aws / aws/aws-cdk

ec2: Creating an InterfaceVpcEndpoint fails with VPC Endpoint Service in another account

Open
#28,851 3 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-ec2 bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

I have the main account and a sub-account (organization).

In the **main** account I have:

* an RDS database with a proxy;
* a VPC endpoint service exposing a connection to the proxy. The service is visible from the CLI when ran with a profile for this account.

In the sub-account, I have a network stack setting up a VPC. In the same stack, I'm trying to create an interface endpoint for the service exposed in the main account. My sub-account role is added to the service as allowed principal. **I am able to create the endpoint both from the console, and from the CLI.**

### Expected Behavior

The deployment should not fail, instead it should create a new `VpcInterfaceEndpoint` pointing at the provided `VpcInterfaceService`.

### Current Behavior

When trying to create the endpoint using CDK, the deployment fails with (real service name changed):

```
[Error at /MyStack/RdsAuroraProdProxyEndpoint] The Vpc Endpoint Service 'com.amazonaws.vpce.eu-west-1.vpce-svc-abc123' does not exist
```

However this CLI command succeeds (service IDs changed):
```
aws --profile distribution-dev ec2 create-vpc-endpoint --vpc-endpoint-type Interface --vpc-id vpc-abc123 --service-name com.amazonaws.vpce.eu-west-1.vpce-svc-abc123 --subnet-ids subnet-aaa123 subnet-bbb123 --ip-address-type ipv4 --no-private-dns-enabled
```

### Reproduction Steps

Failing CDK script:

```
import { Environment, Stack } from 'aws-cdk-lib';
import { InterfaceVpcEndpoint, InterfaceVpcEndpointService, IVpcEndpoint, SubnetType, Vpc } from 'aws-cdk-lib/aws-ec2';
import { Construct } from 'constructs';
import { VpcNetwork, VpcNetworkProps } from '../constructs/vpc-network';

interface NetworkStackProps {
readonly env: Environment;
readonly networkProps: VpcNetworkProps;
readonly rdsEndpointServiceName: string;
}

export class NetworkStack extends Stack {
readonly vpc: Vpc;
readonly rdsEndpoint: IVpcEndpoint;

constructor(scope: Construct, id: string, props: NetworkStackProps) {
super(scope, id, {
description: 'Network infrastructure',
env: props.env,
});
const { vpc } = new VpcNetwork(this, 'Vpc', props.networkProps);
this.vpc = vpc;

this.rdsEndpoint = new InterfaceVpcEndpoint(this, 'RdsAuroraProdProxyEndpoint', {
vpc: this.vpc,
service: new InterfaceVpcEndpointService('com.amazonaws.vpce.eu-west-1.vpce-svc-0db5283ce0cd76edd'),
subnets: this.vpc.selectSubnets({
subnetType: SubnetType.PRIVATE_WITH_EGRESS,
}),
lookupSupportedAzs: true,
});
}
}
```

However this CLI call succeeded (I changed the VPC ID and subnet IDs here for safety):
```bash
aws --profile dev ec2 create-vpc-endpoint --vpc-endpoint-type Interface --vpc-id vpc-abc123 --service-name com.amazonaws.vpce.eu-west-1.vpce-svc-0db5283ce0cd76edd --subnet-ids subnet-aaa123 subnet-bbb123 --ip-address-type ipv4 --no-private-dns-enabled
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.121.1

### Framework Version

_No response_

### Node.js Version

v20.9.0

### OS

Linux Manjaro 6.1.69-1-MANJARO x86_64 GNU/Linux

### Language

TypeScript

### Language Version

TypeScript 5.3.3

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the InterfaceVpcEndpoint and InterfaceVpcEndpointService entry points shown in the reproduction, then compare their deployment behavior with the successful AWS CLI create-vpc-endpoint command. Done means a cross-account service name can create the interface endpoint through CDK without the service-not-found error, while preserving the documented endpoint options.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure, networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.