aws-ec2: missing props in VpnConnection L2 construct

[garysassano]

Describe the bug

The current VpnConnection L2 construct lacks critical configuration options, forcing you to resort to using the L1 CfnVPNConnection.

Specifically:

• The tunnel type defaults to Static, with no option to set it to Dynamic.
• There's no way to configure Phase 1 and Phase 2 settings for tunnels in VpnTunnelOption.

These limitations significantly restrict the usability of the VpnConnection construct for more advanced VPN setups.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Version

No response

Expected Behavior

See above.

Current Behavior

See above.

Reproduction Steps

See above.

Possible Solution

No response

Additional Information/Context

No response

CDK CLI Version

2.172.0

Framework Version

No response

Node.js Version

22.11.0

OS

Ubuntu 24.04

Language

TypeScript

Language Version

No response

Other information

No response

[ashishdhingra]

AWS::EC2::VPNConnection VpnTunnelOptionsSpecification and CfnVPNConnection does support bunch of properties which are missing from VpnConnection L2 construct.

@garysassano Good afternoon. Thanks for opening the issue. As a workaround, you could use escape hatch to set missing properties on VpnConnection L2 construct. For the issue you mentioned The tunnel type defaults to Static, with no option to set it to Dynamic., could you please share more details, including reference to CloudFormation documentation (there is a Type for AWS::EC2::VPNConnection resource which allows only one value ipsec.1).

And as always, community contributed PR is welcome. :)

Thanks,
Ashish

[garysassano]

I'm not sure about the equivalent CloudFormation property, but I was referring to the Routing options setting available when creating a new VPN connection through the AWS Console. This setting is permanent: once you make a choice, you must delete the existing VPN connection and create a new one if you wish to change it.

[phuhung273]

This line shows that we can indirectly set VpnConnection as Dynamic by not passing staticRoutes

aws-cdk/packages/aws-cdk-lib/aws-ec2/lib/vpn.ts

Line 355 in ff57cc3

staticRoutesOnly: props.staticRoutes ? true : false,