[aws-eks] Construct Library custom resources can't be used within vpc

[oleksii-boiko-ua]

When we use construct library, it creates lambda functions which are not inside vpc, i would like to have this ability to define it

Use Case

We have strict policy in our company to have all lambda functions attached to the vpc

Proposed Solution

Other

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[oleksii-boiko-ua]

Sorry maybe i was not precise. Not sure why topic was changed as it relates not only to eks but to all custom resources of AWS CDK. For example, I want to create eks cluster with kubectl_enabled=True, code:

    # Control plane
    self.cluster = aws_eks.Cluster(
        scope=self,
        id='cluster',
        cluster_name="cluster-" + environment,
        kubectl_enabled=True
        default_capacity=0,
        vpc=vpc,
        vpc_subnets=[aws_ec2.SubnetSelection(subnets=[subnet_a_eks, subnet_b_eks, subnet_c_eks])],
        version=cluster_version,
        security_group=eks_control_plane_sg,
        role=eks_control_plane_role,
    )

AWS CDK is going to create custom resources(lambda functions) to interact with cluster but this lambda functions are not going to be inside vpc. And we can't use it. We need way to redefine this functions. The main problem that most of enterprise companies will face same problem eventually as most of them use lambda function only within vpc. also would be nice to be able to define proxy for lambda functions as aws doesn't have vpc endpoints for all api's

[oleksii-boiko-ua]

I also created ticket to AWS Premiums Support (Case ID 7252363561). this issue blocks us to use AWS CDK for our huge infrastructure

[oleksii-boiko-ua]

also by not allowing to set kubectl_enabled=False(we don't want rely on deprecated code you proposed), we lose ability even to test without all that nice features that construct provides

[iliapolo]

This PR has a PoC implementation for this ability, we made sure supporting can work without requiring cluster replacement.

Therefore it is no longer scheduled for the upcoming milestone, but will be considered for the next one.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.