feat(vpcv2): vpc peering connection construct

packages/@aws-cdk/aws-ec2-alpha/README.md

@@ -231,6 +231,42 @@ new Route(this, 'DynamoDBRoute', {
 });
 ```
 
+## VPC Peering Connection
+
+VPC peering connection allows you to connect two VPCs and route traffic between them using private IP addresses. The VpcV2 construct supports creating VPC peering connections through the `VPCPeeringConnection` construct from the `route` module.
+
+Here's an example of how to create a VPC peering connection between two VPCs:
+
+```ts
+const stack = new Stack();
+
+const vpcA = new VpcV2(this, 'VpcA', {
+  primaryAddressBlock: IpAddresses.ipv4('10.0.0.0/16'),
+});
+
+const vpcB = new VpcV2(this, 'VpcB', {
+  primaryAddressBlock: IpAddresses.ipv4('10.1.0.0/16'),
+});
+
+const peeringConnection = new VPCPeeringConnection(this, 'crossAccountCrossRegionPeering', {
+  isCrossAccount: true,
+  requestorVpc: vpcA,
+  acceptorVpc: vpcB,
+  acceptorAccountId: '123456789012',
+  acceptorRegion: 'us-west-2',
+});
+
+const routeTable = new RouteTable(this, 'RouteTable', {
+  vpc: vpcA,
+});
+
+routeTable.addRoute('vpcPeeringRoute', '10.0.0.0/16', { gateway: peeringConnection });
+```
+
+Note that for cross-account peering, you'll need to ensure that the peering request is accepted in the peer account. For more information see [Accept or reject a VPC peering connection](https://docs.aws.amazon.com/vpc/latest/peering/accept-vpc-peering-connection.html).
+
+To add routes for the peering connection to specific subnets, you can use the addRoute method of the RouteTable construct.
+
 ## Adding Egress-Only Internet Gateway to VPC
 
 An egress-only internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows outbound communication over IPv6 from instances in your VPC to the internet, and prevents the internet from initiating an IPv6 connection with your instances.

packages/@aws-cdk/aws-ec2-alpha/lib/route.ts

@@ -1,9 +1,10 @@
-import { CfnEIP, CfnEgressOnlyInternetGateway, CfnInternetGateway, CfnNatGateway, CfnRoute, CfnRouteTable, CfnVPCGatewayAttachment, CfnVPNGateway, CfnVPNGatewayRoutePropagation, GatewayVpcEndpoint, IRouteTable, IVpcEndpoint, RouterType } from 'aws-cdk-lib/aws-ec2';
+import { CfnEIP, CfnEgressOnlyInternetGateway, CfnInternetGateway, CfnNatGateway, CfnVPCPeeringConnection, CfnRoute, CfnRouteTable, CfnVPCGatewayAttachment, CfnVPNGateway, CfnVPNGatewayRoutePropagation, GatewayVpcEndpoint, IRouteTable, IVpcEndpoint, RouterType } from 'aws-cdk-lib/aws-ec2';
 import { Construct, IDependable } from 'constructs';
-import { Annotations, Duration, IResource, Resource } from 'aws-cdk-lib/core';
+import { Aws, Annotations, Duration, IResource, Resource, Stack } from 'aws-cdk-lib/core';
 import { IVpcV2, VPNGatewayV2Options } from './vpc-v2-base';
-import { NetworkUtils, allRouteTableIds } from './util';
+import { CidrBlock, NetworkUtils, allRouteTableIds } from './util';
 import { ISubnetV2 } from './subnet-v2';
+import { AccountPrincipal, Effect, PolicyStatement, Role } from 'aws-cdk-lib/aws-iam';
 
 /**
  * Indicates whether the NAT gateway supports public or private connectivity.
@@ -175,6 +176,47 @@ export interface NatGatewayProps extends NatGatewayOptions {
   readonly vpc?: IVpcV2;
 }
 
+/**
+ * Properties to define a VPC peering connection.
+ */
+export interface VPCPeeringConnectionProps {
+  /**
+   * Indicates whether this is a cross-account VPC peering connection.
+   */
+  readonly isCrossAccount: boolean;
+
+  /**
+   * The VPC that is requesting the peering connection.
+   */
+  readonly requestorVpc: IVpcV2;
+
+  /**
+   * The VPC that is accepting the peering connection.
+   */
+  readonly acceptorVpc: IVpcV2;
+
+  /**
+   * The AWS account ID of the acceptor VPC owner.
+   *
+   * @default - no acceptor account ID needed if not cross account connection
+   */
+  readonly acceptorAccountId?: string;
+
+  /**
+   * The region of the acceptor VPC.
+   *
+   * @default - same region as the requestor VPC
+   */
+  readonly acceptorRegion?: string;
+
+  /**
+   * The resource name of the peering connection.
+   *
+   * @default - peering connection provisioned without any name
+   */
+  readonly vpcPeeringConnectionName?: string;
+}
+
 /**
  * Creates an egress-only internet gateway
  * @resource AWS::EC2::EgressOnlyInternetGateway
@@ -402,6 +444,88 @@ export class NatGateway extends Resource implements IRouteTarget {
   }
 }
 
+/**
+ * Creates a peering connection between two VPCs
+ * @resource AWS::EC2::VPCPeeringConnection
+ */
+export class VPCPeeringConnection extends Resource implements IRouteTarget {
+
+  /**
+   * The type of router used in the route.
+   */
+  readonly routerType: RouterType;
+
+  /**
+   * The ID of the route target.
+   */
+  readonly routerTargetId: string;
+
+  /**
+   * The VPC peering connection CFN resource.
+   */
+  public readonly resource: CfnVPCPeeringConnection;
+
+  constructor(scope: Construct, id: string, props: VPCPeeringConnectionProps) {
+    super(scope, id);
+
+    const region = props.acceptorRegion ? props.acceptorRegion : Stack.of(this).region;
+    let peerRole: Role | undefined;
+    this.routerType = RouterType.VPC_PEERING_CONNECTION;
+
+    if (props.isCrossAccount && props.acceptorAccountId === undefined) {
+      throw new Error('AcceptorAccountId is required for cross-account peering connections');
+    }
+
+    const overlap = validateVpcCidrOverlap(props.requestorVpc, props.acceptorVpc);
+    if (overlap) {
+      throw new Error('CIDR block should not overlap with existing subnet blocks');
+    }
+
+    if (props.isCrossAccount) {
+      peerRole = new Role(this, 'PeerRole', {
+        assumedBy: new AccountPrincipal(Stack.of(this).account),
+        roleName: `VPCPeeringRole-${id}`,
+      });
+
+      peerRole.assumeRolePolicy?.addStatements(
+        new PolicyStatement({
+          effect: Effect.ALLOW,
+          actions: ['sts:AssumeRole'],
+          principals: [new AccountPrincipal(Stack.of(this).account)],
+        }),
+      );
+
+      peerRole.addToPolicy(new PolicyStatement({
+        effect: Effect.ALLOW,
+        actions: ['ec2:acceptVpcPeeringConnection'],
+        resources: [`arn:${Aws.PARTITION}:ec2:${region}:${props.acceptorAccountId}:vpc/${props.acceptorVpc.vpcId}`],
+      }));
+
+      peerRole.addToPolicy(new PolicyStatement({
+        actions: ['ec2:acceptVpcPeeringConnection'],
+        effect: Effect.ALLOW,
+        resources: [`arn:${Aws.PARTITION}:ec2:${region}:${props.acceptorAccountId}:vpc-peering-connection/*`],
+        conditions: {
+          StringEquals: {
+            'ec2:AccepterVpc': `arn:${Aws.PARTITION}:ec2:${region}:${props.acceptorAccountId}:vpc/${props.acceptorVpc.vpcId}`,
+          },
+        },
+      }));
+    }
+
+    this.resource = new CfnVPCPeeringConnection(this, 'PeeringConnection', {
+      vpcId: props.requestorVpc.vpcId,
+      peerVpcId: props.acceptorVpc.vpcId,
+      peerOwnerId: props.acceptorAccountId,
+      peerRegion: region,
+      peerRoleArn: peerRole?.roleArn,
+    });
+
+    this.routerTargetId = this.resource.attrId;
+    this.node.defaultChild = this.resource;
+  }
+}
+
 /**
  * The type of endpoint or gateway being targeted by the route.
  */
@@ -534,7 +658,7 @@ export class Route extends Resource implements IRouteV2 {
   /**
    * The type of router the route is targetting
    */
-  public readonly targetRouterType: RouterType
+  public readonly targetRouterType: RouterType;
 
   /**
    * The route CFN resource.
@@ -663,4 +787,46 @@ function routerTypeToPropName(routerType: RouterType) {
     [RouterType.VPC_PEERING_CONNECTION]: 'vpcPeeringConnectionId',
     [RouterType.VPC_ENDPOINT]: 'vpcEndpointId',
   })[routerType];
+}
+
+/**
+ * Validates if the provided IPv4 CIDR block overlaps with existing subnet CIDR blocks within the given VPC.
+ *
+ * @param requestorVpc The VPC of the requestor.
+ * @param acceptorVpc The VPC of the acceptor.
+ * @returns True if the IPv4 CIDR block overlaps with existing subnet CIDR blocks, false otherwise.
+ * @internal
+ */
+function validateVpcCidrOverlap(requestorVpc: IVpcV2, acceptorVpc: IVpcV2): boolean {
+
+  const requestorCidrs = [requestorVpc.ipv4CidrBlock];
+  const acceptorCidrs = [acceptorVpc.ipv4CidrBlock];
+
+  if (requestorVpc.secondaryCidrBlock) {
+    requestorCidrs.push(...requestorVpc.secondaryCidrBlock
+      .map(block => block.cidrBlock)
+      .filter((cidr): cidr is string => cidr !== undefined));
+  }
+
+  if (acceptorVpc.secondaryCidrBlock) {
+    acceptorCidrs.push(...acceptorVpc.secondaryCidrBlock
+      .map(block => block.cidrBlock)
+      .filter((cidr): cidr is string => cidr !== undefined));
+  }
+
+  for (const requestorCidr of requestorCidrs) {
+    const requestorRange = new CidrBlock(requestorCidr);
+    const requestorIpRange: [string, string] = [requestorRange.minIp(), requestorRange.maxIp()];
+
+    for (const acceptorCidr of acceptorCidrs) {
+      const acceptorRange = new CidrBlock(acceptorCidr);
+      const acceptorIpRange: [string, string] = [acceptorRange.minIp(), acceptorRange.maxIp()];
+
+      if (requestorRange.rangesOverlap(acceptorIpRange, requestorIpRange)) {
+        return true;
+      }
+    }
+  }
+
+  return false;
 }

packages/@aws-cdk/aws-ec2-alpha/rosetta/default.ts-fixture

@@ -1,7 +1,7 @@
 // Fixture with packages imported, but nothing else
 import { Construct } from 'constructs';
 import { Stack, App, Fn } from 'aws-cdk-lib';
-import { VpcV2, SubnetV2, IpAddresses, IpamPoolPublicIpSource, RouteTable, InternetGateway, Route, NatGateway, EgressOnlyInternetGateway } from '@aws-cdk/aws-ec2-alpha';
+import { VpcV2, SubnetV2, IpAddresses, IpamPoolPublicIpSource, RouteTable, InternetGateway, Route, NatGateway, EgressOnlyInternetGateway, VPCPeeringConnection } from '@aws-cdk/aws-ec2-alpha';
 import { Ipam, AwsServiceName, IpCidr, AddressFamily } from '@aws-cdk/aws-ec2-alpha';
 import { NatConnectivityType } from '@aws-cdk/aws-ec2-alpha';
 import { SubnetType, VpnConnectionType } from 'aws-cdk-lib/aws-ec2';

packages/@aws-cdk/aws-ec2-alpha/test/integ.route-v2.js.snapshot/aws-cdk-routev2-egressonlyigw-alpha.template.json

@@ -35,7 +35,6 @@
   "TestRoottableeigwRouteF867084E": {
    "Type": "AWS::EC2::Route",
    "Properties": {
-    "DestinationCidrBlock": "::/0",
     "DestinationIpv6CidrBlock": "::/0",
     "EgressOnlyInternetGatewayId": {
      "Fn::GetAtt": [
@@ -49,7 +48,10 @@
       "RouteTableId"
      ]
     }
-   }
+   },
+   "DependsOn": [
+    "testEOIGWEIGW54CCAD37"
+   ]
   },
   "eigwSubnetCC28B9F9": {
    "Type": "AWS::EC2::Subnet",

packages/@aws-cdk/aws-ec2-alpha/test/integ.route-v2.js.snapshot/aws-cdk-routev2-igw-alpha.template.json

@@ -48,24 +48,11 @@
       "RouteTableId"
      ]
     }
-   }
-  },
-  "TestRoottableigwRouteGWAttachment4B3E8FD9": {
-   "Type": "AWS::EC2::VPCGatewayAttachment",
-   "Properties": {
-    "InternetGatewayId": {
-     "Fn::GetAtt": [
-      "testIGW8D947AF2",
-      "InternetGatewayId"
-     ]
-    },
-    "VpcId": {
-     "Fn::GetAtt": [
-      "igw127F1970",
-      "VpcId"
-     ]
-    }
-   }
+   },
+   "DependsOn": [
+    "testIGWGWAttachment682A6782",
+    "testIGW8D947AF2"
+   ]
   },
   "igwSubnetF238E402": {
    "Type": "AWS::EC2::Subnet",
@@ -114,6 +101,23 @@
   },
   "testIGW8D947AF2": {
    "Type": "AWS::EC2::InternetGateway"
+  },
+  "testIGWGWAttachment682A6782": {
+   "Type": "AWS::EC2::VPCGatewayAttachment",
+   "Properties": {
+    "InternetGatewayId": {
+     "Fn::GetAtt": [
+      "testIGW8D947AF2",
+      "InternetGatewayId"
+     ]
+    },
+    "VpcId": {
+     "Fn::GetAtt": [
+      "igw127F1970",
+      "VpcId"
+     ]
+    }
+   }
   }
  },
  "Parameters": {