feat: add support to Subnet and VPC L2 constructs for deploying to an Outpost

[RyanFrench]

Issue # (if applicable)

Closes #33542.

Reason for this change

This PR extends the L2 VPC Construct to allow developers to provision a VPC that extends the Subnets onto an Outpost, and provides simplified configuration of the routing via the Local Gateway (on-premise router) or NAT/Internet Gateway (in-region routers)

Description of changes

This PR changes the VPC and Subnet L2 constructs with new subnet types, adds additional configuration options to the SubnetConfig in the VPC construct, and changes the default route setup based on the SubnetConfig.

Describe any new or updated permissions being added

None

Description of how you validated changes

We have written tests covering the new configuration options for subnets, as well as validated that this worked by deploying a VPC to an account with an Outpost attached, using the example code in the original Issue.

Example usage for deploying a VPC with on-premise networking routing traffic via the Local Gateway

const vpcCidr = this.node.tryGetContext("vpcCidr");
const outpostAvailabilityZone = this.node.tryGetContext("outpostAvailabilityZone");
const outpostArn = this.node.tryGetContext("outpostArn");
const localGatewayId = this.node.tryGetContext("localGatewayId");
const localGatewayRouteTableId = this.node.tryGetContext("localGatewayRouteTableId");
new ec2.Vpc(this, "OutpostVPC", {
    cidr: vpcCidr,
    maxAzs: 2,
    localGatewayRouteTableIds: [localGatewayRouteTableId],
    subnetConfiguration: [
        {
            cidrMask: 26,
            name: "Public",
            subnetType: ec2.SubnetType.PUBLIC,
        },
        {
            cidrMask: 26,
            name: "Private",
            subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
        },
        {
            cidrMask: 26,
            name: "OutpostPublic",
            outpostArn,
            outpostAvailabilityZone: outpostAvailabilityZone,
            outpostDefaultRoute: ec2.OutpostDefaultRoute.ON_PREMISE,
            localGatewayId: localGatewayId,
            subnetType: ec2.SubnetType.PUBLIC_OUTPOST,
        },
        {
            cidrMask: 26,
            name: "OutpostPrivate",
            outpostArn,
            outpostAvailabilityZone: outpostAvailabilityZone,
            outpostDefaultRoute: ec2.OutpostDefaultRoute.ON_PREMISE,
            localGatewayId: localGatewayId,
            subnetType: ec2.SubnetType.PRIVATE_OUTPOST_WITH_EGRESS,
        },
    ],
});

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

The pull request linter fails with the following errors:

❌ Features must contain a change to an integration test file and the resulting snapshot.
❌ CLI code has changed. A maintainer must run the code through the testing pipeline (git fetch origin pull/33545/head && git push -f origin FETCH_HEAD:test-main-pipeline), then add the 'pr-linter/cli-integ-tested' label when the pipeline succeeds.

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

[RyanFrench]

Exemption Request - I have some Integ tests that I can add, however, they will always fail unless the account has an Outpost attached to it, and the test is able to dynamically find the correct values for OutpostARN, Local Gateway ID, Local Gateway Route Table ID, and the CIDR range associated with the ServiceLink. Some of these values cannot be programatically determined.

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 8db364e
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository