aws-cdk.aws-appmesh 1.113.0

The CDK Construct Library for AWS::AppMesh

AWS App Mesh Construct Library

---

All classes with the Cfn prefix in this module (CFN Resources) are always stable and safe to use.

The APIs of higher level constructs in this module are in developer preview before they become stable. We will only make breaking changes to address unforeseen API issues. Therefore, these APIs are not subject to Semantic Versioning, and breaking changes will be announced in release notes. This means that while you may use them, you may need to update your source code when upgrading to a newer version of this package.

---

AWS App Mesh is a service mesh based on the Envoy proxy that makes it easy to monitor and control microservices. App Mesh standardizes how your microservices communicate, giving you end-to-end visibility and helping to ensure high-availability for your applications.

App Mesh gives you consistent visibility and network traffic controls for every microservice in an application.

App Mesh supports microservice applications that use service discovery naming for their components. To use App Mesh, you must have an existing application running on AWS Fargate, Amazon ECS, Amazon EKS, Kubernetes on AWS, or Amazon EC2.

For further information on AWS AppMesh visit the AWS Docs for AppMesh.

Create the App and Stack

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
app = cdk.App()
stack = cdk.Stack(app, "stack")

Creating the Mesh

A service mesh is a logical boundary for network traffic between the services that reside within it.

After you create your service mesh, you can create virtual services, virtual nodes, virtual routers, and routes to distribute traffic between the applications in your mesh.

The following example creates the AppMesh service mesh with the default filter of DROP_ALL, see docs here for more info on egress filters.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
mesh = Mesh(stack, "AppMesh",
    mesh_name="myAwsmMesh"
)

The mesh can also be created with the "ALLOW_ALL" egress filter by overwritting the property.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
mesh = Mesh(stack, "AppMesh",
    mesh_name="myAwsmMesh",
    egress_filter=MeshFilterType.ALLOW_ALL
)

Adding VirtualRouters

The Mesh needs VirtualRouters as logical units to route requests to VirtualNodes.

Virtual routers handle traffic for one or more virtual services within your mesh. After you create a virtual router, you can create and associate routes to your virtual router that direct incoming requests to different virtual nodes.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
router = mesh.add_virtual_router("router",
    listeners=[appmesh.VirtualRouterListener.http(8080)]
)

Note that creating the router using the addVirtualRouter() method places it in the same Stack that the mesh belongs to (which might be different from the current Stack). The router can also be created using the constructor of VirtualRouter and passing in the mesh instead of calling the addVirtualRouter() method. This is particularly useful when splitting your resources between many Stacks, like creating the mesh as part of an infrastructure stack, but the other resources, such as routers, in the application stack:

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
mesh = Mesh(infra_stack, "AppMesh",
    mesh_name="myAwsmMesh",
    egress_filter=MeshFilterType.ALLOW_ALL
)

# the VirtualRouter will belong to 'appStack',
# even though the Mesh belongs to 'infraStack'
router = VirtualRouter(app_stack, "router",
    mesh=mesh, # notice that mesh is a required property when creating a router with the 'new' statement
    listeners=[appmesh.VirtualRouterListener.http(8081)]
)

The same is true for other add*() methods in the AppMesh library.

The VirtualRouterListener class provides an easy interface for defining new protocol specific listeners. The http(), http2(), grpc() and tcp() methods are available for use. They accept a single port parameter, that is used to define what port to match requests on. The port parameter can be omitted, and it will default to port 8080.

Adding VirtualService

A virtual service is an abstraction of a real service that is provided by a virtual node directly or indirectly by means of a virtual router. Dependent services call your virtual service by its virtualServiceName, and those requests are routed to the virtual node or virtual router that is specified as the provider for the virtual service.

We recommend that you use the service discovery name of the real service that you're targeting (such as my-service.default.svc.cluster.local).

When creating a virtual service:

• If you want the virtual service to spread traffic across multiple virtual nodes, specify a Virtual router.
• If you want the virtual service to reach a virtual node directly, without a virtual router, specify a Virtual node.

Adding a virtual router as the provider:

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
appmesh.VirtualService("virtual-service",
    virtual_service_name="my-service.default.svc.cluster.local", # optional
    virtual_service_provider=appmesh.VirtualServiceProvider.virtual_router(router)
)

Adding a virtual node as the provider:

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
appmesh.VirtualService("virtual-service",
    virtual_service_name="my-service.default.svc.cluster.local", # optional
    virtual_service_provider=appmesh.VirtualServiceProvider.virtual_node(node)
)

Adding a VirtualNode

A virtual node acts as a logical pointer to a particular task group, such as an Amazon ECS service or a Kubernetes deployment.

When you create a virtual node, any inbound traffic that your virtual node expects should be specified as a listener. Any outbound traffic that your virtual node expects to reach should be specified as a backend.

The response metadata for your new virtual node contains the Amazon Resource Name (ARN) that is associated with the virtual node. Set this value (either the full ARN or the truncated resource name) as the APPMESH_VIRTUAL_NODE_NAME environment variable for your task group's Envoy proxy container in your task definition or pod spec. For example, the value could be mesh/default/virtualNode/simpleapp. This is then mapped to the node.id and node.cluster Envoy parameters.

Note If you require your Envoy stats or tracing to use a different name, you can override the node.cluster value that is set by APPMESH_VIRTUAL_NODE_NAME with the APPMESH_VIRTUAL_NODE_CLUSTER environment variable.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
vpc = ec2.Vpc(stack, "vpc")
namespace = servicediscovery.PrivateDnsNamespace(self, "test-namespace",
    vpc=vpc,
    name="domain.local"
)
service = namespace.create_service("Svc")

node = mesh.add_virtual_node("virtual-node",
    service_discovery=appmesh.ServiceDiscovery.cloud_map(service),
    listeners=[appmesh.VirtualNodeListener.http_node_listener(
        port=8081,
        health_check=appmesh.HealthCheck.http(
            healthy_threshold=3,
            interval=Duration.seconds(5), # minimum
            path="/health-check-path",
            timeout=Duration.seconds(2), # minimum
            unhealthy_threshold=2
        )
    )],
    access_log=appmesh.AccessLog.from_file_path("/dev/stdout")
)

Create a VirtualNode with the constructor and add tags.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
node = VirtualNode(self, "node",
    mesh=mesh,
    service_discovery=appmesh.ServiceDiscovery.cloud_map(service),
    listeners=[appmesh.VirtualNodeListener.http(
        port=8080,
        health_check=appmesh.HealthCheck.http(
            healthy_threshold=3,
            interval=Duration.seconds(5), # min
            path="/ping",
            timeout=Duration.seconds(2), # min
            unhealthy_threshold=2
        ),
        timeout={
            "idle": cdk.Duration.seconds(5)
        }
    )],
    backend_defaults={
        "tls_client_policy": {
            "validation": {
                "trust": appmesh.TlsValidationTrust.file("/keys/local_cert_chain.pem")
            }
        }
    },
    access_log=appmesh.AccessLog.from_file_path("/dev/stdout")
)

cdk.Tag.add(node, "Environment", "Dev")

Create a VirtualNode with the constructor and add backend virtual service.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
node = VirtualNode(self, "node",
    mesh=mesh,
    service_discovery=appmesh.ServiceDiscovery.cloud_map(service),
    listeners=[appmesh.VirtualNodeListener.http_node_listener(
        port=8080,
        health_check=appmesh.HealthCheck.http(
            healthy_threshold=3,
            interval=Duration.seconds(5), # min
            path="/ping",
            timeout=Duration.seconds(2), # min
            unhealthy_threshold=2
        ),
        timeout={
            "idle": cdk.Duration.seconds(5)
        }
    )],
    access_log=appmesh.AccessLog.from_file_path("/dev/stdout")
)

virtual_service = appmesh.VirtualService(stack, "service-1",
    virtual_service_provider=appmesh.VirtualServiceProvider.virtual_router(router),
    virtual_service_name="service1.domain.local"
)

node.add_backend(appmesh.Backend.virtual_service(virtual_service))

The listeners property can be left blank and added later with the node.addListener() method. The healthcheck and timeout properties are optional but if specifying a listener, the port must be added.

The backends property can be added with node.addBackend(). We define a virtual service and add it to the virtual node to allow egress traffic to other node.

The backendDefaults property are added to the node while creating the virtual node. These are virtual node's default settings for all backends.

Adding TLS to a listener

The tls property can be provided when creating a Virtual Node listener, or a Virtual Gateway listener to add TLS configuration. App Mesh allows you to provide the TLS certificate to the proxy in the following ways:

• A certificate from AWS Certificate Manager (ACM) can be used.
• A customer provided certificate can be specified with a certificateChain path file and a privateKey file path.
• A certificate provided by a Secrets Discovery Service (SDS) endpoint over local Unix Domain Socket can be specified with its secretName.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
import aws_cdk.aws_certificatemanager as certificatemanager

# A Virtual Node with listener TLS from an ACM provided certificate
cert = certificatemanager.Certificate(self, "cert", ...)

node = appmesh.VirtualNode(stack, "node",
    mesh=mesh,
    service_discovery=appmesh.ServiceDiscovery.dns("node"),
    listeners=[appmesh.VirtualNodeListener.grpc(
        port=80,
        tls={
            "mode": appmesh.TlsMode.STRICT,
            "certificate": appmesh.TlsCertificate.acm(cert)
        }
    )]
)

# A Virtual Gateway with listener TLS from a customer provided file certificate
gateway = appmesh.VirtualGateway(self, "gateway",
    mesh=mesh,
    listeners=[appmesh.VirtualGatewayListener.grpc(
        port=8080,
        tls={
            "mode": appmesh.TlsMode.STRICT,
            "certificate": appmesh.TlsCertificate.file("path/to/certChain", "path/to/privateKey")
        }
    )],
    virtual_gateway_name="gateway"
)

# A Virtual Gateway with listener TLS from a SDS provided certificate
gateway2 = appmesh.VirtualGateway(self, "gateway2",
    mesh=mesh,
    listeners=[appmesh.VirtualGatewayListener.http2(
        port=8080,
        tls={
            "mode": appmesh.TlsMode.STRICT,
            "certificate": appmesh.TlsCertificate.sds("secrete_certificate")
        }
    )],
    virtual_gateway_name="gateway2"
)

Adding mutual TLS authentication

Mutual TLS authentication is an optional component of TLS that offers two-way peer authentication. To enable mutual TLS authentication, add mutualTlsCertificate property to TLS Client Policy and/or mutualTlsValidation property to TLS Listener.

tls.mutualTlsValidation and tlsClientPolicy.mutualTlsCertificate can be sourced from either:

• A customer provided certificate can be specified with a certificateChain path file and a privateKey file path.
• A certificate provided by a Secrets Discovery Service (SDS) endpoint over local Unix Domain Socket can be specified with its secretName.

Note: Currently, a certificate from AWS Certificate Manager (ACM) cannot be sourced for above two properties.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
import aws_cdk.aws_certificatemanager as certificatemanager

node1 = appmesh.VirtualNode(stack, "node1",
    mesh=mesh,
    service_discovery=appmesh.ServiceDiscovery.dns("node"),
    listeners=[appmesh.VirtualNodeListener.grpc(
        port=80,
        tls={
            "mode": appmesh.TlsMode.STRICT,
            "certificate": appmesh.TlsCertificate.file("path/to/certChain", "path/to/privateKey"),
            # Validate a file client certificates to enable mutual TLS authentication when a client provides a certificate.
            "mutual_tls_validation": {
                "trust": appmesh.TlsValidationTrust.file("path-to-certificate")
            }
        }
    )]
)

node2 = appmesh.VirtualNode(stack, "node2",
    mesh=mesh,
    service_discovery=appmesh.ServiceDiscovery.dns("node2"),
    backend_defaults={
        "tls_client_policy": {
            "ports": [8080, 8081],
            "validation": {
                "subject_alternative_names": appmesh.SubjectAlternativeNames.matching_exactly("mesh-endpoint.apps.local"),
                "trust": appmesh.TlsValidationTrust.acm([
                    acmpca.CertificateAuthority.from_certificate_authority_arn(stack, "certificate", certificate_authority_arn)
                ])
            },
            # Provide a SDS client certificate when a server requests it and enable mutual TLS authentication.
            "mutual_tls_certificate": appmesh.TlsCertificate.sds("secret_certificate")
        }
    }
)

Adding outlier detection to a Virtual Node listener

The outlierDetection property can be added to a Virtual Node listener to add outlier detection. The 4 parameters (baseEjectionDuration, interval, maxEjectionPercent, maxServerErrors) are required.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
# Cloud Map service discovery is currently required for host ejection by outlier detection
vpc = ec2.Vpc(stack, "vpc")
namespace = servicediscovery.PrivateDnsNamespace(self, "test-namespace",
    vpc=vpc,
    name="domain.local"
)
service = namespace.create_service("Svc")

node = mesh.add_virtual_node("virtual-node",
    service_discovery=appmesh.ServiceDiscovery.cloud_map(service),
    outlier_detection={
        "base_ejection_duration": cdk.Duration.seconds(10),
        "interval": cdk.Duration.seconds(30),
        "max_ejection_percent": 50,
        "max_server_errors": 5
    }
)

Adding a connection pool to a listener

The connectionPool property can be added to a Virtual Node listener or Virtual Gateway listener to add a request connection pool. There are different connection pool properties per listener protocol types.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
# A Virtual Node with a gRPC listener with a connection pool set
node = appmesh.VirtualNode(stack, "node",
    mesh=mesh,
    # DNS service discovery can optionally specify the DNS response type as either LOAD_BALANCER or ENDPOINTS.
    # LOAD_BALANCER means that the DNS resolver returns a loadbalanced set of endpoints,
    # whereas ENDPOINTS means that the DNS resolver is returning all the endpoints.
    # By default, the response type is assumed to be LOAD_BALANCER
    service_discovery=appmesh.ServiceDiscovery.dns("node", appmesh.ResponseType.ENDPOINTS),
    listeners=[appmesh.VirtualNodeListener.http(
        port=80,
        connection_pool={
            "max_connections": 100,
            "max_pending_requests": 10
        }
    )]
)

# A Virtual Gateway with a gRPC listener with a connection pool set
gateway = appmesh.VirtualGateway(self, "gateway",
    mesh=mesh,
    listeners=[appmesh.VirtualGatewayListener.grpc(
        port=8080,
        connection_pool={
            "max_requests": 10
        }
    )],
    virtual_gateway_name="gateway"
)

Adding a Route

A route is associated with a virtual router, and it's used to match requests for a virtual router and distribute traffic accordingly to its associated virtual nodes.

If your route matches a request, you can distribute traffic to one or more target virtual nodes with relative weighting.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
router.add_route("route-http",
    route_spec=appmesh.RouteSpec.http(
        weighted_targets=[{
            "virtual_node": node
        }
        ],
        match={
            "prefix_path": "/path-to-app"
        }
    )
)

Add an HTTP2 route that matches based on method, scheme and header:

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
router.add_route("route-http2",
    route_spec=appmesh.RouteSpec.http2(
        weighted_targets=[{
            "virtual_node": node
        }
        ],
        match={
            "prefix_path": "/",
            "method": appmesh.HttpRouteMethod.POST,
            "protocol": appmesh.HttpRouteProtocol.HTTPS,
            "headers": [
                # All specified headers must match for the route to match.
                appmesh.HeaderMatch.value_is("Content-Type", "application/json"),
                appmesh.HeaderMatch.value_is_not("Content-Type", "application/json")
            ]
        }
    )
)

Add a single route with multiple targets and split traffic 50/50

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
router.add_route("route-http",
    route_spec=appmesh.RouteSpec.http(
        weighted_targets=[{
            "virtual_node": node,
            "weight": 50
        }, {
            "virtual_node": node,
            "weight": 50
        }
        ],
        match={
            "prefix_path": "/path-to-app"
        }
    )
)

Add an http2 route with retries:

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
router.add_route("route-http2-retry",
    route_spec=appmesh.RouteSpec.http2(
        weighted_targets=[{"virtual_node": node}],
        retry_policy={
            # Retry if the connection failed
            "tcp_retry_events": [appmesh.TcpRetryEvent.CONNECTION_ERROR],
            # Retry if HTTP responds with a gateway error (502, 503, 504)
            "http_retry_events": [appmesh.HttpRetryEvent.GATEWAY_ERROR],
            # Retry five times
            "retry_attempts": 5,
            # Use a 1 second timeout per retry
            "retry_timeout": cdk.Duration.seconds(1)
        }
    )
)

Add a gRPC route with retries:

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
router.add_route("route-grpc-retry",
    route_spec=appmesh.RouteSpec.grpc(
        weighted_targets=[{"virtual_node": node}],
        match={"service_name": "servicename"},
        retry_policy={
            "tcp_retry_events": [appmesh.TcpRetryEvent.CONNECTION_ERROR],
            "http_retry_events": [appmesh.HttpRetryEvent.GATEWAY_ERROR],
            # Retry if gRPC responds that the request was cancelled, a resource
            # was exhausted, or if the service is unavailable
            "grpc_retry_events": [appmesh.GrpcRetryEvent.CANCELLED, appmesh.GrpcRetryEvent.RESOURCE_EXHAUSTED, appmesh.GrpcRetryEvent.UNAVAILABLE
            ],
            "retry_attempts": 5,
            "retry_timeout": cdk.Duration.seconds(1)
        }
    )
)

The RouteSpec class provides an easy interface for defining new protocol specific route specs. The tcp(), http() and http2() methods provide the spec necessary to define a protocol specific spec.

For HTTP based routes, the match field can be used to match on a route prefix. By default, an HTTP based route will match on /. All matches must start with a leading /. The timeout field can also be specified for idle and perRequest timeouts.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
router.add_route("route-http",
    route_spec=appmesh.RouteSpec.grpc(
        weighted_targets=[{
            "virtual_node": node
        }
        ],
        match={
            "service_name": "my-service.default.svc.cluster.local"
        },
        timeout={
            "idle": Duration.seconds(2),
            "per_request": Duration.seconds(1)
        }
    )
)

Adding a Virtual Gateway

A virtual gateway allows resources outside your mesh to communicate to resources that are inside your mesh. The virtual gateway represents an Envoy proxy running in an Amazon ECS task, in a Kubernetes service, or on an Amazon EC2 instance. Unlike a virtual node, which represents an Envoy running with an application, a virtual gateway represents Envoy deployed by itself.

A virtual gateway is similar to a virtual node in that it has a listener that accepts traffic for a particular port and protocol (HTTP, HTTP2, GRPC). The traffic that the virtual gateway receives, is directed to other services in your mesh, using rules defined in gateway routes which can be added to your virtual gateway.

Create a virtual gateway with the constructor:

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
certificate_authority_arn = "arn:aws:acm-pca:us-east-1:123456789012:certificate-authority/12345678-1234-1234-1234-123456789012"

gateway = appmesh.VirtualGateway(stack, "gateway",
    mesh=mesh,
    listeners=[appmesh.VirtualGatewayListener.http(
        port=443,
        health_check=appmesh.HealthCheck.http(
            interval=cdk.Duration.seconds(10)
        )
    )],
    backend_defaults={
        "tls_client_policy": {
            "ports": [8080, 8081],
            "validation": {
                "trust": appmesh.TlsValidationTrust.acm([
                    acmpca.CertificateAuthority.from_certificate_authority_arn(stack, "certificate", certificate_authority_arn)
                ])
            }
        }
    },
    access_log=appmesh.AccessLog.from_file_path("/dev/stdout"),
    virtual_gateway_name="virtualGateway"
)

Add a virtual gateway directly to the mesh:

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
gateway = mesh.add_virtual_gateway("gateway",
    access_log=appmesh.AccessLog.from_file_path("/dev/stdout"),
    virtual_gateway_name="virtualGateway",
    listeners=[appmesh.VirtualGatewayListener.http(
        port=443,
        health_check=appmesh.HealthCheck.http(
            interval=cdk.Duration.seconds(10)
        )
    )]
)

The listeners field can be omitted which will default to an HTTP Listener on port 8080. A gateway route can be added using the gateway.addGatewayRoute() method.

The backendDefaults property is added to the node while creating the virtual gateway. These are virtual gateway's default settings for all backends.

Adding a Gateway Route

A gateway route is attached to a virtual gateway and routes traffic to an existing virtual service. If a route matches a request, it can distribute traffic to a target virtual service.

For HTTP based routes, the match field can be used to match on a route prefix. By default, an HTTP based route will match on /. All matches must start with a leading /.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
gateway.add_gateway_route("gateway-route-http",
    route_spec=appmesh.GatewayRouteSpec.http(
        route_target=virtual_service,
        match={
            "prefix_match": "/"
        }
    )
)

For GRPC based routes, the match field can be used to match on service names. You cannot omit the field, and must specify a match for these routes.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
gateway.add_gateway_route("gateway-route-grpc",
    route_spec=appmesh.GatewayRouteSpec.grpc(
        route_target=virtual_service,
        match={
            "service_name": "my-service.default.svc.cluster.local"
        }
    )
)

Importing Resources

Each mesh resource comes with two static methods for importing a reference to an existing App Mesh resource. These imported resources can be used as references for other resources in your mesh. There are two static methods, from<Resource>Arn and from<Resource>Attributes where the <Resource> is replaced with the resource name.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
arn = "arn:aws:appmesh:us-east-1:123456789012:mesh/testMesh/virtualNode/testNode"
appmesh.VirtualNode.from_virtual_node_arn(stack, "importedVirtualNode", arn)

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
appmesh.VirtualNode.from_virtual_node_attributes(stack, "imported-virtual-node",
    mesh=appmesh.Mesh.from_mesh_name(stack, "Mesh", "testMesh"),
    virtual_node_name=virtual_node_name
)

To import a mesh, there are two static methods, fromMeshArn and fromMeshName.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
arn = "arn:aws:appmesh:us-east-1:123456789012:mesh/testMesh"
appmesh.Mesh.from_mesh_arn(stack, "imported-mesh", arn)

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
appmesh.Mesh.from_mesh_name(stack, "imported-mesh", "abc")

IAM Grants

Virtual Node and Virtual Gateway implement grantStreamAggregatedResources that will grant identities that are running Envoy access to stream generated config from App Mesh.

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
gateway = appmesh.VirtualGateway(stack, "testGateway", mesh=mesh)
envoy_user = iam.User(stack, "envoyUser")

#
# This will grant `grantStreamAggregatedResources` ONLY for this gateway.
#
gateway.grant_stream_aggregated_resources(envoy_user)

Adding Resources to shared meshes

A shared mesh allows resources created by different accounts to communicate with each other in the same mesh:

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
# This is the ARN for the mesh from different AWS IAM account ID.
# Ensure mesh is properly shared with your account. For more details, see: https://github.com/aws/aws-cdk/issues/15404
arn = "arn:aws:appmesh:us-east-1:123456789012:mesh/testMesh"
shared_mesh = appmesh.Mesh.from_mesh_arn(stack, "imported-mesh", arn)

# This VirtualNode resource can communicate with the resources in the mesh from different AWS IAM account ID.
appmesh.VirtualNode(stack, "test-node",
    mesh=shared_mesh
)