AWS CDK: NaN.NaN.NaN.NaN 在创建客户端 VPN 端点时不是有效的 IP 地址

huangapple
go评论112阅读模式
英文:

AWS CDK: NaN.NaN.NaN.NaN is not a valid IP Address when creating Client VPN Endpoint

问题

当尝试创建客户端 VPN 资源时，我遇到以下错误：

  1. Error: NaN.NaN.NaN.NaN 不是有效的 IP 地址
  2.       at NetworkUtils.numToIp (C:\Users\user\AppData\Local\Temp\jsii-kernel-mj0Ij1\node_modules\aws-cdk-lib\aws-ec2\lib\network-util.js:80:19)
  3.       at CidrBlock.minIp (C:\Users\user\AppData\Local\Temp\jsii-kernel-mj0Ij1\node_modules\aws-cdk-lib\aws-ec2\lib\network-util.js:202:29)
  4.       at new CidrBlock (C:\Users\user\AppData\Local\Temp\jsii-kernel-mj0Ij1\node_modules\aws-cdk-lib\aws-ec2\lib\network-util.js:189:29)
  5.       at new ClientVpnEndpoint (C:\Users\user\AppData\Local\Temp\jsii-kernel-mj0Ij1\node_modules\aws-cdk-lib\aws-ec2\lib\client-vpn-endpoint.js:133:29)
  7. 上述异常是以下异常的直接原因：
  9. Traceback (most recent call last):
  10.   File "C:\Users\user\cdk\networking\client_vpn_stack.py", line 95, in __init__        
  11.     client_vpn = ec2.ClientVpnEndpoint(
  12.                  ^^^^^^^^^^^^^^^^^^^^^^

这是代码（所有其他资源，如 VPC，都在代码中较早地创建）：

  1. from aws_cdk import aws_ec2 as ec2
  3. client_vpn = ec2.ClientVpnEndpoint(
  4.     self,
  5.     id='ClientVPNEndpoint',
  6.     description=f'Client VPN in VPC - {vpc.attr_vpc_id}',
  8.     # Networking
  9.     split_tunnel=True,
  10.     cidr='172.16.0.0/16',
  11.     vpc=vpc,
  12.     port=ec2.VpnPort.HTTPS,
  13.     session_timeout=ec2.ClientVpnSessionTimeout.TEN_HOURS,
  15.     # Security
  16.     server_certificate_arn=f'arn:aws:acm:eu-west-1:{self.account}:certificate/{certificate_id}',
  17.     security_groups=[sg],
  18.     user_based_authentication=ec2.ClientVpnUserBasedAuthentication.federated(
  19.         saml_provider=saml_provider
  20.     )
  21. )

我能想到的唯一 IP 地址是 CIDR，但根据文档，它们期望的 CIDR 块格式应为 X.X.X.X/X。

我尝试用其他值替换 CIDR，但没有帮助...

有人可以帮我看看这里缺少什么吗？

提前感谢。

英文:

When trying to create a client vpn resource, I get the following error:

  1. Error: NaN.NaN.NaN.NaN is not a valid IP Address
  2.       at NetworkUtils.numToIp (C:\Users\user\AppData\Local\Temp\jsii-kernel-mj0Ij1\node_modules\aws-cdk-lib\aws-ec2\lib\network-util.js:80:19)
  3.       at CidrBlock.minIp (C:\Users\user\AppData\Local\Temp\jsii-kernel-mj0Ij1\node_modules\aws-cdk-lib\aws-ec2\lib\network-util.js:202:29)
  4.       at new CidrBlock (C:\Users\user\AppData\Local\Temp\jsii-kernel-mj0Ij1\node_modules\aws-cdk-lib\aws-ec2\lib\network-util.js:189:29)
  5.       at new ClientVpnEndpoint (C:\Users\user\AppData\Local\Temp\jsii-kernel-mj0Ij1\node_modules\aws-cdk-lib\aws-ec2\lib\client-vpn-endpoint.js:133:29)
  7. The above exception was the direct cause of the following exception:
  9. Traceback (most recent call last):
  10.   File "C:\Users\user\cdk\networking\client_vpn_stack.py", line 95, in __init__        
  11.     client_vpn = ec2.ClientVpnEndpoint(
  12.                  ^^^^^^^^^^^^^^^^^^^^^^

This is the code (all the other resources such as the VPC are created earlier in the code):

  1. from aws_cdk import aws_ec2 as ec2
  3. client_vpn = ec2.ClientVpnEndpoint(
  4.     self,
  5.     id='ClientVPNEndpoint',
  6.     description=f'Client VPN in VPC - {vpc.attr_vpc_id}',
  8.     # Networking
  9.     split_tunnel=True,
  10.     cidr='172.16.0.0/16',
  11.     vpc=vpc,
  12.     port=ec2.VpnPort.HTTPS,
  13.     session_timeout=ec2.ClientVpnSessionTimeout.TEN_HOURS,
  15.     # Security
  16.     server_certificate_arn=f'arn:aws:acm:eu-west-1:{self.account}:certificate/{certificate_id}',
  17.     security_groups=[sg],
  18.     user_based_authentication=ec2.ClientVpnUserBasedAuthentication.federated(
  19.         saml_provider=saml_provider
  20.     )
  21. )

The only IP I can think of is the cidr but from the documentation they except a cidr block of the format X.X.X.X/X.

I tried to replace the cidr with other values, but nothing helped...

Can anyone help me what is missing here?

Thanks in advance.

Edit

VPC range: 10.1.0.0/16 (defined in another stack but passed by value in the same app)

I tried using /22 and /16 for the client VPN CIDR block, this didn't change anything.

答案1

得分: 0

我的错误...

使用的vpc变量的类型为ec2.CfnVPC。编译器找不到ec2.IVpc中包含的必需字段，并返回错误。

虽然我应该更仔细地阅读文档，但错误消息并不十分清晰。

这是文档中的构造函数：

  1. class ClientVpnEndpoint(
  2.     scope: Construct,
  3.     id: str,
  4.     *,
  5.     vpc: IVpc,
  6.     cidr: str,
  7.     server_certificate_arn: str,
  8.     authorize_all_users_to_vpc_cidr: bool | None = None,
  9.     client_certificate_arn: str | None = None,
  10.     client_connection_handler: IClientVpnConnectionHandler | None = None,
  11.     client_login_banner: str | None = None,
  12.     description: str | None = None,
  13.     dns_servers: Sequence[str] | None = None,
  14.     logging: bool | None = None,
  15.     log_group: ILogGroup | None = None,
  16.     log_stream: ILogStream | None = None,
  17.     port: VpnPort | None = None,
  18.     security_groups: Sequence[ISecurityGroup] | None = None,
  19.     self_service_portal: bool | None = None,
  20.     session_timeout: ClientVpnSessionTimeout | None = None,
  21.     split_tunnel: bool | None = None,
  22.     transport_protocol: TransportProtocol | None = None,
  23.     user_based_authentication: ClientVpnUserBasedAuthentication | None = None,
  24.     vpc_subnets: SubnetSelection | Dict[str, Any] | None = None
  25. )

如果有兴趣，以下是完整的堆栈：

  1. from aws_cdk import (
  2.     Tags,
  3.     aws_ec2 as ec2,
  4.     aws_iam as iam
  5. )
  7. # Client VPN Endpoint
  8. saml_provider = iam.SamlProvider.from_saml_provider_arn(
  9.     self,
  10.     id='IdP',
  11.     saml_provider_arn=f'arn:aws:iam::{self.account}:saml-provider/{identity_provider_id}'
  12. )
  14. client_vpn = ec2.ClientVpnEndpoint(
  15.     self,
  16.     id='ClientVpn',
  17.     description=f'Client VPN Endpoint',
  19.     # Networking
  20.     vpc=vpc,
  21.     vpc_subnets=ec2.SubnetSelection(
  22.         subnets=clientvpn_subnets
  23.     ),
  24.     cidr=clientvpn_cidr_block,
  25.     port=ec2.VpnPort.HTTPS,
  26.     split_tunnel=True,
  27.     transport_protocol=ec2.TransportProtocol.TCP,
  28.     session_timeout=ec2.ClientVpnSessionTimeout.TEN_HOURS,
  30.     # Security
  31.     server_certificate_arn=f'arn:aws:acm:eu-west-1:{self.account}:certificate/{certificate_id}',
  32.     security_groups=[sg],
  33.     user_based_authentication=ec2.ClientVpnUserBasedAuthentication.federated(
  34.         saml_provider=saml_provider
  35.     ),
  36.     authorize_all_users_to_vpc_cidr=False,
  38.     # Logging
  39.     logging=True,
  40.     log_group=log_group,
  41.     log_stream=log_stream
  42. )
  44. client_vpn.add_authorization_rule(
  45.     id='AuthorizationRule',
  46.     description='Authorize all private ip range to everyone',
  47.     cidr='10.0.0.0/8'
  48. )
英文:

My bad...

The vpc variable in use was of type ec2.CfnVPC. The compiler couldn't find required fields contained in ec2.IVpc and returned an error.
Although I should have read the documentation more carefully, the error message wasn't quite clear.

This is the constructor from the documentation:
> python
> class ClientVpnEndpoint(
> scope: Construct,
> id: str,
> *,
> vpc: IVpc,
> cidr: str,
> server_certificate_arn: str,
> authorize_all_users_to_vpc_cidr: bool | None = None,
> client_certificate_arn: str | None = None,
> client_connection_handler: IClientVpnConnectionHandler | None = None,
> client_login_banner: str | None = None,
> description: str | None = None,
> dns_servers: Sequence[str] | None = None,
> logging: bool | None = None,
> log_group: ILogGroup | None = None,
> log_stream: ILogStream | None = None,
> port: VpnPort | None = None,
> security_groups: Sequence[ISecurityGroup] | None = None,
> self_service_portal: bool | None = None,
> session_timeout: ClientVpnSessionTimeout | None = None,
> split_tunnel: bool | None = None,
> transport_protocol: TransportProtocol | None = None,
> user_based_authentication: ClientVpnUserBasedAuthentication | None = None,
> vpc_subnets: SubnetSelection | Dict[str, Any] | None = None
> )
>

This is the full stack if someone is interested:

  1. from aws_cdk import (
  2.     Tags,
  3.     aws_ec2 as ec2,
  4.     aws_iam as iam
  5. )
  7. # Client VPN Endpoint
  8. saml_provider = iam.SamlProvider.from_saml_provider_arn(
  9.     self,
  10.     id='IdP',
  11.     saml_provider_arn=f'arn:aws:iam::{self.account}:saml-provider/{identity_provider_id}'
  12. )
  14. client_vpn = ec2.ClientVpnEndpoint(
  15.     self,
  16.     id='ClientVpn',
  17.     description=f'Client VPN Endpoint',
  19.     # Networking
  20.     vpc=vpc,
  21.     vpc_subnets=ec2.SubnetSelection(
  22.         subnets=clientvpn_subnets
  23.     ),
  24.     cidr=clientvpn_cidr_block,
  25.     port=ec2.VpnPort.HTTPS,
  26.     split_tunnel=True,
  27.     transport_protocol=ec2.TransportProtocol.TCP,
  28.     session_timeout=ec2.ClientVpnSessionTimeout.TEN_HOURS,
  30.     # Security
  31.     server_certificate_arn=f'arn:aws:acm:eu-west-1:{self.account}:certificate/{certificate_id}',
  32.     security_groups=[sg],
  33.     user_based_authentication=ec2.ClientVpnUserBasedAuthentication.federated(
  34.         saml_provider=saml_provider
  35.     ),
  36.     authorize_all_users_to_vpc_cidr=False,
  38.     # Logging
  39.     logging=True,
  40.     log_group=log_group,
  41.     log_stream=log_stream
  42. )
  44. client_vpn.add_authorization_rule(
  45.     id='AuthorizationRule',
  46.     description='Authorize all private ip range to everyone',
  47.     cidr='10.0.0.0/8'
  48. )
  50. </details>

huangapple
  • 本文由 发表于 2023年4月7日 04:39:41
  • 转载请务必保留本文链接：https://go.coder-hub.com/75953592.html
  • amazon-web-services
  • aws-cdk
  • python
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定