title: AWS CDK: How to access VPC in another account
body: <p>I need access to resources in my staging/prod accounts' VPC from my "tools" account (I have an RDS instance sitting in each of both VPCs and want to automate schema upgrades as part of my CI/CD).</p>
  
  <p>How can I import a VPC from the staging/prod account within a stack in the "tools" accounts?</p>
  
  <p><a href="https://docs.aws.amazon.com/cdk/api/latest/docs/aws-ec2-readme.html#importing-an-existing-vpc" rel="nofollow noreferrer"><code>Vpc.fromLookup()</code></a> does not work since it searches for VPCs in the stack's region and account, but not in other regions/accounts.  </p>
  
  <p><strong>EDIT:</strong></p>
  
  <p>I want to give a CodeBuild project (part of a CodePipeline) in the "tools" account access to the RDS instance in the VPC of the prod/staging accounts.
  To give it access, I use the <a href="https://docs.aws.amazon.com/cdk/api/latest/docs/aws-codebuild-readme.html#definition-of-vpc-configuration-in-codebuild-project" rel="nofollow noreferrer"><code>vpc</code> attribute</a> on the CodeBuild project.</p>
  
  <p>I'm not sure what's the best way to tackle schema upgrades using CodePipeline/CodeBuild.
  Ideally, the RDS instance should be sitting in a private/isolated subnet.</p>
  
  <pre class="lang-js prettyprint-override"><code>const dbMigrateBuild = new codebuild.PipelineProject(this, 'MigrateBuild', {
    buildSpec: codebuild.BuildSpec.fromSourceFilename('buildspec-migrate.yml'),
    environment: {
      buildImage: codebuild.LinuxBuildImage.STANDARD_4_0,
    },
    environmentVariables: {
      migrationBucketId: {
        type: codebuild.BuildEnvironmentVariableType.PLAINTEXT,
        value: sourceOutput.bucketName,
      },
      dbEndpoint: {
        type: codebuild.BuildEnvironmentVariableType.PLAINTEXT,
        value: dbEndpoint,
      },
      dbSecretId: {
        type: codebuild.BuildEnvironmentVariableType.PLAINTEXT,
        value: dbSecretId,
      },
    },
    vpc: ec2.Vpc.fromLookup(this, 'Vpc', { vpcId }), // &lt;-- this is not working
  });
  
  // dbMigrateBuild.connections.allowToDefaultPort(db); // how to grant permission ??
  
  const dbMigrateAction = new codepipeline_actions.CodeBuildAction({
    actionName: 'Db_Migrate',
    project: dbMigrateBuild,
    input: sourceOutput,
    runOrder: 130,
  });
  </code></pre>