fix(elasticache): security group for ServerlessCache does not use default endpoint port

[go-to-k]

Issue # (if applicable)

N/A

Reason for this change

A security group ingress for the new ServerlessCache construct does not use an endpoint port.

The following CDK code generates an INVALID CFn template with null for FromPort and ToPort:

    const cache = new ServerlessCache(this, 'ServerlessCache', {
      vpc,
    });
    const sg = new SecurityGroup(this, 'SecurityGroup', {
      vpc,
    });
    sg.connections.allowToDefaultPort(cache);

  "SecurityGroupfromawscdkserverlesscacheClientSG6D18D5F9IndirectPortFE633A67": {
   "Type": "AWS::EC2::SecurityGroupIngress",
   "Properties": {
    // ...
    // ...
    "FromPort": null,
    // ...
    // ...
    "ToPort": null
   },

An expected template:

  "SecurityGroupfromawscdkserverlesscacheClientSG6D18D5F9IndirectPortFE633A67": {
   "Type": "AWS::EC2::SecurityGroupIngress",
   "Properties": {
    // ...
    // ...
    "FromPort": {
     "Fn::GetAtt": [
      "Cache18F6EE16",
      "Endpoint.Port"
     ]
    },
    // ...
    // ...
    "ToPort": {
     "Fn::GetAtt": [
      "Cache18F6EE16",
      "Endpoint.Port"
     ]
    }
   }
  },

FYI: The method cache.connections.defaultPort?.toRuleJson() outputs {"Value":{"ipProtocol":"tcp","fromPort":null,"toPort":null}}. But we expect {"Value":{"ipProtocol":"tcp","fromPort":{"Fn::GetAtt":["Cache18F6EE16","Endpoint.Port"]},"toPort":{"Fn::GetAtt":["Cache18F6EE16","Endpoint.Port"]}}}.

Description of changes

Use Token.asNumber for the defaultPort of Connections in ServerlessCache:

    this.connections = new ec2.Connections({
      securityGroups: this.securityGroups,
-      defaultPort: ec2.Port.tcp(Lazy.number({ produce: () => parseInt(this.serverlessCacheEndpointPort) })),
+      defaultPort: ec2.Port.tcp(Token.asNumber(this.serverlessCacheEndpointPort)),
    });

Describe any new or updated permissions being added

Description of how you validated changes

Both an unit test and an integ test.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[mazyu36]

Thank you for the fix!