fix(ec2): fix error when using Tokens in Vpc.fromLookup() (#3740)

`fromLookup()` will not support lazy values. Throw a clear
error message when that is done, and update the documentation
to make it clear what should be done instead.

Fixes #3600.

packages/@aws-cdk/aws-ec2/lib/vpc.ts

@@ -698,8 +698,22 @@ export class Vpc extends VpcBase {
 
   /**
    * Import an existing VPC from by querying the AWS environment this stack is deployed to.
+   *
+   * Calling this method will lead to a lookup when the CDK CLI is executed.
+   * You can therefore not use any values that will only be available at
+   * CloudFormation execution time (i.e., Tokens).
+   *
+   * If you are looking to share a VPC between stacks, you can pass the `Vpc`
+   * object between stacks and use it as normal.
    */
   public static fromLookup(scope: Construct, id: string, options: VpcLookupOptions): IVpc {
+    if (Token.isUnresolved(options.vpcId)
+      || Token.isUnresolved(options.vpcName)
+      || Object.values(options.tags || {}).some(Token.isUnresolved)
+      || Object.keys(options.tags || {}).some(Token.isUnresolved)) {
+      throw new Error(`All arguments to Vpc.fromLookup() must be concrete (no Tokens)`);
+    }
+
     const filter: {[key: string]: string} = makeTagFilter(options.tags);
 
     // We give special treatment to some tags

packages/@aws-cdk/aws-ec2/test/test.vpc.ts

@@ -728,6 +728,20 @@ export = {
       test.done();
     }
   },
+
+  'fromLookup() requires concrete values'(test: Test) {
+    // GIVEN
+    const stack = new Stack();
+
+    test.throws(() => {
+      Vpc.fromLookup(stack, 'Vpc', {
+        vpcId: Lazy.stringValue({ produce: () => 'some-id' })
+      });
+
+    }, 'All arguments to Vpc.fromLookup() must be concrete');
+
+    test.done();
+  },
 };
 
 function getTestStack(): Stack {