"use strict";var _a,_b;Object.defineProperty(exports,"__esModule",{value:!0}),exports.RESERVED_TUNNEL_INSIDE_CIDR=exports.VpnConnection=exports.VpnGateway=exports.VpnConnectionType=void 0;const jsiiDeprecationWarnings=require("../../.warnings.jsii.js"),JSII_RTTI_SYMBOL_1=Symbol.for("jsii.rtti"),net=require("net"),cloudwatch=require("../../aws-cloudwatch"),core_1=require("../../core"),ec2_generated_1=require("./ec2.generated");var VpnConnectionType;(function(VpnConnectionType2){VpnConnectionType2.IPSEC_1="ipsec.1",VpnConnectionType2.DUMMY="dummy"})(VpnConnectionType=exports.VpnConnectionType||(exports.VpnConnectionType={}));class VpnGateway extends core_1.Resource{constructor(scope,id,props){super(scope,id);jsiiDeprecationWarnings.aws_cdk_lib_aws_ec2_VpnGatewayProps(props);const vpnGW=new ec2_generated_1.CfnVPNGateway(this,"Default",props);this.gatewayId=vpnGW.ref}}exports.VpnGateway=VpnGateway,_a=JSII_RTTI_SYMBOL_1,VpnGateway[_a]={fqn:"aws-cdk-lib.aws_ec2.VpnGateway",version:"2.13.0"};class VpnConnection extends core_1.Resource{constructor(scope,id,props){super(scope,id);if(jsiiDeprecationWarnings.aws_cdk_lib_aws_ec2_VpnConnectionProps(props),props.vpc.vpnGatewayId||props.vpc.enableVpnGateway({type:"ipsec.1",amazonSideAsn:props.asn}),!core_1.Token.isUnresolved(props.ip)&&!net.isIPv4(props.ip))throw new Error(`The \`ip\` ${props.ip} is not a valid IPv4 address.`);const type=VpnConnectionType.IPSEC_1,bgpAsn=props.asn||65e3,customerGateway=new ec2_generated_1.CfnCustomerGateway(this,"CustomerGateway",{bgpAsn,ipAddress:props.ip,type});if(this.customerGatewayId=customerGateway.ref,this.customerGatewayAsn=bgpAsn,this.customerGatewayIp=props.ip,props.tunnelOptions){if(props.tunnelOptions.length>2)throw new Error("Cannot specify more than two `tunnelOptions`");if(props.tunnelOptions.length===2&&props.tunnelOptions[0].tunnelInsideCidr===props.tunnelOptions[1].tunnelInsideCidr)throw new Error(`Same ${props.tunnelOptions[0].tunnelInsideCidr} \`tunnelInsideCidr\` cannot be used for both tunnels.`);props.tunnelOptions.forEach((options,index)=>{if(options.preSharedKey&&!core_1.Token.isUnresolved(options.preSharedKey)&&!/^[a-zA-Z1-9._][a-zA-Z\d._]{7,63}$/.test(options.preSharedKey))throw new Error(`The \`preSharedKey\` ${options.preSharedKey} for tunnel ${index+1} is invalid. Allowed characters are alphanumeric characters and ._. Must be between 8 and 64 characters in length and cannot start with zero (0).`);if(options.tunnelInsideCidr){if(exports.RESERVED_TUNNEL_INSIDE_CIDR.includes(options.tunnelInsideCidr))throw new Error(`The \`tunnelInsideCidr\` ${options.tunnelInsideCidr} for tunnel ${index+1} is a reserved inside CIDR.`);if(!/^169\.254\.\d{1,3}\.\d{1,3}\/30$/.test(options.tunnelInsideCidr))throw new Error(`The \`tunnelInsideCidr\` ${options.tunnelInsideCidr} for tunnel ${index+1} is not a size /30 CIDR block from the 169.254.0.0/16 range.`)}})}const vpnConnection=new ec2_generated_1.CfnVPNConnection(this,"Resource",{type,customerGatewayId:customerGateway.ref,staticRoutesOnly:!!props.staticRoutes,vpnGatewayId:props.vpc.vpnGatewayId,vpnTunnelOptionsSpecifications:props.tunnelOptions});this.vpnId=vpnConnection.ref,props.staticRoutes&&props.staticRoutes.forEach(route=>{new ec2_generated_1.CfnVPNConnectionRoute(this,`Route${route.replace(/[^\d]/g,"")}`,{destinationCidrBlock:route,vpnConnectionId:this.vpnId})})}static metricAll(metricName,props){return jsiiDeprecationWarnings.aws_cdk_lib_aws_cloudwatch_MetricOptions(props),new cloudwatch.Metric({namespace:"AWS/VPN",metricName,...props})}static metricAllTunnelState(props){return jsiiDeprecationWarnings.aws_cdk_lib_aws_cloudwatch_MetricOptions(props),this.metricAll("TunnelState",{statistic:"avg",...props})}static metricAllTunnelDataIn(props){return jsiiDeprecationWarnings.aws_cdk_lib_aws_cloudwatch_MetricOptions(props),this.metricAll("TunnelDataIn",{statistic:"sum",...props})}static metricAllTunnelDataOut(props){return jsiiDeprecationWarnings.aws_cdk_lib_aws_cloudwatch_MetricOptions(props),this.metricAll("TunnelDataOut",{statistic:"sum",...props})}}exports.VpnConnection=VpnConnection,_b=JSII_RTTI_SYMBOL_1,VpnConnection[_b]={fqn:"aws-cdk-lib.aws_ec2.VpnConnection",version:"2.13.0"},exports.RESERVED_TUNNEL_INSIDE_CIDR=["169.254.0.0/30","169.254.1.0/30","169.254.2.0/30","169.254.3.0/30","169.254.4.0/30","169.254.5.0/30","169.254.169.252/30"];
//# sourceMappingURL=vpn.js.map
