WIP: import "from:" methods

packages/@aws-cdk/aws-codepipeline/lib/pipeline.ts

@@ -97,6 +97,14 @@ export interface PipelineProps {
   readonly stages?: StageProps[];
 }
 
+abstract class PipelineBase extends Resource implements IPipeline {
+  public abstract readonly pipelineName: string;
+  public abstract readonly pipelineArn: string;
+  public abstract grantBucketRead(identity: iam.IGrantable): iam.Grant;
+  public abstract grantBucketReadWrite(identity: iam.IGrantable): iam.Grant;
+  public abstract asEventRuleTarget(ruleArn: string, ruleUniqueId: string): events.EventRuleTargetProps;
+}
+
 /**
  * An AWS CodePipeline pipeline with its associated IAM role and S3 bucket.
  *
@@ -116,7 +124,32 @@ export interface PipelineProps {
  *
  * // ... add more stages
  */
-export class Pipeline extends Resource implements IPipeline {
+export class Pipeline extends PipelineBase implements IPipeline {
+
+  public static fromPipelineName(scope: Construct, pipelineName: string): IPipeline {
+    class Import extends PipelineBase {
+      public readonly pipelineName = pipelineName;
+      public readonly pipelineArn = scope.node.stack.formatArn({
+        service: 'codepipeline',
+        resource: pipelineName
+      });
+
+      public grantBucketRead(grantable: iam.IGrantable): iam.Grant {
+
+      }
+
+      public grantBucketReadWrite(grantable: iam.IGrantable): iam.Grant {
+        // drop
+      }
+
+      public asEventRuleTarget(_: string, _: string): events.EventRuleTargetProps {
+        // drop
+      }
+    }
+
+    return new Import(scope, pipelineName);
+  }
+
   /**
    * The IAM role AWS CodePipeline will use to perform actions or assume roles for actions with
    * a more specific IAM role.
@@ -369,9 +402,7 @@ export class Pipeline extends Resource implements IPipeline {
       replicationBucketName = crossRegionScaffoldStack.replicationBucketName;
     }
 
-    const replicationBucket = s3.Bucket.import(this, 'CrossRegionCodePipelineReplicationBucket-' + region, {
-      bucketName: replicationBucketName,
-    });
+    const replicationBucket = s3.Bucket.fromBucketName(this, replicationBucketName);
     replicationBucket.grantReadWrite(this.role);
 
     this.artifactStores[region] = {

packages/@aws-cdk/aws-ec2/lib/index.ts

@@ -4,7 +4,6 @@ export * from './machine-image';
 export * from './security-group';
 export * from './security-group-rule';
 export * from './vpc';
-export * from './vpc-ref';
 export * from './vpc-network-provider';
 export * from './vpn';
 export * from './vpc-endpoint';

packages/@aws-cdk/aws-ec2/lib/security-group.ts

@@ -2,7 +2,7 @@ import { CfnOutput, Construct, IResource, Resource, Token } from '@aws-cdk/cdk';
 import { Connections, IConnectable } from './connections';
 import { CfnSecurityGroup, CfnSecurityGroupEgress, CfnSecurityGroupIngress } from './ec2.generated';
 import { IPortRange, ISecurityGroupRule } from './security-group-rule';
-import { IVpcNetwork } from './vpc-ref';
+import { IVpcNetwork } from './vpc';
 
 const isSecurityGroupSymbol = Symbol.for('aws-cdk:isSecurityGroup');
 
@@ -12,6 +12,11 @@ export interface ISecurityGroup extends IResource, ISecurityGroupRule, IConnecta
    */
   readonly securityGroupId: string;
 
+  /**
+   * VPC ID of this security group. Will be `undefined` for imported security groups.
+   */
+  readonly securityGroupVpcId?: string;
+
   /**
    * Add an ingress rule for the current security group
    *
@@ -37,28 +42,35 @@ export interface ISecurityGroup extends IResource, ISecurityGroupRule, IConnecta
   /**
    * Export the security group
    */
-  export(): SecurityGroupImportProps;
+  export(): SecurityGroupAttrs;
 }
 
-export interface SecurityGroupImportProps {
+export interface SecurityGroupAttrs {
   /**
    * ID of security group
    */
   readonly securityGroupId: string;
+
+  /**
+   * The VPC ID of this security group.
+   */
+  readonly securityGroupVpcId?: string;
 }
 
 /**
  * A SecurityGroup that is not created in this template
  */
-export abstract class SecurityGroupBase extends Resource implements ISecurityGroup {
+abstract class SecurityGroupBase extends Resource implements ISecurityGroup {
   /**
    * Return whether the indicated object is a security group
    */
   public static isSecurityGroup(construct: any): construct is SecurityGroupBase {
-    return (construct as any)[isSecurityGroupSymbol] === true;
+    return isSecurityGroupSymbol in construct;
   }
 
   public abstract readonly securityGroupId: string;
+  public abstract readonly securityGroupVpcId?: string;
+
   public readonly canInlineRule = false;
   public readonly connections: Connections = new Connections({ securityGroups: [this] });
 
@@ -124,7 +136,7 @@ export abstract class SecurityGroupBase extends Resource implements ISecurityGro
   /**
    * Export this SecurityGroup for use in a different Stack
    */
-  public abstract export(): SecurityGroupImportProps;
+  public abstract export(): SecurityGroupAttrs;
 }
 
 /**
@@ -241,11 +253,28 @@ export interface SecurityGroupProps {
  * the template).
  */
 export class SecurityGroup extends SecurityGroupBase {
+
+  public static fromSecurityGroupId(scope: Construct, securityGroupId: string): ISecurityGroup {
+    return this.fromSecurityGroupAttributes(scope, securityGroupId, { securityGroupId });
+  }
+
   /**
    * Import an existing SecurityGroup
    */
-  public static import(scope: Construct, id: string, props: SecurityGroupImportProps): ISecurityGroup {
-    return new ImportedSecurityGroup(scope, id, props);
+  public static fromSecurityGroupAttributes(scope: Construct, id: string, attrs: SecurityGroupAttrs): ISecurityGroup {
+    class Import extends SecurityGroupBase {
+      get securityGroupId() { return attrs.securityGroupId; }
+      get securityGroupVpcId() { return attrs.securityGroupVpcId; }
+
+      public export(): SecurityGroupAttrs {
+        return {
+          securityGroupId: attrs.securityGroupId,
+          securityGroupVpcId: attrs.securityGroupVpcId
+        };
+      }
+    }
+
+    return new Import(scope, id);
   }
 
   /**
@@ -263,6 +292,8 @@ export class SecurityGroup extends SecurityGroupBase {
    */
   public readonly securityGroupId: string;
 
+  public readonly securityGroupVpcId?: string;
+
   private readonly securityGroup: CfnSecurityGroup;
   private readonly directIngressRules: CfnSecurityGroup.IngressProperty[] = [];
   private readonly directEgressRules: CfnSecurityGroup.EgressProperty[] = [];
@@ -285,6 +316,8 @@ export class SecurityGroup extends SecurityGroupBase {
     });
 
     this.securityGroupId = this.securityGroup.securityGroupId;
+    this.securityGroupVpcId = this.securityGroup.securityGroupVpcId;
+
     this.groupName = this.securityGroup.securityGroupName;
     this.vpcId = this.securityGroup.securityGroupVpcId;
 
@@ -294,7 +327,7 @@ export class SecurityGroup extends SecurityGroupBase {
   /**
    * Export this SecurityGroup for use in a different Stack
    */
-  public export(): SecurityGroupImportProps {
+  public export(): SecurityGroupAttrs {
     return {
       securityGroupId: new CfnOutput(this, 'SecurityGroupId', { value: this.securityGroupId }).makeImportValue().toString()
     };
@@ -489,23 +522,6 @@ export interface ConnectionRule {
   readonly description?: string;
 }
 
-/**
- * A SecurityGroup that hasn't been created here
- */
-class ImportedSecurityGroup extends SecurityGroupBase {
-  public readonly securityGroupId: string;
-
-  constructor(scope: Construct, id: string, private readonly props: SecurityGroupImportProps) {
-    super(scope, id);
-
-    this.securityGroupId = props.securityGroupId;
-  }
-
-  public export() {
-    return this.props;
-  }
-}
-
 /**
  * Compare two ingress rules for equality the same way CloudFormation would (discarding description)
  */

packages/@aws-cdk/aws-ec2/lib/util.ts

@@ -1,6 +1,6 @@
 import cdk = require('@aws-cdk/cdk');
 import { VpcSubnet } from './vpc';
-import { IVpcSubnet, SubnetType } from "./vpc-ref";
+import { IVpcSubnet, SubnetType } from "./vpc";
 
 /**
  * Turn an arbitrary string into one that can be used as a CloudFormation identifier by stripping special characters