feat(ec2): add support for vpc endpoints

packages/@aws-cdk/aws-autoscaling/lib/auto-scaling-group.ts

@@ -292,7 +292,7 @@ export class AutoScalingGroup extends cdk.Construct implements IAutoScalingGroup
     };
 
     if (!props.vpc.isPublicSubnets(subnetIds) && props.associatePublicIpAddress) {
-      throw new Error("To set 'associatePublicIpAddress: true' you must select Public subnets (vpcSubnets: { subnetType: SubnetType.Public })");
+      throw new Error("To set 'associatePublicIpAddress: true' you must select Public subnets (vpcSubnets: { subnetTypes: [SubnetType.Public] })");
     }
 
     this.autoScalingGroup = new CfnAutoScalingGroup(this, 'ASG', asgProps);

packages/@aws-cdk/aws-autoscaling/test/test.auto-scaling-group.ts

@@ -419,7 +419,7 @@ export = {
       maxCapacity: 0,
       desiredCapacity: 0,
 
-      vpcSubnets: { subnetType: ec2.SubnetType.Public },
+      vpcSubnets: { subnetTypes: [ec2.SubnetType.Public] },
       associatePublicIpAddress: true,
     });
 

packages/@aws-cdk/aws-codebuild/lib/project.ts

@@ -872,9 +872,6 @@ export class Project extends ProjectBase {
       });
       this._securityGroups = [securityGroup];
     }
-    const subnetSelection: ec2.SubnetSelection = props.subnetSelection ? props.subnetSelection : {
-      subnetType: ec2.SubnetType.Private
-    };
     this.addToRoleInlinePolicy(new iam.PolicyStatement()
       .addAllResources()
       .addActions(
@@ -897,7 +894,7 @@ export class Project extends ProjectBase {
       .addAction('ec2:CreateNetworkInterfacePermission'));
     return {
       vpcId: props.vpc.vpcId,
-      subnets: props.vpc.subnetIds(subnetSelection).map(s => s),
+      subnets: props.vpc.subnetIds(props.subnetSelection),
       securityGroupIds: this._securityGroups.map(s => s.securityGroupId)
     };
   }

packages/@aws-cdk/aws-ec2/README.md

@@ -399,3 +399,10 @@ const vpnConnection = vpc.addVpnConnection('Dynamic', {
 });
 const state = vpnConnection.metricTunnelState();
 ```
+
+### VPC endpoints
+A VPC endpoint enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by PrivateLink without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC do not require public IP addresses to communicate with resources in the service. Traffic between your VPC and the other service does not leave the Amazon network.
+
+Endpoints are virtual devices. They are horizontally scaled, redundant, and highly available VPC components that allow communication between instances in your VPC and services without imposing availability risks or bandwidth constraints on your network traffic.
+
+[example of setting up VPC endpoints](test/integ.vpc-endpoint.lit.ts)

packages/@aws-cdk/aws-ec2/lib/index.ts

@@ -7,6 +7,7 @@ export * from './vpc';
 export * from './vpc-ref';
 export * from './vpc-network-provider';
 export * from './vpn';
+export * from './vpc-endpoint';
 
 // AWS::EC2 CloudFormation Resources:
 export * from './ec2.generated';