AWS CDK: How to access VPC in another account

I need access to resources in my staging/prod accounts' VPC from my "tools" account (I have an RDS instance sitting in each of both VPCs and want to automate schema upgrades as part of my CI/CD).

How can I import a VPC from the staging/prod account within a stack in the "tools" accounts?

Vpc.fromLookup() does not work since it searches for VPCs in the stack's region and account, but not in other regions/accounts.

EDIT:

I want to give a CodeBuild project (part of a CodePipeline) in the "tools" account access to the RDS instance in the VPC of the prod/staging accounts. To give it access, I use the vpc attribute on the CodeBuild project.

I'm not sure what's the best way to tackle schema upgrades using CodePipeline/CodeBuild. Ideally, the RDS instance should be sitting in a private/isolated subnet.

const dbMigrateBuild = new codebuild.PipelineProject(this, 'MigrateBuild', {
  buildSpec: codebuild.BuildSpec.fromSourceFilename('buildspec-migrate.yml'),
  environment: {
    buildImage: codebuild.LinuxBuildImage.STANDARD_4_0,
  },
  environmentVariables: {
    migrationBucketId: {
      type: codebuild.BuildEnvironmentVariableType.PLAINTEXT,
      value: sourceOutput.bucketName,
    },
    dbEndpoint: {
      type: codebuild.BuildEnvironmentVariableType.PLAINTEXT,
      value: dbEndpoint,
    },
    dbSecretId: {
      type: codebuild.BuildEnvironmentVariableType.PLAINTEXT,
      value: dbSecretId,
    },
  },
  vpc: ec2.Vpc.fromLookup(this, 'Vpc', { vpcId }), // <-- this is not working
});

// dbMigrateBuild.connections.allowToDefaultPort(db); // how to grant permission ??

const dbMigrateAction = new codepipeline_actions.CodeBuildAction({
  actionName: 'Db_Migrate',
  project: dbMigrateBuild,
  input: sourceOutput,
  runOrder: 130,
});