AWS CDK：如何在另一个账户中访问 VPC

Question

I need access to resources in my staging/prod accounts' VPC from my "tools" account (I have an RDS instance sitting in each of both VPCs and want to automate schema upgrades as part of my CI/CD).

How can I import a VPC from the staging/prod account within a stack in the "tools" accounts?

Vpc.fromLookup() does not work since it searches for VPCs in the stack's region and account, but not in other regions/accounts.

EDIT:

I want to give a CodeBuild project (part of a CodePipeline) in the "tools" account access to the RDS instance in the VPC of the prod/staging accounts. To give it access, I use the vpc attribute on the CodeBuild project.

I'm not sure what's the best way to tackle schema upgrades using CodePipeline/CodeBuild. Ideally, the RDS instance should be sitting in a private/isolated subnet.

const dbMigrateBuild = new codebuild.PipelineProject(this, 'MigrateBuild', {
  buildSpec: codebuild.BuildSpec.fromSourceFilename('buildspec-migrate.yml'),
  environment: {
    buildImage: codebuild.LinuxBuildImage.STANDARD_4_0,
  },
  environmentVariables: {
    migrationBucketId: {
      type: codebuild.BuildEnvironmentVariableType.PLAINTEXT,
      value: sourceOutput.bucketName,
    },
    dbEndpoint: {
      type: codebuild.BuildEnvironmentVariableType.PLAINTEXT,
      value: dbEndpoint,
    },
    dbSecretId: {
      type: codebuild.BuildEnvironmentVariableType.PLAINTEXT,
      value: dbSecretId,
    },
  },
  vpc: ec2.Vpc.fromLookup(this, 'Vpc', { vpcId }), // <-- this is not working
});

// dbMigrateBuild.connections.allowToDefaultPort(db); // how to grant permission ??

const dbMigrateAction = new codepipeline_actions.CodeBuildAction({
  actionName: 'Db_Migrate',
  project: dbMigrateBuild,
  input: sourceOutput,
  runOrder: 130,
});

Answer 1

For this you would need to do one of the following:

• Assume a role from the "other account".
• Use the credentials from assuming this role to retrieve your values, by performing an export of the variables on the CLI.

This has to be performed before you run the cdk commands, using the sts assume-role command.