[synthetics] Make it possible to set vpcConfig in synthetics.Canary for vpc private API testing

[frjtrifork]

When creating a Canary using synthetics.Canary there is no way to set the vpc config which is needed for invocations of VPC-private APIs.

If you create the canary using CfnCanary you can configure the VpcConfig in the https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-synthetics.CfnCanaryProps.html

So there is a workaround, but by using CfnCanary you have to create the role, permission, s3 bucket (artifacts) etc. by hand also - so you end up with a lot of cdk code for even simple canaries.

Use Case

We have a number of VPC private APIs we would like to make canaries for.
Configuring api testing of vpc private api calls without this option when using the synthetics.Canary - and using CfnCanary is quite verbose / easy to get wrong in comparison to having the synthetics.Canary auto-create them.

Proposed Solution

Add vpcConfig option to the synthetics.CanaryProps

Other

If it is not an option to add vpc config to the synthetics.Canary, then please provide an example of how to use the vpc config in the CfnCanary.

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[1davidmichael]

Another solution is to use overrides but is almost as much work as CfnCanary.

        canary_cfn = canary.node.default_child
        canary_cfn.add_property_override("VPCConfig.VpcId", vpc.vpc_id)

        # Get a list of private subnet id strings
        private_subnet_ids = []
        for subnet in vpc.private_subnets:
            private_subnet_ids.append(subnet.subnet_id)
        canary_cfn.add_property_override("VPCConfig.SubnetIds", private_subnet_ids)
        canary_cfn.add_property_override("VPCConfig.SecurityGroupIds", [canary_sg.security_group_id])

Note that you will also need to configure a role for the Synthetic which has permissions to create Lambdas in a VPC to utilize this.

[nbaillie]

Just to help others, as i had initially made a typo on this and caused me some delays.

To add the permissions as described above i used:
canary.role.addManagedPolicy(ManagedPolicy.fromAwsManagedPolicyName('service-role/AWSLambdaVPCAccessExecutionRole'))

[mariomerco]

You can also create an instance of CfnCanary.VPCConfigProperty and pass it to the vpc_config property of the CfnCanary:

vpc_config = synthetics.CfnCanary.VPCConfigProperty (
    security_group_ids = ["sg-0715f7256c15ac074"],
    subnet_ids = ["subnet-088d506ff2c332ea55", "subnet-0d1d4e2ba3067d113", "subnet-0099c4e2daa304307"],
    vpc_id = "vpc-09597deba63ce2c57"
)

self.canary.node.default_child.vpc_config = vpc_config

[marius-jakobi]

With escape hatches in Typescript:

const cfnCanary = canary.node.defaultChild as synthetics.CfnCanary

cfnCanary.vpcConfig = {
      vpcId: vpc.vpcId,
      securityGroupIds: [securityGroupId],
      subnetIds: [subnetId]
}

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.