DEV Community: Rafal Krol

Ping Me! (Part 3: Transit Gateway Using CDK)

Rafal Krol — Mon, 26 Jul 2021 12:27:54 +0000

Overview

Transit Gateway (TGW) is a relatively new thing on AWS, but one that has greatly simplified networking, especially for the more complex topologies (e.g. dozens or even hundreds of VPCs spanned across different AWS regions and accounts).

In short, it's a powerful beast that acts as a highly scalable cloud router. A single TGW can support up to 5,000 attachments, where an attachment can be a VPC, a Direct Connect Gateway (DXGW), a VPN connection or a peering connection to another TGW.

Traffic between a TGW and a VPC, as well as any inter-region traffic, stays on the AWS backbone network.

There is a multitude of scenarios for using a TGW (mesh networks, hub-and-spoke networks, isolated VPCs with shared services, etc.) and it'd be virtually impossible to build an enterprise-grade infrastructure on AWS without using one.

Cost-wise, you pay for two things: the number of attachments to a TGW (there's an hourly rate) and data transfer.

Implementation

As is the common theme in this series, we'll connect two VPCs together to make a successful ping between EC2 instances placed in both of them. This time a Transit Gateway (TGW) is going to be the glue.

Once again, we'll reuse the VpcStack and InstanceStack classes that we created in part 1. Additionally, we'll create two classes, both will live in one file, one for a TGW and the other for routes leading to it:

➜  ping-me-cdk-example$ touch lib/tgw.ts

ping-me-cdk-example/lib/tgw.ts

import * as ec2 from '@aws-cdk/aws-ec2';
import * as cdk from '@aws-cdk/core';

interface TransitGatewayProps extends cdk.StackProps {
    vpcs: [ec2.Vpc, ec2.Vpc, ...ec2.Vpc[]]; // <--- a list of VPC objects (at least two are required) to be attached to the Transit Gateway; NB only routes between the first two VPCs will be created
}

export class TransitGatewayStack extends cdk.Stack {

    constructor(scope: cdk.Construct, id: string, props: TransitGatewayProps) {
        super(scope, id, props);

        // create a Transit Gateway
        const tgw = new ec2.CfnTransitGateway(this, 'Tgw');

        // For each supplied VPC, create a Transit Gateway attachment
        props.vpcs.forEach((vpc, index) => {
            new ec2.CfnTransitGatewayAttachment(this, `TgwVpcAttachment${index}`, {
                subnetIds: vpc.privateSubnets.map(privateSubnet => privateSubnet.subnetId),
                transitGatewayId: tgw.ref,
                vpcId: vpc.vpcId,
            });
        });

        // Output the Transit Gateway's ID
        new cdk.CfnOutput(this, 'TransitGatewayId', {
            value: tgw.ref,
            exportName: 'TransitGatewayId',
        });
    }
}

export class RoutesToTransitGatewayStack extends cdk.Stack {

    constructor(scope: cdk.Construct, id: string, props: TransitGatewayProps) {
        super(scope, id, props);

        // Add route from the private subnet of the first VPC to the second VPC over the Transit Gateway
        // NB the below was taken from: https://stackoverflow.com/questions/62525195/adding-entry-to-route-table-with-cdk-typescript-when-its-private-subnet-alread
        props.vpcs[0].privateSubnets.forEach(({ routeTable: { routeTableId } }, index) => {
            new ec2.CfnRoute(this, 'RouteFromPrivateSubnetOfVpc1ToVpc2' + index, {
                destinationCidrBlock: props.vpcs[1].vpcCidrBlock,
                routeTableId,
                transitGatewayId: cdk.Fn.importValue('TransitGatewayId'), // Transit Gateway must already exist
            });
        });

        // Add route from the private subnet of the second VPC to the first VPC over the Transit Gateway
        props.vpcs[1].privateSubnets.forEach(({ routeTable: { routeTableId } }, index) => {
            new ec2.CfnRoute(this, 'RouteFromPrivateSubnetOfVpc2ToVpc1' + index, {
                destinationCidrBlock: props.vpcs[0].vpcCidrBlock,
                routeTableId,
                transitGatewayId: cdk.Fn.importValue('TransitGatewayId'), // Transit Gateway must already exist
            });
        });
    }
}

With these four classes at our disposal, we can initialize the necessary stacks:

ping-me-cdk-example/bin/ping-me-cdk-example.ts

import * as cdk from '@aws-cdk/core';
import { VpcStack } from '../lib/vpc';
import { InstanceStack } from '../lib/instance';
import { PeeringStack } from '../lib/peering';
import { CustomerGatewayDeviceStack } from '../lib/cgd';
import { TransitGatewayStack, RoutesToTransitGatewayStack } from '../lib/tgw';

const app = new cdk.App(); // <--- you can read more about the App construct here: https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_core.App.html

/**
 * CODE FROM "Ping Me! (Part 1: VPC Peering Using CDK)" AND "Ping Me! (Part 2: Site-to-Site VPN Using CDK)" WAS REMOVED FOR VISIBILITY
 */

 // Create two VPCs
const vpcsMetInTransit = new VpcStack(app, 'VpcsMetInTransitStack', {
  vpcSetup: {
    cidrs: ['10.0.4.0/24', '10.0.5.0/24'], // <--- two non-overlapping CIDR ranges for our two VPCs
    maxAzs: 1, // <--- to keep the costs down, we'll stick to 1 availability zone per VPC (obviously, not something you'd want to do in production)
  },
});

// Create two EC2 instances, one in each VPC
new InstanceStack(app, 'InstanceTransitStack', {
  vpcs: vpcsMetInTransit.createdVpcs,
});

// Create a Transit Gateway and attach both VPCs to it
new TransitGatewayStack(app, 'TransitGatewayStack', {
  vpcs: [vpcsMetInTransit.createdVpcs[0], vpcsMetInTransit.createdVpcs[1]],
});

// Create routes between both VPCs over the Transit Gateway
new RoutesToTransitGatewayStack(app, 'RoutesToTransitGatewayStack', {
  vpcs: [vpcsMetInTransit.createdVpcs[0], vpcsMetInTransit.createdVpcs[1]],
});

The deployment will be done in three stages:

first, InstanceTransitStack (implicitly with VpcsMetInTransitStack).

(During this step you can grab the ID of your source EC2 instance and the private IP of your destination EC2 instance.
Both will come in handy in a bit when we'll attempt to ping one from the other.)

➜  ping-me-cdk-example$ cdk deploy InstanceTransitStack --require-approval never
Including dependency stacks: VpcsMetInTransitStack
VpcsMetInTransitStack
VpcsMetInTransitStack: deploying...
VpcsMetInTransitStack: creating CloudFormation changeset...
[██████████████████████████████████████████████████████████] (30/30)

 ✅  VpcsMetInTransitStack

Outputs:
VpcsMetInTransitStack.ExportsOutputFnGetAttVpc07C831B30CidrBlockB8164F9E = 10.0.4.0/24
VpcsMetInTransitStack.ExportsOutputFnGetAttVpc07C831B30DefaultSecurityGroup52C351BF = sg-0b97deeeacfd5627d
VpcsMetInTransitStack.ExportsOutputFnGetAttVpc1C211860BCidrBlock933A5AA8 = 10.0.5.0/24
VpcsMetInTransitStack.ExportsOutputFnGetAttVpc1C211860BDefaultSecurityGroup87C47BC2 = sg-0dfe3c25a0cd42e84
VpcsMetInTransitStack.ExportsOutputRefVpc07C831B304FE08623 = vpc-063e0aaa8aaf32b32
VpcsMetInTransitStack.ExportsOutputRefVpc0privateSubnet1RouteTableB5C6777D52F53FE8 = rtb-053b342d2f9950c58
VpcsMetInTransitStack.ExportsOutputRefVpc0privateSubnet1SubnetD6383522ACB05B9B = subnet-002286581738a15da
VpcsMetInTransitStack.ExportsOutputRefVpc1C211860B64169B74 = vpc-0020c0197873df61c
VpcsMetInTransitStack.ExportsOutputRefVpc1privateSubnet1RouteTable339A93B3DFC75FCA = rtb-0b3cac3abd02c16d6
VpcsMetInTransitStack.ExportsOutputRefVpc1privateSubnet1Subnet41967AFDFF883DAB = subnet-0c10da57ee874b680

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/VpcsMetInTransitStack/a54b7350-3560-11eb-ae91-0643678755c5
InstanceTransitStack
InstanceTransitStack: deploying...
InstanceTransitStack: creating CloudFormation changeset...
[██████████████████████████████████████████████████████████] (10/10)

 ✅  InstanceTransitStack

Outputs:
InstanceTransitStack.Instance0BastionHostId1959CA92 = i-03d7c391c35302d4a # <--- COPY THE ID OF YOUR SOURCE EC2 INSTANCE!
InstanceTransitStack.Instance0PrivateIp = 10.0.4.58
InstanceTransitStack.Instance1BastionHostIdEF2AA144 = i-0d315dbb89ed80f82
InstanceTransitStack.Instance1PrivateIp = 10.0.5.54 # <--- COPY THE PRIVATE IP OF YOUR DESTINATION EC2 INSTANCE!

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/InstanceTransitStack/11f0b6a0-3561-11eb-842c-0aa13688a741

then TransitGatewayStack

➜  ping-me-cdk-example$ cdk deploy TransitGatewayStack --require-approval never
Including dependency stacks: VpcsMetInTransitStack
VpcsMetInTransitStack
VpcsMetInTransitStack: deploying...

 ✅  VpcsMetInTransitStack (no changes)

Outputs:
VpcsMetInTransitStack.ExportsOutputFnGetAttVpc07C831B30CidrBlockB8164F9E = 10.0.4.0/24
VpcsMetInTransitStack.ExportsOutputFnGetAttVpc07C831B30DefaultSecurityGroup52C351BF = sg-0b97deeeacfd5627d
VpcsMetInTransitStack.ExportsOutputFnGetAttVpc1C211860BCidrBlock933A5AA8 = 10.0.5.0/24
VpcsMetInTransitStack.ExportsOutputFnGetAttVpc1C211860BDefaultSecurityGroup87C47BC2 = sg-0dfe3c25a0cd42e84
VpcsMetInTransitStack.ExportsOutputRefVpc07C831B304FE08623 = vpc-063e0aaa8aaf32b32
VpcsMetInTransitStack.ExportsOutputRefVpc0privateSubnet1RouteTableB5C6777D52F53FE8 = rtb-053b342d2f9950c58
VpcsMetInTransitStack.ExportsOutputRefVpc0privateSubnet1SubnetD6383522ACB05B9B = subnet-002286581738a15da
VpcsMetInTransitStack.ExportsOutputRefVpc1C211860B64169B74 = vpc-0020c0197873df61c
VpcsMetInTransitStack.ExportsOutputRefVpc1privateSubnet1RouteTable339A93B3DFC75FCA = rtb-0b3cac3abd02c16d6
VpcsMetInTransitStack.ExportsOutputRefVpc1privateSubnet1Subnet41967AFDFF883DAB = subnet-0c10da57ee874b680

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/VpcsMetInTransitStack/a54b7350-3560-11eb-ae91-0643678755c5
TransitGatewayStack
TransitGatewayStack: deploying...
TransitGatewayStack: creating CloudFormation changeset...
[██████████████████████████████████████████████████████████] (5/5)

 ✅  TransitGatewayStack

Outputs:
TransitGatewayStack.TransitGatewayId = tgw-057de86d7c789626e

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/TransitGatewayStack/e86b7b70-3561-11eb-b82a-0ad12ebbcfd9

and finally RoutesToTransitGatewayStack

➜  ping-me-cdk-example$ cdk deploy RoutesToTransitGatewayStack --require-approval never
Including dependency stacks: VpcsMetInTransitStack
VpcsMetInTransitStack
VpcsMetInTransitStack: deploying...

 ✅  VpcsMetInTransitStack (no changes)

Outputs:
VpcsMetInTransitStack.ExportsOutputFnGetAttVpc07C831B30CidrBlockB8164F9E = 10.0.4.0/24
VpcsMetInTransitStack.ExportsOutputFnGetAttVpc07C831B30DefaultSecurityGroup52C351BF = sg-0b97deeeacfd5627d
VpcsMetInTransitStack.ExportsOutputFnGetAttVpc1C211860BCidrBlock933A5AA8 = 10.0.5.0/24
VpcsMetInTransitStack.ExportsOutputFnGetAttVpc1C211860BDefaultSecurityGroup87C47BC2 = sg-0dfe3c25a0cd42e84
VpcsMetInTransitStack.ExportsOutputRefVpc07C831B304FE08623 = vpc-063e0aaa8aaf32b32
VpcsMetInTransitStack.ExportsOutputRefVpc0privateSubnet1RouteTableB5C6777D52F53FE8 = rtb-053b342d2f9950c58
VpcsMetInTransitStack.ExportsOutputRefVpc0privateSubnet1SubnetD6383522ACB05B9B = subnet-002286581738a15da
VpcsMetInTransitStack.ExportsOutputRefVpc1C211860B64169B74 = vpc-0020c0197873df61c
VpcsMetInTransitStack.ExportsOutputRefVpc1privateSubnet1RouteTable339A93B3DFC75FCA = rtb-0b3cac3abd02c16d6
VpcsMetInTransitStack.ExportsOutputRefVpc1privateSubnet1Subnet41967AFDFF883DAB = subnet-0c10da57ee874b680

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/VpcsMetInTransitStack/a54b7350-3560-11eb-ae91-0643678755c5
RoutesToTransitGatewayStack
RoutesToTransitGatewayStack: deploying...
RoutesToTransitGatewayStack: creating CloudFormation changeset...
[██████████████████████████████████████████████████████████] (4/4)

 ✅  RoutesToTransitGatewayStack

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/RoutesToTransitGatewayStack/d803d8d0-3562-11eb-aaeb-02e586bc56f0

Validation

It's time to unleash the ping!

If you're following along, be sure to swap the ID of the source EC2 instance (i-03d7c391c35302d4a) and the private IP of the destination EC2 instance (10.0.5.54) for appropriate values before running the below:

aws ssm send-command \
--document-name "AWS-RunShellScript" \
--document-version "1" \
--targets '[{"Key":"InstanceIds","Values":["i-03d7c391c35302d4a"]}]' \
--parameters '{"workingDirectory":[""],"executionTimeout":["3600"],"commands":["ping 10.0.5.54 -c 3"]}' \
--timeout-seconds 600 \
--max-concurrency "50" \
--max-errors "0"
{
    "Command": {
        "CommandId": "f7ed8e0e-a313-405a-a811-7885b4d532e7",
        "DocumentName": "AWS-RunShellScript",
        "DocumentVersion": "1",
        "Comment": "",
        "ExpiresAfter": "2020-12-03T15:06:43.691000+01:00",
        "Parameters": {
            "commands": [
                "ping 10.0.5.54 -c 3"
            ],
            "executionTimeout": [
                "3600"
            ],
            "workingDirectory": [
                ""
            ]
        },
        "InstanceIds": [],
        "Targets": [
            {
                "Key": "InstanceIds",
                "Values": [
                    "i-03d7c391c35302d4a"
                ]
            }
        ],
        "RequestedDateTime": "2020-12-03T13:56:43.691000+01:00",
        "Status": "Pending",
        "StatusDetails": "Pending",
        "OutputS3BucketName": "",
        "OutputS3KeyPrefix": "",
        "MaxConcurrency": "50",
        "MaxErrors": "0",
        "TargetCount": 0,
        "CompletedCount": 0,
        "ErrorCount": 0,
        "DeliveryTimedOutCount": 0,
        "ServiceRole": "",
        "NotificationConfig": {
            "NotificationArn": "",
            "NotificationEvents": [],
            "NotificationType": ""
        },
        "CloudWatchOutputConfig": {
            "CloudWatchLogGroupName": "",
            "CloudWatchOutputEnabled": false
        },
        "TimeoutSeconds": 600
    }
}

Now, let's check whether that succeeded by using AWS CLI's aws ssm get-command-invocation command.

Again, if you're following along, be sure to swap the command ID (f7ed8e0e-a313-405a-a811-7885b4d532e7) and the ID of the source EC2 instance (i-03d7c391c35302d4a) for appropriate values before running the below:

➜  ping-me-cdk-example$ aws ssm get-command-invocation --command-id f7ed8e0e-a313-405a-a811-7885b4d532e7 --instance-id i-03d7c391c35302d4a
{
    "CommandId": "f7ed8e0e-a313-405a-a811-7885b4d532e7",
    "InstanceId": "i-03d7c391c35302d4a",
    "Comment": "",
    "DocumentName": "AWS-RunShellScript",
    "DocumentVersion": "1",
    "PluginName": "aws:runShellScript",
    "ResponseCode": 0,
    "ExecutionStartDateTime": "2020-12-03T12:56:44.343Z",
    "ExecutionElapsedTime": "PT2.044S",
    "ExecutionEndDateTime": "2020-12-03T12:56:46.343Z",
    "Status": "Success",
    "StatusDetails": "Success",
    "StandardOutputContent": "PING 10.0.5.54 (10.0.5.54) 56(84) bytes of data.\n64 bytes from 10.0.5.54: icmp_seq=1 ttl=254 time=0.489 ms\n64 bytes from 10.0.5.54: icmp_seq=2 ttl=254 time=0.311 ms\n64 bytes from 10.0.5.54: icmp_seq=3 ttl=254 time=0.306 ms\n\n--- 10.0.5.54 ping statistics ---\n3 packets transmitted, 3 received, 0% packet loss, time 2027ms\nrtt min/avg/max/mdev = 0.306/0.368/0.489/0.087 ms\n",
    "StandardOutputUrl": "",
    "StandardErrorContent": "",
    "StandardErrorUrl": "",
    "CloudWatchOutputConfig": {
        "CloudWatchLogGroupName": "",
        "CloudWatchOutputEnabled": false
    }
}

3 packets transmitted, 3 received, 0% packet loss. That's an astounding success!

Cleanup

For the sake of our wallets, let's promptly destroy the current infrastructure before wrapping everything up.

As was the case with the building process, the destroying part must also be done in stages:

first we need to remove the routes to the Transit Gateway. When prompted, type y for yes:

➜  ping-me-cdk-example$ cdk destroy RoutesToTransitGatewayStack
Are you sure you want to delete: RoutesToTransitGatewayStack (y/n)? y
RoutesToTransitGatewayStack: destroying...
14:08:49 | DELETE_IN_PROGRESS   | AWS::CloudFormation::Stack | RoutesToTransitGatewayStack
14:08:51 | DELETE_IN_PROGRESS   | AWS::EC2::Route    | RouteFromPrivateSubnetOfVpc2ToVpc10
 ✅  RoutesToTransitGatewayStack: destroyed

once the routes are removed we can safely delete the remaining stacks. When prompted, type y for yes:

➜  ping-me-cdk-example$ cdk destroy --all
Are you sure you want to delete: InstanceVpnDestinationStack, VpcVpnDestinationStack, TransitGatewayStack, RoutesToTransitGatewayStack, PeeringStack, InstanceTransitStack, InstancePeersStack, CustomerGatewayDeviceStack, VpcsMetInTransitStack, VpcVpnSourceStack, VpcPeersStack (y/n)? y
InstanceVpnDestinationStack: destroying...
 ✅  InstanceVpnDestinationStack: destroyed
VpcVpnDestinationStack: destroying...
 ✅  VpcVpnDestinationStack: destroyed
TransitGatewayStack: destroying...
14:12:23 | DELETE_IN_PROGRESS   | AWS::CloudFormation::Stack         | TransitGatewayStack
 ✅  TransitGatewayStack: destroyed
RoutesToTransitGatewayStack: destroying...
 ✅  RoutesToTransitGatewayStack: destroyed
PeeringStack: destroying...
 ✅  PeeringStack: destroyed
InstanceTransitStack: destroying...
14:15:30 | DELETE_IN_PROGRESS   | AWS::CloudFormation::Stack | InstanceTransitStack
 ✅  InstanceTransitStack: destroyed
InstancePeersStack: destroying...
 ✅  InstancePeersStack: destroyed
CustomerGatewayDeviceStack: destroying...
 ✅  CustomerGatewayDeviceStack: destroyed
VpcsMetInTransitStack: destroying...
14:16:49 | DELETE_IN_PROGRESS   | AWS::CloudFormation::Stack            | VpcsMetInTransitStack
14:18:56 | DELETE_IN_PROGRESS   | AWS::EC2::InternetGateway             | Vpc0/IGW
14:18:56 | DELETE_IN_PROGRESS   | AWS::EC2::VPC                         | Vpc0
 ✅  VpcsMetInTransitStack: destroyed
VpcVpnSourceStack: destroying...
 ✅  VpcVpnSourceStack: destroyed
VpcPeersStack: destroying...
 ✅  VpcPeersStack: destroyed

Conclusion

In this series of articles, we saw how with relative ease you can use Cloud Development Kit (CDK) to create, update and destroy various AWS resources, and further bind them all together in a configuration that best suits your needs.

Ping Me! (Intro: IaC and Prep Work) discussed why we even bother with such things like Infrastructure as Code (IaC).

In Ping Me! (Part 1: VPC Peering Using CDK) we wrote our first classes and then initialized them as stacks.

Ping Me! (Part 2: Site-to-Site VPN Using CDK) focused on a more complex construct that needed additional configuration through the AWS CLI.

The final part centered around one of the coolest AWS network resources, namely the Transit Gateway (TGW).

Please remember that all of the code is available on GitHub.

"That's all Folks!" Hope you enjoyed the read and until next time!

Ping Me! (Part 2: Site-to-Site VPN Using CDK)

Rafal Krol — Sun, 25 Jul 2021 11:55:48 +0000

Overview

Thanks to AWS Site-to-Site VPN you can establish a secure connection over insecure infrastructure (e.g. the public internet) between a VPC and your on-premises data center. With such a connection in place, you can communicate with your EC2 instances as if they were within your existing corporate network.

It is much cheaper and quicker to establish this option rather than AWS Direct Connect, although it is less reliable in terms of performance and has a lower cap for bandwidth. It's not uncommon to have both in place, with AWS Site-to-Site VPN being the backup option.

Furthermore, if you have multiple data centers, each with an AWS Site-to-Site VPN connection to a central Virtual Private Gateway (that's the logical construct on which the VPN connection is terminated), you can provide secure communications between those in a hub-and-spoke model using something that AWS advertises as VPN CloudHub.

As far as billing is concerned, you pay for each hour during which the VPN connection is in the available state (thus, to avoid unnecessary costs you should terminate it whenever it's not in use), plus the usual fee for the data out transfer.

Implementation and validation

As mentioned in the overview section, in most cases you'd use AWS Site-to-Site VPN to connect your on-premises data center to AWS. However, for the sake of simplicity, we're going to connect two VPCs together using the Software VPN-to-AWS Managed VPN approach.

Since we'll reuse the VpcStack and InstanceStack classes that we've created in part 1, the only class we're missing is the one for the Customer Gateway Device (CGD):

➜  ping-me-cdk-example$ touch lib/cgd.ts

ping-me-cdk-example/lib/instance.ts

import * as cdk from '@aws-cdk/core';
import * as ec2 from '@aws-cdk/aws-ec2';
import * as iam from '@aws-cdk/aws-iam'; // <--- this module is not available from the start; remember to import it: `npm install @aws-cdk/aws-iam`

interface CustomerGatewayDeviceProps extends cdk.StackProps {
  vpc: ec2.Vpc; // <--- the VPC in which the Customer Gateway Device will be created
}

export class CustomerGatewayDeviceStack extends cdk.Stack {

  constructor(scope: cdk.Construct, id: string, props: CustomerGatewayDeviceProps) {
    super(scope, id, props);

    // Prepare the user data to be applied to the Windows EC2 instance on its initial boot-up
    const userData = ec2.UserData.forWindows();
    userData.addCommands(
      // The below PowerShell commands were taken from here: https://github.com/ACloudGuru-Resources/course-aws-certified-advanced-networking-specialty/blob/3a687ba5c70d507a53743037b8f1c5a52d05d357/SteveResources/OnPremNet.yaml#L126
      '<powershell>',
      '# Disable Internet Explorer Enhanced Security Configuration for Administrators',
      'Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" -Name "IsInstalled" -Value 0 -Force',
      'Stop-Process -Name iexplore -ErrorAction SilentlyContinue',
      '# Begin configuration for VPN services',
      'Set-NetAdapterAdvancedProperty -DisplayName "IPv4 Checksum Offload" -DisplayValue "Disabled"',
      'Set-NetAdapterAdvancedProperty -DisplayName "TCP Checksum Offload (IPv4)" -DisplayValue "Disabled"',
      'Set-NetAdapterAdvancedProperty -DisplayName "UDP Checksum Offload (IPv4)" -DisplayValue "Disabled"',
      'Invoke-WebRequest https://steveatacg.s3-us-west-1.amazonaws.com/advnetspec/Win2019VPNServerConfig.xml -OutFile c:\config.xml',
      'Install-WindowsFeature -ConfigurationFilePath c:\config.xml -computername $env:COMPUTERNAME -Restart',
      'Install-RemoteAccess -VpnType VpnS2S',
      '</powershell>',
    )

    // Create an IAM role allowing the instance to be managed by SSM
    const ssmRoleForEc2 = new iam.Role(this, 'SsmRoleForEc2', {
      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
      managedPolicies: [iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSSMManagedInstanceCore')],
    });

    // Create an EC2 instance to serve as the software VPN
    const cgd = new ec2.Instance(this, 'CGW', {
      vpc: props.vpc,
      instanceType: new ec2.InstanceType('t2.micro'),
      machineImage: ec2.MachineImage.fromSSMParameter('/aws/service/ami-windows-latest/Windows_Server-2019-English-Full-Base', ec2.OperatingSystemType.WINDOWS, userData), // <--- use the latest Amazon Machine Image for Windows Server 2019
      vpcSubnets: {
        subnetType: ec2.SubnetType.PUBLIC, // <--- place the instance in a public subnet
      },
      role: ssmRoleForEc2, // <--- use the created earlier IAM role as the instance profile
      sourceDestCheck: false, // <--- make sure the source/destination check is turned off
    });

    // Output the instance's public IP
    new cdk.CfnOutput(this, 'CustomerGatewayDevicePublicIp', {
      value: cgd.instancePublicIp,
    });
  }
}

Since the @aws-cdk/aws-iam module was not imported during the cdk initialization, let's install it now:

➜  ping-me-cdk-example$ npm install @aws-cdk/aws-iam@1.73.0  
npm WARN ping-me-cdk-example@0.1.0 No repository field.
npm WARN ping-me-cdk-example@0.1.0 No license field.

+ @aws-cdk/aws-iam@1.73.0
updated 1 package and audited 847 packages in 5.085s

27 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

We explicitly chose the 1.73.0 version (the exact same one as for our @aws-cdk/core and @aws-cdk/aws-ec2 modules) to avoid the possibility of seeing the Argument of type 'this' is not assignable to parameter of type 'Construct' error.

Since we got all the pieces of the puzzle, let's start putting them together.

First, we'll initialize the VPN source VPC (that's the one that mocks an on-prem network) and place a Customer Gateway Device (a software VPN in our case) in it:

ping-me-cdk-example/bin/ping-me-cdk-example.ts

import * as cdk from '@aws-cdk/core';
import { VpcStack } from '../lib/vpc';
import { InstanceStack } from '../lib/instance';
import { PeeringStack } from '../lib/peering';
import { CustomerGatewayDeviceStack } from '../lib/cgd'; // <--- added in part 2

const app = new cdk.App(); // <--- you can read more about the App construct here: https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_core.App.html

/**
 * CODE FROM "Ping Me! (Part 1: VPC Peering Using CDK)" WAS REMOVED FOR VISIBILITY
 */

// Create a VPN source VPC
const vpcVpnSource = new VpcStack(app, 'VpcVpnSourceStack', {
  vpcSetup: {
    cidrs: ['10.0.2.0/24'],
    maxAzs: 1, // <--- to keep the costs down, we'll stick to 1 availability zone per VPC (obviously, not something you'd want to do in production)
  },
});

// Create a Customer Gateway Device in the VPN source VPC
new CustomerGatewayDeviceStack(app, 'CustomerGatewayDeviceStack', {
  vpc: vpcVpnSource.createdVpcs[0],
});

Now, we can deploy these two stacks. And since VpcVpnSourceStack is a dependency of CustomerGatewayDeviceStack we can just call the latter in our command and still both are going to be built out:

➜  ping-me-cdk-example$ cdk deploy CustomerGatewayDeviceStack --require-approval never
Including dependency stacks: VpcVpnSourceStack
VpcVpnSourceStack
VpcVpnSourceStack: deploying...
VpcVpnSourceStack: creating CloudFormation changeset...
[██████████████████████████████████████████████████████████] (16/16)

 ✅  VpcVpnSourceStack

Outputs:
VpcVpnSourceStack.ExportsOutputFnGetAttVpc07C831B30CidrBlockB8164F9E = 10.0.2.0/24
VpcVpnSourceStack.ExportsOutputRefVpc07C831B304FE08623 = vpc-0d8d8118923b40b85
VpcVpnSourceStack.ExportsOutputRefVpc0publicSubnet1SubnetB977A71E8C9155C7 = subnet-037467ea871b103c1

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/VpcVpnSourceStack/f9d46c70-3005-11eb-8c3a-06fab0925578
CustomerGatewayDeviceStack
CustomerGatewayDeviceStack: deploying...
CustomerGatewayDeviceStack: creating CloudFormation changeset...
[██████████████████████████████████████████████████████████] (6/6)

 ✅  CustomerGatewayDeviceStack

Outputs:
CustomerGatewayDeviceStack.CustomerGatewayDevicePublicIp = 52.51.199.29 # <--- COPY THE PUBLIC IP OF THE CUSTOMER GATEWAY DEVICE (CGD)

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/CustomerGatewayDeviceStack/665a19d0-3006-11eb-9492-0a91d0eaa80f

Let's grab the public IP of the CGD from the above output, or by using AWS CLI (like so: aws cloudformation describe-stacks --stack-name CustomerGatewayDeviceStack --query "Stacks[].Outputs[].OutputValue") and move on to creating a VPN destination VPC, with a Site-to-Site VPN connection to the VPN source VPC already in place, and an EC2 instance that'll serve as our ping destination.

ping-me-cdk-example/bin/ping-me-cdk-example.ts

/**
 * ALL PRECEDING CODE WAS REMOVED FOR VISIBILITY
 */

const vpcVpnDestination = new VpcStack(app, 'VpcVpnDestinationStack', {
  vpcSetup: {
    cidrs: ['10.0.3.0/24'],
    maxAzs: 1, // <--- to keep the costs down, we'll stick to 1 availability zone per VPC (obviously, not something you'd want to do in production)
    vpnConnections: {
      toOnPrem: {
        ip: '52.51.199.29', // <--- grab this from the outputs of CustomerGatewayDeviceStack, e.g.: aws cloudformation describe-stacks --stack-name CustomerGatewayDeviceStack --query "Stacks[].Outputs[].OutputValue"
        staticRoutes: [
          vpcVpnSource.createdVpcs[0].vpcCidrBlock,
        ]
      }
    }
  },
});

new InstanceStack(app, 'InstanceVpnDestinationStack', {
  vpcs: vpcVpnDestination.createdVpcs,
});

➜  ping-me-cdk-example$ cdk deploy InstanceVpnDestinationStack --require-approval never
Including dependency stacks: VpcVpnDestinationStack, VpcVpnSourceStack
VpcVpnSourceStack
VpcVpnSourceStack: deploying...

 ✅  VpcVpnSourceStack (no changes)

Outputs:
VpcVpnSourceStack.ExportsOutputFnGetAttVpc07C831B30CidrBlockB8164F9E = 10.0.2.0/24
VpcVpnSourceStack.ExportsOutputRefVpc07C831B304FE08623 = vpc-0d8d8118923b40b85
VpcVpnSourceStack.ExportsOutputRefVpc0publicSubnet1SubnetB977A71E8C9155C7 = subnet-037467ea871b103c1

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/VpcVpnSourceStack/f9d46c70-3005-11eb-8c3a-06fab0925578
VpcVpnDestinationStack
VpcVpnDestinationStack: deploying...
VpcVpnDestinationStack: creating CloudFormation changeset...
[██████████████████████████████████████████████████████████] (22/22)

 ✅  VpcVpnDestinationStack

Outputs:
VpcVpnDestinationStack.ExportsOutputFnGetAttVpc07C831B30DefaultSecurityGroup52C351BF = sg-0e750a0ff54ed08aa
VpcVpnDestinationStack.ExportsOutputRefVpc0privateSubnet1SubnetD6383522ACB05B9B = subnet-0149bc2a09ea2bc34

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/VpcVpnDestinationStack/af2f9e90-3007-11eb-93e5-0a4cff3749d5
InstanceVpnDestinationStack
InstanceVpnDestinationStack: deploying...
InstanceVpnDestinationStack: creating CloudFormation changeset...
[██████████████████████████████████████████████████████████] (6/6)

 ✅  InstanceVpnDestinationStack

Outputs:
InstanceVpnDestinationStack.Instance0BastionHostId1959CA92 = i-02e376354bcb4b094
InstanceVpnDestinationStack.Instance0PrivateIp = 10.0.3.49

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/InstanceVpnDestinationStack/c2a92a30-3008-11eb-a26f-0639b3b50e04

The necessary infrastructure is standing, but we still need to configure the CGD. To accomplish that we'll head over to the AWS Console and download a config file that was generated for us:

AWS Console -> VPC -> Site-to-Site VPN Connections -> select our new connection -> click on "Download Configuration"

In this text file we're interested in the lines 111 to 129 containing two scripts we'll need to execute on the CGD. Those should look something like this:

! Script for Tunnel 1:
netsh advfirewall consec add rule Name="vgw-0e89a3295d6b100c2 Tunnel 1" ^
Enable=Yes Profile=any Type=Static Mode=Tunnel ^
LocalTunnelEndpoint=[Windows_Server_Private_IP_address] ^
RemoteTunnelEndpoint=34.253.60.42 Endpoint1=[Your_Static_Route_IP_Prefix] ^
Endpoint2=[Your_VPC_CIDR_Block] Protocol=Any Action=RequireInClearOut ^
Auth1=ComputerPSK Auth1PSK=iKV4pvEVAxVk6wKeVma38F8ZDxVfPhNA ^
QMSecMethods=ESP:SHA1-AES128+60min+100000kb ^
ExemptIPsecProtectedConnections=No ApplyAuthz=No QMPFS=dhgroup2

! Script for Tunnel 2:
netsh advfirewall consec add rule Name="vgw-0e89a3295d6b100c2 Tunnel 2" ^
Enable=Yes Profile=any Type=Static Mode=Tunnel ^
LocalTunnelEndpoint=[Windows_Server_Private_IP_address] ^
RemoteTunnelEndpoint=52.50.166.48 Endpoint1=[Your_Static_Route_IP_Prefix] ^
Endpoint2=[Your_VPC_CIDR_Block] Protocol=Any Action=RequireInClearOut ^
Auth1=ComputerPSK Auth1PSK=PAoYUDzM_V93hRcJxvVkMCV6VjpWFtKt ^
QMSecMethods=ESP:SHA1-AES128+60min+100000kb ^
ExemptIPsecProtectedConnections=No ApplyAuthz=No QMPFS=dhgroup2

Swap [Windows_Server_Private_IP_address] for the private IP address of your CGD (you can get it using the AWS CLI: aws ec2 describe-instances --filters "Name=tag:Name,Values=CustomerGatewayDeviceStack/CGW" --query "Reservations[].Instances[].PrivateIpAddress"), [Your_Static_Route_IP_Prefix] for the VPN source VPC's CIDR (10.0.2.0/24), [Your_VPC_CIDR_Block] for the VPN destination VPC's CIDR (10.0.3.0/24), escape the quotation marks (") by preceding them with backslashes (\) and remove all the carets (^) and following new lines to make both scripts into one-liners, e.g.:

netsh advfirewall consec add rule Name=\"vgw-06fab417114297dd1 Tunnel 1\" Enable=Yes Profile=any Type=Static Mode=Tunnel LocalTunnelEndpoint=10.0.2.18 RemoteTunnelEndpoint=34.249.222.228 Endpoint1=10.0.2.0/24 Endpoint2=10.0.3.0/24 Protocol=Any Action=RequireInClearOut Auth1=ComputerPSK Auth1PSK=F_BjSjPg8ctE6XeX183INrtAPxkaktXm QMSecMethods=ESP:SHA1-AES128+60min+100000kb ExemptIPsecProtectedConnections=No ApplyAuthz=No QMPFS=dhgroup2

We'll run them on the Windows instance remotely using SSM.

If you're following along, be sure to swap the ID of the Windows instance (i-03dd90e66a0e6a145) for the appropriate value before running the below:

➜  ping-me-cdk-example$ aws ssm send-command --document-name "AWS-RunPowerShellScript" \
--document-version "1" \
--targets '[{"Key":"InstanceIds","Values":["i-03dd90e66a0e6a145"]}]' \
--parameters '{"workingDirectory":[""],"executionTimeout":["3600"],"commands":["netsh advfirewall consec add rule Name=\"vgw-06fab417114297dd1 Tunnel 1\" Enable=Yes Profile=any Type=Static Mode=Tunnel LocalTunnelEndpoint=10.0.2.18 RemoteTunnelEndpoint=34.249.222.228 Endpoint1=10.0.2.0/24 Endpoint2=10.0.3.0/24 Protocol=Any Action=RequireInClearOut Auth1=ComputerPSK Auth1PSK=F_BjSjPg8ctE6XeX183INrtAPxkaktXm QMSecMethods=ESP:SHA1-AES128+60min+100000kb ExemptIPsecProtectedConnections=No ApplyAuthz=No QMPFS=dhgroup2"]}' \
--timeout-seconds 600 \
--max-concurrency "50" \
--max-errors "0"
{
    "Command": {
        "CommandId": "ab32f5e8-78c9-4e5b-95d4-944e02814682",
        "DocumentName": "AWS-RunPowerShellScript",
        "DocumentVersion": "1",
        "Comment": "",
        "ExpiresAfter": "2020-11-26T19:27:48.114000+01:00",
        "Parameters": {
            "commands": [
                "netsh advfirewall consec add rule Name=\"vgw-06fab417114297dd1 Tunnel 1\" Enable=Yes Profile=any Type=Static Mode=Tunnel LocalTunnelEndpoint=10.0.2.18 RemoteTunnelEndpoint=34.249.222.228 Endpoint1=10.0.2.0/24 Endpoint2=10.0.3.0/24 Protocol=Any Action=RequireInClearOut Auth1=ComputerPSK Auth1PSK=F_BjSjPg8ctE6XeX183INrtAPxkaktXm QMSecMethods=ESP:SHA1-AES128+60min+100000kb ExemptIPsecProtectedConnections=No ApplyAuthz=No QMPFS=dhgroup2"
            ],
            "executionTimeout": [
                "3600"
            ],
            "workingDirectory": [
                ""
            ]
        },
        "InstanceIds": [],
        "Targets": [
            {
                "Key": "InstanceIds",
                "Values": [
                    "i-03dd90e66a0e6a145"
                ]
            }
        ],
        "RequestedDateTime": "2020-11-26T18:17:48.114000+01:00",
        "Status": "Pending",
        "StatusDetails": "Pending",
        "OutputS3BucketName": "",
        "OutputS3KeyPrefix": "",
        "MaxConcurrency": "50",
        "MaxErrors": "0",
        "TargetCount": 0,
        "CompletedCount": 0,
        "ErrorCount": 0,
        "DeliveryTimedOutCount": 0,
        "ServiceRole": "",
        "NotificationConfig": {
            "NotificationArn": "",
            "NotificationEvents": [],
            "NotificationType": ""
        },
        "CloudWatchOutputConfig": {
            "CloudWatchLogGroupName": "",
            "CloudWatchOutputEnabled": false
        },
        "TimeoutSeconds": 600
    }
}

Now, let's check whether that succeeded using AWS CLI's aws ssm get-command-invocation command.

Again, if you're following along, be sure to swap the command ID (ab32f5e8-78c9-4e5b-95d4-944e02814682) and the ID of the Windows instance (i-03dd90e66a0e6a145) for appropriate values before running the below:

➜  ping-me-cdk-example$ aws ssm get-command-invocation --command-id ab32f5e8-78c9-4e5b-95d4-944e02814682 --instance-id i-03dd90e66a0e6a145
{
    "CommandId": "ab32f5e8-78c9-4e5b-95d4-944e02814682",
    "InstanceId": "i-03dd90e66a0e6a145",
    "Comment": "",
    "DocumentName": "AWS-RunPowerShellScript",
    "DocumentVersion": "1",
    "PluginName": "aws:runPowerShellScript",
    "ResponseCode": 0,
    "ExecutionStartDateTime": "2020-11-26T17:17:49.795Z",
    "ExecutionElapsedTime": "PT1.96S",
    "ExecutionEndDateTime": "2020-11-26T17:17:50.795Z",
    "Status": "Success",
    "StatusDetails": "Success",
    "StandardOutputContent": "Ok.\r\n\r\n",
    "StandardOutputUrl": "",
    "StandardErrorContent": "",
    "StandardErrorUrl": "",
    "CloudWatchOutputConfig": {
        "CloudWatchLogGroupName": "",
        "CloudWatchOutputEnabled": false
    }
}

All's A-OKAY, so let's repeat these two steps for the second script:

➜  ping-me-cdk-example$ aws ssm send-command --document-name "AWS-RunPowerShellScript" \
--document-version "1" \
--targets '[{"Key":"InstanceIds","Values":["i-03dd90e66a0e6a145"]}]' \
--parameters '{"workingDirectory":[""],"executionTimeout":["3600"],"commands":["netsh advfirewall consec add rule Name=\"vgw-06fab417114297dd1 Tunnel 2\" Enable=Yes Profile=any Type=Static Mode=Tunnel LocalTunnelEndpoint=10.0.2.18 RemoteTunnelEndpoint=54.77.85.166 Endpoint1=10.0.2.0/24 Endpoint2=10.0.3.0/24 Protocol=Any Action=RequireInClearOut Auth1=ComputerPSK Auth1PSK=sPGbITqCkW.PSrwuhlycnn6CgFFbjS0w QMSecMethods=ESP:SHA1-AES128+60min+100000kb ExemptIPsecProtectedConnections=No ApplyAuthz=No QMPFS=dhgroup2"]}' \
--timeout-seconds 600 \
--max-concurrency "50" \
--max-errors "0"
{
    "Command": {
        "CommandId": "dd7bb695-51e2-41eb-a898-eec8fc4562f4",
        "DocumentName": "AWS-RunPowerShellScript",
        "DocumentVersion": "1",
        "Comment": "",
        "ExpiresAfter": "2020-11-26T19:30:10.955000+01:00",
        "Parameters": {
            "commands": [
                "netsh advfirewall consec add rule Name=\"vgw-06fab417114297dd1 Tunnel 2\" Enable=Yes Profile=any Type=Static Mode=Tunnel LocalTunnelEndpoint=10.0.2.18 RemoteTunnelEndpoint=54.77.85.166 Endpoint1=10.0.2.0/24 Endpoint2=10.0.3.0/24 Protocol=Any Action=RequireInClearOut Auth1=ComputerPSK Auth1PSK=sPGbITqCkW.PSrwuhlycnn6CgFFbjS0w QMSecMethods=ESP:SHA1-AES128+60min+100000kb ExemptIPsecProtectedConnections=No ApplyAuthz=No QMPFS=dhgroup2"
            ],
            "executionTimeout": [
                "3600"
            ],
            "workingDirectory": [
                ""
            ]
        },
        "InstanceIds": [],
        "Targets": [
            {
                "Key": "InstanceIds",
                "Values": [
                    "i-03dd90e66a0e6a145"
                ]
            }
        ],
        "RequestedDateTime": "2020-11-26T18:20:10.955000+01:00",
        "Status": "Pending",
        "StatusDetails": "Pending",
        "OutputS3BucketName": "",
        "OutputS3KeyPrefix": "",
        "MaxConcurrency": "50",
        "MaxErrors": "0",
        "TargetCount": 0,
        "CompletedCount": 0,
        "ErrorCount": 0,
        "DeliveryTimedOutCount": 0,
        "ServiceRole": "",
        "NotificationConfig": {
            "NotificationArn": "",
            "NotificationEvents": [],
            "NotificationType": ""
        },
        "CloudWatchOutputConfig": {
            "CloudWatchLogGroupName": "",
            "CloudWatchOutputEnabled": false
        },
        "TimeoutSeconds": 600
    }
}

➜  ping-me-cdk-example$ aws ssm get-command-invocation --command-id dd7bb695-51e2-41eb-a898-eec8fc4562f4 --instance-id i-03dd90e66a0e6a145
{
    "CommandId": "dd7bb695-51e2-41eb-a898-eec8fc4562f4",
    "InstanceId": "i-03dd90e66a0e6a145",
    "Comment": "",
    "DocumentName": "AWS-RunPowerShellScript",
    "DocumentVersion": "1",
    "PluginName": "aws:runPowerShellScript",
    "ResponseCode": 0,
    "ExecutionStartDateTime": "2020-11-26T17:20:11.557Z",
    "ExecutionElapsedTime": "PT0.647S",
    "ExecutionEndDateTime": "2020-11-26T17:20:11.557Z",
    "Status": "Success",
    "StatusDetails": "Success",
    "StandardOutputContent": "Ok.\r\n\r\n",
    "StandardOutputUrl": "",
    "StandardErrorContent": "",
    "StandardErrorUrl": "",
    "CloudWatchOutputConfig": {
        "CloudWatchLogGroupName": "",
        "CloudWatchOutputEnabled": false
    }
}

Another A-OKAY, so let's ping the EC2 instance in the VPN destination VPC from the Windows instance in the VPN source VPC to make sure the Site-to-Site VPN connection is working as expected.

Again, if you're following along, be sure to swap the ID of the Windows instance (i-03dd90e66a0e6a145) and the private IP of the Linux instance for appropriate values before running the below:

aws ssm send-command --document-name "AWS-RunPowerShellScript" --document-version "1" --targets '[{"Key":"InstanceIds","Values":["i-03dd90e66a0e6a145"]}]' --parameters '{"workingDirectory":[""],"executionTimeout":["3600"],"commands":["ping 10.0.3.49"]}' --timeout-seconds 600 --max-concurrency "50" --max-errors "0"
{
    "Command": {
        "CommandId": "09785d32-8b7e-4f24-9581-90aed774aa7d",
        "DocumentName": "AWS-RunPowerShellScript",
        "DocumentVersion": "1",
        "Comment": "",
        "ExpiresAfter": "2020-11-26T20:16:40.640000+01:00",
        "Parameters": {
            "commands": [
                "ping 10.0.3.49"
            ],
            "executionTimeout": [
                "3600"
            ],
            "workingDirectory": [
                ""
            ]
        },
        "InstanceIds": [],
        "Targets": [
            {
                "Key": "InstanceIds",
                "Values": [
                    "i-03dd90e66a0e6a145"
                ]
            }
        ],
        "RequestedDateTime": "2020-11-26T19:06:40.640000+01:00",
        "Status": "Pending",
        "StatusDetails": "Pending",
        "OutputS3BucketName": "",
        "OutputS3KeyPrefix": "",
        "MaxConcurrency": "50",
        "MaxErrors": "0",
        "TargetCount": 0,
        "CompletedCount": 0,
        "ErrorCount": 0,
        "DeliveryTimedOutCount": 0,
        "ServiceRole": "",
        "NotificationConfig": {
            "NotificationArn": "",
            "NotificationEvents": [],
            "NotificationType": ""
        },
        "CloudWatchOutputConfig": {
            "CloudWatchLogGroupName": "",
            "CloudWatchOutputEnabled": false
        },
        "TimeoutSeconds": 600
    }
}

Let's see the result's output:

➜  ping-me-cdk-example$ aws ssm get-command-invocation --command-id 09785d32-8b7e-4f24-9581-90aed774aa7d --instance-id i-03dd90e66a0e6a145
{
    "CommandId": "09785d32-8b7e-4f24-9581-90aed774aa7d",
    "InstanceId": "i-03dd90e66a0e6a145",
    "Comment": "",
    "DocumentName": "AWS-RunPowerShellScript",
    "DocumentVersion": "1",
    "PluginName": "aws:runPowerShellScript",
    "ResponseCode": 0,
    "ExecutionStartDateTime": "2020-11-26T18:06:41.265Z",
    "ExecutionElapsedTime": "PT7.529S",
    "ExecutionEndDateTime": "2020-11-26T18:06:48.265Z",
    "Status": "Success",
    "StatusDetails": "Success",
    "StandardOutputContent": "\r\nPinging 10.0.3.49 with 32 bytes of data:\r\nRequest timed out.\r\nReply from 10.0.3.49: bytes=32 time=1ms TTL=254\r\nReply from 10.0.3.49: bytes=32 time<1ms TTL=254\r\nReply from 10.0.3.49: bytes=32 time<1ms TTL=254\r\n\r\nPing statistics for 10.0.3.49:\r\n    Packets: Sent = 4, Received = 3, Lost = 1 (25% loss),\r\nApproximate round trip times in milli-seconds:\r\n    Minimum = 0ms, Maximum = 1ms, Average = 0ms\r\n",
    "StandardOutputUrl": "",
    "StandardErrorContent": "",
    "StandardErrorUrl": "",
    "CloudWatchOutputConfig": {
        "CloudWatchLogGroupName": "",
        "CloudWatchOutputEnabled": false
    }
}

The first ping was lost, the other three came back. It's a perfectly valid behavior since by default the Customer Gateway Device must bring up the VPN tunnels by generating traffic into AWS.

Wait, tunnels? Yep, AWS Site-to-site VPN creates two tunnels from the Customer Gateway Device and they operate in an active/passive failover configuration. You can check their status in the AWS Console:

before the ping

after the ping

Cleanup

For the sake of our wallets, let's promptly destroy the current infrastructure before moving on. When prompted, type y for yes:

➜  ping-me-cdk-example$ cdk destroy --all
Are you sure you want to delete: InstanceVpnDestinationStack, VpcVpnDestinationStack, PeeringStack, InstancePeersStack, CustomerGatewayDeviceStack, VpcVpnSourceStack, VpcPeersStack (y/n)? y
InstanceVpnDestinationStack: destroying...
19:15:58 | DELETE_IN_PROGRESS   | AWS::CloudFormation::Stack | InstanceVpnDestinationStack
 ✅  InstanceVpnDestinationStack: destroyed
VpcVpnDestinationStack: destroying...
19:16:55 | DELETE_IN_PROGRESS   | AWS::CloudFormation::Stack            | VpcVpnDestinationStack
19:18:39 | DELETE_IN_PROGRESS   | AWS::EC2::InternetGateway             | Vpc0/IGW
19:18:39 | DELETE_IN_PROGRESS   | AWS::EC2::VPC                         | Vpc0
 ✅  VpcVpnDestinationStack: destroyed
PeeringStack: destroying...
 ✅  PeeringStack: destroyed
InstancePeersStack: destroying...
 ✅  InstancePeersStack: destroyed
CustomerGatewayDeviceStack: destroying...
19:19:00 | DELETE_IN_PROGRESS   | AWS::CloudFormation::Stack | CustomerGatewayDeviceStack
19:19:52 | DELETE_IN_PROGRESS   | AWS::IAM::Role            | SsmRoleForEc2
 ✅  CustomerGatewayDeviceStack: destroyed
VpcVpnSourceStack: destroying...
19:19:58 | DELETE_IN_PROGRESS   | AWS::CloudFormation::Stack            | VpcVpnSourceStack
 ✅  VpcVpnSourceStack: destroyed
VpcPeersStack: destroying...
 ✅  VpcPeersStack: destroyed

Well then, we've already pinged over a VPC Peering and just a moment ago we've seen AWS Site-to-Site VPN in action. Hence, what's left is taking AWS Transit Gateway for a spin!

Ping Me! (Part 1: VPC Peering Using CDK)

Rafal Krol — Sat, 24 Jul 2021 09:30:41 +0000

Overview

VPC Peering is a networking connection that you can establish between two VPCs to allow instances on either end to communicate with each other, using their private IPs (both IPv4 and IPv6 are supported), in exactly the same way as if they were inside one VPC. Traffic never leaves the AWS backbone network, thus avoiding the dirty pipes of the Internet. The connection itself is free of charge. However, you have to pay for the data transferred between the VPCs.

Intra-region (between VPCs within the same region), inter-region (between VPCs in different regions) and cross-account (between VPCs belonging to different AWS accounts) peering are all possible. Of course, in either case, the CIDR ranges of the peered VPCs mustn't overlap with each other, e.g. peering VPC A with the CIDR range of 10.0.0.0/16 and VPC B with the CIDR range of 10.0.1.0/24 would not be possible as IP addresses from 10.0.1.0 to 10.0.1.255 exist in both VPCs.

One more gotcha is that transitive peering is also disallowed. Hence, if you got VPC A peered to VPC B and VPC B peered to VPC C, you wouldn't be able to reach VPC C from VPC A through VPC B. Instead, you'd need to peer VPC A directly with VPC C. With three VPCs it shouldn't be such a hard thing to accomplish (and then to maintain), but imagine having hundreds of VPCs... To achieve full mesh topology in that scenario, you'd need a Transit Gateway. But I'm getting a little ahead of myself.

Implementation

We'll need three stacks: one for the two VPCs, another one for the two EC2 instances and the third one for the actual peering connection and appropriate routes.

Let's begin by creating the file for our VpcStack class:



➜  ping-me-cdk-example$ touch lib/vpc.ts

Now, the class itself:

ping-me-cdk-example/lib/vpc.ts



import * as cdk from '@aws-cdk/core';
import * as ec2 from '@aws-cdk/aws-ec2'; // <--- this module is not available from the start; remember to import it: `npm install @aws-cdk/aws-ec2`

interface VpcProps extends cdk.StackProps {
  vpcSetup: {
    cidrs: string[], // <--- each VPC will need a list of CIDRs
    maxAzs?: number, // <--- optionally the number of Availability Zones can be provided; defaults to 2 in our particular case
    vpnConnections?: { // <--- if dealing with Site-to-Site VPN, the VPN connection details can be provided
      [id: string]: ec2.VpnConnectionOptions;
    },
  };
}

export class VpcStack extends cdk.Stack {

  readonly createdVpcs: ec2.Vpc[]; // <-- create a class property for exposing the list of VPC objects

  constructor(scope: cdk.Construct, id: string, props: VpcProps) {
    super(scope, id, props);

    const createdVpcs: ec2.Vpc[] = [];

    // for each of the provided CIDR ranges, create a VPC with two /27 subnets (one public and one private) per AZ
    props.vpcSetup.cidrs.forEach((cidr, index) => {
      createdVpcs.push(new ec2.Vpc(this, 'Vpc' + index, {
        cidr,
        maxAzs: props.vpcSetup.maxAzs,
        subnetConfiguration: [
          {
            cidrMask: 27,
            name: 'public',
            subnetType: ec2.SubnetType.PUBLIC,
          },
          {
            cidrMask: 27,
            name: 'private',
            subnetType: ec2.SubnetType.PRIVATE,
          },
        ],
        vpnConnections: props.vpcSetup.vpnConnections,
      }));
    });

    // For each VPC's default security group, allow inbound ICMP (ping) requests from anywhere
    createdVpcs.forEach((vpc, index) => {
      ec2.SecurityGroup.fromSecurityGroupId(this, 'DefaultSecurityGroup' + index, vpc.vpcDefaultSecurityGroup)
        .addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.icmpPing(), 'Allow ping from anywhere');
    });

    this.createdVpcs = createdVpcs; // <-- expose the list of created VPC objects so that they can be used by different stacks
  }
}

Since the @aws-cdk/aws-ec2 module was not imported during the cdk initialization, let's install it now:



➜  ping-me-cdk-example$ npm install @aws-cdk/aws-ec2@1.73.0
npm WARN @aws-cdk/aws-ec2@1.74.0 requires a peer of @aws-cdk/core@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-ec2@1.74.0 requires a peer of @aws-cdk/cx-api@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-ec2@1.74.0 requires a peer of @aws-cdk/cloud-assembly-schema@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-ec2@1.74.0 requires a peer of @aws-cdk/region-info@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-cloudwatch@1.74.0 requires a peer of @aws-cdk/core@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-ssm@1.74.0 requires a peer of @aws-cdk/core@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-ssm@1.74.0 requires a peer of @aws-cdk/cloud-assembly-schema@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-logs@1.74.0 requires a peer of @aws-cdk/core@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-s3-assets@1.74.0 requires a peer of @aws-cdk/core@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-s3-assets@1.74.0 requires a peer of @aws-cdk/cx-api@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-kms@1.74.0 requires a peer of @aws-cdk/core@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-s3@1.74.0 requires a peer of @aws-cdk/core@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-iam@1.74.0 requires a peer of @aws-cdk/core@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-iam@1.74.0 requires a peer of @aws-cdk/region-info@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/assets@1.74.0 requires a peer of @aws-cdk/core@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/assets@1.74.0 requires a peer of @aws-cdk/cx-api@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN @aws-cdk/aws-events@1.74.0 requires a peer of @aws-cdk/core@1.74.0 but none is installed. You must install peer dependencies yourself.
npm WARN ping-me-cdk-example@0.1.0 No repository field.
npm WARN ping-me-cdk-example@0.1.0 No license field.

+ @aws-cdk/aws-ec2@1.74.0
added 190 packages from 9 contributors and audited 932 packages in 10.624s

27 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

We chose the 1.73.0 version on purpose (the exact same one we used for our @aws-cdk/core module) to avoid the possibility of seeing the Argument of type 'this' is not assignable to parameter of type 'Construct' error.

Next, we'll initialize an instance of our VpcStack class in ping-me-cdk-example/bin/ping-me-cdk-example.ts:

ping-me-cdk-example/bin/ping-me-cdk-example.ts



import * as cdk from '@aws-cdk/core';
import { VpcStack } from '../lib/vpc';

const app = new cdk.App(); // <--- you can read more about the App construct here: https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_core.App.html

const vpcPeers = new VpcStack(app, 'VpcPeersStack', {
  vpcSetup: {
    cidrs: ['10.0.0.0/24', '10.0.1.0/24'], // <--- two non-overlapping CIDR ranges for our two VPCs
    maxAzs: 1, // <--- to keep the costs down, we'll stick to 1 availability zone per VPC (obviously, not something you'd want to do in production)
  },
});

TypeScript should be compiled to JavaScript after each modification to our source code. To avoid manually executing the npm run build command every time that happens, we'll run the below:



➜  ping-me-cdk-example$ npm run watch
[19:50:46] Starting compilation in watch mode...

[19:50:51] Found 0 errors. Watching for file changes.

# KEEP THIS RUNNING!

We're ready to synthesize our code into a CloudFormation template. As this is an optional step, we shall do it now for the sake of demonstration, but refrain from doing it later on:



➜  ping-me-cdk-example$ cdk synth
Resources:
  Vpc07C831B30:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/24
      EnableDnsHostnames: true
      EnableDnsSupport: true
      InstanceTenancy: default
      Tags:
        - Key: Name
          Value: VpcPeersStack/Vpc0
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc0/Resource
  Vpc0publicSubnet1SubnetB977A71E:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.0.0/27
      VpcId:
        Ref: Vpc07C831B30
      AvailabilityZone:
        Fn::Select:
          - 0
          - Fn::GetAZs: ""
      MapPublicIpOnLaunch: true
      Tags:
        - Key: aws-cdk:subnet-name
          Value: public
        - Key: aws-cdk:subnet-type
          Value: Public
        - Key: Name
          Value: VpcPeersStack/Vpc0/publicSubnet1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc0/publicSubnet1/Subnet
  Vpc0publicSubnet1RouteTable2012E33A:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: Vpc07C831B30
      Tags:
        - Key: Name
          Value: VpcPeersStack/Vpc0/publicSubnet1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc0/publicSubnet1/RouteTable
  Vpc0publicSubnet1RouteTableAssociation0E1C3D4B:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId:
        Ref: Vpc0publicSubnet1RouteTable2012E33A
      SubnetId:
        Ref: Vpc0publicSubnet1SubnetB977A71E
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc0/publicSubnet1/RouteTableAssociation
  Vpc0publicSubnet1DefaultRouteC03283FF:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: Vpc0publicSubnet1RouteTable2012E33A
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: Vpc0IGW3080DF7F
    DependsOn:
      - Vpc0VPCGW9FBA9469
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc0/publicSubnet1/DefaultRoute
  Vpc0publicSubnet1EIP16FED7DC:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: VpcPeersStack/Vpc0/publicSubnet1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc0/publicSubnet1/EIP
  Vpc0publicSubnet1NATGateway40294DF4:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId:
        Fn::GetAtt:
          - Vpc0publicSubnet1EIP16FED7DC
          - AllocationId
      SubnetId:
        Ref: Vpc0publicSubnet1SubnetB977A71E
      Tags:
        - Key: Name
          Value: VpcPeersStack/Vpc0/publicSubnet1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc0/publicSubnet1/NATGateway
  Vpc0privateSubnet1SubnetD6383522:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.0.32/27
      VpcId:
        Ref: Vpc07C831B30
      AvailabilityZone:
        Fn::Select:
          - 0
          - Fn::GetAZs: ""
      MapPublicIpOnLaunch: false
      Tags:
        - Key: aws-cdk:subnet-name
          Value: private
        - Key: aws-cdk:subnet-type
          Value: Private
        - Key: Name
          Value: VpcPeersStack/Vpc0/privateSubnet1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc0/privateSubnet1/Subnet
  Vpc0privateSubnet1RouteTableB5C6777D:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: Vpc07C831B30
      Tags:
        - Key: Name
          Value: VpcPeersStack/Vpc0/privateSubnet1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc0/privateSubnet1/RouteTable
  Vpc0privateSubnet1RouteTableAssociationC17661A1:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId:
        Ref: Vpc0privateSubnet1RouteTableB5C6777D
      SubnetId:
        Ref: Vpc0privateSubnet1SubnetD6383522
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc0/privateSubnet1/RouteTableAssociation
  Vpc0privateSubnet1DefaultRoute1EA0AEFE:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: Vpc0privateSubnet1RouteTableB5C6777D
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId:
        Ref: Vpc0publicSubnet1NATGateway40294DF4
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc0/privateSubnet1/DefaultRoute
  Vpc0IGW3080DF7F:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: VpcPeersStack/Vpc0
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc0/IGW
  Vpc0VPCGW9FBA9469:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId:
        Ref: Vpc07C831B30
      InternetGatewayId:
        Ref: Vpc0IGW3080DF7F
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc0/VPCGW
  Vpc1C211860B:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.1.0/24
      EnableDnsHostnames: true
      EnableDnsSupport: true
      InstanceTenancy: default
      Tags:
        - Key: Name
          Value: VpcPeersStack/Vpc1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc1/Resource
  Vpc1publicSubnet1SubnetB43EFACE:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.1.0/27
      VpcId:
        Ref: Vpc1C211860B
      AvailabilityZone:
        Fn::Select:
          - 0
          - Fn::GetAZs: ""
      MapPublicIpOnLaunch: true
      Tags:
        - Key: aws-cdk:subnet-name
          Value: public
        - Key: aws-cdk:subnet-type
          Value: Public
        - Key: Name
          Value: VpcPeersStack/Vpc1/publicSubnet1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc1/publicSubnet1/Subnet
  Vpc1publicSubnet1RouteTable1C630681:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: Vpc1C211860B
      Tags:
        - Key: Name
          Value: VpcPeersStack/Vpc1/publicSubnet1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc1/publicSubnet1/RouteTable
  Vpc1publicSubnet1RouteTableAssociation4DA13984:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId:
        Ref: Vpc1publicSubnet1RouteTable1C630681
      SubnetId:
        Ref: Vpc1publicSubnet1SubnetB43EFACE
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc1/publicSubnet1/RouteTableAssociation
  Vpc1publicSubnet1DefaultRouteB4C85D62:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: Vpc1publicSubnet1RouteTable1C630681
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId:
        Ref: Vpc1IGW15AE5E6B
    DependsOn:
      - Vpc1VPCGW4C1BD07A
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc1/publicSubnet1/DefaultRoute
  Vpc1publicSubnet1EIP5F1D9658:
    Type: AWS::EC2::EIP
    Properties:
      Domain: vpc
      Tags:
        - Key: Name
          Value: VpcPeersStack/Vpc1/publicSubnet1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc1/publicSubnet1/EIP
  Vpc1publicSubnet1NATGateway06106699:
    Type: AWS::EC2::NatGateway
    Properties:
      AllocationId:
        Fn::GetAtt:
          - Vpc1publicSubnet1EIP5F1D9658
          - AllocationId
      SubnetId:
        Ref: Vpc1publicSubnet1SubnetB43EFACE
      Tags:
        - Key: Name
          Value: VpcPeersStack/Vpc1/publicSubnet1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc1/publicSubnet1/NATGateway
  Vpc1privateSubnet1Subnet41967AFD:
    Type: AWS::EC2::Subnet
    Properties:
      CidrBlock: 10.0.1.32/27
      VpcId:
        Ref: Vpc1C211860B
      AvailabilityZone:
        Fn::Select:
          - 0
          - Fn::GetAZs: ""
      MapPublicIpOnLaunch: false
      Tags:
        - Key: aws-cdk:subnet-name
          Value: private
        - Key: aws-cdk:subnet-type
          Value: Private
        - Key: Name
          Value: VpcPeersStack/Vpc1/privateSubnet1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc1/privateSubnet1/Subnet
  Vpc1privateSubnet1RouteTable339A93B3:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId:
        Ref: Vpc1C211860B
      Tags:
        - Key: Name
          Value: VpcPeersStack/Vpc1/privateSubnet1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc1/privateSubnet1/RouteTable
  Vpc1privateSubnet1RouteTableAssociation4FB53340:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId:
        Ref: Vpc1privateSubnet1RouteTable339A93B3
      SubnetId:
        Ref: Vpc1privateSubnet1Subnet41967AFD
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc1/privateSubnet1/RouteTableAssociation
  Vpc1privateSubnet1DefaultRoute4ACBA7B3:
    Type: AWS::EC2::Route
    Properties:
      RouteTableId:
        Ref: Vpc1privateSubnet1RouteTable339A93B3
      DestinationCidrBlock: 0.0.0.0/0
      NatGatewayId:
        Ref: Vpc1publicSubnet1NATGateway06106699
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc1/privateSubnet1/DefaultRoute
  Vpc1IGW15AE5E6B:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: VpcPeersStack/Vpc1
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc1/IGW
  Vpc1VPCGW4C1BD07A:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId:
        Ref: Vpc1C211860B
      InternetGatewayId:
        Ref: Vpc1IGW15AE5E6B
    Metadata:
      aws:cdk:path: VpcPeersStack/Vpc1/VPCGW
  DefaultSecurityGroup0from00000ICMPType829E2C81F:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: icmp
      CidrIp: 0.0.0.0/0
      Description: Allow ping from anywhere
      FromPort: 8
      GroupId:
        Fn::GetAtt:
          - Vpc07C831B30
          - DefaultSecurityGroup
      ToPort: -1
    Metadata:
      aws:cdk:path: VpcPeersStack/DefaultSecurityGroup0/from 0.0.0.0_0:ICMP Type 8
  DefaultSecurityGroup1from00000ICMPType8D69AB703:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: icmp
      CidrIp: 0.0.0.0/0
      Description: Allow ping from anywhere
      FromPort: 8
      GroupId:
        Fn::GetAtt:
          - Vpc1C211860B
          - DefaultSecurityGroup
      ToPort: -1
    Metadata:
      aws:cdk:path: VpcPeersStack/DefaultSecurityGroup1/from 0.0.0.0_0:ICMP Type 8
  CDKMetadata:
    Type: AWS::CDK::Metadata
    Properties:
      Modules: aws-cdk=1.74.0,@aws-cdk/assets=1.74.0,@aws-cdk/aws-cloudwatch=1.74.0,@aws-cdk/aws-ec2=1.74.0,@aws-cdk/aws-events=1.74.0,@aws-cdk/aws-iam=1.74.0,@aws-cdk/aws-kms=1.74.0,@aws-cdk/aws-logs=1.74.0,@aws-cdk/aws-s3=1.74.0,@aws-cdk/aws-s3-assets=1.74.0,@aws-cdk/aws-ssm=1.74.0,@aws-cdk/cloud-assembly-schema=1.74.0,@aws-cdk/core=1.74.0,@aws-cdk/cx-api=1.74.0,@aws-cdk/region-info=1.74.0,jsii-runtime=node.js/v14.14.0
    Metadata:
      aws:cdk:path: VpcPeersStack/CDKMetadata/Default
    Condition: CDKMetadataAvailable
Conditions:
  CDKMetadataAvailable:
    Fn::Or:
      - Fn::Or:
          - Fn::Equals:
              - Ref: AWS::Region
              - ap-east-1
          - Fn::Equals:
              - Ref: AWS::Region
              - ap-northeast-1
          - Fn::Equals:
              - Ref: AWS::Region
              - ap-northeast-2
          - Fn::Equals:
              - Ref: AWS::Region
              - ap-south-1
          - Fn::Equals:
              - Ref: AWS::Region
              - ap-southeast-1
          - Fn::Equals:
              - Ref: AWS::Region
              - ap-southeast-2
          - Fn::Equals:
              - Ref: AWS::Region
              - ca-central-1
          - Fn::Equals:
              - Ref: AWS::Region
              - cn-north-1
          - Fn::Equals:
              - Ref: AWS::Region
              - cn-northwest-1
          - Fn::Equals:
              - Ref: AWS::Region
              - eu-central-1
      - Fn::Or:
          - Fn::Equals:
              - Ref: AWS::Region
              - eu-north-1
          - Fn::Equals:
              - Ref: AWS::Region
              - eu-west-1
          - Fn::Equals:
              - Ref: AWS::Region
              - eu-west-2
          - Fn::Equals:
              - Ref: AWS::Region
              - eu-west-3
          - Fn::Equals:
              - Ref: AWS::Region
              - me-south-1
          - Fn::Equals:
              - Ref: AWS::Region
              - sa-east-1
          - Fn::Equals:
              - Ref: AWS::Region
              - us-east-1
          - Fn::Equals:
              - Ref: AWS::Region
              - us-east-2
          - Fn::Equals:
              - Ref: AWS::Region
              - us-west-1
          - Fn::Equals:
              - Ref: AWS::Region
              - us-west-2

Yep, yep, Ladies and Gentleman, without the CDK we would be forced to write all of the above lines ourselves if we wanted to deploy our infrastructure with CloudFormation (that's one giant leap right there).

Instead of looking at the CloudFormation template, you can run the cdk diff command to see what changes can be applied:



➜  ping-me-cdk-example$ cdk diff  
Stack VpcPeersStack
Security Group Changes
┌───┬──────────────────────────────┬─────┬───────────┬─────────────────┐
│   │ Group                        │ Dir │ Protocol  │ Peer            │
├───┼──────────────────────────────┼─────┼───────────┼─────────────────┤
│ + │ ${Vpc0.DefaultSecurityGroup} │ In  │ ICMP 8--1 │ Everyone (IPv4) │
├───┼──────────────────────────────┼─────┼───────────┼─────────────────┤
│ + │ ${Vpc1.DefaultSecurityGroup} │ In  │ ICMP 8--1 │ Everyone (IPv4) │
└───┴──────────────────────────────┴─────┴───────────┴─────────────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)

Conditions
[+] Condition CDKMetadata/Condition CDKMetadataAvailable: {"Fn::Or":[{"Fn::Or":[{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-east-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-northeast-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-northeast-2"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-south-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-southeast-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ap-southeast-2"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"ca-central-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"cn-north-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"cn-northwest-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"eu-central-1"]}]},{"Fn::Or":[{"Fn::Equals":[{"Ref":"AWS::Region"},"eu-north-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"eu-west-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"eu-west-2"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"eu-west-3"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"me-south-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"sa-east-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"us-east-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"us-east-2"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"us-west-1"]},{"Fn::Equals":[{"Ref":"AWS::Region"},"us-west-2"]}]}]}

Resources
[+] AWS::EC2::VPC Vpc0 Vpc07C831B30 
[+] AWS::EC2::Subnet Vpc0/publicSubnet1/Subnet Vpc0publicSubnet1SubnetB977A71E 
[+] AWS::EC2::RouteTable Vpc0/publicSubnet1/RouteTable Vpc0publicSubnet1RouteTable2012E33A 
[+] AWS::EC2::SubnetRouteTableAssociation Vpc0/publicSubnet1/RouteTableAssociation Vpc0publicSubnet1RouteTableAssociation0E1C3D4B 
[+] AWS::EC2::Route Vpc0/publicSubnet1/DefaultRoute Vpc0publicSubnet1DefaultRouteC03283FF 
[+] AWS::EC2::EIP Vpc0/publicSubnet1/EIP Vpc0publicSubnet1EIP16FED7DC 
[+] AWS::EC2::NatGateway Vpc0/publicSubnet1/NATGateway Vpc0publicSubnet1NATGateway40294DF4 
[+] AWS::EC2::Subnet Vpc0/privateSubnet1/Subnet Vpc0privateSubnet1SubnetD6383522 
[+] AWS::EC2::RouteTable Vpc0/privateSubnet1/RouteTable Vpc0privateSubnet1RouteTableB5C6777D 
[+] AWS::EC2::SubnetRouteTableAssociation Vpc0/privateSubnet1/RouteTableAssociation Vpc0privateSubnet1RouteTableAssociationC17661A1 
[+] AWS::EC2::Route Vpc0/privateSubnet1/DefaultRoute Vpc0privateSubnet1DefaultRoute1EA0AEFE 
[+] AWS::EC2::InternetGateway Vpc0/IGW Vpc0IGW3080DF7F 
[+] AWS::EC2::VPCGatewayAttachment Vpc0/VPCGW Vpc0VPCGW9FBA9469 
[+] AWS::EC2::VPC Vpc1 Vpc1C211860B 
[+] AWS::EC2::Subnet Vpc1/publicSubnet1/Subnet Vpc1publicSubnet1SubnetB43EFACE 
[+] AWS::EC2::RouteTable Vpc1/publicSubnet1/RouteTable Vpc1publicSubnet1RouteTable1C630681 
[+] AWS::EC2::SubnetRouteTableAssociation Vpc1/publicSubnet1/RouteTableAssociation Vpc1publicSubnet1RouteTableAssociation4DA13984 
[+] AWS::EC2::Route Vpc1/publicSubnet1/DefaultRoute Vpc1publicSubnet1DefaultRouteB4C85D62 
[+] AWS::EC2::EIP Vpc1/publicSubnet1/EIP Vpc1publicSubnet1EIP5F1D9658 
[+] AWS::EC2::NatGateway Vpc1/publicSubnet1/NATGateway Vpc1publicSubnet1NATGateway06106699 
[+] AWS::EC2::Subnet Vpc1/privateSubnet1/Subnet Vpc1privateSubnet1Subnet41967AFD 
[+] AWS::EC2::RouteTable Vpc1/privateSubnet1/RouteTable Vpc1privateSubnet1RouteTable339A93B3 
[+] AWS::EC2::SubnetRouteTableAssociation Vpc1/privateSubnet1/RouteTableAssociation Vpc1privateSubnet1RouteTableAssociation4FB53340 
[+] AWS::EC2::Route Vpc1/privateSubnet1/DefaultRoute Vpc1privateSubnet1DefaultRoute4ACBA7B3 
[+] AWS::EC2::InternetGateway Vpc1/IGW Vpc1IGW15AE5E6B 
[+] AWS::EC2::VPCGatewayAttachment Vpc1/VPCGW Vpc1VPCGW4C1BD07A 
[+] AWS::EC2::SecurityGroupIngress DefaultSecurityGroup0/from 0.0.0.0_0:ICMP Type 8 DefaultSecurityGroup0from00000ICMPType829E2C81F 
[+] AWS::EC2::SecurityGroupIngress DefaultSecurityGroup1/from 0.0.0.0_0:ICMP Type 8 DefaultSecurityGroup1from00000ICMPType8D69AB703

All looks good. Hence, without further ado, let's deploy these changes:



➜  ping-me-cdk-example$ cdk deploy --require-approval never
VpcPeersStack: deploying...
VpcPeersStack: creating CloudFormation changeset...
[██████████████████████████████████████████████████████████] (30/30)

 ✅  VpcPeersStack

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/VpcPeersStack/1057bae0-2cc0-11eb-8cd5-0a517997c0b3

We've set the --require-approval flag to never to avoid manually confirming the creation of the Allow ping from anywhere rules, which were deemed as potentially insecure by the CDK.

We got the VPCs. Now, on to the EC2s and the peering connection itself:



➜  ping-me-cdk-example$ touch lib/instance.ts

ping-me-cdk-example/lib/instance.ts



import * as cdk from '@aws-cdk/core';
import * as ec2 from '@aws-cdk/aws-ec2';

interface InstanceProps extends cdk.StackProps {
  vpcs: ec2.Vpc[]; // <--- a list of VPC objects required for the creation of the EC2 instance(s)
}

export class InstanceStack extends cdk.Stack {

  constructor(scope: cdk.Construct, id: string, props: InstanceProps) {
    super(scope, id, props);

    // For each supplied VPC, create a Linux-based EC2 instance in the private subnet and attach the VPC's default security group to it
    props.vpcs.forEach((vpc, index) => {
      const instanceName = `Instance${index}`;
      const instanceResource = new ec2.BastionHostLinux(this, instanceName, {
        vpc,
        instanceName,
        securityGroup: ec2.SecurityGroup.fromSecurityGroupId(this, instanceName + 'SecurityGroup', vpc.vpcDefaultSecurityGroup),
      });
      // Output the instance's private IP
      new cdk.CfnOutput(this, instanceName + 'PrivateIp', {
        value: instanceResource.instancePrivateIp,
      });
    });
  }
}



➜  ping-me-cdk-example$ touch lib/peering.ts

ping-me-cdk-example/lib/peering.ts



import * as cdk from '@aws-cdk/core';
import * as ec2 from '@aws-cdk/aws-ec2';

interface PeeringProps extends cdk.StackProps {
  vpcs: [ec2.Vpc, ec2.Vpc]; // <--- a fixed-length array (a tuple type in TypeScript parlance) consisting of two VPC objects between which the peering connection will be made
}

export class PeeringStack extends cdk.Stack {

  constructor(scope: cdk.Construct, id: string, props: PeeringProps) {
    super(scope, id, props);

    // Create the peering connection
    const peer = new ec2.CfnVPCPeeringConnection(this, 'Peer', {
      vpcId: props.vpcs[0].vpcId,
      peerVpcId: props.vpcs[1].vpcId
    });

    // Add route from the private subnet of the first VPC to the second VPC over the peering connection
    // NB the below was taken from: https://stackoverflow.com/questions/62525195/adding-entry-to-route-table-with-cdk-typescript-when-its-private-subnet-alread
    props.vpcs[0].privateSubnets.forEach(({ routeTable: { routeTableId } }, index) => {
      new ec2.CfnRoute(this, 'RouteFromPrivateSubnetOfVpc1ToVpc2' + index, {
        destinationCidrBlock: props.vpcs[1].vpcCidrBlock,
        routeTableId,
        vpcPeeringConnectionId: peer.ref,
      });
    });

    // Add route from the private subnet of the second VPC to the first VPC over the peering connection
    props.vpcs[1].privateSubnets.forEach(({ routeTable: { routeTableId } }, index) => {
      new ec2.CfnRoute(this, 'RouteFromPrivateSubnetOfVpc2ToVpc1' + index, {
        destinationCidrBlock: props.vpcs[0].vpcCidrBlock,
        routeTableId,
        vpcPeeringConnectionId: peer.ref,
      });
    });
  }
}

Back to the ping-me-cdk-example/bin/ping-me-cdk-example.ts file to initialize our newly created classes:

ping-me-cdk-example/bin/ping-me-cdk-example.ts



import * as cdk from '@aws-cdk/core';
import { VpcStack } from '../lib/vpc';
import { InstanceStack } from '../lib/instance';
import { PeeringStack } from '../lib/peering';

const app = new cdk.App(); // <--- you can read more about the App construct here: https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_core.App.html

const vpcPeers = new VpcStack(app, 'VpcPeersStack', {
  vpcSetup: {
    cidrs: ['10.0.0.0/24', '10.0.1.0/24'], // <--- two non-overlapping CIDR ranges for our two VPCs
    maxAzs: 1, // <--- to keep the costs down, we'll stick to 1 availability zone per VPC (obviously, not something you'd want to do in production)
  },
});

// Create two EC2 instances, one in each VPC
new InstanceStack(app, 'InstancePeersStack', {
  vpcs: vpcPeers.createdVpcs,
});

// Establish a VPC Peering connection between the two VPCs
new PeeringStack(app, 'PeeringStack', {
  vpcs: [vpcPeers.createdVpcs[0], vpcPeers.createdVpcs[1]],
});

Finally, we can deploy the two EC2 instances (one in each of the earlier created VPCs) and the VPC Peering connection itself:



➜  ping-me-cdk-example$ cdk deploy --all --require-approval never
VpcPeersStack
VpcPeersStack: deploying...

 ✅  VpcPeersStack (no changes)

Outputs:
VpcPeersStack.ExportsOutputFnGetAttVpc07C831B30CidrBlockB8164F9E = 10.0.0.0/24
VpcPeersStack.ExportsOutputFnGetAttVpc07C831B30DefaultSecurityGroup52C351BF = sg-0dd8a9cd265dc8acb
VpcPeersStack.ExportsOutputFnGetAttVpc1C211860BCidrBlock933A5AA8 = 10.0.1.0/24
VpcPeersStack.ExportsOutputFnGetAttVpc1C211860BDefaultSecurityGroup87C47BC2 = sg-0496c16092cdd8311
VpcPeersStack.ExportsOutputRefVpc07C831B304FE08623 = vpc-07277da5218b90290
VpcPeersStack.ExportsOutputRefVpc0privateSubnet1RouteTableB5C6777D52F53FE8 = rtb-005f39777bccd74f4
VpcPeersStack.ExportsOutputRefVpc0privateSubnet1SubnetD6383522ACB05B9B = subnet-0a018df57060948a4
VpcPeersStack.ExportsOutputRefVpc1C211860B64169B74 = vpc-0c5433d68b3f2f67c
VpcPeersStack.ExportsOutputRefVpc1privateSubnet1RouteTable339A93B3DFC75FCA = rtb-02ca74736f4f0ea17
VpcPeersStack.ExportsOutputRefVpc1privateSubnet1Subnet41967AFDFF883DAB = subnet-048b1e861592d392c

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/VpcPeersStack/d91b71b0-2dbf-11eb-8c69-06b222f0b0a4
InstancePeersStack
InstancePeersStack: deploying...
InstancePeersStack: creating CloudFormation changeset...
[██████████████████████████████████████████████████████████] (10/10)

 ✅  InstancePeersStack

Outputs:
InstancePeersStack.Instance0BastionHostId1959CA92 = i-0ca24549d1646cccd # <--- COPY THE ID OF YOUR SOURCE EC2 INSTANCE!
InstancePeersStack.Instance0PrivateIp = 10.0.0.36
InstancePeersStack.Instance1BastionHostIdEF2AA144 = i-0fec2bdd51392974d
InstancePeersStack.Instance1PrivateIp = 10.0.1.59 # <--- COPY THE PRIVATE IP OF YOUR DESTINATION EC2 INSTANCE!

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/InstancePeersStack/9e40f500-2dc0-11eb-aab0-0a253e5a178e
PeeringStack
PeeringStack: deploying...
PeeringStack: creating CloudFormation changeset...
[██████████████████████████████████████████████████████████] (5/5)

 ✅  PeeringStack

Stack ARN:
arn:aws:cloudformation:eu-west-1:REDACTED:stack/PeeringStack/15e96f10-2dc1-11eb-ae91-0643678755c5

Validation

To test if the VPC Peering has been properly set up, we're gonna send 3 pings from one of the EC2 instances to the other using the AWS CLI and its aws ssm send-command command.

If you're following along, be sure to swap the ID of the source EC2 instance (i-0ca24549d1646cccd) and the private IP of the destination EC2 instance (10.0.1.59) for appropriate values before running the below:



➜  ping-me-cdk-example$ aws ssm send-command \
--document-name "AWS-RunShellScript" \
--document-version "1" \
--targets '[{"Key":"InstanceIds","Values":["i-0ca24549d1646cccd"]}]' \
--parameters '{"workingDirectory":[""],"executionTimeout":["3600"],"commands":["ping 10.0.1.59 -c 3"]}' \
--timeout-seconds 600 \
--max-concurrency "50" \
--max-errors "0"
{
    "Command": {
        "CommandId": "e2171883-d9d1-478c-9ad2-2c7c51ca6c2e",
        "DocumentName": "AWS-RunShellScript",
        "DocumentVersion": "1",
        "Comment": "",
        "ExpiresAfter": "2020-11-23T22:04:17.410000+01:00",
        "Parameters": {
            "commands": [
                "ping 10.0.1.59 -c 3"
            ],
            "executionTimeout": [
                "3600"
            ],
            "workingDirectory": [
                ""
            ]
        },
        "InstanceIds": [],
        "Targets": [
            {
                "Key": "InstanceIds",
                "Values": [
                    "i-0ca24549d1646cccd"
                ]
            }
        ],
        "RequestedDateTime": "2020-11-23T20:54:17.410000+01:00",
        "Status": "Pending",
        "StatusDetails": "Pending",
        "OutputS3BucketName": "",
        "OutputS3KeyPrefix": "",
        "MaxConcurrency": "50",
        "MaxErrors": "0",
        "TargetCount": 0,
        "CompletedCount": 0,
        "ErrorCount": 0,
        "DeliveryTimedOutCount": 0,
        "ServiceRole": "",
        "NotificationConfig": {
            "NotificationArn": "",
            "NotificationEvents": [],
            "NotificationType": ""
        },
        "CloudWatchOutputConfig": {
            "CloudWatchLogGroupName": "",
            "CloudWatchOutputEnabled": false
        },
        "TimeoutSeconds": 600
    }
}

Now, let's check whether that succeeded using AWS CLI's aws ssm get-command-invocation command.

Again, if you're following along, be sure to swap the command ID (e2171883-d9d1-478c-9ad2-2c7c51ca6c2e) and the ID of the source EC2 instance (i-0ca24549d1646cccd) for appropriate values before running the below:



➜  ping-me-cdk-example$ aws ssm get-command-invocation --command-id e2171883-d9d1-478c-9ad2-2c7c51ca6c2e --instance-id i-0ca24549d1646cccd
{
    "CommandId": "e2171883-d9d1-478c-9ad2-2c7c51ca6c2e",
    "InstanceId": "i-0ca24549d1646cccd",
    "Comment": "",
    "DocumentName": "AWS-RunShellScript",
    "DocumentVersion": "1",
    "PluginName": "aws:runShellScript",
    "ResponseCode": 0,
    "ExecutionStartDateTime": "2020-11-23T19:54:17.876Z",
    "ExecutionElapsedTime": "PT2.032S",
    "ExecutionEndDateTime": "2020-11-23T19:54:19.876Z",
    "Status": "Success",
    "StatusDetails": "Success",
    "StandardOutputContent": "PING 10.0.1.59 (10.0.1.59) 56(84) bytes of data.\n64 bytes from 10.0.1.59: icmp_seq=1 ttl=255 time=0.140 ms\n64 bytes from 10.0.1.59: icmp_seq=2 ttl=255 time=0.152 ms\n64 bytes from 10.0.1.59: icmp_seq=3 ttl=255 time=0.138 ms\n\n--- 10.0.1.59 ping statistics ---\n3 packets transmitted, 3 received, 0% packet loss, time 2025ms\nrtt min/avg/max/mdev = 0.138/0.143/0.152/0.011 ms\n",
    "StandardOutputUrl": "",
    "StandardErrorContent": "",
    "StandardErrorUrl": "",
    "CloudWatchOutputConfig": {
        "CloudWatchLogGroupName": "",
        "CloudWatchOutputEnabled": false
    }
}

3 packets transmitted, 3 received, 0% packet loss, woop woop!

Cleanup

For the sake of our wallets, let's promptly destroy the current infrastructure before moving on. When prompted, type y for yes:



➜  ping-me-cdk-example$ cdk destroy --all
Are you sure you want to delete: PeeringStack, InstancePeersStack, VpcPeersStack (y/n)? y
PeeringStack: destroying...
21:15:12 | DELETE_IN_PROGRESS   | AWS::CloudFormation::Stack     | PeeringStack
 ✅  PeeringStack: destroyed
InstancePeersStack: destroying...
21:16:03 | DELETE_IN_PROGRESS   | AWS::CloudFormation::Stack | InstancePeersStack
 ✅  InstancePeersStack: destroyed
VpcPeersStack: destroying...
21:17:01 | DELETE_IN_PROGRESS   | AWS::CloudFormation::Stack            | VpcPeersStack
21:18:55 | DELETE_IN_PROGRESS   | AWS::EC2::InternetGateway             | Vpc1/IGW
21:18:55 | DELETE_IN_PROGRESS   | AWS::EC2::VPC                         | Vpc1
 ✅  VpcPeersStack: destroyed

Okey doke, pinging over Site-to-Site VPN is next!

Ping Me! (Intro: IaC and Prep Work)

Rafal Krol — Fri, 23 Jul 2021 09:24:45 +0000

Introduction

Hello, everyone! Welcome to Ping Me!, a short series of articles in which we are going to build out and compare three different solutions - VPC Peering, Site-to-Site VPN and Transit Gateway - for connecting VPCs together.

The building part will be done using AWS Cloud Development Kit. Then, we will prove that each connection works by deploying two EC2 instances, one on each end of the connection, and making a successful ping between them.

Infrastructure as Code (IaC)

Before we jump headfirst into hacking out our infra, I'd like to take a minute to talk about Infrastructure as Code (IaC), and why it is important. IaC is a powerful concept! Thanks to it instead of clicking through graphical user interfaces you can code your infrastructure exactly the same way you would code any other application. And since it is code, then it means you can apply all the best coding practices to it, e.g. version control, static code analysis, peer review, etc. With IaC your infra can be immutable, replicable, less error-prone than manual changes (especially when a lot of repetitiveness is involved); it works great at scale, can be automated, you can write tests for it... I'd daresay there's no DevOps without IaC. Everything as Code? Hell yeah!!!

There are many tools to pick and choose from when it comes to implementing Infrastructure as Code; Puppet, Chef and Ansible just to name a few. Hashicorp's Terraform is one that shines exceptionally bright on the IaC firmament. Despite just reaching the v1, it is a mature and battle-tested tool that has been used by both big and small in recent years.

Nonetheless, a new kid showed up on the block recently, the name's AWS CDK, and may soon disturb the peace. AWS CDK is a software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation.

What that means is that instead of declaring your resources and their interconnections in YAML (like you would do in Ansible, for instance) or in JSON (like you could do in CloudFormation, which also supports YAML) or in a Domain-Specific Language (as is the case with Terraform and its Hashicorp Configuration Language (HCL); JSON is also supported if you're a masochist) you can actually code in TypeScript or Javascript or Python or Java or C# (or, in Developer Preview, Go).

One apparent limitation of the CDK is that, at least for the nonce, it can only be used with AWS (there are two notable projects in the work right now that will greatly expand CDK's reach: cdk8s and cdktf). With Terraform you can use choose from a plethora of providers. Hell, I was able to set up my home network running on Unifi Dream Machine using Terraform. How cool is that?!

PS. Pulumi, ~~which I haven't fiddled with yet but definitely will~~, deserves an honorable mention in this little digression of mine, since it might be just the right mix of Terraform's providers and CDK's general-purpose languages support.

Prerequisites

If you want to follow me along, you'll need to have:

a) access, with adequate permissions, to an AWS account

b) AWS CLI v2 that's properly configured

c) Node v10.3 or higher (I'll be using node v14.14.0 with npm v6.14.9)

I recommend installing it with NVM, e.g.:

nvm install v14.14.0
nvm use v14.14.0

d) CDK

npm install -g aws-cdk

e) TypeScript

npm install -g typescript

f) some dollars to spend // even with the free tier on, be prepared to incur a few dollars of costs (be sure to destroy your stacks as soon as possible to avoid incurring much bigger costs!!!)

Preparations

Before we commence with provisioning any resources, we ought to do some prep work. Let's kick-off by creating a folder for our project and entering it:

➜  ~$ mkdir ping-me-cdk-example && cd $_

Now, we shall scaffold our project using CDK's neat init command specifying app as the template and typescript as the language:

➜  ping-me-cdk-example$ cdk init app --language=typescript
Applying project template app for typescript
# Welcome to your CDK TypeScript project!

This is a blank project for TypeScript development with CDK.

The `cdk.json` file tells the CDK Toolkit how to execute your app.

## Useful commands

 * `npm run build`   compile typescript to js
 * `npm run watch`   watch for changes and compile
 * `npm run test`    perform the jest unit tests
 * `cdk deploy`      deploy this stack to your default AWS account/region
 * `cdk diff`        compare deployed stack with current state
 * `cdk synth`       emits the synthesized CloudFormation template

Executing npm install...
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated request-promise-native@1.0.9: request-promise-native has been deprecated because it extends the now deprecated request package, see https://github.com/request/request/issues/3142
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm notice created a lockfile as package-lock.json. You should commit this file.
npm WARN ping-me-cdk-example@0.1.0 No repository field.
npm WARN ping-me-cdk-example@0.1.0 No license field.

✅ All done!

You should end up with the following structure:

ping-me-cdk-example # we're here
├── bin
│   └── ping-me-cdk-example.ts
├── lib
│   └── ping-me-cdk-example-stack.ts
├── node_modules
│   └── ... # Many, many subfolders here
├── test
│   └── ping-me-cdk-example.test.ts
├── .gitignore
├── .npmignore
├── cdk.json
├── jest.config.js
├── package-lock.json
├── package.json
├── README.md
└── tsconfig .json

As you can see, CDK has created a rather intimidating host of files and subdirectories for us. Well, not so intimidating if you've ever worked with Node and/or TypeScript before. Most of it is boilerplate and throughout these articles we shall only deal with the ping-me-cdk-example/bin/ping-me-cdk-example.ts file and the ping-me-cdk-example/lib directory.

Let's remove ping-me-cdk-example/lib/ping-me-cdk-example-stack.ts and ping-me-cdk-example/test/ping-me-cdk-example.test.ts as they'd just get in the way:

➜  ping-me-cdk-example$ rm lib/ping-me-cdk-example-stack.ts test/ping-me-cdk-example.test.ts

Also, let's wipe clear the contents of the ping-me-cdk-example/bin/ping-me-cdk-example.ts file:

:> bin/ping-me-cdk-example.ts

Okay, seems the groundwork's done and thus we're ready to peer some VPCs. Follow me!