aws / aws/aws-cdk

ClientVpnEndpoint: Integration with IPAM for CIDR selection

Open
#22,889 2 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-ec2 feature-request needs-cfn p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the feature

I would like to request the ability to use IPAM for generating a CIDR for a `ClientVpnEndpoint`. This would be similar to how VPC has integrated with IPAM and can just pick a netmask length and you don't have to create an allocation separately

### Use Case

Our team is utilizing AWS IPAM fully and want to automate all CIDR generation. We want to include our VPN client address space in IPAM and ideally its automatically provisioned by just setting a netmask length.

### Proposed Solution

Recently VPC with IPAM integration [Issue](https://github.com/aws/aws-cdk/issues/21333) was merged allowing VPC creation to set an IPAM poolID and masks to auto allocate unused range to a VPC as seen below.

```
const vpc = new ec2.Vpc(this, "vpc", {
ipAddresses: ec2.IpAddresses.awsIpamAllocation({
ipv4IpamPoolId: props.poolId,
ipv4NetmaskLength: props.netmaskLength,
}),
...
});
```

I would like the ability to do the same for ClientVpnEndpoint, instead of passing in a cidr(that my team has to lookup/calculate manually). So the proposed solution would almost be a duplicate of the VPC implementation where I give it a pool ID and a mask and say just give me a range that isn't allocated
```
const vpnEndpoint = new ec2.ClientVpnEndpoint(this, "vpn-endpoint", {
ipAddresses: ec2.IpAddresses.awsIpamAllocation({
ipv4IpamPoolId: props.poolId,
ipv4NetmaskLength: props.netmaskLength,
}),
...
});
```

### Other Information

I have tried creating an IPAM allocation and setting the cidr on the ClientEndPoint with that object but it fails because the cidr is empty.
```
const allocation = new ec2.CfnIPAMAllocation(this, 'ipam-allocation', {
ipamPoolId: props.poolId,
description: 'Client VPN IPAM allocation',
netmaskLength: props.netmaskLength,
});

const vpnEndpoint = new ec2.ClientVpnEndpoint(this, "vpn-endpoint", {
cidr: allocation.cidr
...
});
```

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

2.48.0

### Environment details (OS name and version, etc.)

macOS 12.5.1

Contributor guide

Open the contributing guide

Research direction

Start by comparing the VPC IPAM integration referenced in issue 21333 with ClientVpnEndpoint's existing cidr input and the IPAM allocation example in this issue. Determine the entry points and tests used for both constructs. Done means ClientVpnEndpoint can accept an IPAM pool and netmask length and provision an automatically selected CIDR.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, networking
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.