How do I utilize CDK escape hatches to retrieve lower-level construct objects from L3 and L2 constructs?

Resolution

There are three AWS CDK abstraction layers, L1, L2, and L3.

Use AWS CDK escape hatches to retrieve child objects from an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with an L3 construct.

Note: The following resolution steps use the Python programming language. The steps are similar for other programming languages. Make sure to adjust code syntax for the programming language you use.

Example Amazon EKS cluster with an L3 construct in Python:

vpc = ec2.Vpc(self, "Vpc", 
            ip_addresses=ec2.IpAddresses.cidr("192.168.0.0/25") 
        ) 
  
eks_object = eks.Cluster(self, "HelloEKS", 
            version=eks.KubernetesVersion.V1_29, 
            kubectl_layer=KubectlV25Layer(self, "kubectl"),
            vpc=vpc, 
            vpc_subnets=[ec2.SubnetSelection(subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS)] 
        )

To retrieve lower-level construct objects, complete the following steps:

1. Use the node.find_all() attribute to retrieve all the child objects of an L3 construct in an Amazon EKS cluster:

   for child in eks_object.node.find_all(): 
       print(child.node.path)

   The preceding command prints all child IDs and paths of the L3 construct print.

2. Run the cdk synthesize CLI command:

   cdk synth --quiet

   Example output:

   pythonStack/HelloEKS 
   ...
   Stack/HelloEKS/NodegroupDefaultCapacity 
   pythonStack/HelloEKS/NodegroupDefaultCapacity/NodeGroupRole
   ...

3. Use the node.find_child() attribute to retrieve the desired child ID.

   l2_nodeGroup = eks_object.node.find_child(example_child_id) 
   print(l2_nodeGroup)

   Note: Replace example_child_id with your target child ID.

4. Run the cdk synthesize CLI command to print the L2 construct of the desired child ID:

   cdk synth --quiet

   Example output:

   <aws_cdk.aws_eks.Nodegroup object at 0x7ffa9c7b2910>

5. Use the node.find_all() attribute to retrieve all the child objects of the L2 construct:

   for child in l2_nodeGroup.node.find_all(): 
   print(child.node.path) 

   Note: You can use variables l2_nodeGroup to invoke the Nodegroup properties, attributes, and methods to modify the associated resources.

6. Run the cdk synthesize CLI command to print all child IDs and the L2 construct paths:

   cdk synth –-quiet

   Example output:

   pythonStack/HelloEKS/NodegroupDefaultCapacity 
   pythonStack/HelloEKS/NodegroupDefaultCapacity/NodeGroupRole 
   pythonStack/HelloEKS/NodegroupDefaultCapacity/NodeGroupRole/ImportNodeGroupRole

7. After the child IDs of the L2 construct print, use the node.find_child() attribute to retrieve the desired child ID:

   l2_nodeGroup_role = l2_nodeGroup.node.find_child(example_child_id)
   print(l2_nodeGroup_role)

   Note: Replace example_child_id with your child ID.

8. Run the cdk synthesize CLI command to return, an object at the L2 layer at the aws_iam.Role level:

   cdk synth --quiet 

9. When you are at the aws_iam.Role level, use the following node.default_child attribute to reach the L1 CfnRole construct object:

   l1_nodeGroup_role = l2_nodeGroup_role.node.default_child 
   print(l1_nodeGroup_role) 

   Note: When you use node.find_all() or node.default_child to retrieve child objects, you can use that construct's functionalities for increased controls over a CloudFormation template.

10. To return the default child at the L1 layer, run the cdk synthesize CLI command CLI command:

    cdk synth --quiet 

If you still can't retrieve child objects, then contact AWS Support or create a new issue at the GitHub website for AWS CDK issues.

Related information

How do I customize a resource property value when there is a gap between CDK higher level constructs and a CloudFormation resource?