From 855c3f4e4b1e47a23b6acdfca9664900b8178da2 Mon Sep 17 00:00:00 2001
From: jwoehrle <joerg.woehrle@gmail.com>
Date: Tue, 9 Feb 2021 11:24:39 +0100
Subject: [PATCH] fix(ec2): VpnConnection fails if `ip` is a Token (#12923)

Add support to use Token for `VpnConnectionProps.ip` and skip `net.isIPv4(...)` validation in that case.

Fixes issue #11633

----

*By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
---
 packages/@aws-cdk/aws-ec2/lib/vpn.ts       |  2 +-
 packages/@aws-cdk/aws-ec2/test/vpn.test.ts | 22 +++++++++++++++++++++-
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/packages/@aws-cdk/aws-ec2/lib/vpn.ts b/packages/@aws-cdk/aws-ec2/lib/vpn.ts
index 4683180d2af84..19fb4f963acd3 100644
--- a/packages/@aws-cdk/aws-ec2/lib/vpn.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/vpn.ts
@@ -224,7 +224,7 @@ export class VpnConnection extends Resource implements IVpnConnection {
       });
     }
 
-    if (!net.isIPv4(props.ip)) {
+    if (!Token.isUnresolved(props.ip) && !net.isIPv4(props.ip)) {
       throw new Error(`The \`ip\` ${props.ip} is not a valid IPv4 address.`);
     }
 
diff --git a/packages/@aws-cdk/aws-ec2/test/vpn.test.ts b/packages/@aws-cdk/aws-ec2/test/vpn.test.ts
index 72be541bf45e2..4cf8880c3b0ab 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpn.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpn.test.ts
@@ -1,5 +1,5 @@
 import { expect, haveResource } from '@aws-cdk/assert';
-import { Duration, Stack } from '@aws-cdk/core';
+import { Duration, Stack, Token } from '@aws-cdk/core';
 import { nodeunitShim, Test } from 'nodeunit-shim';
 import { PublicSubnet, Vpc, VpnConnection } from '../lib';
 
@@ -322,4 +322,24 @@ nodeunitShim({
     }));
     test.done();
   },
+  'can add a vpn connection with a Token as customer gateway ip'(test:Test) {
+    // GIVEN
+    const stack = new Stack();
+    const token = Token.asAny('192.0.2.1');
+
+    // WHEN
+    new Vpc(stack, 'VpcNetwork', {
+      vpnConnections: {
+        VpnConnection: {
+          ip: token as any,
+        },
+      },
+    });
+
+    // THEN
+    expect(stack).to(haveResource('AWS::EC2::CustomerGateway', {
+      IpAddress: '192.0.2.1',
+    }));
+    test.done();
+  },
 });