feat(vpc-lattice-alpha): initial ServiceNetwork and Service L2 constructs #35055

vishaalmehrishi · 2025-07-24T13:01:48Z

This is a WIP change - sharing to get early feedback

Issue # (if applicable)

Closes #.

Reason for this change

Initial implementation of the vpc-lattice-alpha L2 constructs.

RFC: https://github.com/aws/aws-cdk-rfcs/blob/main/text/0502_aws-vpclattice.md

The implementation details may differ from the RFC in some ways - I am using this exercise as a way to evaluate the L2 creation process and find potential improvements.

Description of changes

So far, just the main constructs: ServiceNetwork and Service. These are not complete either - I am continuing to work on them.

Describe any new or updated permissions being added

N/A

Description of how you validated changes

Wrote a couple of basic unit tests. I will add comprehensive testing once the constructs are in a near-final state.

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

The pull request linter fails with the following errors:

❌ Features must contain a change to an integration test file and the resulting snapshot.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

vishaalmehrishi · 2025-07-24T13:04:42Z

packages/@aws-cdk/aws-vpclattice-alpha/lib/service-network.ts

+    this.serviceNetworkArn = resource.attrArn;
+    this.serviceNetworkId = resource.attrId;
+
+    // TODO: enforce at least one service? A service network without services is just...a network


@mrgrain thoughts on this? IMO enforcing this is good, because a service network should have at least one service. However, this is not enforced by CFN or the AWS Console UX when creating a service network.

https://docs.aws.amazon.com/vpc-lattice/latest/ug/create-service-network.html

Seems overly prescriptive to me and would prevent common coding patterns like

const sn = new ServiceNetwork(scope, 'ServiceNetwork', { ... }); // do stuff // somewhere completely different do sn. associateServices(...);

vishaalmehrishi · 2025-07-24T13:05:56Z

packages/@aws-cdk/aws-vpclattice-alpha/lib/service-network-base.ts

+/**
+ * Base class for VPC Lattice service networks
+ */
+export abstract class ServiceNetworkBase extends Resource implements IServiceNetwork {


Guidelines say not to export the base class, but there's no way around it if the base class is in a different file (which is not necessary, of course).

Is it a hard requirement not to expose the base class?

The important part will be that it's not exported from index.ts

I tried that - without the index.ts export, the import in service-network.ts does not work (or I am doing something wrong).

DDB Tablev2 also exports the base class FYI:

aws-cdk/packages/aws-cdk-lib/aws-dynamodb/lib/index.ts

Line 5 in 84e875a

export * from './table-v2-base';

(not saying this is correct, just pointing it out).

mrgrain · 2025-07-24T13:15:38Z

packages/@aws-cdk/aws-vpclattice-alpha/lib/service-network.ts

+  /**
+   * Tags for the service network
+   *
+   * @default - No tags
+   */
+  readonly tags?: string;


Suggested change

/**

* Tags for the service network

*

* @default - No tags

*/

readonly tags?: string;

/**

* Tags for the service network

*

* @default - No tags

*/

readonly tags?: { [key: string]: string };

Required as per https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#tags
But I don't think we actually do this in a lot of places. @rix0rrr might have a better idea what the actual latest recommendation is here.

Ah thanks, I haven't really touched tags yet - forgot that I left that in :D. I will make the change.

aws-cdk-automation · 2025-07-24T13:16:59Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 231075d
Result: FAILED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

packages/@aws-cdk/aws-vpclattice-alpha/lib/service-network.ts

mrgrain · 2025-07-24T13:17:37Z

packages/@aws-cdk/aws-vpclattice-alpha/lib/service-network.ts

+
+    // TODO: validation?
+
+    // TODO: tags


mrgrain · 2025-07-24T13:18:49Z

packages/@aws-cdk/aws-vpclattice-alpha/lib/service-network.ts

+  constructor(scope: Construct, id: string, props: ServiceNetworkProps) {
+    super(scope, id);
+
+    // TODO: validation?


Use validateAllProps helper. Extend mini-framework if needed.

Note, this is relatively new. We should add this to the design guide.

packages/@aws-cdk/aws-vpclattice-alpha/lib/service-network.ts

mrgrain · 2025-07-24T13:20:27Z

packages/@aws-cdk/aws-vpclattice-alpha/lib/service-network.ts

+      authType: props.authType,
+      name: props.serviceNetworkName,
+      sharingConfig: {
+        enabled: props.enableSharing ?? false,


Side note: we probably should have a centralized way to apply defaults to input props.

mrgrain · 2025-07-24T13:23:35Z

packages/@aws-cdk/aws-vpclattice-alpha/lib/service.ts

+   *
+   * @default - No hosted zone ID
+   */
+  readonly hostedZoneId?: string;


Not IHostedZone?

Should the whole of DnsEntry just be a hosted zone?

mrgrain · 2025-07-24T13:24:31Z

packages/@aws-cdk/aws-vpclattice-alpha/lib/service.ts

+/**
+ * DNS entry information for a VPC Lattice service
+ */
+export interface DnsEntry {


Side note: an interface with all optional props always raises questions for me. What happens if an empty object is provided? Is this a mutex?

mrgrain · 2025-07-24T13:25:14Z

packages/@aws-cdk/aws-vpclattice-alpha/lib/service.ts

+   * The VPC lattice service ID
+   */
+  // TODO: restore ID? Constructing the ARN from the ID will need accountId, region, etc
+  // readonly serviceId: string;


see other comment

mrgrain · 2025-07-24T13:26:10Z

packages/@aws-cdk/aws-vpclattice-alpha/lib/service.ts

+   * @returns An object representing the imported VPC Lattice service.
+   */
+  public static fromServiceAttributes(scope: Construct, id: string, attrs: ServiceAttributes): IService {
+    class UnownedServiceReference extends ServiceBase {


Nice! Unowned might be to technical, certainly love the Reference part. Whatever we land on, we should update the guide with this.

mrgrain · 2025-07-24T13:31:53Z

packages/@aws-cdk/aws-vpclattice-alpha/lib/service.ts

+    if (props.authType === ServiceAuthType.AWS_IAM && props.authPolicy === undefined) {
+      throw new ValidationError('An auth policy must be provided when the authType is `AWS_IAM`', this);
+    }


this tells me that this should be a single property with a more complex object:

/** * The authentication type for the service * * @default ServiceAuth.NONE */ readonly auth: ServiceAuth;

class ServiceAuth { public static NONE = new ServiceAuth('NONE'); public static iam(policy: PolicyDocument): ServiceAuth { return new ServiceAuth('IAM', { authPolicy: policy, ); } private constructor() { ... } }

There are plenty of examples around this in the code base. But needs a better example in the design guidelines
https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#enums

vishaalmehrishi added 2 commits July 24, 2025 11:48

feat: WIP initial ServiceNetwork and Service constructs

2a0f372

chore: config file updates

231075d

aws-cdk-automation requested a review from a team July 24, 2025 13:01

github-actions bot added the p2 label Jul 24, 2025

vishaalmehrishi requested a review from mrgrain July 24, 2025 13:02

mergify bot added the contribution/core This is a PR that came from AWS. label Jul 24, 2025

aws-cdk-automation requested changes Jul 24, 2025

View reviewed changes

vishaalmehrishi commented Jul 24, 2025

View reviewed changes

vishaalmehrishi added the pr/do-not-merge This PR should not be merged at this time. label Jul 24, 2025

mrgrain reviewed Jul 24, 2025

View reviewed changes

packages/@aws-cdk/aws-vpclattice-alpha/lib/service-network.ts Show resolved Hide resolved

mrgrain reviewed Jul 24, 2025

View reviewed changes

packages/@aws-cdk/aws-vpclattice-alpha/lib/service-network.ts

// TODO: validation?

// TODO: tags

Copy link

Contributor

mrgrain Jul 24, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rix0rrr

mrgrain reviewed Jul 24, 2025

View reviewed changes

packages/@aws-cdk/aws-vpclattice-alpha/lib/service-network.ts Show resolved Hide resolved

mrgrain reviewed Jul 24, 2025

View reviewed changes

feat(vpc-lattice-alpha): initial ServiceNetwork and Service L2 constructs #35055

Are you sure you want to change the base?

feat(vpc-lattice-alpha): initial ServiceNetwork and Service L2 constructs #35055

Uh oh!

Conversation

vishaalmehrishi commented Jul 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aws-cdk-automation commented Jul 24, 2025

AWS CodeBuild CI Report

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mrgrain Jul 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

vishaalmehrishi commented Jul 24, 2025 •

edited

Loading

mrgrain Jul 24, 2025 •

edited

Loading