CreateVirtualNode - AWS App Mesh


Creates a virtual node within a service mesh.

A virtual node acts as a logical pointer to a particular task group, such as an Amazon ECS service or a Kubernetes deployment. When you create a virtual node, you can specify the service discovery information for your task group, and whether the proxy running in a task group will communicate with other proxies using Transport Layer Security (TLS).

You define a listener for any inbound traffic that your virtual node expects. Any virtual service that your virtual node expects to communicate to is specified as a backend.

The response metadata for your new virtual node contains the arn that is associated with the virtual node. Set this value (either the full ARN or the truncated resource name: for example, mesh/default/virtualNode/simpleapp) as the APPMESH_VIRTUAL_NODE_NAME environment variable for your task group's Envoy proxy container in your task definition or pod spec. This is then mapped to the and node.cluster Envoy parameters.


If you require your Envoy stats or tracing to use a different name, you can override the node.cluster value that is set by APPMESH_VIRTUAL_NODE_NAME with the APPMESH_VIRTUAL_NODE_CLUSTER environment variable.

For more information about virtual nodes, see Virtual nodes.

Request Syntax

PUT /v20190125/meshes/meshName/virtualNodes?meshOwner=meshOwner HTTP/1.1 Content-type: application/json { "clientToken": "string", "spec": { "backendDefaults": { "clientPolicy": { "tls": { "enforce": boolean, "ports": [ number ], "validation": { "trust": { "acm": { "certificateAuthorityArns": [ "string" ] }, "file": { "certificateChain": "string" } } } } } }, "backends": [ { "virtualService": { "clientPolicy": { "tls": { "enforce": boolean, "ports": [ number ], "validation": { "trust": { "acm": { "certificateAuthorityArns": [ "string" ] }, "file": { "certificateChain": "string" } } } } }, "virtualServiceName": "string" } } ], "listeners": [ { "healthCheck": { "healthyThreshold": number, "intervalMillis": number, "path": "string", "port": number, "protocol": "string", "timeoutMillis": number, "unhealthyThreshold": number }, "portMapping": { "port": number, "protocol": "string" }, "timeout": { "grpc": { "idle": { "unit": "string", "value": number }, "perRequest": { "unit": "string", "value": number } }, "http": { "idle": { "unit": "string", "value": number }, "perRequest": { "unit": "string", "value": number } }, "http2": { "idle": { "unit": "string", "value": number }, "perRequest": { "unit": "string", "value": number } }, "tcp": { "idle": { "unit": "string", "value": number } } }, "tls": { "certificate": { "acm": { "certificateArn": "string" }, "file": { "certificateChain": "string", "privateKey": "string" } }, "mode": "string" } } ], "logging": { "accessLog": { "file": { "path": "string" } } }, "serviceDiscovery": { "awsCloudMap": { "attributes": [ { "key": "string", "value": "string" } ], "namespaceName": "string", "serviceName": "string" }, "dns": { "hostname": "string" } } }, "tags": [ { "key": "string", "value": "string" } ], "virtualNodeName": "string" }

URI Request Parameters

The request uses the following URI parameters.


The name of the service mesh to create the virtual node in.

Length Constraints: Minimum length of 1. Maximum length of 255.

Required: Yes


The AWS IAM account ID of the service mesh owner. If the account ID is not your own, then the account that you specify must share the mesh with your account before you can create the resource in the service mesh. For more information about mesh sharing, see Working with shared meshes.

Length Constraints: Fixed length of 12.

Request Body

The request accepts the following data in JSON format.


Unique, case-sensitive identifier that you provide to ensure the idempotency of the request. Up to 36 letters, numbers, hyphens, and underscores are allowed.

Type: String

Required: No


The virtual node specification to apply.

Type: VirtualNodeSpec object

Required: Yes


Optional metadata that you can apply to the virtual node to assist with categorization and organization. Each tag consists of a key and an optional value, both of which you define. Tag keys can have a maximum character length of 128 characters, and tag values can have a maximum length of 256 characters.

Type: Array of TagRef objects

Array Members: Minimum number of 0 items. Maximum number of 50 items.

Required: No


The name to use for the virtual node.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 255.

Required: Yes

Response Syntax

HTTP/1.1 200 Content-type: application/json { "virtualNode": { "meshName": "string", "metadata": { "arn": "string", "createdAt": number, "lastUpdatedAt": number, "meshOwner": "string", "resourceOwner": "string", "uid": "string", "version": number }, "spec": { "backendDefaults": { "clientPolicy": { "tls": { "enforce": boolean, "ports": [ number ], "validation": { "trust": { "acm": { "certificateAuthorityArns": [ "string" ] }, "file": { "certificateChain": "string" } } } } } }, "backends": [ { "virtualService": { "clientPolicy": { "tls": { "enforce": boolean, "ports": [ number ], "validation": { "trust": { "acm": { "certificateAuthorityArns": [ "string" ] }, "file": { "certificateChain": "string" } } } } }, "virtualServiceName": "string" } } ], "listeners": [ { "healthCheck": { "healthyThreshold": number, "intervalMillis": number, "path": "string", "port": number, "protocol": "string", "timeoutMillis": number, "unhealthyThreshold": number }, "portMapping": { "port": number, "protocol": "string" }, "timeout": { "grpc": { "idle": { "unit": "string", "value": number }, "perRequest": { "unit": "string", "value": number } }, "http": { "idle": { "unit": "string", "value": number }, "perRequest": { "unit": "string", "value": number } }, "http2": { "idle": { "unit": "string", "value": number }, "perRequest": { "unit": "string", "value": number } }, "tcp": { "idle": { "unit": "string", "value": number } } }, "tls": { "certificate": { "acm": { "certificateArn": "string" }, "file": { "certificateChain": "string", "privateKey": "string" } }, "mode": "string" } } ], "logging": { "accessLog": { "file": { "path": "string" } } }, "serviceDiscovery": { "awsCloudMap": { "attributes": [ { "key": "string", "value": "string" } ], "namespaceName": "string", "serviceName": "string" }, "dns": { "hostname": "string" } } }, "status": { "status": "string" }, "virtualNodeName": "string" } }

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.


The full description of your virtual node following the create call.

Type: VirtualNodeData object



The request syntax was malformed. Check your request syntax and try again.

HTTP Status Code: 400


The request contains a client token that was used for a previous update resource call with different specifications. Try the request again with a new client token.

HTTP Status Code: 409


You don't have permissions to perform this action.

HTTP Status Code: 403


The request processing has failed because of an unknown error, exception, or failure.

HTTP Status Code: 500


You have exceeded a service limit for your account. For more information, see Service Limits in the AWS App Mesh User Guide.

HTTP Status Code: 400


The specified resource doesn't exist. Check your request syntax and try again.

HTTP Status Code: 404


The request has failed due to a temporary failure of the service.

HTTP Status Code: 503


The maximum request rate permitted by the App Mesh APIs has been exceeded for your account. For best results, use an increasing or variable sleep interval between requests.

HTTP Status Code: 429


In the following example or examples, the Authorization header contents ( AUTHPARAMS) must be replaced with an AWS Signature Version 4 signature. For more information about creating these signatures, see Signature Version 4 Signing Process in the AWS General Reference.

You need to learn how to sign HTTP requests only if you intend to manually create them. When you use the AWS Command Line Interface (AWS CLI) or one of the AWS SDKs to make requests to AWS, these tools automatically sign the requests for you with the access key that you specify when you configure the tools. When you use these tools, you don't need to learn how to sign requests yourself.


The following example creates a virtual node named colorgateway-vn in the ecs-mesh service mesh.

Sample Request

PUT /v20190125/meshes/ecs-mesh/virtualNodes HTTP/1.1 Host: Accept-Encoding: identity User-Agent: aws-cli/1.16.56 Python/3.7.0 Darwin/17.7.0 botocore/1.12.46 X-Amz-Date: 20190227T192431Z Authorization: AUTHPARAMS { "spec": { "listeners": [ { "portMapping": { "port": 9080, "protocol": "http" } } ], "serviceDiscovery": { "dns": { "hostname": "colorgateway.default.svc.cluster.local" } }, "backends": [ { "virtualService": { "virtualServiceName": "tcpecho.default.svc.cluster.local" } }, { "virtualService": { "virtualServiceName": "colorteller.default.svc.cluster.local" } } ] }, "virtualNodeName": "colorgateway-vn", "clientToken": "c148ccbb-3619-49da-bb3e-4561eb5370c4" }

Sample Response

HTTP/1.1 200 OK x-amzn-requestid: cc29e2dd-e4c4-4d6e-9424-e9211580f70e content-type: application/json content-length: 687 date: Wed, 27 Feb 2019 19:24:31 GMT x-envoy-upstream-service-time: 132 server: envoy Connection: keep-alive { "meshName": "ecs-mesh", "metadata": { "arn": "arn:aws:appmesh:us-east-1:123456789012:mesh/ecs-mesh/virtualNode/colorgateway-vn", "createdAt": 1.551295471546E9, "lastUpdatedAt": 1.551295471546E9, "uid": "887cfab8-a727-41b2-8cd7-2fdebfd6304e", "version": 1 }, "spec": { "backends": [{ "virtualService": { "virtualServiceName": "tcpecho.default.svc.cluster.local" } }, { "virtualService": { "virtualServiceName": "colorteller.default.svc.cluster.local" } }], "listeners": [{ "healthCheck": null, "portMapping": { "port": 9080, "protocol": "http" } }], "logging": null, "serviceDiscovery": { "dns": { "hostname": "colorgateway.default.svc.cluster.local" } } }, "status": { "status": "ACTIVE" }, "virtualNodeName": "colorgateway-vn" }

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: