Question

A platform team maintains an AWS CDK (v2, TypeScript) library of reusable constructs that application teams import to provision workloads. One construct needs to place resources into an existing VPC that already lives in each application team's account. The application accounts vary, and the platform team wants the synthesized CloudFormation to reference the correct VPC subnets deterministically at deploy time without hard-coding subnet IDs in the construct. During code review, a developer used ec2.Vpc.fromLookup() and CDK synthesis failed in the CI pipeline with an error about missing environment/account context. What is the MOST appropriate way to make this reusable construct resolve the existing VPC reliably across accounts?

Accepted Answer

Configure the consuming stack with an explicit env (account and region), ensure CDK can assume a role with describe permissions in the target account so fromLookup() performs a context lookup, and commit the generated cdk.context.json for reproducible synth.

Answer

Replace fromLookup() with ec2.Vpc.fromVpcAttributes() and pass CloudFormation parameters for the VPC ID and subnet IDs, requiring each app team to supply values at deploy time.

Answer

Keep fromLookup() but set the stack env to the CDK default (agnostic) environment so it works for any account without additional configuration.

Answer

Use a custom resource backed by a Lambda function that calls ec2:DescribeVpcs during stack deployment and returns the subnet IDs to the rest of the template.