(aws-ec2): VpcEndpointService allowedPrincipals has type of ArnPrincipal[], but should also support the ServicePrincipal type

[7e11]

Describe the bug

VpcEndpointService has the member allowedPrincipals which is of type ArnPrincipal[]. However, if you use the AWS console, allowlisting a service principal is supported as well. Users are not able to use the type ServicePrincipal in allowedPrincipals in CDK. This is a feature gap.

packages/aws-cdk-lib/aws-ec2/lib/vpc-endpoint-service.ts

Expected Behavior

VpcEndpointService allowedPrincipals should support ArnPrincipal as well as ServicePrincipal.

Current Behavior

VpcEndpointService allowedPrincipals only supports ArnPrincipal.

Reproduction Steps

const privateLinkVPCEService = new VpcEndpointService(this, 'PrivateLinkVPCEService', {
  vpcEndpointServiceLoadBalancers: [privateLinkNlb],
  acceptanceRequired: false,
  allowedPrincipals: [new ServicePrincipal('someservice.aws.internal'),  // <-- type error. Only ArnPrincipal[] allowed.
});

Possible Solution

Modify the VpcEndpointService construct to support ServicePrincipal as well as ArnPrincipal for the member allowedPrincipals

Additional Information/Context

For context, this is an AWS internal service which is onboarding to privatelink, and only wants to allowlist specific service principals. This is possible in the console, but not in CDK.

---

There is a workaround I've been using, but it's a little janky. It's possible to pass in a service principal to the allowedPrincipals by wrapping it in the ArnPrincipal type. For example:

new ArnPrincipal('someservice.aws.internal');

You could also use L1 constructs, but that gets painful if you're using VpcEndpointServiceDomainName, because there is no corresponding L1 construct and it's nontrivial.

CDK CLI Version

2.130.0 (build bd6e5ee)

Framework Version

2.130.0

Node.js Version

v16.7.0

OS

macOS Ventura 13.6.4

Language

TypeScript

Language Version

No response

Other information

No response

[7e11]

This is what the VPCE principal allowlisting page looks like in the console. It also claims to only accept ARNs, but service principals also work.

[7e11]

Here's a redacted service principle in the "Allow Principles" list after adding it in the above UI. The type is listed as Service, instead of Arn.

[pahud]

The principals passed in will generate AllowedPrincipals in VPCEndpointServicePermissions, which literally accept any format of principals.

aws-cdk/packages/aws-cdk-lib/aws-ec2/lib/vpc-endpoint-service.ts

Lines 127 to 130 in 87139ab

	new CfnVPCEndpointServicePermissions(this, 'Permissions', {
	serviceId: this.endpointService.ref,
	allowedPrincipals: this.allowedPrincipals.map(x => x.arn),
	});

We can't make it either ArnPrincipal type or ServicePrincipal type in CDK. I guess we need to document what we should do when we are assigning a service principal to it. And it could be the workaround you provided.

I'll request the team for more input on this. And let me know if you have any further thoughts.

[GavinZZ]

Hi @7e11, after investigation, I think you're right that although the documentation specifically mentions arn principal, the console doesn't stop you from using service principals. I agree with Pahud's suggestion on adding the workaround to README documentation.

Since this is an issue with potential workaround, I think marking this issue as p2 is reasonable here, and unfortunately we won't be able to prioritize working on a p2 issue. Meanwhile we welcome community contribution and it will be appreciated if you'll be able to make the documentation update.

[7e11]

Gotcha -- so because using SPs is a bit of an undocumented feature, we can't alter the construct to accept other principal types. I'll update the readme soon.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.