ec2: Creating an InterfaceVpcEndpoint fails with VPC Endpoint Service in another account
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
I have the main account and a sub-account (organization).
In the **main** account I have:
* an RDS database with a proxy;
* a VPC endpoint service exposing a connection to the proxy. The service is visible from the CLI when ran with a profile for this account.
In the sub-account, I have a network stack setting up a VPC. In the same stack, I'm trying to create an interface endpoint for the service exposed in the main account. My sub-account role is added to the service as allowed principal. **I am able to create the endpoint both from the console, and from the CLI.**
### Expected Behavior
The deployment should not fail, instead it should create a new `VpcInterfaceEndpoint` pointing at the provided `VpcInterfaceService`.
### Current Behavior
When trying to create the endpoint using CDK, the deployment fails with (real service name changed):
```
[Error at /MyStack/RdsAuroraProdProxyEndpoint] The Vpc Endpoint Service 'com.amazonaws.vpce.eu-west-1.vpce-svc-abc123' does not exist
```
However this CLI command succeeds (service IDs changed):
```
aws --profile distribution-dev ec2 create-vpc-endpoint --vpc-endpoint-type Interface --vpc-id vpc-abc123 --service-name com.amazonaws.vpce.eu-west-1.vpce-svc-abc123 --subnet-ids subnet-aaa123 subnet-bbb123 --ip-address-type ipv4 --no-private-dns-enabled
```
### Reproduction Steps
Failing CDK script:
```
import { Environment, Stack } from 'aws-cdk-lib';
import { InterfaceVpcEndpoint, InterfaceVpcEndpointService, IVpcEndpoint, SubnetType, Vpc } from 'aws-cdk-lib/aws-ec2';
import { Construct } from 'constructs';
import { VpcNetwork, VpcNetworkProps } from '../constructs/vpc-network';
interface NetworkStackProps {
readonly env: Environment;
readonly networkProps: VpcNetworkProps;
readonly rdsEndpointServiceName: string;
}
export class NetworkStack extends Stack {
readonly vpc: Vpc;
readonly rdsEndpoint: IVpcEndpoint;
constructor(scope: Construct, id: string, props: NetworkStackProps) {
super(scope, id, {
description: 'Network infrastructure',
env: props.env,
});
const { vpc } = new VpcNetwork(this, 'Vpc', props.networkProps);
this.vpc = vpc;
this.rdsEndpoint = new InterfaceVpcEndpoint(this, 'RdsAuroraProdProxyEndpoint', {
vpc: this.vpc,
service: new InterfaceVpcEndpointService('com.amazonaws.vpce.eu-west-1.vpce-svc-0db5283ce0cd76edd'),
subnets: this.vpc.selectSubnets({
subnetType: SubnetType.PRIVATE_WITH_EGRESS,
}),
lookupSupportedAzs: true,
});
}
}
```
However this CLI call succeeded (I changed the VPC ID and subnet IDs here for safety):
```bash
aws --profile dev ec2 create-vpc-endpoint --vpc-endpoint-type Interface --vpc-id vpc-abc123 --service-name com.amazonaws.vpce.eu-west-1.vpce-svc-0db5283ce0cd76edd --subnet-ids subnet-aaa123 subnet-bbb123 --ip-address-type ipv4 --no-private-dns-enabled
```
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.121.1
### Framework Version
_No response_
### Node.js Version
v20.9.0
### OS
Linux Manjaro 6.1.69-1-MANJARO x86_64 GNU/Linux
### Language
TypeScript
### Language Version
TypeScript 5.3.3
### Other information
_No response_
Contributor guide
Research direction
Start with the InterfaceVpcEndpoint and InterfaceVpcEndpointService entry points shown in the reproduction, then compare their deployment behavior with the successful AWS CLI create-vpc-endpoint command. Done means a cross-account service name can create the interface endpoint through CDK without the service-not-found error, while preserving the documented endpoint options.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100