AWS CDK で VPC Lambda の IPv6 アドレスへのアウトバウンド通信の許可が簡単に設定可能になりました

import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';

export class CdkSampleStack extends cdk.Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    const vpc = new ec2.Vpc(this, 'Vpc');

    new lambda.Function(this, 'MyFunction', {
      code: new lambda.InlineCode('def main(event, context): pass'),
      handler: 'index.main',
      runtime: lambda.Runtime.PYTHON_3_9,
      vpc,
    });
  }
}

npm i aws-cdk-lib@latest aws-cdk@latest

import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';

export class CdkSampleStack extends cdk.Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    const vpc = new ec2.Vpc(this, 'Vpc');

    new lambda.Function(this, 'MyFunction', {
      code: new lambda.InlineCode('def main(event, context): pass'),
      handler: 'index.main',
      runtime: lambda.Runtime.PYTHON_3_9,
      vpc,
      allowAllIpv6Outbound: true, // 追記
    });
  }
}

$ npx cdk diff
Stack CdkSampleStack
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)
Security Group Changes
┌───┬─────────────────────────────────────┬─────┬────────────┬─────────────────┐
│   │ Group                               │ Dir │ Protocol   │ Peer            │
├───┼─────────────────────────────────────┼─────┼────────────┼─────────────────┤
│ + │ ${MyFunction/SecurityGroup.GroupId} │ Out │ Everything │ Everyone (IPv6) │
└───┴─────────────────────────────────────┴─────┴────────────┴─────────────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)

Resources
[~] AWS::EC2::SecurityGroup MyFunction/SecurityGroup MyFunctionSecurityGroup5241BB0E
 └─ [~] SecurityGroupEgress
     └─ @@ -3,5 +3,10 @@
        [ ]     "CidrIp": "0.0.0.0/0",
        [ ]     "Description": "Allow all outbound traffic by default",
        [ ]     "IpProtocol": "-1"
        [+]   },
        [+]   {
        [+]     "CidrIpv6": "::/0",
        [+]     "Description": "Allow all outbound ipv6 traffic by default",
        [+]     "IpProtocol": "-1"
        [ ]   }
        [ ] ]

✨  Number of stacks with differences: 1

import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as lambda from 'aws-cdk-lib/aws-lambda';
import { Construct } from 'constructs';

export class CdkSampleStack extends cdk.Stack {
  constructor(scope: Construct, id: string) {
    super(scope, id);

    const vpc = new ec2.Vpc(this, 'Vpc');

    new lambda.Function(this, 'MyFunction', {
      code: new lambda.InlineCode('def main(event, context): pass'),
      handler: 'index.main',
      runtime: lambda.Runtime.PYTHON_3_9,
      vpc,
      allowAllIpv6Outbound: true,
      allowAllOutbound: false, // 追記
    });
  }
}

$ npx cdk diff
Stack CdkSampleStack
Hold on while we create a read-only change set to get a diff with accurate replacement information (use --no-change-set to use a less accurate but faster template-only diff)
Security Group Changes
┌───┬─────────────────────────────────────┬─────┬─────────────┬────────────────────┐
│   │ Group                               │ Dir │ Protocol    │ Peer               │
├───┼─────────────────────────────────────┼─────┼─────────────┼────────────────────┤
│ - │ ${MyFunction/SecurityGroup.GroupId} │ Out │ Everything  │ Everyone (IPv4)    │
├───┼─────────────────────────────────────┼─────┼─────────────┼────────────────────┤
│ + │ ${MyFunction/SecurityGroup.GroupId} │ Out │ ICMP 252-86 │ 255.255.255.255/32 │
└───┴─────────────────────────────────────┴─────┴─────────────┴────────────────────┘
(NOTE: There may be security-related changes not in this list. See https://github.com/aws/aws-cdk/issues/1299)

Resources
[~] AWS::EC2::SecurityGroup MyFunction/SecurityGroup MyFunctionSecurityGroup5241BB0E
 └─ [~] SecurityGroupEgress
     └─ @@ -1,8 +1,10 @@
        [ ] [
        [ ]   {
        [-]     "CidrIp": "0.0.0.0/0",
        [-]     "Description": "Allow all outbound traffic by default",
        [-]     "IpProtocol": "-1"
        [+]     "CidrIp": "255.255.255.255/32",
        [+]     "Description": "Disallow all traffic",
        [+]     "FromPort": 252,
        [+]     "IpProtocol": "icmp",
        [+]     "ToPort": 86
        [ ]   },
        [ ]   {
        [ ]     "CidrIpv6": "::/0",

✨  Number of stacks with differences: 1