custom-vpc-peering-dns.ts

/* Based on https://stackoverflow.com/questions/65213615/cdk-to-enable-dns-resolution-for-vpcpeering */

import { custom_resources } from 'aws-cdk-lib';
import { aws_ec2 as ec2, aws_iam as iam, aws_logs as logs } from 'aws-cdk-lib';
import { Construct } from 'constructs';

export interface AllowVPCPeeringDNSResolutionProps {
  vpcPeering: ec2.CfnVPCPeeringConnection,
}

export class AllowVPCPeeringDNSResolution extends Construct {
  constructor(scope: Construct, id: string, props: AllowVPCPeeringDNSResolutionProps) {
    super(scope, id);

    const onCreate: custom_resources.AwsSdkCall = {
        service: "EC2",
        action: "modifyVpcPeeringConnectionOptions",
        parameters: {
            VpcPeeringConnectionId: props.vpcPeering.ref,
            AccepterPeeringConnectionOptions: {
                AllowDnsResolutionFromRemoteVpc: true,
            },
            RequesterPeeringConnectionOptions: {
                AllowDnsResolutionFromRemoteVpc: true
            }
        },
        physicalResourceId: custom_resources.PhysicalResourceId.of(`allowVPCPeeringDNSResolution:${props.vpcPeering.ref}`)
    };
    const onUpdate = onCreate;
    const onDelete: custom_resources.AwsSdkCall = {
        service: "EC2",
        action: "modifyVpcPeeringConnectionOptions",
        parameters: {
            VpcPeeringConnectionId: props.vpcPeering.ref,
            AccepterPeeringConnectionOptions: {
                AllowDnsResolutionFromRemoteVpc: false,
            },
            RequesterPeeringConnectionOptions: {
                AllowDnsResolutionFromRemoteVpc: false
            }
        },
    };

    const customResource = new custom_resources.AwsCustomResource(this, "allow-peering-dns-resolution", {
        policy: custom_resources.AwsCustomResourcePolicy.fromStatements([
            new iam.PolicyStatement({
                effect: iam.Effect.ALLOW,
                resources: ["*"],
                actions: [
                    "ec2:ModifyVpcPeeringConnectionOptions",
                ]
            }),
        ]),
        logRetention: logs.RetentionDays.ONE_DAY,
        onCreate,
        onUpdate,
        onDelete,
    });

    customResource.node.addDependency(props.vpcPeering);
  }
}

For anyone finding this, if the accepter is in another account, this worked for me:

const onCreate: AwsSdkCall = {
                service: 'EC2',
                action: 'ModifyVpcPeeringConnectionOptions',
                region: 'us-east-1',
                assumedRoleArn: peerRoleArn,
                parameters: {
                    VpcPeeringConnectionId: peeringConnection.ref,
                    AccepterPeeringConnectionOptions: {
                        AllowDnsResolutionFromRemoteVpc: true,
                    },
                },
                physicalResourceId: PhysicalResourceId.of(`allowVPCPeeringDNSResolution-${peeringConnection.ref}`),
            };

Change the region as needed. You'll need to do two separate AwsCustomResources, one for the accepter side with the assumedRoleArn and one for the requester side, without assumedRoleArn. Also make sure your AwsCustomResource policy statement has sts:AssumeRole so that it can assume the peer role.