Vpc

class aws_cdk.aws_ec2.Vpc(scope, id, *, cidr=None, default_instance_tenancy=None, enable_dns_hostnames=None, enable_dns_support=None, gateway_endpoints=None, max_azs=None, nat_gateways=None, nat_gateway_subnets=None, subnet_configuration=None, vpn_connections=None, vpn_gateway=None, vpn_gateway_asn=None, vpn_route_propagation=None)

Bases: aws_cdk.core.Resource

Define an AWS Virtual Private Cloud.

See the package-level documentation of this package for an overview of the various dimensions in which you can configure your VPC.

For example:

import { SubnetType, Vpc } from '@aws-cdk/aws-ec2'

const vpc = new Vpc(this, 'TheVPC', {
   cidr: "10.0.0.0/16"
})

// Iterate the private subnets
const selection = vpc.selectSubnets({
   subnetType: SubnetType.PRIVATE
});

for (const subnet of selection.subnets) {
   // ...
}

resource: :resource:: AWS::EC2::VPC

__init__(scope, id, *, cidr=None, default_instance_tenancy=None, enable_dns_hostnames=None, enable_dns_support=None, gateway_endpoints=None, max_azs=None, nat_gateways=None, nat_gateway_subnets=None, subnet_configuration=None, vpn_connections=None, vpn_gateway=None, vpn_gateway_asn=None, vpn_route_propagation=None)

Vpc creates a VPC that spans a whole region. It will automatically divide the provided VPC CIDR range, and create public and private subnets per Availability Zone. Network routing for the public subnets will be configured to allow outbound access directly via an Internet Gateway. Network routing for the private subnets will be configured to allow outbound access via a set of resilient NAT Gateways (one per AZ).

Parameters
  • scope (Construct) –

  • id (str) –

  • props

  • cidr (Optional[str]) – The CIDR range to use for the VPC, e.g. ‘10.0.0.0/16’. Should be a minimum of /28 and maximum size of /16. The range will be split across all subnets per Availability Zone. Default: Vpc.DEFAULT_CIDR_RANGE

  • default_instance_tenancy (Optional[DefaultInstanceTenancy]) – The default tenancy of instances launched into the VPC. By setting this to dedicated tenancy, instances will be launched on hardware dedicated to a single AWS customer, unless specifically specified at instance launch time. Please note, not all instance types are usable with Dedicated tenancy. Default: DefaultInstanceTenancy.Default (shared) tenancy

  • enable_dns_hostnames (Optional[bool]) – Indicates whether the instances launched in the VPC get public DNS hostnames. If this attribute is true, instances in the VPC get public DNS hostnames, but only if the enableDnsSupport attribute is also set to true. Default: true

  • enable_dns_support (Optional[bool]) – Indicates whether the DNS resolution is supported for the VPC. If this attribute is false, the Amazon-provided DNS server in the VPC that resolves public DNS hostnames to IP addresses is not enabled. If this attribute is true, queries to the Amazon provided DNS server at the 169.254.169.253 IP address, or the reserved IP address at the base of the VPC IPv4 network range plus two will succeed. Default: true

  • gateway_endpoints (Optional[Mapping[str, GatewayVpcEndpointOptions]]) – Gateway endpoints to add to this VPC. Default: - None.

  • max_azs (Union[int, float, None]) – Define the maximum number of AZs to use in this region. If the region has more AZs than you want to use (for example, because of EIP limits), pick a lower number here. The AZs will be sorted and picked from the start of the list. If you pick a higher number than the number of AZs in the region, all AZs in the region will be selected. To use “all AZs” available to your account, use a high number (such as 99). Be aware that environment-agnostic stacks will be created with access to only 2 AZs, so to use more than 2 AZs, be sure to specify the account and region on your stack. Default: 3

  • nat_gateways (Union[int, float, None]) – The number of NAT Gateways to create. For example, if set this to 1 and your subnet configuration is for 3 Public subnets then only one of the Public subnets will have a gateway and all Private subnets will route to this NAT Gateway. Default: - One NAT gateway per Availability Zone

  • nat_gateway_subnets (Optional[SubnetSelection]) – Configures the subnets which will have NAT Gateways. You can pick a specific group of subnets by specifying the group name; the picked subnets must be public subnets. Only necessary if you have more than one public subnet group. Default: - All public subnets.

  • subnet_configuration (Optional[List[SubnetConfiguration]]) – Configure the subnets to build for each AZ. Each entry in this list configures a Subnet Group; each group will contain a subnet for each Availability Zone. For example, if you want 1 public subnet, 1 private subnet, and 1 isolated subnet in each AZ provide the following:: subnetConfiguration: [ { cidrMask: 24, name: ‘ingress’, subnetType: SubnetType.PUBLIC, }, { cidrMask: 24, name: ‘application’, subnetType: SubnetType.PRIVATE, }, { cidrMask: 28, name: ‘rds’, subnetType: SubnetType.ISOLATED, } ] Default: - The VPC CIDR will be evenly divided between 1 public and 1 private subnet per AZ.

  • vpn_connections (Optional[Mapping[str, VpnConnectionOptions]]) – VPN connections to this VPC. Default: - No connections.

  • vpn_gateway (Optional[bool]) – Indicates whether a VPN gateway should be created and attached to this VPC. Default: - true when vpnGatewayAsn or vpnConnections is specified.

  • vpn_gateway_asn (Union[int, float, None]) – The private Autonomous System Number (ASN) for the VPN gateway. Default: - Amazon default ASN.

  • vpn_route_propagation (Optional[List[SubnetSelection]]) – Where to propagate VPN routes. Default: - On the route tables associated with private subnets.

Return type

None

Methods

add_dynamo_db_endpoint(id, subnets=None)

Adds a new DynamoDB gateway endpoint to this VPC.

Parameters

deprecated :deprecated: use addGatewayEndpoint() instead

stability :stability: deprecated

Return type

GatewayVpcEndpoint

add_gateway_endpoint(id, *, service, subnets=None)

Adds a new gateway endpoint to this VPC.

Parameters
  • id (str) –

  • options

  • service (IGatewayVpcEndpointService) – The service to use for this gateway VPC endpoint.

  • subnets (Optional[List[SubnetSelection]]) – Where to add endpoint routing. Default: private subnets

Return type

GatewayVpcEndpoint

add_interface_endpoint(id, *, service, private_dns_enabled=None, subnets=None)

Adds a new interface endpoint to this VPC.

Parameters
  • id (str) –

  • options

  • service (IInterfaceVpcEndpointService) – The service to use for this interface VPC endpoint.

  • private_dns_enabled (Optional[bool]) – Whether to associate a private hosted zone with the specified VPC. This allows you to make requests to the service using its default DNS hostname. Default: true

  • subnets (Optional[SubnetSelection]) – The subnets in which to create an endpoint network interface. At most one per availability zone. Default: private subnets

Return type

InterfaceVpcEndpoint

add_s3_endpoint(id, subnets=None)

Adds a new S3 gateway endpoint to this VPC.

Parameters

deprecated :deprecated: use addGatewayEndpoint() instead

stability :stability: deprecated

Return type

GatewayVpcEndpoint

add_vpn_connection(id, *, ip, asn=None, static_routes=None, tunnel_options=None)

Adds a new VPN connection to this VPC.

Parameters
  • id (str) –

  • options

  • ip (str) – The ip address of the customer gateway.

  • asn (Union[int, float, None]) – The ASN of the customer gateway. Default: 65000

  • static_routes (Optional[List[str]]) – The static routes to be routed from the VPN gateway to the customer gateway. Default: Dynamic routing (BGP)

  • tunnel_options (Optional[List[VpnTunnelOption]]) – The tunnel options for the VPN connection. At most two elements (one per tunnel). Duplicates not allowed. Default: Amazon generated tunnel options

Return type

VpnConnection

select_subnets(*, one_per_az=None, subnet_name=None, subnet_type=None)

Returns IDs of selected subnets.

Parameters
  • selection

  • one_per_az (Optional[bool]) – If true, return at most one subnet per AZ. Default: false

  • subnet_name (Optional[str]) – Place the instances in the subnets with the given name. (This is the name supplied in subnetConfiguration). At most one of subnetType and subnetName can be supplied. Default: name

  • subnet_type (Optional[SubnetType]) – Place the instances in the subnets of the given type. At most one of subnetType and subnetName can be supplied. Default: SubnetType.PRIVATE

Return type

SelectedSubnets

to_string()

Returns a string representation of this construct.

Return type

str

Attributes

DEFAULT_CIDR_RANGE = '10.0.0.0/16'
DEFAULT_SUBNETS = [SubnetConfiguration(name='Public', subnet_type=<SubnetType.PUBLIC: 'PUBLIC'>), SubnetConfiguration(name='Private', subnet_type=<SubnetType.PRIVATE: 'PRIVATE'>)]
availability_zones

AZs for this VPC.

Return type

List[str]

internet_connectivity_established

Dependencies for internet connectivity.

Return type

IDependable

isolated_subnets

List of isolated subnets in this VPC.

Return type

List[ISubnet]

node

Construct tree node which offers APIs for interacting with the construct tree.

Return type

ConstructNode

private_subnets

List of private subnets in this VPC.

Return type

List[ISubnet]

public_subnets

List of public subnets in this VPC.

Return type

List[ISubnet]

stack

The stack in which this resource is defined.

Return type

Stack

vpc_cidr_block

attribute: :attribute:: true

Return type

str

vpc_cidr_block_associations

attribute: :attribute:: true

Return type

List[str]

vpc_default_network_acl

attribute: :attribute:: true

Return type

str

vpc_default_security_group

attribute: :attribute:: true

Return type

str

vpc_id

Identifier for this VPC.

Return type

str

vpc_ipv6_cidr_blocks

attribute: :attribute:: true

Return type

List[str]

vpn_gateway_id

Identifier for the VPN gateway.

Return type

Optional[str]

Static Methods

classmethod from_lookup(scope, id, *, is_default=None, tags=None, vpc_id=None, vpc_name=None)

Import an existing VPC from by querying the AWS environment this stack is deployed to.

This function only needs to be used to use VPCs not defined in your CDK application. If you are looking to share a VPC between stacks, you can pass the Vpc object between stacks and use it as normal.

See the package-level documentation of this package for constraints on importing existing VPCs.

Calling this method will lead to a lookup when the CDK CLI is executed. You can therefore not use any values that will only be available at CloudFormation execution time (i.e., Tokens).

Parameters
  • scope (Construct) –

  • id (str) –

  • options

  • is_default (Optional[bool]) – Whether to match the default VPC. Default: Don’t care whether we return the default VPC

  • tags (Optional[Mapping[str, str]]) – Tags on the VPC. The VPC must have all of these tags Default: Don’t filter on tags

  • vpc_id (Optional[str]) – The ID of the VPC. If given, will import exactly this VPC. Default: Don’t filter on vpcId

  • vpc_name (Optional[str]) – The name of the VPC. If given, will import the VPC with this name. Default: Don’t filter on vpcName

Return type

IVpc

classmethod from_vpc_attributes(scope, id, *, availability_zones, vpc_id, isolated_subnet_ids=None, isolated_subnet_names=None, isolated_subnet_route_table_ids=None, private_subnet_ids=None, private_subnet_names=None, private_subnet_route_table_ids=None, public_subnet_ids=None, public_subnet_names=None, public_subnet_route_table_ids=None, vpn_gateway_id=None)

Import an exported VPC.

Parameters
  • scope (Construct) –

  • id (str) –

  • attrs

  • availability_zones (List[str]) – List of availability zones for the subnets in this VPC.

  • vpc_id (str) – VPC’s identifier.

  • isolated_subnet_ids (Optional[List[str]]) – List of isolated subnet IDs. Must be undefined or match the availability zones in length and order.

  • isolated_subnet_names (Optional[List[str]]) – List of names for the isolated subnets. Must be undefined or have a name for every isolated subnet group.

  • isolated_subnet_route_table_ids (Optional[List[str]]) – List of IDs of routing tables for the isolated subnets. Must be undefined or have a name for every isolated subnet group.

  • private_subnet_ids (Optional[List[str]]) – List of private subnet IDs. Must be undefined or match the availability zones in length and order.

  • private_subnet_names (Optional[List[str]]) – List of names for the private subnets. Must be undefined or have a name for every private subnet group.

  • private_subnet_route_table_ids (Optional[List[str]]) – List of IDs of routing tables for the private subnets. Must be undefined or have a name for every private subnet group.

  • public_subnet_ids (Optional[List[str]]) – List of public subnet IDs. Must be undefined or match the availability zones in length and order.

  • public_subnet_names (Optional[List[str]]) – List of names for the public subnets. Must be undefined or have a name for every public subnet group.

  • public_subnet_route_table_ids (Optional[List[str]]) – List of IDs of routing tables for the public subnets. Must be undefined or have a name for every public subnet group.

  • vpn_gateway_id (Optional[str]) – VPN gateway’s identifier.

Return type

IVpc

classmethod is_construct(x)

Return whether the given object is a Construct.

Parameters

x (Any) –

Return type

bool