ClientVpnEndpoint: Integration with IPAM for CIDR selection
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 1d 19h
- Merged PRs (30d)
- 74
Description
### Describe the feature
I would like to request the ability to use IPAM for generating a CIDR for a `ClientVpnEndpoint`. This would be similar to how VPC has integrated with IPAM and can just pick a netmask length and you don't have to create an allocation separately
### Use Case
Our team is utilizing AWS IPAM fully and want to automate all CIDR generation. We want to include our VPN client address space in IPAM and ideally its automatically provisioned by just setting a netmask length.
### Proposed Solution
Recently VPC with IPAM integration [Issue](https://github.com/aws/aws-cdk/issues/21333) was merged allowing VPC creation to set an IPAM poolID and masks to auto allocate unused range to a VPC as seen below.
```
const vpc = new ec2.Vpc(this, "vpc", {
ipAddresses: ec2.IpAddresses.awsIpamAllocation({
ipv4IpamPoolId: props.poolId,
ipv4NetmaskLength: props.netmaskLength,
}),
...
});
```
I would like the ability to do the same for ClientVpnEndpoint, instead of passing in a cidr(that my team has to lookup/calculate manually). So the proposed solution would almost be a duplicate of the VPC implementation where I give it a pool ID and a mask and say just give me a range that isn't allocated
```
const vpnEndpoint = new ec2.ClientVpnEndpoint(this, "vpn-endpoint", {
ipAddresses: ec2.IpAddresses.awsIpamAllocation({
ipv4IpamPoolId: props.poolId,
ipv4NetmaskLength: props.netmaskLength,
}),
...
});
```
### Other Information
I have tried creating an IPAM allocation and setting the cidr on the ClientEndPoint with that object but it fails because the cidr is empty.
```
const allocation = new ec2.CfnIPAMAllocation(this, 'ipam-allocation', {
ipamPoolId: props.poolId,
description: 'Client VPN IPAM allocation',
netmaskLength: props.netmaskLength,
});
const vpnEndpoint = new ec2.ClientVpnEndpoint(this, "vpn-endpoint", {
cidr: allocation.cidr
...
});
```
### Acknowledgements
- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change
### CDK version used
2.48.0
### Environment details (OS name and version, etc.)
macOS 12.5.1
Contributor guide
Research direction
Start by comparing the VPC IPAM integration referenced in issue 21333 with ClientVpnEndpoint's existing cidr input and the IPAM allocation example in this issue. Determine the entry points and tests used for both constructs. Done means ClientVpnEndpoint can accept an IPAM pool and netmask length and provision an automatically selected CIDR.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, networking
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100