feat(ec2): add interface endpoint dynamodb #30162

mazyu36 · 2024-05-12T13:41:36Z

Issue # (if applicable)

Closes #29547

Reason for this change

Description of changes

Add DynamoDB interface endpoint and validation

Description of how you validated changes

Added unit tests and integ test.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

Add Eventbridge's missing VPC endpoints. I identified the missing VPC endpoints using the following procedure: 1. Retrieved a list of interface endpoints using the command below ```sh % aws ec2 describe-vpc-endpoint-services \ --filter Name=service-type,Values=Interface \ --query 'ServiceDetails[].[ServiceName,BaseEndpointDnsNames[0]]' \ --output json --region us-east-1| jq -r '.[] | @csv' // result "aws.api.us-east-1.bcm-data-exports","bcm-data-exports.us-east-1.vpce.amazonaws.com" "aws.api.us-east-1.freetier","freetier.us-east-1.vpce.amazonaws.com" "aws.api.us-east-1.kendra-ranking","kendra-ranking.us-east-1.vpce.amazonaws.com" "aws.api.us-east-1.qbusiness","qbusiness.us-east-1.vpce.amazonaws.com" // omit ``` 2. Obtained the differences by comparing the implementation with the list 3. Verified the differing endpoints exist in the documentation and added them to the implementation Ref: * https://docs.aws.amazon.com/vpc/latest/privatelink/aws-services-privatelink-support.html Note: * This PR doesn't include DynamoDB interface endpoint because #30162 already opened. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

### Issue # (if applicable) None ### Reason for this change There some interface vpc endpoints which is not supported by AWS CDK. ### Description of changes I've added the following VPC endpoints. - airflow.api-fips - airflow.env-fips - applicationinsights - emr-serverless-services.livy - pcs - pcs-fips - pi - pi-fips - q - rbin - service.user-subscriptions - ssm-fips - ssm-quicksetup - timestream-influxdb-fips - wellarchitected Since a PR has already been created for the following endpoints, this PR does not address them. - kinesis-streams-fips (#31350) - dynamodb (#30162) ### Description of how you validated changes These endpoints are obtained from AWS CLI. ```sh $ aws ec2 describe-vpc-endpoint-services --filters Name=service-type,Values=Interface Name=owner,Values=amazon --region us-east-1 --query ServiceNames ``` ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

### Issue # (if applicable) None ### Reason for this change There some interface vpc endpoints which is not supported by AWS CDK. ### Description of changes I've added the following VPC endpoints. - airflow.api-fips - airflow.env-fips - applicationinsights - emr-serverless-services.livy - pcs - pcs-fips - pi - pi-fips - q - rbin - service.user-subscriptions - ssm-fips - ssm-quicksetup - timestream-influxdb-fips - wellarchitected Since a PR has already been created for the following endpoints, this PR does not address them. - kinesis-streams-fips (aws#31350) - dynamodb (aws#30162) ### Description of how you validated changes These endpoints are obtained from AWS CLI. ```sh $ aws ec2 describe-vpc-endpoint-services --filters Name=service-type,Values=Interface Name=owner,Values=amazon --region us-east-1 --query ServiceNames ``` ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

Leo10Gama

Thanks for your contribution, and sorry about the wait! Taking an initial look through the changes, I'm not sure about the new Private DNS behaviour being added. I left a comment below that I think should be addressed before moving forward with the rest of the changes.

Leo10Gama · 2024-10-01T22:11:41Z

packages/aws-cdk-lib/aws-ec2/lib/vpc-endpoint.ts

@@ -613,6 +614,7 @@ export class InterfaceVpcEndpointAwsService implements IInterfaceVpcEndpointServ

  /**
   * Whether Private DNS is supported by default.
+   * If the interface endpoint doesn't support Private DNS, privateDnsDefault will be set false.


I'm a little skeptical about this behaviour. If we're only adding this in now, I assume it means that there are no other services out of the hundreds listed above which don't support private DNS. Is there any documentation we have to back up that claim?

If DynamoDB is the only service that doesn't support it, I'm curious what happens when we try deploying without these checks in place; what sort of errors get thrown (if any) and how does it look in the console? If there are other services that also don't support private DNS, what does their behaviour currently look like?

From the original issue, it seems like private connections might be supported anyways (documentation), but this could also be something separate.

Private connections are supported, but private DNS is not supported for DynamoDB.

Document is here.

AWS PrivateLink for Amazon DynamoDB does not support the following:

Private and Hybrid Domain Name System (DNS) services

I tried enabling private DNS through the Management Console and CloudFormation, but it resulted in an error.

Previously, similar restrictions existed for S3 interface endpoint, but resolved through an update.

Ref:

https://aws.amazon.com/about-aws/whats-new/2023/03/amazon-s3-private-connectivity-on-premises-networks/?nc1=h_ls

Currently, DynamoDB is the only service where private DNS cannot be used with interface VPC endpoints.
This is likely due to the fact that DynamoDB originally only had Gateway VPC Endpoint.

I think we could remove the logic that sets privateDnsDefault to false specifically for DynamoDB.

In this case, if privateDnsDefault is not specified, it defaults to true and results in a deployment error. However, deployment can succeed if privateDnsDefault is explicitly set to false.
Furthermore, since DynamoDB may support private DNS in the future, the process of setting the default to false might become unnecessary.

What do you think?

If it fails at deploy time, I think it should be fine that we don't need the extra logic on our end. The error message also seems descriptive enough that users could figure out the source of the issue and resolve it on their end.

So going forward, I think we can scrap the getPrivateDnsDefault method and the related documentation around it. It'd be nice to catch it earlier, but I don't think the added complexity is worth it, especially if this only applies to a single service.

Thank you.
I have only added the DynamoDB interface endpoint and removed the methods.
I also added a unit test and an integ test for when privateDnsEnabled is set to false.

Pull request has been modified.

Leo10Gama

Thanks for addressing the feedback! I think removing the privateDnsDefault logic seems like a good way forward. Seems like the error message it throws at deploy time, "Private DNS can't be enabled because the service com.amazonaws.us-east-1.dynamodb does not provide a private DNS name." is descriptive enough that it'll direct people to private DNS as the issue, and they can just set privateDnsEnabled to false to deploy successfully.

Leo10Gama · 2024-10-02T17:53:29Z

packages/aws-cdk-lib/aws-ec2/lib/vpc-endpoint.ts

@@ -613,6 +614,7 @@ export class InterfaceVpcEndpointAwsService implements IInterfaceVpcEndpointServ

  /**
   * Whether Private DNS is supported by default.
+   * If the interface endpoint doesn't support Private DNS, privateDnsDefault will be set false.


If it fails at deploy time, I think it should be fine that we don't need the extra logic on our end. The error message also seems descriptive enough that users could figure out the source of the issue and resolve it on their end.

So going forward, I think we can scrap the getPrivateDnsDefault method and the related documentation around it. It'd be nice to catch it earlier, but I don't think the added complexity is worth it, especially if this only applies to a single service.

Pull request has been modified.

aws-cdk-automation

The pull request linter has failed. See the aws-cdk-automation comment below for failure reasons. If you believe this pull request should receive an exemption, please comment and provide a justification.

A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed add Clarification Request to a comment.

mazyu36 · 2024-10-03T03:23:58Z

Exemption Request: only added DynamoDB interface endpoint. I don't think it's necessary to add or update the README.

mazyu36 · 2024-10-03T03:26:16Z

@Leo10Gama
Thank you for the review.
I've removed the privateDnsDefault logic and updated tests.

Leo10Gama

LGTM, thanks for the contribution!

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

Leo10Gama · 2024-10-03T18:48:01Z

@Mergifyio update

mergify · 2024-10-03T18:48:48Z

update

✅ Branch has been successfully updated

mergify · 2024-10-03T18:48:49Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2024-10-03T19:20:46Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2024-10-03T19:51:59Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 39cd246
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2024-10-03T19:52:31Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2024-10-03T19:52:47Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

feat: dynamodb interface endpoint

30d7b37

github-actions bot added effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 beginning-contributor [Pilot] contributed between 0-2 PRs to the CDK labels May 12, 2024

aws-cdk-automation requested a review from a team May 12, 2024 13:41

aws-cdk-automation previously requested changes May 12, 2024

View reviewed changes

fix: update docs

e7b6fa6

mazyu36 added 2 commits May 12, 2024 23:21

fix: typo

d3b7b50

fix: unit test

6701397

mazyu36 marked this pull request as ready for review May 12, 2024 16:32

github-actions bot mentioned this pull request May 13, 2024

Weekly PR metrics report #30176

Closed

fix: typo

162dda7

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label May 13, 2024

github-actions bot mentioned this pull request Jun 1, 2024

Monthly PR metrics report #30414

Closed

mazyu36 force-pushed the vpc-endpoint-dynamodb branch from 76d5467 to 162dda7 Compare June 15, 2024 13:08

mazyu36 mentioned this pull request Jul 10, 2024

chore(ec2): add missing interface vpc endpoints #30807

Merged

1 task

badmintoncryer mentioned this pull request Sep 8, 2024

chore(ec2): add interface VPC endpoints #31359

Merged

1 task

Leo10Gama self-assigned this Oct 1, 2024

Leo10Gama previously requested changes Oct 1, 2024

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Oct 1, 2024

mazyu36 added 3 commits October 2, 2024 20:49

lint

e3d7da0

Merge remote-tracking branch 'upstream/main' into vpc-endpoint-dynamodb

62a8c6e

update integ

30a970c

mazyu36 force-pushed the vpc-endpoint-dynamodb branch from 83de21e to 30a970c Compare October 2, 2024 12:28

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Oct 2, 2024

Leo10Gama previously requested changes Oct 2, 2024

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Oct 2, 2024

incorporate review comments

787c62f

aws-cdk-automation previously requested changes Oct 3, 2024

View reviewed changes

aws-cdk-automation added the pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. label Oct 3, 2024

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Oct 3, 2024

mazyu36 requested a review from Leo10Gama October 3, 2024 03:26

update test

5caf3bc

Leo10Gama approved these changes Oct 3, 2024

View reviewed changes

Leo10Gama added the pr-linter/exempt-readme The PR linter will not require README changes label Oct 3, 2024

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Oct 3, 2024

Merge branch 'main' into vpc-endpoint-dynamodb

e55376a

Merge branch 'main' into vpc-endpoint-dynamodb

39cd246

mergify bot merged commit 182804a into aws:main Oct 3, 2024
9 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Oct 3, 2024

mazyu36 deleted the vpc-endpoint-dynamodb branch October 3, 2024 21:51

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(ec2): add interface endpoint dynamodb #30162

feat(ec2): add interface endpoint dynamodb #30162

mazyu36 commented May 12, 2024

aws-cdk-automation left a comment

Leo10Gama left a comment

Leo10Gama Oct 1, 2024

mazyu36 Oct 2, 2024

Leo10Gama Oct 2, 2024

mazyu36 Oct 3, 2024

Leo10Gama left a comment •

edited

Loading

Leo10Gama Oct 2, 2024

aws-cdk-automation left a comment

mazyu36 commented Oct 3, 2024

mazyu36 commented Oct 3, 2024

Leo10Gama left a comment

Leo10Gama commented Oct 3, 2024 •

edited

Loading

mergify bot commented Oct 3, 2024

mergify bot commented Oct 3, 2024

mergify bot commented Oct 3, 2024

aws-cdk-automation commented Oct 3, 2024

mergify bot commented Oct 3, 2024

github-actions bot commented Oct 3, 2024

feat(ec2): add interface endpoint dynamodb #30162

feat(ec2): add interface endpoint dynamodb #30162

Conversation

mazyu36 commented May 12, 2024

Issue # (if applicable)

Reason for this change

Description of changes

Description of how you validated changes

Checklist

aws-cdk-automation left a comment

Choose a reason for hiding this comment

Leo10Gama left a comment

Choose a reason for hiding this comment

Leo10Gama Oct 1, 2024

Choose a reason for hiding this comment

mazyu36 Oct 2, 2024

Choose a reason for hiding this comment

Leo10Gama Oct 2, 2024

Choose a reason for hiding this comment

mazyu36 Oct 3, 2024

Choose a reason for hiding this comment

Leo10Gama left a comment • edited Loading

Choose a reason for hiding this comment

Leo10Gama Oct 2, 2024

Choose a reason for hiding this comment

aws-cdk-automation left a comment

Choose a reason for hiding this comment

mazyu36 commented Oct 3, 2024

mazyu36 commented Oct 3, 2024

Leo10Gama left a comment

Choose a reason for hiding this comment

Leo10Gama commented Oct 3, 2024 • edited Loading

mergify bot commented Oct 3, 2024

✅ Branch has been successfully updated

mergify bot commented Oct 3, 2024

mergify bot commented Oct 3, 2024

aws-cdk-automation commented Oct 3, 2024

AWS CodeBuild CI Report

mergify bot commented Oct 3, 2024

github-actions bot commented Oct 3, 2024

Leo10Gama left a comment •

edited

Loading

Leo10Gama commented Oct 3, 2024 •

edited

Loading