fix(core): Fixing VPN Tunnel options for Static cgw routing (#751)

* Fixing VPN Tunnel options for Static cgw routing

* Fixing tests

Author: naveenkoppula

src/deployments/cdk/src/deployments/firewall/cluster/outputs.ts

@@ -45,17 +45,17 @@ export const FirewallPortOutputFinder = createStructuredOutputFinder(FirewallPor
 export const FirewallVpnTunnelOptions = t.interface({
   cgwTunnelInsideAddress1: t.string,
   cgwTunnelOutsideAddress1: t.string,
-  cgwBgpAsn1: t.string,
+  cgwBgpAsn1: optional(t.string),
   vpnTunnelInsideAddress1: t.string,
   vpnTunnelOutsideAddress1: t.string,
-  vpnBgpAsn1: t.string,
+  vpnBgpAsn1: optional(t.string),
   preSharedSecret1: t.string,
   cgwTunnelInsideAddress2: t.string,
   cgwTunnelOutsideAddress2: t.string,
-  cgwBgpAsn2: t.string,
+  cgwBgpAsn2: optional(t.string),
   vpnTunnelInsideAddress2: t.string,
   vpnTunnelOutsideAddress2: t.string,
-  vpnBgpAsn2: t.string,
+  vpnBgpAsn2: optional(t.string),
   preSharedSecret2: t.string,
 });
 

src/deployments/cdk/src/deployments/firewall/cluster/step-2.ts

@@ -145,17 +145,17 @@ async function createCustomerGateways(props: {
       vpnTunnelOptions = {
         cgwTunnelInsideAddress1: options.getAttString('CgwInsideIpAddress1'),
         cgwTunnelOutsideAddress1: options.getAttString('CgwOutsideIpAddress1'),
-        cgwBgpAsn1: options.getAttString('CgwBgpAsn1'),
+        cgwBgpAsn1: firewallCgwRouting === 'dynamic' ? options.getAttString('CgwBgpAsn1') : undefined,
         vpnTunnelInsideAddress1: options.getAttString('VpnInsideIpAddress1'),
         vpnTunnelOutsideAddress1: options.getAttString('VpnOutsideIpAddress1'),
-        vpnBgpAsn1: options.getAttString('VpnBgpAsn1'),
+        vpnBgpAsn1: firewallCgwRouting === 'dynamic' ? options.getAttString('VpnBgpAsn1') : undefined,
         preSharedSecret1: options.getAttString('PreSharedKey1'),
         cgwTunnelInsideAddress2: options.getAttString('CgwInsideIpAddress2'),
         cgwTunnelOutsideAddress2: options.getAttString('CgwOutsideIpAddress2'),
-        cgwBgpAsn2: options.getAttString('CgwBgpAsn2'),
+        cgwBgpAsn2: firewallCgwRouting === 'dynamic' ? options.getAttString('CgwBgpAsn2') : undefined,
         vpnTunnelInsideAddress2: options.getAttString('VpnInsideIpAddress2'),
         vpnTunnelOutsideAddress2: options.getAttString('VpnOutsideIpAddress2'),
-        vpnBgpAsn2: options.getAttString('VpnBgpAsn2'),
+        vpnBgpAsn2: firewallCgwRouting === 'dynamic' ? options.getAttString('VpnBgpAsn2') : undefined,
         preSharedSecret2: options.getAttString('PreSharedKey2'),
       };
 

src/lib/cdk-constructs/src/firewall/instance.ts

@@ -10,16 +10,16 @@ import { CfnSleep } from '@aws-accelerator/custom-resource-cfn-sleep';
 export interface FirewallVpnTunnelOptions {
   cgwTunnelInsideAddress1: string;
   cgwTunnelOutsideAddress1: string;
-  cgwBgpAsn1: string;
   vpnTunnelInsideAddress1: string;
   vpnTunnelOutsideAddress1: string;
-  vpnBgpAsn1: string;
   preSharedSecret1: string;
   preSharedSecret2: string;
   vpnTunnelInsideAddress2: string;
   vpnTunnelOutsideAddress2: string;
   cgwTunnelInsideAddress2: string;
   cgwTunnelOutsideAddress2: string;
+  cgwBgpAsn1?: string;
+  vpnBgpAsn1?: string;
 }
 
 export interface FirewallConfigurationProps {
@@ -171,10 +171,14 @@ export class FirewallInstance extends cdk.Construct {
     if (vpnTunnelOptions) {
       this.template.addReplacement(`\${${name}CgwTunnelOutsideAddress1}`, vpnTunnelOptions?.cgwTunnelOutsideAddress1);
       this.template.addReplacement(`\${${name}CgwTunnelInsideAddress1}`, vpnTunnelOptions?.cgwTunnelInsideAddress1);
-      this.template.addReplacement(`\${${name}CgwBgpAsn1}`, vpnTunnelOptions?.cgwBgpAsn1);
+      if (vpnTunnelOptions?.cgwBgpAsn1) {
+        this.template.addReplacement(`\${${name}CgwBgpAsn1}`, vpnTunnelOptions?.cgwBgpAsn1);
+      }
       this.template.addReplacement(`\${${name}VpnTunnelOutsideAddress1}`, vpnTunnelOptions?.vpnTunnelOutsideAddress1);
       this.template.addReplacement(`\${${name}VpnTunnelInsideAddress1}`, vpnTunnelOptions?.vpnTunnelInsideAddress1);
-      this.template.addReplacement(`\${${name}VpnBgpAsn1}`, vpnTunnelOptions?.vpnBgpAsn1);
+      if (vpnTunnelOptions?.vpnBgpAsn1) {
+        this.template.addReplacement(`\${${name}VpnBgpAsn1}`, vpnTunnelOptions?.vpnBgpAsn1);
+      }
       this.template.addReplacement(`\${${name}PreSharedSecret1}`, vpnTunnelOptions?.preSharedSecret1);
       this.template.addReplacement(`\${${name}CgwTunnelOutsideAddress2}`, vpnTunnelOptions?.cgwTunnelOutsideAddress2);
       this.template.addReplacement(`\${${name}CgwTunnelInsideAddress2}`, vpnTunnelOptions?.cgwTunnelInsideAddress2);