VPCPeeringConnection: CfnVPCPeeringConnection tries to accept cross-account request

[luqmanulkhair]

What is the problem?

I want to create a cross-account peering request and don't want to accept it immediately as the default behavior in UI and also awscli, however creating a peering connection using CfnVPCPeeringConnection, I get the error User cannot accept peering pcx-..... An example is given below.

Reproduction Steps

const connection = new CfnVPCPeeringConnection(
this, 
'xyzzy', 
{   
    peerOwnerId: '1234',
    peerVpcId: 'abc',
    vpcId: vpc.vpcId,
});

What did you expect to happen?

It should create a peering request instead of trying to accept it directly after creating it.

What actually happened?

It creates a peering request and tries to accept it. Since the role is not available and therefore it fails and gives this error.
User 'XYZ' cannot accept peering pcx-.

CDK CLI Version

1.130.0

Framework Version

No response

Node.js Version

v12.7.0

OS

macOS Catalina 10.15.6

Language

Typescript

Language Version

No response

Other information

No response

[ryparker]

Hey @luqmanulkhair 👋🏻

CfnVPCPeeringConnection is an L1 construct which means that it is auto generated from the AWS::EC2::VPCPeeringConnection CloudFormation resource. This also means that there shouldn't be any CDK logic that overrides the defaults of CloudFormation.

Could you provide an example of how you're using awscli to achieve what you are expecting?

[luqmanulkhair]

@ryparker i used create-vpc-peering-connection which works perfectly fine but this L1 construct doesn't work.

[ryparker]

It creates a peering request and tries to accept it. Since the role is not available and therefore it fails and gives this error.
User 'XYZ' cannot accept peering pcx-.

Have you tried using CfnVpcPeeringConnection.addDependsOn() to guarantee that the role is created before it attempts the connection?

[luqmanulkhair]

@ryparker I don't understand what should I write in dependsOn(), To me seems like it wants the role from another VPC and I don't have access to it (Cross-Account). I only want to create a pending connection. Even the connection request is created but then it is rolled-back. Why isn't it working the way create-vpc-peering-connection is working?

[rix0rrr]

Looking at the documentation here: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/peer-with-vpc-in-another-account.html

Are you not missing peerRoleArn ?

We cannot really help you any more than that. VPC Peering has not been implemented in the hand-written layer of CDK. As such, you need to use exactly the same mechanisms as you would need to set up VPC peering using CloudFormation, except using CDK.

Otherwise, this seems like a duplicate of #9338. Closing.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.