feat(ec2): support PrefixList.fromLookup()

[Tietew]

Issue # (if applicable)

Closes #33606.
Closes #15115.

Reason for this change

AWS-managed prefix lists are useful to control traffic VPC and AWS managed services.
The name of the AWS-managed prefix list is documented but the id should be copy&paste by hand.

Description of changes

This PR implements PrefixList.fromLookup() to look up an existing managed prefix list by name.

ec2.PrefixList.fromLookup(this, 'CloudFrontOriginFacing', {
  prefixListName: 'com.amazonaws.global.cloudfront.origin-facing',
});

Uses the new CloudControl context provider: aws/aws-cdk-cli#138 and cdklabs/cloud-assembly-schema#124.

Describe any new or updated permissions being added

Nothing.

Description of how you validated changes

Added unit tests and an integ test.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

[Tietew]

Verified CloudControl context provider works:

import * as cxschema from '@aws-cdk/cloud-assembly-schema';
import { Toolkit } from '@aws-cdk/toolkit-lib';
import * as cdk from 'aws-cdk-lib';

(async () => {
  const toolkit = new Toolkit({ sdkConfig: { profile: 'sandbox' } });
  const cx = await toolkit.fromAssemblyBuilder(async () => {
    const app = new cdk.App();
    const stack = new cdk.Stack(app, 'Stack', { env: { region: 'us-east-1', account: 'ACCOUNT-ID' } });

    const responses = cdk.ContextProvider.getValue(stack, {
      provider: cxschema.ContextProvider.CC_API_PROVIDER,
      props: {
        typeName: 'AWS::EC2::PrefixList',
        propertyMatch: {
          PrefixListName: 'com.amazonaws.global.cloudfront.origin-facing',
        },
        propertiesToReturn: ['PrefixListId'],
      },
      dummyValue: [{ PrefixListId: 'pl-xxxxxxxx' }],
    }).value;

    new cdk.CfnOutput(stack, 'PrefixListId', {
      value: responses[0].PrefixListId,
    });

    return app.synth();
  });

  const cxSnap = await toolkit.synth(cx);
  const assembly = await cxSnap.produce();
  const template = assembly.getStackByName('Stack').template;

  const { Outputs } = template;
  console.log(JSON.stringify({ Outputs }, undefined, 2));
})().catch(console.error);

$ yarn ts-node --prefer-ts-exts cc-api-test.ts
✨  Synthesis time: 3.87s
Successfully synthesized to /tmp/cdk.out8jL5HY
{
  "Outputs": {
    "PrefixListId": {
      "Value": "pl-3b927c52"
    }
  }
}
$ aws --profile sandbox --region us-east-1 ec2 describe-managed-prefix-lists --prefix-list-ids pl-3b927c52
{
    "PrefixLists": [
        {
            "PrefixListId": "pl-3b927c52",
            "AddressFamily": "IPv4",
            "State": "create-complete",
            "PrefixListArn": "arn:aws:ec2:us-east-1:aws:prefix-list/pl-3b927c52",
            "PrefixListName": "com.amazonaws.global.cloudfront.origin-facing",
            "Tags": [],
            "OwnerId": "AWS"
        }
    ]
}

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 82.37%. Comparing base (7fe033a) to head (7d4b1ce).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #33619   +/-   ##
=======================================
  Coverage   82.37%   82.37%           
=======================================
  Files         120      120           
  Lines        6933     6933           
  Branches     1169     1169           
=======================================
  Hits         5711     5711           
  Misses       1119     1119           
  Partials      103      103           

Flag	Coverage Δ
suite.unit	82.37% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	∅ <ø> (∅)
packages/aws-cdk-lib/core	82.37% <ø> (ø)

🚀 New features to boost your workflow:

• ❄ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Tietew]

#33617 allows this line to be changed to

alb.connections.allowFrom(cfOriginFacing, ec2.Port.HTTP);

[badmintoncryer]

Thank you for your contribution! The implementation details were very informative for me!

[shikha372]

I see in the documentation that it says prefix list name cannot start with, does it affect the request being sent to CCAPI.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-prefixlist.html#cfn-ec2-prefixlist-prefixlistname

The name cannot start with com.amazonaws.

[Tietew]

fromLookup() is used to lookup an existing managed prefix list, including an AWS-managed prefix list which name starts with com.amazonaws..

The documentation just says we users cannot create.

I confirmed the CC API ContextProvider can query an AWS-managed prefix list, see #33619 (comment)

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
• Commit ID: 7d4b1ce
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository