fix(route53): add vpce:AllowMultiRegion permission to VpcEndpointServiceDomainName

When using VpcEndpointServiceDomainName with a VpcEndpointService that has
cross-region PrivateLink enabled via allowedRegions, the custom resource
Lambda fails because the IAM policy is missing the vpce:AllowMultiRegion
permission.

This change updates the EnableDns custom resource to use an explicit policy
with both ec2:ModifyVpcEndpointServiceConfiguration and vpce:AllowMultiRegion
permissions, scoped to the specific VPC endpoint service resource.

Fixes #36216

Author: Tiago Queiroz

packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.vpc-endpoint-service-domain-name.js.snapshot/AwsCdkVpcEndpointDnsIntegTestDefaultTestDeployAssertFB27EF1F.assets.json

@@ -481,7 +481,10 @@
     "PolicyDocument": {
      "Statement": [
       {
-       "Action": "ec2:ModifyVpcEndpointServiceConfiguration",
+       "Action": [
+        "ec2:ModifyVpcEndpointServiceConfiguration",
+        "vpce:AllowMultiRegion"
+       ],
        "Effect": "Allow",
        "Resource": {
         "Fn::Join": [

packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.vpc-endpoint-service-domain-name.js.snapshot/AwsCdkVpcEndpointDnsIntegTestDefaultTestDeployAssertFB27EF1F.template.json

@@ -1,5 +1,6 @@
 import { Construct } from 'constructs';
 import { IVPCEndpointServiceRef } from '../../aws-ec2';
+import * as iam from '../../aws-iam';
 import { Fn, Names, Stack } from '../../core';
 import { ValidationError } from '../../core/lib/errors';
 import { md5hash } from '../../core/lib/helpers-internal';
@@ -109,25 +110,28 @@ export class VpcEndpointServiceDomainName extends Construct {
         RemovePrivateDnsName: true,
       },
     };
+    const serviceArn = Fn.join(':', [
+      'arn',
+      Stack.of(this).partition,
+      'ec2',
+      Stack.of(this).region,
+      Stack.of(this).account,
+      Fn.join('/', ['vpc-endpoint-service', serviceId]),
+    ]);
+
     const enable = new AwsCustomResource(this, 'EnableDns', {
       onCreate: enablePrivateDnsAction,
       onUpdate: enablePrivateDnsAction,
       onDelete: removePrivateDnsAction,
-      policy: AwsCustomResourcePolicy.fromSdkCalls({
-        resources: [
-          Fn.join(':', [
-            'arn',
-            Stack.of(this).partition,
-            'ec2',
-            Stack.of(this).region,
-            Stack.of(this).account,
-            Fn.join('/', [
-              'vpc-endpoint-service',
-              serviceId,
-            ]),
-          ]),
-        ],
-      }),
+      policy: AwsCustomResourcePolicy.fromStatements([
+        new iam.PolicyStatement({
+          actions: [
+            'ec2:ModifyVpcEndpointServiceConfiguration',
+            'vpce:AllowMultiRegion',
+          ],
+          resources: [serviceArn],
+        }),
+      ]),
       // APIs are available in 2.1055.0
       installLatestAwsSdk: false,
     });

packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.vpc-endpoint-service-domain-name.js.snapshot/asset.c11608a15785084ea1afe65826e575ee316add10c8b1bb373e93297e26aec564.bundle/index.js renamed to packages/@aws-cdk-testing/framework-integ/test/aws-route53/test/integ.vpc-endpoint-service-domain-name.js.snapshot/asset.ca235e6258b11c240506ff06f79037eca461b8d0d9464a947a386d38d8163515.bundle/index.js

@@ -1,4 +1,4 @@
-import { Template } from '../../assertions';
+import { Match, Template } from '../../assertions';
 import { IVpcEndpointServiceLoadBalancer, VpcEndpointService } from '../../aws-ec2';
 import { Stack } from '../../core';
 import { PublicHostedZone, VpcEndpointServiceDomainName } from '../lib';
@@ -278,3 +278,44 @@ test('endpoint domain name property equals input domain name', () => {
   });
   expect(dn.domainName).toEqual('name-test.aws-cdk.dev');
 });
+
+test('EnableDns custom resource policy includes vpce:AllowMultiRegion permission scoped to endpoint service', () => {
+  // GIVEN
+  const testVpces = new VpcEndpointService(stack, 'TestVPCES', {
+    vpcEndpointServiceLoadBalancers: [nlb],
+  });
+
+  // WHEN
+  new VpcEndpointServiceDomainName(stack, 'EndpointDomain', {
+    endpointService: testVpces,
+    domainName: 'my-stuff.aws-cdk.dev',
+    publicHostedZone: zone,
+  });
+
+  // THEN
+  Template.fromStack(stack).hasResourceProperties('AWS::IAM::Policy', {
+    PolicyDocument: {
+      Statement: Match.arrayWith([
+        Match.objectLike({
+          Action: [
+            'ec2:ModifyVpcEndpointServiceConfiguration',
+            'vpce:AllowMultiRegion',
+          ],
+          Effect: 'Allow',
+          Resource: {
+            'Fn::Join': Match.arrayWith([
+              ':',
+              Match.arrayWith([
+                'arn',
+                { Ref: 'AWS::Partition' },
+                'ec2',
+                { Ref: 'AWS::Region' },
+                { Ref: 'AWS::AccountId' },
+              ]),
+            ]),
+          },
+        }),
+      ]),
+    },
+  });
+});