:11:27Z

AWS CodeBuild CI Report

Result: FAILED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

aws-cdk-automation · 2019-09-25T13:18:04Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

aws-cdk-automation · 2019-09-25T13:54:08Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

aws-cdk-automation · 2019-09-25T14:15:27Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

aws-cdk-automation · 2019-09-25T14:26:34Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

jogold

Hey @nmussy,

I'm currently using Client VPN in production and have developed a CDK construct for my use case.

Some feedback on your PR based on my experience:

I would expect the construct to create a new logs.LogGroup if the user wants logging but doesn't want to specify group/stream (a retention prop could be exposed)
Instead of having to specify a subnet: ISubnet how about using a subnetSelection: ec2.SubnetSelection; like other CDK constructs do?
You are missing a security group on your target network associations, without it the client vpn will be using the VPC's default security group. This means that you cannot offer connections on your construct. Specifying a security group for a target network association is currently not supported by CloudFormation, I had to go with the AwsCustomResource, something like this:

this.securityGroup = new ec2.SecurityGroup(this, 'SecurityGroup', {
  vpc: props.vpc,
  allowAllOutbound: false,
});

// Use custom resource to update security group
new custom.AwsCustomResource(this, 'ApplySecurityGroupsToClientVpnTargetNetwork', {
  onUpdate: {
    service: 'EC2',
    action: 'applySecurityGroupsToClientVpnTargetNetwork',
    parameters: {
      ClientVpnEndpointId: clientVpnEndpoint.ref,
      VpcId: props.vpc.vpcId,
      SecurityGroupIds: [this.securityGroup.securityGroupId],
    } as EC2.ApplySecurityGroupsToClientVpnTargetNetworkRequest,
    physicalResourceId: this.securityGroup.securityGroupId,
  },
});

nmussy · 2019-09-26T17:04:13Z

Thanks a lot @jogold for the great comments, as always. I'll keep pushing this feature tomorrow, I should have to ready for review soon-ish.

nmussy · 2019-09-27T13:28:42Z

Concerning @jogold second comment:

Instead of having to specify a subnet: ISubnet how about using a subnetSelection: ec2.SubnetSelection; like other CDK constructs do?

~~This would require asking the user for a VPC to vpc.selectSubnets, while it's not strictly required for any ClientVpn construct.~~
EDIT: The VPC would be used to create the security group his third comment

There's also the issue of having multiple subnets returned by vpc.selectSubnets. I don't know if we should throw and warn the user that their selection is ambiguous, or change the method to a addTargetNetworkAssociations and all the selected subnets.

Thoughts?

rix0rrr

There's also the issue of having multiple subnets returned by vpc.selectSubnets. I don't know if we should throw and warn the user that their selection is ambiguous, or change the method to a addTargetNetworkAssociations and all the selected subnets.

Right now there is no way to select a single subnet, it would always be a list of subnets. On the other hand, this feature has been requested so at some point SubnetSelection will grow a way to pick out individual subnets.

Is there a problem with adding the routes to multiple subnets?

Unless you have a pressing need right now to select individual subnets, I suggest you lift along with the rising tide of SubnetSelection. If you do have a pressing need, I still think you should probably implement the SubnetSelection variant, maybe add a special method to apply to a single specific ISubnet, and mark that one @experimental.

In fact, I think I would like it if you marked all of the new classes and interfaces @experimental, so we can give the new API a couple of releases to bake and a number of people to try it out before we commit to it.

rix0rrr · 2019-09-30T08:40:58Z

packages/@aws-cdk/aws-ec2/lib/client-vpn.ts

+import {CIDR_VALIDATION_REGEXES} from "./peer";
+import {ISubnet} from './vpc';
+
+interface IClientAuthenticationRequestOptions {


Docstring on the type declaration itself as well please. This comment applies to all interfaces and classes.

rix0rrr · 2019-09-30T08:42:46Z

packages/@aws-cdk/aws-ec2/lib/client-vpn.ts

+  /**
+   * Information about the Active Directory to be used
+   */
+  readonly activeDirectory?: {


This isn't going to work in jsii (and if it does, it shouldn't).

Either inline the directoryId into the parent struct, or define it as an IActiveDirectory with a class that implements it.

rix0rrr · 2019-09-30T08:42:53Z

packages/@aws-cdk/aws-ec2/lib/client-vpn.ts

+  /**
+   * Information about the authentication certificates to be used
+   */
+  readonly mutualAuthentication?: {


rix0rrr · 2019-09-30T08:44:19Z

packages/@aws-cdk/aws-ec2/lib/client-vpn.ts

+  /**
+   * The name of the CloudWatch Logs log group
+   */
+  readonly cloudwatchLogGroup?: string;


Tell us using a @default declaration what happens if you don't supply this.

Feels like this should be an ILogGroup, and the same for ILogStream, no?

rix0rrr · 2019-09-30T08:44:45Z

packages/@aws-cdk/aws-ec2/lib/client-vpn.ts

+   */
+  readonly cloudwatchLogStream?: string;
+  /**
+   * Indicates whether connection logging is enabled


Would a default of true be sensible here?

rix0rrr · 2019-09-30T08:45:50Z

packages/@aws-cdk/aws-ec2/lib/client-vpn.ts

+  }
+}
+
+interface IConnectionLogOptions {


This seems to be an intra-framework communication struct (as opposed to something that users are expected to fill in). We tend to call these XxxConfig.

It is. Do your previous comments about the default values still apply, seen as they're required by CloudFormation (either cloudwatchLogGroup or cloudwatchLogStream)?

rix0rrr · 2019-09-30T08:46:57Z

packages/@aws-cdk/aws-ec2/lib/client-vpn.ts

+   * The id of the Client VPN Endpoint
+   */
+  readonly clientVpnEndpointId: string;
+  readonly routes: ClientVpnRoute[];


Docstrings please.

rix0rrr · 2019-09-30T08:48:23Z

packages/@aws-cdk/aws-ec2/lib/client-vpn.ts

+    this.clientVpnEndpointId = clientVpnEndpoint.ref;
+  }
+
+  public addRoute(options: ClientVpnRouteOptions): ClientVpnRoute {


Does it make sense to add routes?: ClientVpnRouteOptions[] to the construction props and call this method on them in the constructor?

Yeah, I'll add it for all 3 addX methods

rix0rrr · 2019-09-30T08:49:54Z

packages/@aws-cdk/aws-ec2/lib/client-vpn.ts

+}
+
+export interface ClientVpnRouteProps extends ClientVpnRouteOptions {
+  readonly clientVpnEndpoint: IClientVpnEndpoint;


rix0rrr · 2019-09-30T08:50:45Z

packages/@aws-cdk/aws-ec2/lib/client-vpn.ts

+        subnet,
+      });
+
+    this.targetNetworkAssociations.push(association);


This is being pushed both here and in the constructed class.

I'm not sure that I'm a fan. What's the use case for maintaining and publishing these objects through the public array?

I was keeping track of them for the this.targetNetworkAssociations.length, but it doesn't feel great I agree. I didn't know what else to hook onto for the id generation.

You can just keep the count, instead of the objects themselves.

aws-cdk-automation · 2019-09-30T10:24:42Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

nmussy · 2019-09-30T12:17:12Z

I was looking into implementing @jogold's AwsCustomResource to associate the security group, but it causes another cyclic dependency:

lerna ERR! ECYCLE Dependency cycles detected, you should fix these!
lerna ERR! ECYCLE @aws-cdk/aws-cloudformation -> @aws-cdk/custom-resources -> @aws-cdk/aws-ec2 -> @aws-cdk/aws-lambda -> @aws-cdk/aws-cloudformation

An issue was recently opened on the roadmap (#199) to implement the missing method.

…cationRequestConfig

aws-cdk-automation · 2019-10-01T07:57:54Z

AWS CodeBuild CI Report

Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

jogold · 2019-10-03T07:44:29Z

I suggest you lift along with the rising tide of SubnetSelection.

We can maybe combine a SubnetSelection with a maxAZs prop... the price per client VPN endpoint association can be costly

mergify · 2019-12-16T12:34:30Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

mergify · 2019-12-16T13:01:32Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

mergify · 2019-12-16T13:53:36Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

mergify · 2019-12-16T14:39:29Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

mergify · 2019-12-16T14:53:09Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

mergify · 2019-12-16T15:18:26Z

Thanks so much for taking the time to contribute to the AWS CDK ❤️

We will shortly assign someone to review this pull request and help get it
merged. In the meantime, please take a minute to make sure you follow this
checklist:

PR title type(scope): text
- type: fix, feat, refactor go into CHANGELOG, chore is hidden
- scope: name of module without aws- or cdk- prefix or postfix (e.g. s3 instead of aws-s3-deployment)
- text: use all lower-case, do not end with a period, do not include issue refs
PR Description
- Rationale: describe rationale of change and approach taken
- Issues: indicate issues fixed via: fixes #xxx or closes #xxx
- Breaking?: last paragraph: BREAKING CHANGE: <describe what changed + link for details>
Testing
- Unit test added. Prefer to add a new test rather than modify existing tests
- CLI or init templates change? Re-run/add CLI integration tests
Documentation
- README: update module README to describe new features
- API docs: public APIs must be documented. Copy from official AWS docs when possible
- Design: for significant features, follow design process

grbartel · 2020-03-17T16:14:15Z

I am interested in using a ClientVPN in an app that I am working on so I would be interested in having access through this L2.

Is this CR still in active development? If not is this on the roadmap to be worked on again

eladb · 2020-06-02T07:30:10Z

Seems like this has been abandoned. Please reopen if relevant.

feat(ec2): ClientVpn support

0f54325

nmussy commented Sep 25, 2019

View reviewed changes

Jimmy Gaussen and others added 6 commits September 25, 2019 10:50

chore: remove consecutive blank lines

375b9f1

feat: "addX" methods

6597d2d

Merge remote-tracking branch 'upstream/master' into 4206

4548b68

chore: missing trailing comma

6715d0e

feat: ConnectionLog helper class

91668e3

chore: connectionLog docs

7e07791

feat: ClientAuthenticationRequest helper class

af723b6

Jimmy Gaussen added 3 commits September 25, 2019 15:13

chore: ClientAuthenticationRequest docs

79a61c5

chore: refactor helper class props -> options

12fae80

chore: don't export helper class options

e652dd6

Jimmy Gaussen added 3 commits September 25, 2019 15:23

chore: ClientVpnEndpoint jsdoc

3e2d456

fix: simplify addX signatures, don't add directly to stack

8597f55

feat: ux checks

1020c92

SomayaB assigned rix0rrr Sep 25, 2019

jogold reviewed Sep 26, 2019

View reviewed changes

nmussy mentioned this pull request Sep 30, 2019

AWS::EC2::ClientVpnTargetNetworkAssociation - Support SecurityGroup IDs aws-cloudformation/cloudformation-coverage-roadmap#199

Closed

rix0rrr reviewed Sep 30, 2019

View reviewed changes

Jimmy Gaussen added 9 commits September 30, 2019 11:25

chore: mark everything as @experimental

e6ed8aa

fix: replace public arrays with counters

bd9ee62

chore: refactor IConnectionLogOptions -> ConnectionLogConfig

069f110

fix: use SubnetSelection instead of ISubnet

642d89e

feat: addX calls in constructor

a43c88a

chore: refactor inline interfaces

9de0916

chore: refactor inline checks

3d47266

chore: fix import order

d5f0fb1

chore: document aws-cloudformation-coverage-roadmap#199

70f6a14

Jimmy Gaussen added 3 commits October 1, 2019 08:54

chore: remove redundant interfaces

e6a894b

chore: refactor IClientAuthenticationRequestOptions -> ClientAuthenti…

a2c8db7

…cationRequestConfig

fix: remove tags, verify blocks, jsdoc

80cce85

SomayaB added draft pr/work-in-progress This PR is a draft and needs further work. and removed draft labels Jan 7, 2020

eladb closed this Jun 2, 2020

sumodgeorge mentioned this pull request Dec 9, 2023

[Snyk] Security upgrade verdaccio from 3.8.1 to 5.29.0 sumodgeorge/aws-cdk#22

Open

sumodgeorge mentioned this pull request Dec 20, 2023

[Snyk] Security upgrade verdaccio from 3.8.1 to 5.29.0 sumodgeorge/aws-cdk#24

Open

feat(ec2): ClientVpn support #4233

feat(ec2): ClientVpn support #4233

Conversation

nmussy commented Sep 25, 2019

mergify bot commented Sep 25, 2019

aws-cdk-automation commented Sep 25, 2019

AWS CodeBuild CI Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aws-cdk-automation commented Sep 25, 2019

AWS CodeBuild CI Report

aws-cdk-automation commented Sep 25, 2019

AWS CodeBuild CI Report

aws-cdk-automation commented Sep 25, 2019

AWS CodeBuild CI Report

aws-cdk-automation commented Sep 25, 2019

AWS CodeBuild CI Report

aws-cdk-automation commented Sep 25, 2019

AWS CodeBuild CI Report

aws-cdk-automation commented Sep 25, 2019

AWS CodeBuild CI Report

aws-cdk-automation commented Sep 25, 2019

AWS CodeBuild CI Report

jogold left a comment

Choose a reason for hiding this comment

nmussy commented Sep 26, 2019

nmussy commented Sep 27, 2019 • edited

rix0rrr left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aws-cdk-automation commented Sep 30, 2019

AWS CodeBuild CI Report

nmussy commented Sep 30, 2019

aws-cdk-automation commented Oct 1, 2019

AWS CodeBuild CI Report

jogold commented Oct 3, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

mergify bot commented Dec 16, 2019

grbartel commented Mar 17, 2020

eladb commented Jun 2, 2020

nmussy commented Sep 27, 2019 •

edited