Namespace Amazon.CDK.AWS.EC2

Amazon EC2 Construct Library

---

AWS CDK v1 has reached End-of-Support on 2023-06-01.
This package is no longer being updated, and users should migrate to AWS CDK v2.

For more information on how to migrate, see the Migrating to AWS CDK v2 guide.

The @aws-cdk/aws-ec2 package contains primitives for setting up networking and instances.

using Amazon.CDK.AWS.EC2;

VPC

Most projects need a Virtual Private Cloud to provide security by means of network partitioning. This is achieved by creating an instance of Vpc:

var vpc = new Vpc(this, "VPC");

All default constructs require EC2 instances to be launched inside a VPC, so you should generally start by defining a VPC whenever you need to launch instances for your project.

Subnet Types

A VPC consists of one or more subnets that instances can be placed into. CDK distinguishes three different subnet types:

A default VPC configuration will create public and private subnets. However, if natGateways:0 and subnetConfiguration is undefined, default VPC configuration will create public and isolated subnets. See Advanced Subnet Configuration below for information on how to change the default subnet configuration.

Constructs using the VPC will "launch instances" (or more accurately, create Elastic Network Interfaces) into one or more of the subnets. They all accept a property called subnetSelection (sometimes called vpcSubnets) to allow you to select in what subnet to place the ENIs, usually defaulting to private subnets if the property is omitted.

If you would like to save on the cost of NAT gateways, you can use isolated subnets instead of private subnets (as described in Advanced Subnet Configuration). If you need private instances to have internet connectivity, another option is to reduce the number of NAT gateways created by setting the natGateways property to a lower value (the default is one NAT gateway per availability zone). Be aware that this may have availability implications for your application.

Control over availability zones

By default, a VPC will spread over at most 3 Availability Zones available to it. To change the number of Availability Zones that the VPC will spread over, specify the maxAzs property when defining it.

The number of Availability Zones that are available depends on the region and account of the Stack containing the VPC. If the region and account are specified on the Stack, the CLI will look up the existing Availability Zones and get an accurate count. If region and account are not specified, the stack could be deployed anywhere and it will have to make a safe choice, limiting itself to 2 Availability Zones.

Therefore, to get the VPC to spread over 3 or more availability zones, you must specify the environment where the stack will be deployed.

You can gain full control over the availability zones selection strategy by overriding the Stack's get availabilityZones() method:

// This example is only available in TypeScript

class MyStack extends Stack {

  constructor(scope: Construct, id: string, props?: StackProps) {
    super(scope, id, props);

    // ...
  }

  get availabilityZones(): string[] {
    return ['us-west-2a', 'us-west-2b'];
  }

}

Note that overriding the get availabilityZones() method will override the default behavior for all constructs defined within the Stack.

Choosing subnets for resources

When creating resources that create Elastic Network Interfaces (such as databases or instances), there is an option to choose which subnets to place them in. For example, a VPC endpoint by default is placed into a subnet in every availability zone, but you can override which subnets to use. The property is typically called one of subnets, vpcSubnets or subnetSelection.

The example below will place the endpoint into two AZs (us-east-1a and us-east-1c), in Isolated subnets:

Vpc vpc;


new InterfaceVpcEndpoint(this, "VPC Endpoint", new InterfaceVpcEndpointProps {
    Vpc = vpc,
    Service = new InterfaceVpcEndpointService("com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc", 443),
    Subnets = new SubnetSelection {
        SubnetType = SubnetType.PRIVATE_ISOLATED,
        AvailabilityZones = new [] { "us-east-1a", "us-east-1c" }
    }
});

You can also specify specific subnet objects for granular control:

Vpc vpc;
Subnet subnet1;
Subnet subnet2;


new InterfaceVpcEndpoint(this, "VPC Endpoint", new InterfaceVpcEndpointProps {
    Vpc = vpc,
    Service = new InterfaceVpcEndpointService("com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc", 443),
    Subnets = new SubnetSelection {
        Subnets = new [] { subnet1, subnet2 }
    }
});

Which subnets are selected is evaluated as follows:

Using NAT instances

By default, the Vpc construct will create NAT gateways for you, which are managed by AWS. If you would prefer to use your own managed NAT instances instead, specify a different value for the natGatewayProvider property, as follows:

// Configure the `natGatewayProvider` when defining a Vpc
var natGatewayProvider = NatProvider.Instance(new NatInstanceProps {
    InstanceType = new InstanceType("t3.small")
});

var vpc = new Vpc(this, "MyVpc", new VpcProps {
    NatGatewayProvider = natGatewayProvider,

    // The 'natGateways' parameter now controls the number of NAT instances
    NatGateways = 2
});

The construct will automatically search for the most recent NAT gateway AMI. If you prefer to use a custom AMI, use machineImage: MachineImage.genericLinux({ ... }) and configure the right AMI ID for the regions you want to deploy to.

By default, the NAT instances will route all traffic. To control what traffic gets routed, pass a custom value for defaultAllowedTraffic and access the NatInstanceProvider.connections member after having passed the NAT provider to the VPC:

InstanceType instanceType;


var provider = NatProvider.Instance(new NatInstanceProps {
    InstanceType = instanceType,
    DefaultAllowedTraffic = NatTrafficDirection.OUTBOUND_ONLY
});
new Vpc(this, "TheVPC", new VpcProps {
    NatGatewayProvider = provider
});
provider.Connections.AllowFrom(Peer.Ipv4("1.2.3.4/8"), Port.Tcp(80));

Advanced Subnet Configuration

If the default VPC configuration (public and private subnets spanning the size of the VPC) don't suffice for you, you can configure what subnets to create by specifying the subnetConfiguration property. It allows you to configure the number and size of all subnets. Specifying an advanced subnet configuration could look like this:

var vpc = new Vpc(this, "TheVPC", new VpcProps {
    // 'cidr' configures the IP range and size of the entire VPC.
    // The IP space will be divided over the configured subnets.
    Cidr = "10.0.0.0/21",

    // 'maxAzs' configures the maximum number of availability zones to use
    MaxAzs = 3,

    // 'subnetConfiguration' specifies the "subnet groups" to create.
    // Every subnet group will have a subnet for each AZ, so this
    // configuration will create `3 groups × 3 AZs = 9` subnets.
    SubnetConfiguration = new [] { new SubnetConfiguration {
        // 'subnetType' controls Internet access, as described above.
        SubnetType = SubnetType.PUBLIC,

        // 'name' is used to name this particular subnet group. You will have to
        // use the name for subnet selection if you have more than one subnet
        // group of the same type.
        Name = "Ingress",

        // 'cidrMask' specifies the IP addresses in the range of of individual
        // subnets in the group. Each of the subnets in this group will contain
        // `2^(32 address bits - 24 subnet bits) - 2 reserved addresses = 254`
        // usable IP addresses.
        //
        // If 'cidrMask' is left out the available address space is evenly
        // divided across the remaining subnet groups.
        CidrMask = 24
    }, new SubnetConfiguration {
        CidrMask = 24,
        Name = "Application",
        SubnetType = SubnetType.PRIVATE_WITH_NAT
    }, new SubnetConfiguration {
        CidrMask = 28,
        Name = "Database",
        SubnetType = SubnetType.PRIVATE_ISOLATED,

        // 'reserved' can be used to reserve IP address space. No resources will
        // be created for this subnet, but the IP range will be kept available for
        // future creation of this subnet, or even for future subdivision.
        Reserved = true
    } }
});

The example above is one possible configuration, but the user can use the constructs above to implement many other network configurations.

The Vpc from the above configuration in a Region with three availability zones will be the following:

Subnet Name	Type	IP Block	AZ	Features
IngressSubnet1	`PUBLIC`	`10.0.0.0/24`	#1	NAT Gateway
IngressSubnet2	`PUBLIC`	`10.0.1.0/24`	#2	NAT Gateway
IngressSubnet3	`PUBLIC`	`10.0.2.0/24`	#3	NAT Gateway
ApplicationSubnet1	`PRIVATE`	`10.0.3.0/24`	#1	Route to NAT in IngressSubnet1
ApplicationSubnet2	`PRIVATE`	`10.0.4.0/24`	#2	Route to NAT in IngressSubnet2
ApplicationSubnet3	`PRIVATE`	`10.0.5.0/24`	#3	Route to NAT in IngressSubnet3
DatabaseSubnet1	`ISOLATED`	`10.0.6.0/28`	#1	Only routes within the VPC
DatabaseSubnet2	`ISOLATED`	`10.0.6.16/28`	#2	Only routes within the VPC
DatabaseSubnet3	`ISOLATED`	`10.0.6.32/28`	#3	Only routes within the VPC

Accessing the Internet Gateway

If you need access to the internet gateway, you can get its ID like so:

Vpc vpc;


var igwId = vpc.InternetGatewayId;

For a VPC with only ISOLATED subnets, this value will be undefined.

This is only supported for VPCs created in the stack - currently you're unable to get the ID for imported VPCs. To do that you'd have to specifically look up the Internet Gateway by name, which would require knowing the name beforehand.

This can be useful for configuring routing using a combination of gateways: for more information see Routing below.

Routing

It's possible to add routes to any subnets using the addRoute() method. If for example you want an isolated subnet to have a static route via the default Internet Gateway created for the public subnet - perhaps for routing a VPN connection - you can do so like this:

var vpc = new Vpc(this, "VPC", new VpcProps {
    SubnetConfiguration = new [] { new SubnetConfiguration {
        SubnetType = SubnetType.PUBLIC,
        Name = "Public"
    }, new SubnetConfiguration {
        SubnetType = SubnetType.PRIVATE_ISOLATED,
        Name = "Isolated"
    } }
});

((Subnet)vpc.IsolatedSubnets[0]).AddRoute("StaticRoute", new AddRouteOptions {
    RouterId = vpc.InternetGatewayId,
    RouterType = RouterType.GATEWAY,
    DestinationCidrBlock = "8.8.8.8/32"
});

Note that we cast to Subnet here because the list of subnets only returns an ISubnet.

Reserving subnet IP space

There are situations where the IP space for a subnet or number of subnets will need to be reserved. This is useful in situations where subnets would need to be added after the vpc is originally deployed, without causing IP renumbering for existing subnets. The IP space for a subnet may be reserved by setting the reserved subnetConfiguration property to true, as shown below:

var vpc = new Vpc(this, "TheVPC", new VpcProps {
    NatGateways = 1,
    SubnetConfiguration = new [] { new SubnetConfiguration {
        CidrMask = 26,
        Name = "Public",
        SubnetType = SubnetType.PUBLIC
    }, new SubnetConfiguration {
        CidrMask = 26,
        Name = "Application1",
        SubnetType = SubnetType.PRIVATE_WITH_NAT
    }, new SubnetConfiguration {
        CidrMask = 26,
        Name = "Application2",
        SubnetType = SubnetType.PRIVATE_WITH_NAT,
        Reserved = true
    }, new SubnetConfiguration {
        CidrMask = 27,
        Name = "Database",
        SubnetType = SubnetType.PRIVATE_ISOLATED
    } }
});

In the example above, the subnet for Application2 is not actually provisioned but its IP space is still reserved. If in the future this subnet needs to be provisioned, then the reserved: true property should be removed. Reserving parts of the IP space prevents the other subnets from getting renumbered.

Sharing VPCs between stacks

If you are creating multiple Stacks inside the same CDK application, you can reuse a VPC defined in one Stack in another by simply passing the VPC instance around:

/**
 * Stack1 creates the VPC
 */
class Stack1 : Stack
{
    public Vpc Vpc { get; }

    public Stack1(App scope, string id, StackProps? props=null) : base(scope, id, props)
    {

        Vpc = new Vpc(this, "VPC");
    }
}

class Stack2Props : StackProps
{
    public IVpc Vpc { get; set; }
}

/**
 * Stack2 consumes the VPC
 */
class Stack2 : Stack
{
    public Stack2(App scope, string id, Stack2Props props) : base(scope, id, props)
    {

        // Pass the VPC to a construct that needs it
        // Pass the VPC to a construct that needs it
        new ConstructThatTakesAVpc(this, "Construct", new ConstructThatTakesAVpcProps {
            Vpc = props.Vpc
        });
    }
}

var stack1 = new Stack1(app, "Stack1");
var stack2 = new Stack2(app, "Stack2", new Stack2Props {
    Vpc = stack1.Vpc
});

Importing an existing VPC

If your VPC is created outside your CDK app, you can use Vpc.fromLookup(). The CDK CLI will search for the specified VPC in the the stack's region and account, and import the subnet configuration. Looking up can be done by VPC ID, but more flexibly by searching for a specific tag on the VPC.

Subnet types will be determined from the aws-cdk:subnet-type tag on the subnet if it exists, or the presence of a route to an Internet Gateway otherwise. Subnet names will be determined from the aws-cdk:subnet-name tag on the subnet if it exists, or will mirror the subnet type otherwise (i.e. a public subnet will have the name "Public").

The result of the Vpc.fromLookup() operation will be written to a file called cdk.context.json. You must commit this file to source control so that the lookup values are available in non-privileged environments such as CI build steps, and to ensure your template builds are repeatable.

Here's how Vpc.fromLookup() can be used:

var vpc = Vpc.FromLookup(stack, "VPC", new VpcLookupOptions {
    // This imports the default VPC but you can also
    // specify a 'vpcName' or 'tags'.
    IsDefault = true
});

Vpc.fromLookup is the recommended way to import VPCs. If for whatever reason you do not want to use the context mechanism to look up a VPC at synthesis time, you can also use Vpc.fromVpcAttributes. This has the following limitations:

Using Vpc.fromVpcAttributes() looks like this:

var vpc = Vpc.FromVpcAttributes(this, "VPC", new VpcAttributes {
    VpcId = "vpc-1234",
    AvailabilityZones = new [] { "us-east-1a", "us-east-1b" },

    // Either pass literals for all IDs
    PublicSubnetIds = new [] { "s-12345", "s-67890" },

    // OR: import a list of known length
    PrivateSubnetIds = Fn.ImportListValue("PrivateSubnetIds", 2),

    // OR: split an imported string to a list of known length
    IsolatedSubnetIds = Fn.Split(",", StringParameter.ValueForStringParameter(this, "MyParameter"), 2)
});

Allowing Connections

In AWS, all network traffic in and out of Elastic Network Interfaces (ENIs) is controlled by Security Groups. You can think of Security Groups as a firewall with a set of rules. By default, Security Groups allow no incoming (ingress) traffic and all outgoing (egress) traffic. You can add ingress rules to them to allow incoming traffic streams. To exert fine-grained control over egress traffic, set allowAllOutbound: false on the SecurityGroup, after which you can add egress traffic rules.

You can manipulate Security Groups directly:

var mySecurityGroup = new SecurityGroup(this, "SecurityGroup", new SecurityGroupProps {
    Vpc = vpc,
    Description = "Allow ssh access to ec2 instances",
    AllowAllOutbound = true
});
mySecurityGroup.AddIngressRule(Peer.AnyIpv4(), Port.Tcp(22), "allow ssh access from the world");

All constructs that create ENIs on your behalf (typically constructs that create EC2 instances or other VPC-connected resources) will all have security groups automatically assigned. Those constructs have an attribute called connections, which is an object that makes it convenient to update the security groups. If you want to allow connections between two constructs that have security groups, you have to add an Egress rule to one Security Group, and an Ingress rule to the other. The connections object will automatically take care of this for you:

ApplicationLoadBalancer loadBalancer;
AutoScalingGroup appFleet;
AutoScalingGroup dbFleet;


// Allow connections from anywhere
loadBalancer.Connections.AllowFromAnyIpv4(Port.Tcp(443), "Allow inbound HTTPS");

// The same, but an explicit IP address
loadBalancer.Connections.AllowFrom(Peer.Ipv4("1.2.3.4/32"), Port.Tcp(443), "Allow inbound HTTPS");

// Allow connection between AutoScalingGroups
appFleet.Connections.AllowTo(dbFleet, Port.Tcp(443), "App can call database");

Connection Peers

There are various classes that implement the connection peer part:

AutoScalingGroup appFleet;
AutoScalingGroup dbFleet;


// Simple connection peers
var peer = Peer.Ipv4("10.0.0.0/16");
peer = Peer.AnyIpv4();
peer = Peer.Ipv6("::0/0");
peer = Peer.AnyIpv6();
peer = Peer.PrefixList("pl-12345");
appFleet.Connections.AllowTo(peer, Port.Tcp(443), "Allow outbound HTTPS");

Any object that has a security group can itself be used as a connection peer:

AutoScalingGroup fleet1;
AutoScalingGroup fleet2;
AutoScalingGroup appFleet;


// These automatically create appropriate ingress and egress rules in both security groups
fleet1.Connections.AllowTo(fleet2, Port.Tcp(80), "Allow between fleets");

appFleet.Connections.AllowFromAnyIpv4(Port.Tcp(80), "Allow from load balancer");

Port Ranges

The connections that are allowed are specified by port ranges. A number of classes provide the connection specifier:

Port.Tcp(80);
Port.TcpRange(60000, 65535);
Port.AllTcp();
Port.AllTraffic();

NOTE: This set is not complete yet; for example, there is no library support for ICMP at the moment.
However, you can write your own classes to implement those.

Default Ports

Some Constructs have default ports associated with them. For example, the listener of a load balancer does (it's the public port), or instances of an RDS database (it's the port the database is accepting connections on).

If the object you're calling the peering method on has a default port associated with it, you can call allowDefaultPortFrom() and omit the port specifier. If the argument has an associated default port, call allowDefaultPortTo().

For example:

ApplicationListener listener;
AutoScalingGroup appFleet;
DatabaseCluster rdsDatabase;


// Port implicit in listener
listener.Connections.AllowDefaultPortFromAnyIpv4("Allow public");

// Port implicit in peer
appFleet.Connections.AllowDefaultPortTo(rdsDatabase, "Fleet can access database");

Security group rules

By default, security group wills be added inline to the security group in the output cloud formation template, if applicable. This includes any static rules by ip address and port range. This optimization helps to minimize the size of the template.

In some environments this is not desirable, for example if your security group access is controlled via tags. You can disable inline rules per security group or globally via the context key @aws-cdk/aws-ec2.securityGroupDisableInlineRules.

var mySecurityGroupWithoutInlineRules = new SecurityGroup(this, "SecurityGroup", new SecurityGroupProps {
    Vpc = vpc,
    Description = "Allow ssh access to ec2 instances",
    AllowAllOutbound = true,
    DisableInlineRules = true
});
//This will add the rule as an external cloud formation construct
mySecurityGroupWithoutInlineRules.AddIngressRule(Peer.AnyIpv4(), Port.Tcp(22), "allow ssh access from the world");

Importing an existing security group

If you know the ID and the configuration of the security group to import, you can use SecurityGroup.fromSecurityGroupId:

var sg = SecurityGroup.FromSecurityGroupId(this, "SecurityGroupImport", "sg-1234", new SecurityGroupImportOptions {
    AllowAllOutbound = true
});

Alternatively, use lookup methods to import security groups if you do not know the ID or the configuration details. Method SecurityGroup.fromLookupByName looks up a security group if the secruity group ID is unknown.

var sg = SecurityGroup.FromLookupByName(this, "SecurityGroupLookup", "security-group-name", vpc);

If the security group ID is known and configuration details are unknown, use method SecurityGroup.fromLookupById instead. This method will lookup property allowAllOutbound from the current configuration of the security group.

var sg = SecurityGroup.FromLookupById(this, "SecurityGroupLookup", "sg-1234");

The result of SecurityGroup.fromLookupByName and SecurityGroup.fromLookupById operations will be written to a file called cdk.context.json. You must commit this file to source control so that the lookup values are available in non-privileged environments such as CI build steps, and to ensure your template builds are repeatable.

Cross Stack Connections

If you are attempting to add a connection from a peer in one stack to a peer in a different stack, sometimes it is necessary to ensure that you are making the connection in a specific stack in order to avoid a cyclic reference. If there are no other dependencies between stacks then it will not matter in which stack you make the connection, but if there are existing dependencies (i.e. stack1 already depends on stack2), then it is important to make the connection in the dependent stack (i.e. stack1).

Whenever you make a connections function call, the ingress and egress security group rules will be added to the stack that the calling object exists in. So if you are doing something like peer1.connections.allowFrom(peer2), then the security group rules (both ingress and egress) will be created in peer1's Stack.

As an example, if we wanted to allow a connection from a security group in one stack (egress) to a security group in a different stack (ingress), we would make the connection like:

If Stack1 depends on Stack2

// Stack 1
Stack stack1;
Stack stack2;


var sg1 = new SecurityGroup(stack1, "SG1", new SecurityGroupProps {
    AllowAllOutbound = false,  // if this is `true` then no egress rule will be created
    Vpc = vpc
});

// Stack 2
var sg2 = new SecurityGroup(stack2, "SG2", new SecurityGroupProps {
    AllowAllOutbound = false,  // if this is `true` then no egress rule will be created
    Vpc = vpc
});

// `connections.allowTo` on `sg1` since we want the
// rules to be created in Stack1
sg1.Connections.AllowTo(sg2, Port.Tcp(3333));

In this case both the Ingress Rule for sg2 and the Egress Rule for sg1 will both be created in Stack 1 which avoids the cyclic reference.

If Stack2 depends on Stack1

// Stack 1
Stack stack1;
Stack stack2;


var sg1 = new SecurityGroup(stack1, "SG1", new SecurityGroupProps {
    AllowAllOutbound = false,  // if this is `true` then no egress rule will be created
    Vpc = vpc
});

// Stack 2
var sg2 = new SecurityGroup(stack2, "SG2", new SecurityGroupProps {
    AllowAllOutbound = false,  // if this is `true` then no egress rule will be created
    Vpc = vpc
});

// `connections.allowFrom` on `sg2` since we want the
// rules to be created in Stack2
sg2.Connections.AllowFrom(sg1, Port.Tcp(3333));

In this case both the Ingress Rule for sg2 and the Egress Rule for sg1 will both be created in Stack 2 which avoids the cyclic reference.

Machine Images (AMIs)

AMIs control the OS that gets launched when you start your EC2 instance. The EC2 library contains constructs to select the AMI you want to use.

Depending on the type of AMI, you select it a different way. Here are some examples of things you might want to use:

// Pick the right Amazon Linux edition. All arguments shown are optional
// and will default to these values when omitted.
var amznLinux = MachineImage.LatestAmazonLinux(new AmazonLinuxImageProps {
    Generation = AmazonLinuxGeneration.AMAZON_LINUX,
    Edition = AmazonLinuxEdition.STANDARD,
    Virtualization = AmazonLinuxVirt.HVM,
    Storage = AmazonLinuxStorage.GENERAL_PURPOSE,
    CpuType = AmazonLinuxCpuType.X86_64
});

// Pick a Windows edition to use
var windows = MachineImage.LatestWindows(WindowsVersion.WINDOWS_SERVER_2019_ENGLISH_FULL_BASE);

// Read AMI id from SSM parameter store
var ssm = MachineImage.FromSsmParameter("/my/ami", new SsmParameterImageOptions { Os = OperatingSystemType.LINUX });

// Look up the most recent image matching a set of AMI filters.
// In this case, look up the NAT instance AMI, by using a wildcard
// in the 'name' field:
var natAmi = MachineImage.Lookup(new LookupMachineImageProps {
    Name = "amzn-ami-vpc-nat-*",
    Owners = new [] { "amazon" }
});

// For other custom (Linux) images, instantiate a `GenericLinuxImage` with
// a map giving the AMI to in for each region:
var linux = MachineImage.GenericLinux(new Dictionary<string, string> {
    { "us-east-1", "ami-97785bed" },
    { "eu-west-1", "ami-12345678" }
});

// For other custom (Windows) images, instantiate a `GenericWindowsImage` with
// a map giving the AMI to in for each region:
var genericWindows = MachineImage.GenericWindows(new Dictionary<string, string> {
    { "us-east-1", "ami-97785bed" },
    { "eu-west-1", "ami-12345678" }
});

NOTE: The AMIs selected by <code>MachineImage.lookup()</code> will be cached in

cdk.context.json, so that your AutoScalingGroup instances aren't replaced while you are making unrelated changes to your CDK app.

To query for the latest AMI again, remove the relevant cache entry from cdk.context.json, or use the cdk context command. For more information, see Runtime Context in the CDK developer guide.

MachineImage.genericLinux(), MachineImage.genericWindows() will use CfnMapping in an agnostic stack.

Special VPC configurations

VPN connections to a VPC

Create your VPC with VPN connections by specifying the vpnConnections props (keys are construct ids):

var vpc = new Vpc(this, "MyVpc", new VpcProps {
    VpnConnections = new Dictionary<string, VpnConnectionOptions> {
        { "dynamic", new VpnConnectionOptions {  // Dynamic routing (BGP)
            Ip = "1.2.3.4" } },
        { "static", new VpnConnectionOptions {  // Static routing
            Ip = "4.5.6.7",
            StaticRoutes = new [] { "192.168.10.0/24", "192.168.20.0/24" } } }
    }
});

To create a VPC that can accept VPN connections, set vpnGateway to true:

var vpc = new Vpc(this, "MyVpc", new VpcProps {
    VpnGateway = true
});

VPN connections can then be added:

vpc.AddVpnConnection("Dynamic", new VpnConnectionOptions {
    Ip = "1.2.3.4"
});

By default, routes will be propagated on the route tables associated with the private subnets. If no private subnets exist, isolated subnets are used. If no isolated subnets exist, public subnets are used. Use the Vpc property vpnRoutePropagation to customize this behavior.

VPN connections expose metrics (cloudwatch.Metric) across all tunnels in the account/region and per connection:

// Across all tunnels in the account/region
var allDataOut = VpnConnection.MetricAllTunnelDataOut();

// For a specific vpn connection
var vpnConnection = vpc.AddVpnConnection("Dynamic", new VpnConnectionOptions {
    Ip = "1.2.3.4"
});
var state = vpnConnection.MetricTunnelState();

VPC endpoints

A VPC endpoint enables you to privately connect your VPC to supported AWS services and VPC endpoint services powered by PrivateLink without requiring an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Instances in your VPC do not require public IP addresses to communicate with resources in the service. Traffic between your VPC and the other service does not leave the Amazon network.

Endpoints are virtual devices. They are horizontally scaled, redundant, and highly available VPC components that allow communication between instances in your VPC and services without imposing availability risks or bandwidth constraints on your network traffic.

// Add gateway endpoints when creating the VPC
var vpc = new Vpc(this, "MyVpc", new VpcProps {
    GatewayEndpoints = new Dictionary<string, GatewayVpcEndpointOptions> {
        { "S3", new GatewayVpcEndpointOptions {
            Service = GatewayVpcEndpointAwsService.S3
        } }
    }
});

// Alternatively gateway endpoints can be added on the VPC
var dynamoDbEndpoint = vpc.AddGatewayEndpoint("DynamoDbEndpoint", new GatewayVpcEndpointOptions {
    Service = GatewayVpcEndpointAwsService.DYNAMODB
});

// This allows to customize the endpoint policy
dynamoDbEndpoint.AddToPolicy(
new PolicyStatement(new PolicyStatementProps {  // Restrict to listing and describing tables
    Principals = new [] { new AnyPrincipal() },
    Actions = new [] { "dynamodb:DescribeTable", "dynamodb:ListTables" },
    Resources = new [] { "*" } }));

// Add an interface endpoint
vpc.AddInterfaceEndpoint("EcrDockerEndpoint", new InterfaceVpcEndpointOptions {
    Service = InterfaceVpcEndpointAwsService.ECR_DOCKER
});

By default, CDK will place a VPC endpoint in one subnet per AZ. If you wish to override the AZs CDK places the VPC endpoint in, use the subnets parameter as follows:

Vpc vpc;


new InterfaceVpcEndpoint(this, "VPC Endpoint", new InterfaceVpcEndpointProps {
    Vpc = vpc,
    Service = new InterfaceVpcEndpointService("com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc", 443),
    // Choose which availability zones to place the VPC endpoint in, based on
    // available AZs
    Subnets = new SubnetSelection {
        AvailabilityZones = new [] { "us-east-1a", "us-east-1c" }
    }
});

Per the AWS documentation, not all VPC endpoint services are available in all AZs. If you specify the parameter lookupSupportedAzs, CDK attempts to discover which AZs an endpoint service is available in, and will ensure the VPC endpoint is not placed in a subnet that doesn't match those AZs. These AZs will be stored in cdk.context.json.

Vpc vpc;


new InterfaceVpcEndpoint(this, "VPC Endpoint", new InterfaceVpcEndpointProps {
    Vpc = vpc,
    Service = new InterfaceVpcEndpointService("com.amazonaws.vpce.us-east-1.vpce-svc-uuddlrlrbastrtsvc", 443),
    // Choose which availability zones to place the VPC endpoint in, based on
    // available AZs
    LookupSupportedAzs = true
});

Pre-defined AWS services are defined in the InterfaceVpcEndpointAwsService class, and can be used to create VPC endpoints without having to configure name, ports, etc. For example, a Keyspaces endpoint can be created for use in your VPC:

Vpc vpc;


new InterfaceVpcEndpoint(this, "VPC Endpoint", new InterfaceVpcEndpointProps {
    Vpc = vpc,
    Service = InterfaceVpcEndpointAwsService.KEYSPACES
});

Security groups for interface VPC endpoints

By default, interface VPC endpoints create a new security group and traffic is not automatically allowed from the VPC CIDR.

Use the connections object to allow traffic to flow to the endpoint:

InterfaceVpcEndpoint myEndpoint;


myEndpoint.Connections.AllowDefaultPortFromAnyIpv4();

Alternatively, existing security groups can be used by specifying the securityGroups prop.

VPC endpoint services

A VPC endpoint service enables you to expose a Network Load Balancer(s) as a provider service to consumers, who connect to your service over a VPC endpoint. You can restrict access to your service via allowed principals (anything that extends ArnPrincipal), and require that new connections be manually accepted.

NetworkLoadBalancer networkLoadBalancer1;
NetworkLoadBalancer networkLoadBalancer2;


new VpcEndpointService(this, "EndpointService", new VpcEndpointServiceProps {
    VpcEndpointServiceLoadBalancers = new [] { networkLoadBalancer1, networkLoadBalancer2 },
    AcceptanceRequired = true,
    AllowedPrincipals = new [] { new ArnPrincipal("arn:aws:iam::123456789012:root") }
});

Endpoint services support private DNS, which makes it easier for clients to connect to your service by automatically setting up DNS in their VPC. You can enable private DNS on an endpoint service like so:

using Amazon.CDK.AWS.Route53;
HostedZone zone;
VpcEndpointService vpces;


new VpcEndpointServiceDomainName(this, "EndpointDomain", new VpcEndpointServiceDomainNameProps {
    EndpointService = vpces,
    DomainName = "my-stuff.aws-cdk.dev",
    PublicHostedZone = zone
});

Note: The domain name must be owned (registered through Route53) by the account the endpoint service is in, or delegated to the account. The VpcEndpointServiceDomainName will handle the AWS side of domain verification, the process for which can be found here

Client VPN endpoint

AWS Client VPN is a managed client-based VPN service that enables you to securely access your AWS resources and resources in your on-premises network. With Client VPN, you can access your resources from any location using an OpenVPN-based VPN client.

Use the addClientVpnEndpoint() method to add a client VPN endpoint to a VPC:

vpc.AddClientVpnEndpoint("Endpoint", new ClientVpnEndpointOptions {
    Cidr = "10.100.0.0/16",
    ServerCertificateArn = "arn:aws:acm:us-east-1:123456789012:certificate/server-certificate-id",
    // Mutual authentication
    ClientCertificateArn = "arn:aws:acm:us-east-1:123456789012:certificate/client-certificate-id",
    // User-based authentication
    UserBasedAuthentication = ClientVpnUserBasedAuthentication.Federated(samlProvider)
});

The endpoint must use at least one authentication method:

If user-based authentication is used, the self-service portal URL is made available via a CloudFormation output.

By default, a new security group is created, and logging is enabled. Moreover, a rule to authorize all users to the VPC CIDR is created.

To customize authorization rules, set the authorizeAllUsersToVpcCidr prop to false and use addAuthorizationRule():

var endpoint = vpc.AddClientVpnEndpoint("Endpoint", new ClientVpnEndpointOptions {
    Cidr = "10.100.0.0/16",
    ServerCertificateArn = "arn:aws:acm:us-east-1:123456789012:certificate/server-certificate-id",
    UserBasedAuthentication = ClientVpnUserBasedAuthentication.Federated(samlProvider),
    AuthorizeAllUsersToVpcCidr = false
});

endpoint.AddAuthorizationRule("Rule", new ClientVpnAuthorizationRuleOptions {
    Cidr = "10.0.10.0/32",
    GroupId = "group-id"
});

Use addRoute() to configure network routes:

var endpoint = vpc.AddClientVpnEndpoint("Endpoint", new ClientVpnEndpointOptions {
    Cidr = "10.100.0.0/16",
    ServerCertificateArn = "arn:aws:acm:us-east-1:123456789012:certificate/server-certificate-id",
    UserBasedAuthentication = ClientVpnUserBasedAuthentication.Federated(samlProvider)
});

// Client-to-client access
endpoint.AddRoute("Route", new ClientVpnRouteOptions {
    Cidr = "10.100.0.0/16",
    Target = ClientVpnRouteTarget.Local()
});

Use the connections object of the endpoint to allow traffic to other security groups.

Instances

You can use the Instance class to start up a single EC2 instance. For production setups, we recommend you use an AutoScalingGroup from the aws-autoscaling module instead, as AutoScalingGroups will take care of restarting your instance if it ever fails.

Vpc vpc;
InstanceType instanceType;


// AWS Linux
// AWS Linux
new Instance(this, "Instance1", new InstanceProps {
    Vpc = vpc,
    InstanceType = instanceType,
    MachineImage = new AmazonLinuxImage()
});

// AWS Linux 2
// AWS Linux 2
new Instance(this, "Instance2", new InstanceProps {
    Vpc = vpc,
    InstanceType = instanceType,
    MachineImage = new AmazonLinuxImage(new AmazonLinuxImageProps {
        Generation = AmazonLinuxGeneration.AMAZON_LINUX_2
    })
});

// AWS Linux 2 with kernel 5.x
// AWS Linux 2 with kernel 5.x
new Instance(this, "Instance3", new InstanceProps {
    Vpc = vpc,
    InstanceType = instanceType,
    MachineImage = new AmazonLinuxImage(new AmazonLinuxImageProps {
        Generation = AmazonLinuxGeneration.AMAZON_LINUX_2,
        Kernel = AmazonLinuxKernel.KERNEL5_X
    })
});

// AWS Linux 2022
// AWS Linux 2022
new Instance(this, "Instance4", new InstanceProps {
    Vpc = vpc,
    InstanceType = instanceType,
    MachineImage = new AmazonLinuxImage(new AmazonLinuxImageProps {
        Generation = AmazonLinuxGeneration.AMAZON_LINUX_2022
    })
});

Configuring Instances using CloudFormation Init (cfn-init)

CloudFormation Init allows you to configure your instances by writing files to them, installing software packages, starting services and running arbitrary commands. By default, if any of the instance setup commands throw an error; the deployment will fail and roll back to the previously known good state. The following documentation also applies to AutoScalingGroups.

For the full set of capabilities of this system, see the documentation for AWS::CloudFormation::Init. Here is an example of applying some configuration to an instance:

Vpc vpc;
InstanceType instanceType;
IMachineImage machineImage;


new Instance(this, "Instance", new InstanceProps {
    Vpc = vpc,
    InstanceType = instanceType,
    MachineImage = machineImage,

    // Showing the most complex setup, if you have simpler requirements
    // you can use `CloudFormationInit.fromElements()`.
    Init = CloudFormationInit.FromConfigSets(new ConfigSetProps {
        ConfigSets = new Dictionary<string, string[]> {
            // Applies the configs below in this order
            { "default", new [] { "yumPreinstall", "config" } }
        },
        Configs = new Dictionary<string, InitConfig> {
            { "yumPreinstall", new InitConfig(new [] { InitPackage.Yum("git") }) },
            { "config", new InitConfig(new [] { InitFile.FromObject("/etc/stack.json", new Dictionary<string, object> {
                { "stackId", Stack.Of(this).StackId },
                { "stackName", Stack.Of(this).StackName },
                { "region", Stack.Of(this).Region }
            }), InitGroup.FromName("my-group"), InitUser.FromName("my-user"), InitPackage.Rpm("http://mirrors.ukfast.co.uk/sites/dl.fedoraproject.org/pub/epel/8/Everything/x86_64/Packages/r/rubygem-git-1.5.0-2.el8.noarch.rpm") }) }
        }
    }),
    InitOptions = new ApplyCloudFormationInitOptions {
        // Optional, which configsets to activate (['default'] by default)
        ConfigSets = new [] { "default" },

        // Optional, how long the installation is expected to take (5 minutes by default)
        Timeout = Duration.Minutes(30),

        // Optional, whether to include the --url argument when running cfn-init and cfn-signal commands (false by default)
        IncludeUrl = true,

        // Optional, whether to include the --role argument when running cfn-init and cfn-signal commands (false by default)
        IncludeRole = true
    }
});

You can have services restarted after the init process has made changes to the system. To do that, instantiate an InitServiceRestartHandle and pass it to the config elements that need to trigger the restart and the service itself. For example, the following config writes a config file for nginx, extracts an archive to the root directory, and then restarts nginx so that it picks up the new config and files:

Bucket myBucket;


var handle = new InitServiceRestartHandle();

CloudFormationInit.FromElements(InitFile.FromString("/etc/nginx/nginx.conf", "...", new InitFileOptions { ServiceRestartHandles = new [] { handle } }), InitSource.FromS3Object("/var/www/html", myBucket, "html.zip", new InitSourceOptions { ServiceRestartHandles = new [] { handle } }), InitService.Enable("nginx", new InitServiceOptions {
    ServiceRestartHandle = handle
}));

Bastion Hosts

A bastion host functions as an instance used to access servers and resources in a VPC without open up the complete VPC on a network level. You can use bastion hosts using a standard SSH connection targeting port 22 on the host. As an alternative, you can connect the SSH connection feature of AWS Systems Manager Session Manager, which does not need an opened security group. (https://aws.amazon.com/about-aws/whats-new/2019/07/session-manager-launches-tunneling-support-for-ssh-and-scp/)

A default bastion host for use via SSM can be configured like:

var host = new BastionHostLinux(this, "BastionHost", new BastionHostLinuxProps { Vpc = vpc });

If you want to connect from the internet using SSH, you need to place the host into a public subnet. You can then configure allowed source hosts.

var host = new BastionHostLinux(this, "BastionHost", new BastionHostLinuxProps {
    Vpc = vpc,
    SubnetSelection = new SubnetSelection { SubnetType = SubnetType.PUBLIC }
});
host.AllowSshAccessFrom(Peer.Ipv4("1.2.3.4/32"));

As there are no SSH public keys deployed on this machine, you need to use EC2 Instance Connect with the command aws ec2-instance-connect send-ssh-public-key to provide your SSH public key.

EBS volume for the bastion host can be encrypted like:

var host = new BastionHostLinux(this, "BastionHost", new BastionHostLinuxProps {
    Vpc = vpc,
    BlockDevices = new [] { new BlockDevice {
        DeviceName = "EBSBastionHost",
        Volume = BlockDeviceVolume.Ebs(10, new EbsDeviceOptions {
            Encrypted = true
        })
    } }
});

Block Devices

To add EBS block device mappings, specify the blockDevices property. The following example sets the EBS-backed root device (/dev/sda1) size to 50 GiB, and adds another EBS-backed device mapped to /dev/sdm that is 100 GiB in size:

Vpc vpc;
InstanceType instanceType;
IMachineImage machineImage;


new Instance(this, "Instance", new InstanceProps {
    Vpc = vpc,
    InstanceType = instanceType,
    MachineImage = machineImage,

    // ...

    BlockDevices = new [] { new BlockDevice {
        DeviceName = "/dev/sda1",
        Volume = BlockDeviceVolume.Ebs(50)
    }, new BlockDevice {
        DeviceName = "/dev/sdm",
        Volume = BlockDeviceVolume.Ebs(100)
    } }
});

It is also possible to encrypt the block devices. In this example we will create an customer managed key encrypted EBS-backed root device:

using Amazon.CDK.AWS.KMS;

Vpc vpc;
InstanceType instanceType;
IMachineImage machineImage;


var kmsKey = new Key(this, "KmsKey");

new Instance(this, "Instance", new InstanceProps {
    Vpc = vpc,
    InstanceType = instanceType,
    MachineImage = machineImage,

    // ...

    BlockDevices = new [] { new BlockDevice {
        DeviceName = "/dev/sda1",
        Volume = BlockDeviceVolume.Ebs(50, new EbsDeviceOptions {
            Encrypted = true,
            KmsKey = kmsKey
        })
    } }
});

Volumes

Whereas a BlockDeviceVolume is an EBS volume that is created and destroyed as part of the creation and destruction of a specific instance. A Volume is for when you want an EBS volume separate from any particular instance. A Volume is an EBS block device that can be attached to, or detached from, any instance at any time. Some types of Volumes can also be attached to multiple instances at the same time to allow you to have shared storage between those instances.

A notable restriction is that a Volume can only be attached to instances in the same availability zone as the Volume itself.

The following demonstrates how to create a 500 GiB encrypted Volume in the us-west-2a availability zone, and give a role the ability to attach that Volume to a specific instance:

Instance instance;
Role role;


var volume = new Volume(this, "Volume", new VolumeProps {
    AvailabilityZone = "us-west-2a",
    Size = Size.Gibibytes(500),
    Encrypted = true
});

volume.GrantAttachVolume(role, new [] { instance });

Instances Attaching Volumes to Themselves

If you need to grant an instance the ability to attach/detach an EBS volume to/from itself, then using grantAttachVolume and grantDetachVolume as outlined above will lead to an unresolvable circular reference between the instance role and the instance. In this case, use grantAttachVolumeByResourceTag and grantDetachVolumeByResourceTag as follows:

Instance instance;
Volume volume;


var attachGrant = volume.GrantAttachVolumeByResourceTag(instance.GrantPrincipal, new [] { instance });
var detachGrant = volume.GrantDetachVolumeByResourceTag(instance.GrantPrincipal, new [] { instance });

Attaching Volumes

The Amazon EC2 documentation for Linux Instances and Windows Instances contains information on how to attach and detach your Volumes to/from instances, and how to format them for use.

The following is a sample skeleton of EC2 UserData that can be used to attach a Volume to the Linux instance that it is running on:

Instance instance;
Volume volume;


volume.GrantAttachVolumeByResourceTag(instance.GrantPrincipal, new [] { instance });
var targetDevice = "/dev/xvdz";
instance.UserData.AddCommands("TOKEN=$(curl -SsfX PUT \"http://169.254.169.254/latest/api/token\" -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\")", "INSTANCE_ID=$(curl -SsfH \"X-aws-ec2-metadata-token: $TOKEN\" http://169.254.169.254/latest/meta-data/instance-id)", $"aws --region {Stack.of(this).region} ec2 attach-volume --volume-id {volume.volumeId} --instance-id $INSTANCE_ID --device {targetDevice}", $"while ! test -e {targetDevice}; do sleep 1; done");

Tagging Volumes

You can configure tag propagation on volume creation.

Vpc vpc;
InstanceType instanceType;
IMachineImage machineImage;


new Instance(this, "Instance", new InstanceProps {
    Vpc = vpc,
    MachineImage = machineImage,
    InstanceType = instanceType,
    PropagateTagsToVolumeOnCreation = true
});

Configuring Instance Metadata Service (IMDS)

Toggling IMDSv1

You can configure EC2 Instance Metadata Service options to either allow both IMDSv1 and IMDSv2 or enforce IMDSv2 when interacting with the IMDS.

To do this for a single Instance, you can use the requireImdsv2 property. The example below demonstrates IMDSv2 being required on a single Instance:

Vpc vpc;
InstanceType instanceType;
IMachineImage machineImage;


new Instance(this, "Instance", new InstanceProps {
    Vpc = vpc,
    InstanceType = instanceType,
    MachineImage = machineImage,

    // ...

    RequireImdsv2 = true
});

You can also use the either the InstanceRequireImdsv2Aspect for EC2 instances or the LaunchTemplateRequireImdsv2Aspect for EC2 launch templates to apply the operation to multiple instances or launch templates, respectively.

The following example demonstrates how to use the InstanceRequireImdsv2Aspect to require IMDSv2 for all EC2 instances in a stack:

var aspect = new InstanceRequireImdsv2Aspect();
Aspects.Of(this).Add(aspect);

VPC Flow Logs

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to Amazon CloudWatch Logs and Amazon S3. After you've created a flow log, you can retrieve and view its data in the chosen destination. (https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html).

By default, a flow log will be created with CloudWatch Logs as the destination.

You can create a flow log like this:

Vpc vpc;


new FlowLog(this, "FlowLog", new FlowLogProps {
    ResourceType = FlowLogResourceType.FromVpc(vpc)
});

Or you can add a Flow Log to a VPC by using the addFlowLog method like this:

var vpc = new Vpc(this, "Vpc");

vpc.AddFlowLog("FlowLog");

You can also add multiple flow logs with different destinations.

var vpc = new Vpc(this, "Vpc");

vpc.AddFlowLog("FlowLogS3", new FlowLogOptions {
    Destination = FlowLogDestination.ToS3()
});

vpc.AddFlowLog("FlowLogCloudWatch", new FlowLogOptions {
    TrafficType = FlowLogTrafficType.REJECT
});

By default, the CDK will create the necessary resources for the destination. For the CloudWatch Logs destination it will create a CloudWatch Logs Log Group as well as the IAM role with the necessary permissions to publish to the log group. In the case of an S3 destination, it will create the S3 bucket.

If you want to customize any of the destination resources you can provide your own as part of the destination.

CloudWatch Logs

Vpc vpc;


var logGroup = new LogGroup(this, "MyCustomLogGroup");

var role = new Role(this, "MyCustomRole", new RoleProps {
    AssumedBy = new ServicePrincipal("vpc-flow-logs.amazonaws.com")
});

new FlowLog(this, "FlowLog", new FlowLogProps {
    ResourceType = FlowLogResourceType.FromVpc(vpc),
    Destination = FlowLogDestination.ToCloudWatchLogs(logGroup, role)
});

Vpc vpc;


var bucket = new Bucket(this, "MyCustomBucket");

new FlowLog(this, "FlowLog", new FlowLogProps {
    ResourceType = FlowLogResourceType.FromVpc(vpc),
    Destination = FlowLogDestination.ToS3(bucket)
});

new FlowLog(this, "FlowLogWithKeyPrefix", new FlowLogProps {
    ResourceType = FlowLogResourceType.FromVpc(vpc),
    Destination = FlowLogDestination.ToS3(bucket, "prefix/")
});

User Data

User data enables you to run a script when your instances start up. In order to configure these scripts you can add commands directly to the script or you can use the UserData's convenience functions to aid in the creation of your script.

A user data could be configured to run a script found in an asset through the following:

using Amazon.CDK.AWS.S3.Assets;

Instance instance;


var asset = new Asset(this, "Asset", new AssetProps {
    Path = "./configure.sh"
});

var localPath = instance.UserData.AddS3DownloadCommand(new S3DownloadOptions {
    Bucket = asset.Bucket,
    BucketKey = asset.S3ObjectKey,
    Region = "us-east-1"
});
instance.UserData.AddExecuteFileCommand(new ExecuteFileOptions {
    FilePath = localPath,
    Arguments = "--verbose -y"
});
asset.GrantRead(instance.Role);

Multipart user data

In addition, to above the MultipartUserData can be used to change instance startup behavior. Multipart user data are composed from separate parts forming archive. The most common parts are scripts executed during instance set-up. However, there are other kinds, too.

The advantage of multipart archive is in flexibility when it's needed to add additional parts or to use specialized parts to fine tune instance startup. Some services (like AWS Batch) support only MultipartUserData.

The parts can be executed at different moment of instance start-up and can serve a different purpose. This is controlled by contentType property. For common scripts, text/x-shellscript; charset="utf-8" can be used as content type.

In order to create archive the MultipartUserData has to be instantiated. Than, user can add parts to multipart archive using addPart. The MultipartBody contains methods supporting creation of body parts.

If the very custom part is required, it can be created using MultipartUserData.fromRawBody, in this case full control over content type, transfer encoding, and body properties is given to the user.

Below is an example for creating multipart user data with single body part responsible for installing awscli and configuring maximum size of storage used by Docker containers:

var bootHookConf = UserData.ForLinux();
bootHookConf.AddCommands("cloud-init-per once docker_options echo 'OPTIONS=\"${OPTIONS} --storage-opt dm.basesize=40G\"' >> /etc/sysconfig/docker");

var setupCommands = UserData.ForLinux();
setupCommands.AddCommands("sudo yum install awscli && echo Packages installed らと > /var/tmp/setup");

var multipartUserData = new MultipartUserData();
// The docker has to be configured at early stage, so content type is overridden to boothook
multipartUserData.AddPart(MultipartBody.FromUserData(bootHookConf, "text/cloud-boothook; charset=\"us-ascii\""));
// Execute the rest of setup
multipartUserData.AddPart(MultipartBody.FromUserData(setupCommands));

new LaunchTemplate(this, "", new LaunchTemplateProps {
    UserData = multipartUserData,
    BlockDevices = new [] {  }
});

For more information see Specifying Multiple User Data Blocks Using a MIME Multi Part Archive

Using add*Command on MultipartUserData

To use the add*Command methods, that are inherited from the UserData interface, on MultipartUserData you must add a part to the MultipartUserData and designate it as the reciever for these methods. This is accomplished by using the addUserDataPart() method on MultipartUserData with the makeDefault argument set to true:

var multipartUserData = new MultipartUserData();
var commandsUserData = UserData.ForLinux();
multipartUserData.AddUserDataPart(commandsUserData, MultipartBody.SHELL_SCRIPT, true);

// Adding commands to the multipartUserData adds them to commandsUserData, and vice-versa.
multipartUserData.AddCommands("touch /root/multi.txt");
commandsUserData.AddCommands("touch /root/userdata.txt");

When used on an EC2 instance, the above multipartUserData will create both multi.txt and userdata.txt in /root.

Importing existing subnet

To import an existing Subnet, call Subnet.fromSubnetAttributes() or Subnet.fromSubnetId(). Only if you supply the subnet's Availability Zone and Route Table Ids when calling Subnet.fromSubnetAttributes() will you be able to use the CDK features that use these values (such as selecting one subnet per AZ).

Importing an existing subnet looks like this:

// Supply all properties
var subnet1 = Subnet.FromSubnetAttributes(this, "SubnetFromAttributes", new SubnetAttributes {
    SubnetId = "s-1234",
    AvailabilityZone = "pub-az-4465",
    RouteTableId = "rt-145"
});

// Supply only subnet id
var subnet2 = Subnet.FromSubnetId(this, "SubnetFromId", "s-1234");

Launch Templates

A Launch Template is a standardized template that contains the configuration information to launch an instance. They can be used when launching instances on their own, through Amazon EC2 Auto Scaling, EC2 Fleet, and Spot Fleet. Launch templates enable you to store launch parameters so that you do not have to specify them every time you launch an instance. For information on Launch Templates please see the official documentation.

The following demonstrates how to create a launch template with an Amazon Machine Image, and security group.

Vpc vpc;


var template = new LaunchTemplate(this, "LaunchTemplate", new LaunchTemplateProps {
    MachineImage = MachineImage.LatestAmazonLinux(),
    SecurityGroup = new SecurityGroup(this, "LaunchTemplateSG", new SecurityGroupProps {
        Vpc = vpc
    })
});

Detailed Monitoring

The following demonstrates how to enable Detailed Monitoring for an EC2 instance. Keep in mind that Detailed Monitoring results in additional charges.

Vpc vpc;
InstanceType instanceType;


new Instance(this, "Instance1", new InstanceProps {
    Vpc = vpc,
    InstanceType = instanceType,
    MachineImage = new AmazonLinuxImage(),
    DetailedMonitoring = true
});

Classes

AclCidr	Either an IPv4 or an IPv6 CIDR.
AclCidrConfig	Acl Configuration for CIDR.
AclIcmp	Properties to create Icmp.
AclPortRange	Properties to create PortRange.
AclTraffic	The traffic that is configured using a Network ACL entry.
AclTrafficConfig	Acl Configuration for traffic.
Action	What action to apply to traffic matching the ACL.
AddRouteOptions	Options for adding a new route to a subnet.
AmazonLinuxCpuType	CPU type.
AmazonLinuxEdition	Amazon Linux edition.
AmazonLinuxGeneration	What generation of Amazon Linux to use.
AmazonLinuxImage	Selects the latest version of Amazon Linux.
AmazonLinuxImageProps	Amazon Linux image properties.
AmazonLinuxKernel	Amazon Linux Kernel.
AmazonLinuxStorage
AmazonLinuxVirt	Virtualization type for Amazon Linux.
ApplyCloudFormationInitOptions	Options for applying CloudFormation init to an instance or instance group.
AttachInitOptions	Options for attaching a CloudFormationInit to a resource.
BastionHostLinux	This creates a linux bastion host you can use to connect to other instances or services in your VPC.
BastionHostLinuxProps	Properties of the bastion host.
BlockDevice	Block device.
BlockDeviceVolume	Describes a block device mapping for an EC2 instance or Auto Scaling group.
CfnCapacityReservation	A CloudFormation `AWS::EC2::CapacityReservation`.
CfnCapacityReservation.TagSpecificationProperty	An array of key-value pairs to apply to this resource.
CfnCapacityReservationFleet	A CloudFormation `AWS::EC2::CapacityReservationFleet`.
CfnCapacityReservationFleet.InstanceTypeSpecificationProperty	Specifies information about an instance type to use in a Capacity Reservation Fleet.
CfnCapacityReservationFleet.TagSpecificationProperty	The tags to apply to a resource when the resource is being created.
CfnCapacityReservationFleetProps	Properties for defining a `CfnCapacityReservationFleet`.
CfnCapacityReservationProps	Properties for defining a `CfnCapacityReservation`.
CfnCarrierGateway	A CloudFormation `AWS::EC2::CarrierGateway`.
CfnCarrierGatewayProps	Properties for defining a `CfnCarrierGateway`.
CfnClientVpnAuthorizationRule	A CloudFormation `AWS::EC2::ClientVpnAuthorizationRule`.
CfnClientVpnAuthorizationRuleProps	Properties for defining a `CfnClientVpnAuthorizationRule`.
CfnClientVpnEndpoint	A CloudFormation `AWS::EC2::ClientVpnEndpoint`.
CfnClientVpnEndpoint.CertificateAuthenticationRequestProperty	Information about the client certificate to be used for authentication.
CfnClientVpnEndpoint.ClientAuthenticationRequestProperty	Describes the authentication method to be used by a Client VPN endpoint.
CfnClientVpnEndpoint.ClientConnectOptionsProperty	Indicates whether client connect options are enabled.
CfnClientVpnEndpoint.ClientLoginBannerOptionsProperty	Options for enabling a customizable text banner that will be displayed on AWS provided clients when a VPN session is established.
CfnClientVpnEndpoint.ConnectionLogOptionsProperty	Describes the client connection logging options for the Client VPN endpoint.
CfnClientVpnEndpoint.DirectoryServiceAuthenticationRequestProperty	Describes the Active Directory to be used for client authentication.
CfnClientVpnEndpoint.FederatedAuthenticationRequestProperty	The IAM SAML identity provider used for federated authentication.
CfnClientVpnEndpoint.TagSpecificationProperty	The tags to apply to a resource when the resource is being created.
CfnClientVpnEndpointProps	Properties for defining a `CfnClientVpnEndpoint`.
CfnClientVpnRoute	A CloudFormation `AWS::EC2::ClientVpnRoute`.
CfnClientVpnRouteProps	Properties for defining a `CfnClientVpnRoute`.
CfnClientVpnTargetNetworkAssociation	A CloudFormation `AWS::EC2::ClientVpnTargetNetworkAssociation`.
CfnClientVpnTargetNetworkAssociationProps	Properties for defining a `CfnClientVpnTargetNetworkAssociation`.
CfnCustomerGateway	A CloudFormation `AWS::EC2::CustomerGateway`.
CfnCustomerGatewayProps	Properties for defining a `CfnCustomerGateway`.
CfnDHCPOptions	A CloudFormation `AWS::EC2::DHCPOptions`.
CfnDHCPOptionsProps	Properties for defining a `CfnDHCPOptions`.
CfnEC2Fleet	A CloudFormation `AWS::EC2::EC2Fleet`.
CfnEC2Fleet.AcceleratorCountRequestProperty	The minimum and maximum number of accelerators (GPUs, FPGAs, or AWS Inferentia chips) on an instance.
CfnEC2Fleet.AcceleratorTotalMemoryMiBRequestProperty	The minimum and maximum amount of total accelerator memory, in MiB.
CfnEC2Fleet.BaselineEbsBandwidthMbpsRequestProperty	The minimum and maximum baseline bandwidth to Amazon EBS, in Mbps.
CfnEC2Fleet.CapacityRebalanceProperty	The Spot Instance replacement strategy to use when Amazon EC2 emits a rebalance notification signal that your Spot Instance is at an elevated risk of being interrupted.
CfnEC2Fleet.CapacityReservationOptionsRequestProperty	Describes the strategy for using unused Capacity Reservations for fulfilling On-Demand capacity.
CfnEC2Fleet.FleetLaunchTemplateConfigRequestProperty	Specifies a launch template and overrides for an EC2 Fleet.
CfnEC2Fleet.FleetLaunchTemplateOverridesRequestProperty	Specifies overrides for a launch template for an EC2 Fleet.
CfnEC2Fleet.FleetLaunchTemplateSpecificationRequestProperty	Specifies the launch template to be used by the EC2 Fleet for configuring Amazon EC2 instances.
CfnEC2Fleet.InstanceRequirementsRequestProperty	The attributes for the instance types.
CfnEC2Fleet.MaintenanceStrategiesProperty	The strategies for managing your Spot Instances that are at an elevated risk of being interrupted.
CfnEC2Fleet.MemoryGiBPerVCpuRequestProperty	The minimum and maximum amount of memory per vCPU, in GiB.
CfnEC2Fleet.MemoryMiBRequestProperty	The minimum and maximum amount of memory, in MiB.
CfnEC2Fleet.NetworkBandwidthGbpsRequestProperty	The minimum and maximum amount of network bandwidth, in gigabits per second (Gbps).
CfnEC2Fleet.NetworkInterfaceCountRequestProperty	The minimum and maximum number of network interfaces.
CfnEC2Fleet.OnDemandOptionsRequestProperty	Specifies the allocation strategy of On-Demand Instances in an EC2 Fleet.
CfnEC2Fleet.PlacementProperty	Describes the placement of an instance.
CfnEC2Fleet.SpotOptionsRequestProperty	Specifies the configuration of Spot Instances for an EC2 Fleet.
CfnEC2Fleet.TagSpecificationProperty	Specifies the tags to apply to a resource when the resource is being created for an EC2 Fleet.
CfnEC2Fleet.TargetCapacitySpecificationRequestProperty	Specifies the number of units to request for an EC2 Fleet.
CfnEC2Fleet.TotalLocalStorageGBRequestProperty	The minimum and maximum amount of total local storage, in GB.
CfnEC2Fleet.VCpuCountRangeRequestProperty	The minimum and maximum number of vCPUs.
CfnEC2FleetProps	Properties for defining a `CfnEC2Fleet`.
CfnEgressOnlyInternetGateway	A CloudFormation `AWS::EC2::EgressOnlyInternetGateway`.
CfnEgressOnlyInternetGatewayProps	Properties for defining a `CfnEgressOnlyInternetGateway`.
CfnEIP	A CloudFormation `AWS::EC2::EIP`.
CfnEIPAssociation	A CloudFormation `AWS::EC2::EIPAssociation`.
CfnEIPAssociationProps	Properties for defining a `CfnEIPAssociation`.
CfnEIPProps	Properties for defining a `CfnEIP`.
CfnEnclaveCertificateIamRoleAssociation	A CloudFormation `AWS::EC2::EnclaveCertificateIamRoleAssociation`.
CfnEnclaveCertificateIamRoleAssociationProps	Properties for defining a `CfnEnclaveCertificateIamRoleAssociation`.
CfnFlowLog	A CloudFormation `AWS::EC2::FlowLog`.
CfnFlowLog.DestinationOptionsProperty	Describes the destination options for a flow log.
CfnFlowLogProps	Properties for defining a `CfnFlowLog`.
CfnGatewayRouteTableAssociation	A CloudFormation `AWS::EC2::GatewayRouteTableAssociation`.
CfnGatewayRouteTableAssociationProps	Properties for defining a `CfnGatewayRouteTableAssociation`.
CfnHost	A CloudFormation `AWS::EC2::Host`.
CfnHostProps	Properties for defining a `CfnHost`.
CfnInstance	A CloudFormation `AWS::EC2::Instance`.
CfnInstance.AssociationParameterProperty	Specifies input parameter values for an SSM document in AWS Systems Manager .
CfnInstance.BlockDeviceMappingProperty	Specifies a block device mapping for an instance.
CfnInstance.CpuOptionsProperty	Specifies the CPU options for the instance.
CfnInstance.CreditSpecificationProperty	Specifies the credit option for CPU usage of a T instance.
CfnInstance.EbsProperty	Specifies a block device for an EBS volume.
CfnInstance.ElasticGpuSpecificationProperty	Specifies the type of Elastic GPU.
CfnInstance.ElasticInferenceAcceleratorProperty	Specifies the Elastic Inference Accelerator for the instance.
CfnInstance.EnclaveOptionsProperty	Indicates whether the instance is enabled for AWS Nitro Enclaves.
CfnInstance.HibernationOptionsProperty	Specifies the hibernation options for the instance.
CfnInstance.InstanceIpv6AddressProperty	Specifies the IPv6 address for the instance.
CfnInstance.LaunchTemplateSpecificationProperty	Specifies a launch template to use when launching an Amazon EC2 instance.
CfnInstance.LicenseSpecificationProperty	Specifies the license configuration to use.
CfnInstance.NetworkInterfaceProperty	Specifies a network interface that is to be attached to an instance.
CfnInstance.NoDeviceProperty	Suppresses the specified device included in the block device mapping of the AMI.
CfnInstance.PrivateDnsNameOptionsProperty	The type of hostnames to assign to instances in the subnet at launch.
CfnInstance.PrivateIpAddressSpecificationProperty	Specifies a secondary private IPv4 address for a network interface.
CfnInstance.SsmAssociationProperty	Specifies the SSM document and parameter values in AWS Systems Manager to associate with an instance.
CfnInstance.VolumeProperty	Specifies a volume to attach to an instance.
CfnInstanceProps	Properties for defining a `CfnInstance`.
CfnInternetGateway	A CloudFormation `AWS::EC2::InternetGateway`.
CfnInternetGatewayProps	Properties for defining a `CfnInternetGateway`.
CfnIPAM	A CloudFormation `AWS::EC2::IPAM`.
CfnIPAM.IpamOperatingRegionProperty	The operating Regions for an IPAM.
CfnIPAMAllocation	A CloudFormation `AWS::EC2::IPAMAllocation`.
CfnIPAMAllocationProps	Properties for defining a `CfnIPAMAllocation`.
CfnIPAMPool	A CloudFormation `AWS::EC2::IPAMPool`.
CfnIPAMPool.ProvisionedCidrProperty	The CIDR provisioned to the IPAM pool.
CfnIPAMPoolCidr	A CloudFormation `AWS::EC2::IPAMPoolCidr`.
CfnIPAMPoolCidrProps	Properties for defining a `CfnIPAMPoolCidr`.
CfnIPAMPoolProps	Properties for defining a `CfnIPAMPool`.
CfnIPAMProps	Properties for defining a `CfnIPAM`.
CfnIPAMResourceDiscovery	A CloudFormation `AWS::EC2::IPAMResourceDiscovery`.
CfnIPAMResourceDiscovery.IpamOperatingRegionProperty	The operating Regions for an IPAM.
CfnIPAMResourceDiscoveryAssociation	A CloudFormation `AWS::EC2::IPAMResourceDiscoveryAssociation`.
CfnIPAMResourceDiscoveryAssociationProps	Properties for defining a `CfnIPAMResourceDiscoveryAssociation`.
CfnIPAMResourceDiscoveryProps	Properties for defining a `CfnIPAMResourceDiscovery`.
CfnIPAMScope	A CloudFormation `AWS::EC2::IPAMScope`.
CfnIPAMScopeProps	Properties for defining a `CfnIPAMScope`.
CfnKeyPair	A CloudFormation `AWS::EC2::KeyPair`.
CfnKeyPairProps	Properties for defining a `CfnKeyPair`.
CfnLaunchTemplate	A CloudFormation `AWS::EC2::LaunchTemplate`.
CfnLaunchTemplate.AcceleratorCountProperty	The minimum and maximum number of accelerators (GPUs, FPGAs, or AWS Inferentia chips) on an instance.
CfnLaunchTemplate.AcceleratorTotalMemoryMiBProperty	The minimum and maximum amount of total accelerator memory, in MiB.
CfnLaunchTemplate.BaselineEbsBandwidthMbpsProperty	The minimum and maximum baseline bandwidth to Amazon EBS, in Mbps.
CfnLaunchTemplate.BlockDeviceMappingProperty	Information about a block device mapping for an Amazon EC2 launch template.
CfnLaunchTemplate.CapacityReservationSpecificationProperty	Specifies an instance's Capacity Reservation targeting option. You can specify only one option at a time.
CfnLaunchTemplate.CapacityReservationTargetProperty	Specifies a target Capacity Reservation.
CfnLaunchTemplate.CpuOptionsProperty	Specifies the CPU options for an instance.
CfnLaunchTemplate.CreditSpecificationProperty	Specifies the credit option for CPU usage of a T2, T3, or T3a instance.
CfnLaunchTemplate.EbsProperty	Parameters for a block device for an EBS volume in an Amazon EC2 launch template.
CfnLaunchTemplate.ElasticGpuSpecificationProperty	Specifies a specification for an Elastic GPU for an Amazon EC2 launch template.
CfnLaunchTemplate.EnclaveOptionsProperty	Indicates whether the instance is enabled for AWS Nitro Enclaves.
CfnLaunchTemplate.HibernationOptionsProperty	Specifies whether your instance is configured for hibernation.
CfnLaunchTemplate.IamInstanceProfileProperty	Specifies an IAM instance profile, which is a container for an IAM role for your instance.
CfnLaunchTemplate.InstanceMarketOptionsProperty	Specifies the market (purchasing) option for an instance.
CfnLaunchTemplate.InstanceRequirementsProperty	The attributes for the instance types.
CfnLaunchTemplate.Ipv4PrefixSpecificationProperty	Specifies an IPv4 prefix for a network interface.
CfnLaunchTemplate.Ipv6AddProperty	Specifies an IPv6 address in an Amazon EC2 launch template.
CfnLaunchTemplate.Ipv6PrefixSpecificationProperty	Specifies an IPv6 prefix for a network interface.
CfnLaunchTemplate.LaunchTemplateDataProperty	The information to include in the launch template.
CfnLaunchTemplate.LaunchTemplateElasticInferenceAcceleratorProperty	Specifies an elastic inference accelerator.
CfnLaunchTemplate.LaunchTemplateTagSpecificationProperty	Specifies the tags to apply to the launch template during creation.
CfnLaunchTemplate.LicenseSpecificationProperty	Specifies a license configuration for an instance.
CfnLaunchTemplate.MaintenanceOptionsProperty	The maintenance options of your instance.
CfnLaunchTemplate.MemoryGiBPerVCpuProperty	The minimum and maximum amount of memory per vCPU, in GiB.
CfnLaunchTemplate.MemoryMiBProperty	The minimum and maximum amount of memory, in MiB.
CfnLaunchTemplate.MetadataOptionsProperty	The metadata options for the instance.
CfnLaunchTemplate.MonitoringProperty	Specifies whether detailed monitoring is enabled for an instance.
CfnLaunchTemplate.NetworkBandwidthGbpsProperty	The minimum and maximum amount of network bandwidth, in gigabits per second (Gbps).
CfnLaunchTemplate.NetworkInterfaceCountProperty	The minimum and maximum number of network interfaces.
CfnLaunchTemplate.NetworkInterfaceProperty	Specifies the parameters for a network interface.
CfnLaunchTemplate.PlacementProperty	Specifies the placement of an instance.
CfnLaunchTemplate.PrivateDnsNameOptionsProperty	The hostname type for EC2 instances launched into this subnet and how DNS A and AAAA record queries should be handled.
CfnLaunchTemplate.PrivateIpAddProperty	Specifies a secondary private IPv4 address for a network interface.
CfnLaunchTemplate.SpotOptionsProperty	Specifies options for Spot Instances.
CfnLaunchTemplate.TagSpecificationProperty	Specifies the tags to apply to a resource when the resource is created for the launch template.
CfnLaunchTemplate.TotalLocalStorageGBProperty	The minimum and maximum amount of total local storage, in GB.
CfnLaunchTemplate.VCpuCountProperty	The minimum and maximum number of vCPUs.
CfnLaunchTemplateProps	Properties for defining a `CfnLaunchTemplate`.
CfnLocalGatewayRoute	A CloudFormation `AWS::EC2::LocalGatewayRoute`.
CfnLocalGatewayRouteProps	Properties for defining a `CfnLocalGatewayRoute`.
CfnLocalGatewayRouteTable	A CloudFormation `AWS::EC2::LocalGatewayRouteTable`.
CfnLocalGatewayRouteTableProps	Properties for defining a `CfnLocalGatewayRouteTable`.
CfnLocalGatewayRouteTableVirtualInterfaceGroupAssociation	A CloudFormation `AWS::EC2::LocalGatewayRouteTableVirtualInterfaceGroupAssociation`.
CfnLocalGatewayRouteTableVirtualInterfaceGroupAssociationProps	Properties for defining a `CfnLocalGatewayRouteTableVirtualInterfaceGroupAssociation`.
CfnLocalGatewayRouteTableVPCAssociation	A CloudFormation `AWS::EC2::LocalGatewayRouteTableVPCAssociation`.
CfnLocalGatewayRouteTableVPCAssociationProps	Properties for defining a `CfnLocalGatewayRouteTableVPCAssociation`.
CfnNatGateway	A CloudFormation `AWS::EC2::NatGateway`.
CfnNatGatewayProps	Properties for defining a `CfnNatGateway`.
CfnNetworkAcl	A CloudFormation `AWS::EC2::NetworkAcl`.
CfnNetworkAclEntry	A CloudFormation `AWS::EC2::NetworkAclEntry`.
CfnNetworkAclEntry.IcmpProperty	Describes the ICMP type and code.
CfnNetworkAclEntry.PortRangeProperty	Describes a range of ports.
CfnNetworkAclEntryProps	Properties for defining a `CfnNetworkAclEntry`.
CfnNetworkAclProps	Properties for defining a `CfnNetworkAcl`.
CfnNetworkInsightsAccessScope	A CloudFormation `AWS::EC2::NetworkInsightsAccessScope`.
CfnNetworkInsightsAccessScope.AccessScopePathRequestProperty	Describes a path.
CfnNetworkInsightsAccessScope.PacketHeaderStatementRequestProperty	Describes a packet header statement.
CfnNetworkInsightsAccessScope.PathStatementRequestProperty	Describes a path statement.
CfnNetworkInsightsAccessScope.ResourceStatementRequestProperty	Describes a resource statement.
CfnNetworkInsightsAccessScope.ThroughResourcesStatementRequestProperty	Describes a through resource statement.
CfnNetworkInsightsAccessScopeAnalysis	A CloudFormation `AWS::EC2::NetworkInsightsAccessScopeAnalysis`.
CfnNetworkInsightsAccessScopeAnalysisProps	Properties for defining a `CfnNetworkInsightsAccessScopeAnalysis`.
CfnNetworkInsightsAccessScopeProps	Properties for defining a `CfnNetworkInsightsAccessScope`.
CfnNetworkInsightsAnalysis	A CloudFormation `AWS::EC2::NetworkInsightsAnalysis`.
CfnNetworkInsightsAnalysis.AdditionalDetailProperty	Describes an additional detail for a path analysis.
CfnNetworkInsightsAnalysis.AlternatePathHintProperty	Describes an potential intermediate component of a feasible path.
CfnNetworkInsightsAnalysis.AnalysisAclRuleProperty	Describes a network access control (ACL) rule.
CfnNetworkInsightsAnalysis.AnalysisComponentProperty	Describes a path component.
CfnNetworkInsightsAnalysis.AnalysisLoadBalancerListenerProperty	Describes a load balancer listener.
CfnNetworkInsightsAnalysis.AnalysisLoadBalancerTargetProperty	Describes a load balancer target.
CfnNetworkInsightsAnalysis.AnalysisPacketHeaderProperty	Describes a header.
CfnNetworkInsightsAnalysis.AnalysisRouteTableRouteProperty	Describes a route table route.
CfnNetworkInsightsAnalysis.AnalysisSecurityGroupRuleProperty	Describes a security group rule.
CfnNetworkInsightsAnalysis.ExplanationProperty	Describes an explanation code for an unreachable path.
CfnNetworkInsightsAnalysis.PathComponentProperty	Describes a path component.
CfnNetworkInsightsAnalysis.PortRangeProperty	Describes a range of ports.
CfnNetworkInsightsAnalysis.TransitGatewayRouteTableRouteProperty	Describes a route in a transit gateway route table.
CfnNetworkInsightsAnalysisProps	Properties for defining a `CfnNetworkInsightsAnalysis`.
CfnNetworkInsightsPath	A CloudFormation `AWS::EC2::NetworkInsightsPath`.
CfnNetworkInsightsPath.FilterPortRangeProperty	Describes a port range.
CfnNetworkInsightsPath.PathFilterProperty	Describes a set of filters for a path analysis.
CfnNetworkInsightsPathProps	Properties for defining a `CfnNetworkInsightsPath`.
CfnNetworkInterface	A CloudFormation `AWS::EC2::NetworkInterface`.
CfnNetworkInterface.InstanceIpv6AddressProperty	Describes the IPv6 addresses to associate with the network interface.
CfnNetworkInterface.PrivateIpAddressSpecificationProperty	Describes a secondary private IPv4 address for a network interface.
CfnNetworkInterfaceAttachment	A CloudFormation `AWS::EC2::NetworkInterfaceAttachment`.
CfnNetworkInterfaceAttachmentProps	Properties for defining a `CfnNetworkInterfaceAttachment`.
CfnNetworkInterfacePermission	A CloudFormation `AWS::EC2::NetworkInterfacePermission`.
CfnNetworkInterfacePermissionProps	Properties for defining a `CfnNetworkInterfacePermission`.
CfnNetworkInterfaceProps	Properties for defining a `CfnNetworkInterface`.
CfnNetworkPerformanceMetricSubscription	A CloudFormation `AWS::EC2::NetworkPerformanceMetricSubscription`.
CfnNetworkPerformanceMetricSubscriptionProps	Properties for defining a `CfnNetworkPerformanceMetricSubscription`.
CfnPlacementGroup	A CloudFormation `AWS::EC2::PlacementGroup`.
CfnPlacementGroupProps	Properties for defining a `CfnPlacementGroup`.
CfnPrefixList	A CloudFormation `AWS::EC2::PrefixList`.
CfnPrefixList.EntryProperty	An entry for a prefix list.
CfnPrefixListProps	Properties for defining a `CfnPrefixList`.
CfnRoute	A CloudFormation `AWS::EC2::Route`.
CfnRouteProps	Properties for defining a `CfnRoute`.
CfnRouteTable	A CloudFormation `AWS::EC2::RouteTable`.
CfnRouteTableProps	Properties for defining a `CfnRouteTable`.
CfnSecurityGroup	A CloudFormation `AWS::EC2::SecurityGroup`.
CfnSecurityGroup.EgressProperty	Adds the specified egress rules to a security group for use with a VPC.
CfnSecurityGroup.IngressProperty	Adds an inbound rule to a security group.
CfnSecurityGroupEgress	A CloudFormation `AWS::EC2::SecurityGroupEgress`.
CfnSecurityGroupEgressProps	Properties for defining a `CfnSecurityGroupEgress`.
CfnSecurityGroupIngress	A CloudFormation `AWS::EC2::SecurityGroupIngress`.
CfnSecurityGroupIngressProps	Properties for defining a `CfnSecurityGroupIngress`.
CfnSecurityGroupProps	Properties for defining a `CfnSecurityGroup`.
CfnSpotFleet	A CloudFormation `AWS::EC2::SpotFleet`.
CfnSpotFleet.AcceleratorCountRequestProperty	The minimum and maximum number of accelerators (GPUs, FPGAs, or AWS Inferentia chips) on an instance.
CfnSpotFleet.AcceleratorTotalMemoryMiBRequestProperty	The minimum and maximum amount of total accelerator memory, in MiB.
CfnSpotFleet.BaselineEbsBandwidthMbpsRequestProperty	The minimum and maximum baseline bandwidth to Amazon EBS, in Mbps.
CfnSpotFleet.BlockDeviceMappingProperty	Specifies a block device mapping.
CfnSpotFleet.ClassicLoadBalancerProperty	Specifies a Classic Load Balancer.
CfnSpotFleet.ClassicLoadBalancersConfigProperty	Specifies the Classic Load Balancers to attach to a Spot Fleet.
CfnSpotFleet.EbsBlockDeviceProperty	Describes a block device for an EBS volume.
CfnSpotFleet.FleetLaunchTemplateSpecificationProperty	Specifies the launch template to be used by the Spot Fleet request for configuring Amazon EC2 instances.
CfnSpotFleet.GroupIdentifierProperty	Describes a security group.
CfnSpotFleet.IamInstanceProfileSpecificationProperty	Describes an IAM instance profile.
CfnSpotFleet.InstanceIpv6AddressProperty	Describes an IPv6 address.
CfnSpotFleet.InstanceNetworkInterfaceSpecificationProperty	Describes a network interface.
CfnSpotFleet.InstanceRequirementsRequestProperty	The attributes for the instance types.
CfnSpotFleet.LaunchTemplateConfigProperty	Specifies a launch template and overrides.
CfnSpotFleet.LaunchTemplateOverridesProperty	Specifies overrides for a launch template.
CfnSpotFleet.LoadBalancersConfigProperty	Specifies the Classic Load Balancers and target groups to attach to a Spot Fleet request.
CfnSpotFleet.MemoryGiBPerVCpuRequestProperty	The minimum and maximum amount of memory per vCPU, in GiB.
CfnSpotFleet.MemoryMiBRequestProperty	The minimum and maximum amount of memory, in MiB.
CfnSpotFleet.NetworkBandwidthGbpsRequestProperty	The minimum and maximum amount of network bandwidth, in gigabits per second (Gbps).
CfnSpotFleet.NetworkInterfaceCountRequestProperty	The minimum and maximum number of network interfaces.
CfnSpotFleet.PrivateIpAddressSpecificationProperty	Describes a secondary private IPv4 address for a network interface.
CfnSpotFleet.SpotCapacityRebalanceProperty	The Spot Instance replacement strategy to use when Amazon EC2 emits a signal that your Spot Instance is at an elevated risk of being interrupted.
CfnSpotFleet.SpotFleetLaunchSpecificationProperty	Specifies the launch specification for one or more Spot Instances.
CfnSpotFleet.SpotFleetMonitoringProperty	Describes whether monitoring is enabled.
CfnSpotFleet.SpotFleetRequestConfigDataProperty	Specifies the configuration of a Spot Fleet request.
CfnSpotFleet.SpotFleetTagSpecificationProperty	The tags for a Spot Fleet resource.
CfnSpotFleet.SpotMaintenanceStrategiesProperty	The strategies for managing your Spot Instances that are at an elevated risk of being interrupted.
CfnSpotFleet.SpotPlacementProperty	Describes Spot Instance placement.
CfnSpotFleet.TargetGroupProperty	Describes a load balancer target group.
CfnSpotFleet.TargetGroupsConfigProperty	Describes the target groups to attach to a Spot Fleet.
CfnSpotFleet.TotalLocalStorageGBRequestProperty	The minimum and maximum amount of total local storage, in GB.
CfnSpotFleet.VCpuCountRangeRequestProperty	The minimum and maximum number of vCPUs.
CfnSpotFleetProps	Properties for defining a `CfnSpotFleet`.
CfnSubnet	A CloudFormation `AWS::EC2::Subnet`.
CfnSubnet.PrivateDnsNameOptionsOnLaunchProperty	Describes the options for instance hostnames.
CfnSubnetCidrBlock	A CloudFormation `AWS::EC2::SubnetCidrBlock`.
CfnSubnetCidrBlockProps	Properties for defining a `CfnSubnetCidrBlock`.
CfnSubnetNetworkAclAssociation	A CloudFormation `AWS::EC2::SubnetNetworkAclAssociation`.
CfnSubnetNetworkAclAssociationProps	Properties for defining a `CfnSubnetNetworkAclAssociation`.
CfnSubnetProps	Properties for defining a `CfnSubnet`.
CfnSubnetRouteTableAssociation	A CloudFormation `AWS::EC2::SubnetRouteTableAssociation`.
CfnSubnetRouteTableAssociationProps	Properties for defining a `CfnSubnetRouteTableAssociation`.
CfnTrafficMirrorFilter	A CloudFormation `AWS::EC2::TrafficMirrorFilter`.
CfnTrafficMirrorFilterProps	Properties for defining a `CfnTrafficMirrorFilter`.
CfnTrafficMirrorFilterRule	A CloudFormation `AWS::EC2::TrafficMirrorFilterRule`.
CfnTrafficMirrorFilterRule.TrafficMirrorPortRangeProperty	Describes the Traffic Mirror port range.
CfnTrafficMirrorFilterRuleProps	Properties for defining a `CfnTrafficMirrorFilterRule`.
CfnTrafficMirrorSession	A CloudFormation `AWS::EC2::TrafficMirrorSession`.
CfnTrafficMirrorSessionProps	Properties for defining a `CfnTrafficMirrorSession`.
CfnTrafficMirrorTarget	A CloudFormation `AWS::EC2::TrafficMirrorTarget`.
CfnTrafficMirrorTargetProps	Properties for defining a `CfnTrafficMirrorTarget`.
CfnTransitGateway	A CloudFormation `AWS::EC2::TransitGateway`.
CfnTransitGatewayAttachment	A CloudFormation `AWS::EC2::TransitGatewayAttachment`.
CfnTransitGatewayAttachment.OptionsProperty	Describes the VPC attachment options.
CfnTransitGatewayAttachmentProps	Properties for defining a `CfnTransitGatewayAttachment`.
CfnTransitGatewayConnect	A CloudFormation `AWS::EC2::TransitGatewayConnect`.
CfnTransitGatewayConnect.TransitGatewayConnectOptionsProperty	Describes the Connect attachment options.
CfnTransitGatewayConnectProps	Properties for defining a `CfnTransitGatewayConnect`.
CfnTransitGatewayMulticastDomain	A CloudFormation `AWS::EC2::TransitGatewayMulticastDomain`.
CfnTransitGatewayMulticastDomain.OptionsProperty	The options for the transit gateway multicast domain.
CfnTransitGatewayMulticastDomainAssociation	A CloudFormation `AWS::EC2::TransitGatewayMulticastDomainAssociation`.
CfnTransitGatewayMulticastDomainAssociationProps	Properties for defining a `CfnTransitGatewayMulticastDomainAssociation`.
CfnTransitGatewayMulticastDomainProps	Properties for defining a `CfnTransitGatewayMulticastDomain`.
CfnTransitGatewayMulticastGroupMember	A CloudFormation `AWS::EC2::TransitGatewayMulticastGroupMember`.
CfnTransitGatewayMulticastGroupMemberProps	Properties for defining a `CfnTransitGatewayMulticastGroupMember`.
CfnTransitGatewayMulticastGroupSource	A CloudFormation `AWS::EC2::TransitGatewayMulticastGroupSource`.
CfnTransitGatewayMulticastGroupSourceProps	Properties for defining a `CfnTransitGatewayMulticastGroupSource`.
CfnTransitGatewayPeeringAttachment	A CloudFormation `AWS::EC2::TransitGatewayPeeringAttachment`.
CfnTransitGatewayPeeringAttachment.PeeringAttachmentStatusProperty	The status of the transit gateway peering attachment.
CfnTransitGatewayPeeringAttachmentProps	Properties for defining a `CfnTransitGatewayPeeringAttachment`.
CfnTransitGatewayProps	Properties for defining a `CfnTransitGateway`.
CfnTransitGatewayRoute	A CloudFormation `AWS::EC2::TransitGatewayRoute`.
CfnTransitGatewayRouteProps	Properties for defining a `CfnTransitGatewayRoute`.
CfnTransitGatewayRouteTable	A CloudFormation `AWS::EC2::TransitGatewayRouteTable`.
CfnTransitGatewayRouteTableAssociation	A CloudFormation `AWS::EC2::TransitGatewayRouteTableAssociation`.
CfnTransitGatewayRouteTableAssociationProps	Properties for defining a `CfnTransitGatewayRouteTableAssociation`.
CfnTransitGatewayRouteTablePropagation	A CloudFormation `AWS::EC2::TransitGatewayRouteTablePropagation`.
CfnTransitGatewayRouteTablePropagationProps	Properties for defining a `CfnTransitGatewayRouteTablePropagation`.
CfnTransitGatewayRouteTableProps	Properties for defining a `CfnTransitGatewayRouteTable`.
CfnTransitGatewayVpcAttachment	A CloudFormation `AWS::EC2::TransitGatewayVpcAttachment`.
CfnTransitGatewayVpcAttachment.OptionsProperty	Describes the VPC attachment options.
CfnTransitGatewayVpcAttachmentProps	Properties for defining a `CfnTransitGatewayVpcAttachment`.
CfnVerifiedAccessEndpoint	A CloudFormation `AWS::EC2::VerifiedAccessEndpoint`.
CfnVerifiedAccessEndpoint.LoadBalancerOptionsProperty	Describes the load balancer options when creating an AWS Verified Access endpoint using the `load-balancer` type.
CfnVerifiedAccessEndpoint.NetworkInterfaceOptionsProperty	Describes the network interface options when creating an AWS Verified Access endpoint using the `network-interface` type.
CfnVerifiedAccessEndpointProps	Properties for defining a `CfnVerifiedAccessEndpoint`.
CfnVerifiedAccessGroup	A CloudFormation `AWS::EC2::VerifiedAccessGroup`.
CfnVerifiedAccessGroupProps	Properties for defining a `CfnVerifiedAccessGroup`.
CfnVerifiedAccessInstance	A CloudFormation `AWS::EC2::VerifiedAccessInstance`.
CfnVerifiedAccessInstance.CloudWatchLogsProperty	Options for CloudWatch Logs as a logging destination.
CfnVerifiedAccessInstance.KinesisDataFirehoseProperty	Options for Kinesis as a logging destination.
CfnVerifiedAccessInstance.S3Property	Options for Amazon S3 as a logging destination.
CfnVerifiedAccessInstance.VerifiedAccessLogsProperty	Describes the destinations for Verified Access logs.
CfnVerifiedAccessInstance.VerifiedAccessTrustProviderProperty	Describes a Verified Access trust provider.
CfnVerifiedAccessInstanceProps	Properties for defining a `CfnVerifiedAccessInstance`.
CfnVerifiedAccessTrustProvider	A CloudFormation `AWS::EC2::VerifiedAccessTrustProvider`.
CfnVerifiedAccessTrustProvider.DeviceOptionsProperty	Describes the options for an AWS Verified Access device-identity based trust provider.
CfnVerifiedAccessTrustProvider.OidcOptionsProperty	Describes the options for an OpenID Connect-compatible user-identity trust provider.
CfnVerifiedAccessTrustProviderProps	Properties for defining a `CfnVerifiedAccessTrustProvider`.
CfnVolume	A CloudFormation `AWS::EC2::Volume`.
CfnVolumeAttachment	A CloudFormation `AWS::EC2::VolumeAttachment`.
CfnVolumeAttachmentProps	Properties for defining a `CfnVolumeAttachment`.
CfnVolumeProps	Properties for defining a `CfnVolume`.
CfnVPC	A CloudFormation `AWS::EC2::VPC`.
CfnVPCCidrBlock	A CloudFormation `AWS::EC2::VPCCidrBlock`.
CfnVPCCidrBlockProps	Properties for defining a `CfnVPCCidrBlock`.
CfnVPCDHCPOptionsAssociation	A CloudFormation `AWS::EC2::VPCDHCPOptionsAssociation`.
CfnVPCDHCPOptionsAssociationProps	Properties for defining a `CfnVPCDHCPOptionsAssociation`.
CfnVPCEndpoint	A CloudFormation `AWS::EC2::VPCEndpoint`.
CfnVPCEndpointConnectionNotification	A CloudFormation `AWS::EC2::VPCEndpointConnectionNotification`.
CfnVPCEndpointConnectionNotificationProps	Properties for defining a `CfnVPCEndpointConnectionNotification`.
CfnVPCEndpointProps	Properties for defining a `CfnVPCEndpoint`.
CfnVPCEndpointService	A CloudFormation `AWS::EC2::VPCEndpointService`.
CfnVPCEndpointServicePermissions	A CloudFormation `AWS::EC2::VPCEndpointServicePermissions`.
CfnVPCEndpointServicePermissionsProps	Properties for defining a `CfnVPCEndpointServicePermissions`.
CfnVPCEndpointServiceProps	Properties for defining a `CfnVPCEndpointService`.
CfnVPCGatewayAttachment	A CloudFormation `AWS::EC2::VPCGatewayAttachment`.
CfnVPCGatewayAttachmentProps	Properties for defining a `CfnVPCGatewayAttachment`.
CfnVPCPeeringConnection	A CloudFormation `AWS::EC2::VPCPeeringConnection`.
CfnVPCPeeringConnectionProps	Properties for defining a `CfnVPCPeeringConnection`.
CfnVPCProps	Properties for defining a `CfnVPC`.
CfnVPNConnection	A CloudFormation `AWS::EC2::VPNConnection`.
CfnVPNConnection.VpnTunnelOptionsSpecificationProperty	The tunnel options for a single VPN tunnel.
CfnVPNConnectionProps	Properties for defining a `CfnVPNConnection`.
CfnVPNConnectionRoute	A CloudFormation `AWS::EC2::VPNConnectionRoute`.
CfnVPNConnectionRouteProps	Properties for defining a `CfnVPNConnectionRoute`.
CfnVPNGateway	A CloudFormation `AWS::EC2::VPNGateway`.
CfnVPNGatewayProps	Properties for defining a `CfnVPNGateway`.
CfnVPNGatewayRoutePropagation	A CloudFormation `AWS::EC2::VPNGatewayRoutePropagation`.
CfnVPNGatewayRoutePropagationProps	Properties for defining a `CfnVPNGatewayRoutePropagation`.
ClientVpnAuthorizationRule	A client VPN authorization rule.
ClientVpnAuthorizationRuleOptions	Options for a ClientVpnAuthorizationRule.
ClientVpnAuthorizationRuleProps	Properties for a ClientVpnAuthorizationRule.
ClientVpnEndpoint	A client VPN connnection.
ClientVpnEndpointAttributes	Attributes when importing an existing client VPN endpoint.
ClientVpnEndpointOptions	Options for a client VPN endpoint.
ClientVpnEndpointProps	Properties for a client VPN endpoint.
ClientVpnRoute	A client VPN route.
ClientVpnRouteOptions	Options for a ClientVpnRoute.
ClientVpnRouteProps	Properties for a ClientVpnRoute.
ClientVpnRouteTarget	Target for a client VPN route.
ClientVpnSessionTimeout	Maximum VPN session duration time.
ClientVpnUserBasedAuthentication	User-based authentication for a client VPN endpoint.
CloudFormationInit	A CloudFormation-init configuration.
CommonNetworkAclEntryOptions	Basic NetworkACL entry props.
ConfigSetProps	Options for CloudFormationInit.withConfigSets.
ConfigureNatOptions	Options passed by the VPC when NAT needs to be configured.
ConnectionRule
Connections_	Manage the allowed network connections for constructs with Security Groups.
ConnectionsProps	Properties to intialize a new Connections object.
CpuCredits	Provides the options for specifying the CPU credit type for burstable EC2 instance types (T2, T3, T3a, etc).
DefaultInstanceTenancy	The default tenancy of instances launched into the VPC.
EbsDeviceOptions	Block device options for an EBS volume.
EbsDeviceOptionsBase	Base block device options for an EBS volume.
EbsDeviceProps	Properties of an EBS block device.
EbsDeviceSnapshotOptions	Block device options for an EBS volume created from a snapshot.
EbsDeviceVolumeType	Supported EBS volume types for blockDevices.
EnableVpnGatewayOptions	Options for the Vpc.enableVpnGateway() method.
ExecuteFileOptions	Options when executing a file.
FlowLog	A VPC flow log.
FlowLogDestination	The destination type for the flow log.
FlowLogDestinationConfig	Flow Log Destination configuration.
FlowLogDestinationType	The available destination types for Flow Logs.
FlowLogOptions	Options to add a flow log to a VPC.
FlowLogProps	Properties of a VPC Flow Log.
FlowLogResourceType	The type of resource to create the flow log for.
FlowLogTrafficType	The type of VPC traffic to log.
GatewayConfig	Pair represents a gateway created by NAT Provider.
GatewayVpcEndpoint	A gateway VPC endpoint.
GatewayVpcEndpointAwsService	An AWS service for a gateway VPC endpoint.
GatewayVpcEndpointOptions	Options to add a gateway endpoint to a VPC.
GatewayVpcEndpointProps	Construction properties for a GatewayVpcEndpoint.
GenericLinuxImage	Construct a Linux machine image from an AMI map.
GenericLinuxImageProps	Configuration options for GenericLinuxImage.
GenericSSMParameterImage	Select the image based on a given SSM parameter.
GenericWindowsImage	Construct a Windows machine image from an AMI map.
GenericWindowsImageProps	Configuration options for GenericWindowsImage.
InitCommand	Command to execute on the instance.
InitCommandOptions	Options for InitCommand.
InitCommandWaitDuration	Represents a duration to wait after a command has finished, in case of a reboot (Windows only).
InitConfig	A collection of configuration elements.
InitElement	Base class for all CloudFormation Init elements.
InitFile	Create files on the EC2 instance.
InitFileAssetOptions	Additional options for creating an InitFile from an asset.
InitFileOptions	Options for InitFile.
InitGroup	Create Linux/UNIX groups and assign group IDs.
InitPackage	A package to be installed during cfn-init time.
InitService	A services that be enabled, disabled or restarted when the instance is launched.
InitServiceOptions	Options for an InitService.
InitServiceRestartHandle	An object that represents reasons to restart an InitService.
InitSource	Extract an archive into a directory.
InitSourceAssetOptions	Additional options for an InitSource that builds an asset from local files.
InitSourceOptions	Additional options for an InitSource.
InitUser	Create Linux/UNIX users and to assign user IDs.
InitUserOptions	Optional parameters used when creating a user.
Instance_	This represents a single EC2 instance.
InstanceArchitecture	Identifies an instance's CPU architecture.
InstanceClass	What class and generation of instance to use.
InstanceInitiatedShutdownBehavior	Provides the options for specifying the instance initiated shutdown behavior.
InstanceProps	Properties of an EC2 Instance.
InstanceRequireImdsv2Aspect	Aspect that applies IMDS configuration on EC2 Instance constructs.
InstanceRequireImdsv2AspectProps	Properties for `InstanceRequireImdsv2Aspect`.
InstanceSize	What size of instance to use.
InstanceType	Instance type for EC2 instances.
InterfaceVpcEndpoint	A interface VPC endpoint.
InterfaceVpcEndpointAttributes	Construction properties for an ImportedInterfaceVpcEndpoint.
InterfaceVpcEndpointAwsService	An AWS service for an interface VPC endpoint.
InterfaceVpcEndpointOptions	Options to add an interface endpoint to a VPC.
InterfaceVpcEndpointProps	Construction properties for an InterfaceVpcEndpoint.
InterfaceVpcEndpointService	A custom-hosted service for an interface VPC endpoint.
LaunchTemplate	This represents an EC2 LaunchTemplate.
LaunchTemplateAttributes	Attributes for an imported LaunchTemplate.
LaunchTemplateProps	Properties of a LaunchTemplate.
LaunchTemplateRequireImdsv2Aspect	Aspect that applies IMDS configuration on EC2 Launch Template constructs.
LaunchTemplateRequireImdsv2AspectProps	Properties for `LaunchTemplateRequireImdsv2Aspect`.
LaunchTemplateSpecialVersions	A class that provides convenient access to special version tokens for LaunchTemplate versions.
LaunchTemplateSpotOptions	Interface for the Spot market instance options provided in a LaunchTemplate.
LinuxUserDataOptions	Options when constructing UserData for Linux.
LocationPackageOptions	Options for InitPackage.rpm/InitPackage.msi.
LookupMachineImage	A machine image whose AMI ID will be searched using DescribeImages.
LookupMachineImageProps	Properties for looking up an image.
MachineImage	Factory functions for standard Amazon Machine Image objects.
MachineImageConfig	Configuration for a machine image.
MultipartBody	The base class for all classes which can be used as {@link MultipartUserData}.
MultipartBodyOptions	Options when creating `MultipartBody`.
MultipartUserData	Mime multipart user data.
MultipartUserDataOptions	Options for creating {@link MultipartUserData}.
NamedPackageOptions	Options for InitPackage.yum/apt/rubyGem/python.
NatGatewayProps	Properties for a NAT gateway.
NatInstanceImage	Machine image representing the latest NAT instance image.
NatInstanceProps	Properties for a NAT instance.
NatInstanceProvider	NAT provider which uses NAT Instances.
NatProvider	NAT providers.
NatTrafficDirection	Direction of traffic to allow all by default.
NetworkAcl	Define a new custom network ACL.
NetworkAclEntry	Define an entry in a Network ACL table.
NetworkAclEntryProps	Properties to create NetworkAclEntry.
NetworkAclProps	Properties to create NetworkAcl.
OperatingSystemType	The OS type of a particular image.
Peer	Peer object factories (to be used in Security Group management).
Port	Interface for classes that provide the connection-specification parts of a security group rule.
PortProps	Properties to create a port range.
PrivateSubnet	Represents a private VPC subnet resource.
PrivateSubnetAttributes
PrivateSubnetProps
Protocol	Protocol for use in Connection Rules.
PublicSubnet	Represents a public VPC subnet resource.
PublicSubnetAttributes
PublicSubnetProps
RouterType	Type of router used in route.
S3DownloadOptions	Options when downloading files from S3.
SecurityGroup	Creates an Amazon EC2 security group within a VPC.
SecurityGroupImportOptions	Additional options for imported security groups.
SecurityGroupProps
SelectedSubnets	Result of selecting a subset of subnets from a VPC.
SpotInstanceInterruption	Provides the options for the types of interruption for spot instances.
SpotRequestType	The Spot Instance request type.
SsmParameterImageOptions	Properties for GenericSsmParameterImage.
Subnet	Represents a new VPC subnet resource.
SubnetAttributes
SubnetConfiguration	Specify configuration parameters for a single subnet group in a VPC.
SubnetFilter	Contains logic which chooses a set of subnets from a larger list, in conjunction with SubnetSelection, to determine where to place AWS resources such as VPC endpoints, EC2 instances, etc.
SubnetNetworkAclAssociation
SubnetNetworkAclAssociationProps	Properties to create a SubnetNetworkAclAssociation.
SubnetProps	Specify configuration parameters for a VPC subnet.
SubnetSelection	Customize subnets that are selected for placement of ENIs.
SubnetType	The type of Subnet.
TrafficDirection	Direction of traffic the AclEntry applies to.
TransportProtocol	Transport protocol for client VPN.
UserData	Instance User Data.
Volume	Creates a new EBS Volume in AWS EC2.
VolumeAttributes	Attributes required to import an existing EBS Volume into the Stack.
VolumeProps	Properties of an EBS Volume.
Vpc	Define an AWS Virtual Private Cloud.
VpcAttributes	Properties that reference an external Vpc.
VpcEndpoint
VpcEndpointService	A VPC endpoint service.
VpcEndpointServiceProps	Construction properties for a VpcEndpointService.
VpcEndpointType	The type of VPC endpoint.
VpcLookupOptions	Properties for looking up an existing VPC.
VpcProps	Configuration for Vpc.
VpnConnection	Define a VPN Connection.
VpnConnectionAttributes	Attributes of an imported VpnConnection.
VpnConnectionBase	Base class for Vpn connections.
VpnConnectionOptions
VpnConnectionProps
VpnConnectionType	The VPN connection type.
VpnGateway	The VPN Gateway that shall be added to the VPC.
VpnGatewayProps	The VpnGateway Properties.
VpnPort	Port for client VPN.
VpnTunnelOption
WindowsImage	Select the latest version of the indicated Windows version.
WindowsImageProps	Configuration options for WindowsImage.
WindowsVersion	The Windows version to use for the WindowsImage.

Interfaces

CfnCapacityReservation.ITagSpecificationProperty	An array of key-value pairs to apply to this resource.
CfnCapacityReservationFleet.IInstanceTypeSpecificationProperty	Specifies information about an instance type to use in a Capacity Reservation Fleet.
CfnCapacityReservationFleet.ITagSpecificationProperty	The tags to apply to a resource when the resource is being created.
CfnClientVpnEndpoint.ICertificateAuthenticationRequestProperty	Information about the client certificate to be used for authentication.
CfnClientVpnEndpoint.IClientAuthenticationRequestProperty	Describes the authentication method to be used by a Client VPN endpoint.
CfnClientVpnEndpoint.IClientConnectOptionsProperty	Indicates whether client connect options are enabled.
CfnClientVpnEndpoint.IClientLoginBannerOptionsProperty	Options for enabling a customizable text banner that will be displayed on AWS provided clients when a VPN session is established.
CfnClientVpnEndpoint.IConnectionLogOptionsProperty	Describes the client connection logging options for the Client VPN endpoint.
CfnClientVpnEndpoint.IDirectoryServiceAuthenticationRequestProperty	Describes the Active Directory to be used for client authentication.
CfnClientVpnEndpoint.IFederatedAuthenticationRequestProperty	The IAM SAML identity provider used for federated authentication.
CfnClientVpnEndpoint.ITagSpecificationProperty	The tags to apply to a resource when the resource is being created.
CfnEC2Fleet.IAcceleratorCountRequestProperty	The minimum and maximum number of accelerators (GPUs, FPGAs, or AWS Inferentia chips) on an instance.
CfnEC2Fleet.IAcceleratorTotalMemoryMiBRequestProperty	The minimum and maximum amount of total accelerator memory, in MiB.
CfnEC2Fleet.IBaselineEbsBandwidthMbpsRequestProperty	The minimum and maximum baseline bandwidth to Amazon EBS, in Mbps.
CfnEC2Fleet.ICapacityRebalanceProperty	The Spot Instance replacement strategy to use when Amazon EC2 emits a rebalance notification signal that your Spot Instance is at an elevated risk of being interrupted.
CfnEC2Fleet.ICapacityReservationOptionsRequestProperty	Describes the strategy for using unused Capacity Reservations for fulfilling On-Demand capacity.
CfnEC2Fleet.IFleetLaunchTemplateConfigRequestProperty	Specifies a launch template and overrides for an EC2 Fleet.
CfnEC2Fleet.IFleetLaunchTemplateOverridesRequestProperty	Specifies overrides for a launch template for an EC2 Fleet.
CfnEC2Fleet.IFleetLaunchTemplateSpecificationRequestProperty	Specifies the launch template to be used by the EC2 Fleet for configuring Amazon EC2 instances.
CfnEC2Fleet.IInstanceRequirementsRequestProperty	The attributes for the instance types.
CfnEC2Fleet.IMaintenanceStrategiesProperty	The strategies for managing your Spot Instances that are at an elevated risk of being interrupted.
CfnEC2Fleet.IMemoryGiBPerVCpuRequestProperty	The minimum and maximum amount of memory per vCPU, in GiB.
CfnEC2Fleet.IMemoryMiBRequestProperty	The minimum and maximum amount of memory, in MiB.
CfnEC2Fleet.INetworkBandwidthGbpsRequestProperty	The minimum and maximum amount of network bandwidth, in gigabits per second (Gbps).
CfnEC2Fleet.INetworkInterfaceCountRequestProperty	The minimum and maximum number of network interfaces.
CfnEC2Fleet.IOnDemandOptionsRequestProperty	Specifies the allocation strategy of On-Demand Instances in an EC2 Fleet.
CfnEC2Fleet.IPlacementProperty	Describes the placement of an instance.
CfnEC2Fleet.ISpotOptionsRequestProperty	Specifies the configuration of Spot Instances for an EC2 Fleet.
CfnEC2Fleet.ITagSpecificationProperty	Specifies the tags to apply to a resource when the resource is being created for an EC2 Fleet.
CfnEC2Fleet.ITargetCapacitySpecificationRequestProperty	Specifies the number of units to request for an EC2 Fleet.
CfnEC2Fleet.ITotalLocalStorageGBRequestProperty	The minimum and maximum amount of total local storage, in GB.
CfnEC2Fleet.IVCpuCountRangeRequestProperty	The minimum and maximum number of vCPUs.
CfnFlowLog.IDestinationOptionsProperty	Describes the destination options for a flow log.
CfnInstance.IAssociationParameterProperty	Specifies input parameter values for an SSM document in AWS Systems Manager .
CfnInstance.IBlockDeviceMappingProperty	Specifies a block device mapping for an instance.
CfnInstance.ICpuOptionsProperty	Specifies the CPU options for the instance.
CfnInstance.ICreditSpecificationProperty	Specifies the credit option for CPU usage of a T instance.
CfnInstance.IEbsProperty	Specifies a block device for an EBS volume.
CfnInstance.IElasticGpuSpecificationProperty	Specifies the type of Elastic GPU.
CfnInstance.IElasticInferenceAcceleratorProperty	Specifies the Elastic Inference Accelerator for the instance.
CfnInstance.IEnclaveOptionsProperty	Indicates whether the instance is enabled for AWS Nitro Enclaves.
CfnInstance.IHibernationOptionsProperty	Specifies the hibernation options for the instance.
CfnInstance.IInstanceIpv6AddressProperty	Specifies the IPv6 address for the instance.
CfnInstance.ILaunchTemplateSpecificationProperty	Specifies a launch template to use when launching an Amazon EC2 instance.
CfnInstance.ILicenseSpecificationProperty	Specifies the license configuration to use.
CfnInstance.INetworkInterfaceProperty	Specifies a network interface that is to be attached to an instance.
CfnInstance.INoDeviceProperty	Suppresses the specified device included in the block device mapping of the AMI.
CfnInstance.IPrivateDnsNameOptionsProperty	The type of hostnames to assign to instances in the subnet at launch.
CfnInstance.IPrivateIpAddressSpecificationProperty	Specifies a secondary private IPv4 address for a network interface.
CfnInstance.ISsmAssociationProperty	Specifies the SSM document and parameter values in AWS Systems Manager to associate with an instance.
CfnInstance.IVolumeProperty	Specifies a volume to attach to an instance.
CfnIPAM.IIpamOperatingRegionProperty	The operating Regions for an IPAM.
CfnIPAMPool.IProvisionedCidrProperty	The CIDR provisioned to the IPAM pool.
CfnIPAMResourceDiscovery.IIpamOperatingRegionProperty	The operating Regions for an IPAM.
CfnLaunchTemplate.IAcceleratorCountProperty	The minimum and maximum number of accelerators (GPUs, FPGAs, or AWS Inferentia chips) on an instance.
CfnLaunchTemplate.IAcceleratorTotalMemoryMiBProperty	The minimum and maximum amount of total accelerator memory, in MiB.
CfnLaunchTemplate.IBaselineEbsBandwidthMbpsProperty	The minimum and maximum baseline bandwidth to Amazon EBS, in Mbps.
CfnLaunchTemplate.IBlockDeviceMappingProperty	Information about a block device mapping for an Amazon EC2 launch template.
CfnLaunchTemplate.ICapacityReservationSpecificationProperty	Specifies an instance's Capacity Reservation targeting option. You can specify only one option at a time.
CfnLaunchTemplate.ICapacityReservationTargetProperty	Specifies a target Capacity Reservation.
CfnLaunchTemplate.ICpuOptionsProperty	Specifies the CPU options for an instance.
CfnLaunchTemplate.ICreditSpecificationProperty	Specifies the credit option for CPU usage of a T2, T3, or T3a instance.
CfnLaunchTemplate.IEbsProperty	Parameters for a block device for an EBS volume in an Amazon EC2 launch template.
CfnLaunchTemplate.IElasticGpuSpecificationProperty	Specifies a specification for an Elastic GPU for an Amazon EC2 launch template.
CfnLaunchTemplate.IEnclaveOptionsProperty	Indicates whether the instance is enabled for AWS Nitro Enclaves.
CfnLaunchTemplate.IHibernationOptionsProperty	Specifies whether your instance is configured for hibernation.
CfnLaunchTemplate.IIamInstanceProfileProperty	Specifies an IAM instance profile, which is a container for an IAM role for your instance.
CfnLaunchTemplate.IInstanceMarketOptionsProperty	Specifies the market (purchasing) option for an instance.
CfnLaunchTemplate.IInstanceRequirementsProperty	The attributes for the instance types.
CfnLaunchTemplate.IIpv4PrefixSpecificationProperty	Specifies an IPv4 prefix for a network interface.
CfnLaunchTemplate.IIpv6AddProperty	Specifies an IPv6 address in an Amazon EC2 launch template.
CfnLaunchTemplate.IIpv6PrefixSpecificationProperty	Specifies an IPv6 prefix for a network interface.
CfnLaunchTemplate.ILaunchTemplateDataProperty	The information to include in the launch template.
CfnLaunchTemplate.ILaunchTemplateElasticInferenceAcceleratorProperty	Specifies an elastic inference accelerator.
CfnLaunchTemplate.ILaunchTemplateTagSpecificationProperty	Specifies the tags to apply to the launch template during creation.
CfnLaunchTemplate.ILicenseSpecificationProperty	Specifies a license configuration for an instance.
CfnLaunchTemplate.IMaintenanceOptionsProperty	The maintenance options of your instance.
CfnLaunchTemplate.IMemoryGiBPerVCpuProperty	The minimum and maximum amount of memory per vCPU, in GiB.
CfnLaunchTemplate.IMemoryMiBProperty	The minimum and maximum amount of memory, in MiB.
CfnLaunchTemplate.IMetadataOptionsProperty	The metadata options for the instance.
CfnLaunchTemplate.IMonitoringProperty	Specifies whether detailed monitoring is enabled for an instance.
CfnLaunchTemplate.INetworkBandwidthGbpsProperty	The minimum and maximum amount of network bandwidth, in gigabits per second (Gbps).
CfnLaunchTemplate.INetworkInterfaceCountProperty	The minimum and maximum number of network interfaces.
CfnLaunchTemplate.INetworkInterfaceProperty	Specifies the parameters for a network interface.
CfnLaunchTemplate.IPlacementProperty	Specifies the placement of an instance.
CfnLaunchTemplate.IPrivateDnsNameOptionsProperty	The hostname type for EC2 instances launched into this subnet and how DNS A and AAAA record queries should be handled.
CfnLaunchTemplate.IPrivateIpAddProperty	Specifies a secondary private IPv4 address for a network interface.
CfnLaunchTemplate.ISpotOptionsProperty	Specifies options for Spot Instances.
CfnLaunchTemplate.ITagSpecificationProperty	Specifies the tags to apply to a resource when the resource is created for the launch template.
CfnLaunchTemplate.ITotalLocalStorageGBProperty	The minimum and maximum amount of total local storage, in GB.
CfnLaunchTemplate.IVCpuCountProperty	The minimum and maximum number of vCPUs.
CfnNetworkAclEntry.IIcmpProperty	Describes the ICMP type and code.
CfnNetworkAclEntry.IPortRangeProperty	Describes a range of ports.
CfnNetworkInsightsAccessScope.IAccessScopePathRequestProperty	Describes a path.
CfnNetworkInsightsAccessScope.IPacketHeaderStatementRequestProperty	Describes a packet header statement.
CfnNetworkInsightsAccessScope.IPathStatementRequestProperty	Describes a path statement.
CfnNetworkInsightsAccessScope.IResourceStatementRequestProperty	Describes a resource statement.
CfnNetworkInsightsAccessScope.IThroughResourcesStatementRequestProperty	Describes a through resource statement.
CfnNetworkInsightsAnalysis.IAdditionalDetailProperty	Describes an additional detail for a path analysis.
CfnNetworkInsightsAnalysis.IAlternatePathHintProperty	Describes an potential intermediate component of a feasible path.
CfnNetworkInsightsAnalysis.IAnalysisAclRuleProperty	Describes a network access control (ACL) rule.
CfnNetworkInsightsAnalysis.IAnalysisComponentProperty	Describes a path component.
CfnNetworkInsightsAnalysis.IAnalysisLoadBalancerListenerProperty	Describes a load balancer listener.
CfnNetworkInsightsAnalysis.IAnalysisLoadBalancerTargetProperty	Describes a load balancer target.
CfnNetworkInsightsAnalysis.IAnalysisPacketHeaderProperty	Describes a header.
CfnNetworkInsightsAnalysis.IAnalysisRouteTableRouteProperty	Describes a route table route.
CfnNetworkInsightsAnalysis.IAnalysisSecurityGroupRuleProperty	Describes a security group rule.
CfnNetworkInsightsAnalysis.IExplanationProperty	Describes an explanation code for an unreachable path.
CfnNetworkInsightsAnalysis.IPathComponentProperty	Describes a path component.
CfnNetworkInsightsAnalysis.IPortRangeProperty	Describes a range of ports.
CfnNetworkInsightsAnalysis.ITransitGatewayRouteTableRouteProperty	Describes a route in a transit gateway route table.
CfnNetworkInsightsPath.IFilterPortRangeProperty	Describes a port range.
CfnNetworkInsightsPath.IPathFilterProperty	Describes a set of filters for a path analysis.
CfnNetworkInterface.IInstanceIpv6AddressProperty	Describes the IPv6 addresses to associate with the network interface.
CfnNetworkInterface.IPrivateIpAddressSpecificationProperty	Describes a secondary private IPv4 address for a network interface.
CfnPrefixList.IEntryProperty	An entry for a prefix list.
CfnSecurityGroup.IEgressProperty	Adds the specified egress rules to a security group for use with a VPC.
CfnSecurityGroup.IIngressProperty	Adds an inbound rule to a security group.
CfnSpotFleet.IAcceleratorCountRequestProperty	The minimum and maximum number of accelerators (GPUs, FPGAs, or AWS Inferentia chips) on an instance.
CfnSpotFleet.IAcceleratorTotalMemoryMiBRequestProperty	The minimum and maximum amount of total accelerator memory, in MiB.
CfnSpotFleet.IBaselineEbsBandwidthMbpsRequestProperty	The minimum and maximum baseline bandwidth to Amazon EBS, in Mbps.
CfnSpotFleet.IBlockDeviceMappingProperty	Specifies a block device mapping.
CfnSpotFleet.IClassicLoadBalancerProperty	Specifies a Classic Load Balancer.
CfnSpotFleet.IClassicLoadBalancersConfigProperty	Specifies the Classic Load Balancers to attach to a Spot Fleet.
CfnSpotFleet.IEbsBlockDeviceProperty	Describes a block device for an EBS volume.
CfnSpotFleet.IFleetLaunchTemplateSpecificationProperty	Specifies the launch template to be used by the Spot Fleet request for configuring Amazon EC2 instances.
CfnSpotFleet.IGroupIdentifierProperty	Describes a security group.
CfnSpotFleet.IIamInstanceProfileSpecificationProperty	Describes an IAM instance profile.
CfnSpotFleet.IInstanceIpv6AddressProperty	Describes an IPv6 address.
CfnSpotFleet.IInstanceNetworkInterfaceSpecificationProperty	Describes a network interface.
CfnSpotFleet.IInstanceRequirementsRequestProperty	The attributes for the instance types.
CfnSpotFleet.ILaunchTemplateConfigProperty	Specifies a launch template and overrides.
CfnSpotFleet.ILaunchTemplateOverridesProperty	Specifies overrides for a launch template.
CfnSpotFleet.ILoadBalancersConfigProperty	Specifies the Classic Load Balancers and target groups to attach to a Spot Fleet request.
CfnSpotFleet.IMemoryGiBPerVCpuRequestProperty	The minimum and maximum amount of memory per vCPU, in GiB.
CfnSpotFleet.IMemoryMiBRequestProperty	The minimum and maximum amount of memory, in MiB.
CfnSpotFleet.INetworkBandwidthGbpsRequestProperty	The minimum and maximum amount of network bandwidth, in gigabits per second (Gbps).
CfnSpotFleet.INetworkInterfaceCountRequestProperty	The minimum and maximum number of network interfaces.
CfnSpotFleet.IPrivateIpAddressSpecificationProperty	Describes a secondary private IPv4 address for a network interface.
CfnSpotFleet.ISpotCapacityRebalanceProperty	The Spot Instance replacement strategy to use when Amazon EC2 emits a signal that your Spot Instance is at an elevated risk of being interrupted.
CfnSpotFleet.ISpotFleetLaunchSpecificationProperty	Specifies the launch specification for one or more Spot Instances.
CfnSpotFleet.ISpotFleetMonitoringProperty	Describes whether monitoring is enabled.
CfnSpotFleet.ISpotFleetRequestConfigDataProperty	Specifies the configuration of a Spot Fleet request.
CfnSpotFleet.ISpotFleetTagSpecificationProperty	The tags for a Spot Fleet resource.
CfnSpotFleet.ISpotMaintenanceStrategiesProperty	The strategies for managing your Spot Instances that are at an elevated risk of being interrupted.
CfnSpotFleet.ISpotPlacementProperty	Describes Spot Instance placement.
CfnSpotFleet.ITargetGroupProperty	Describes a load balancer target group.
CfnSpotFleet.ITargetGroupsConfigProperty	Describes the target groups to attach to a Spot Fleet.
CfnSpotFleet.ITotalLocalStorageGBRequestProperty	The minimum and maximum amount of total local storage, in GB.
CfnSpotFleet.IVCpuCountRangeRequestProperty	The minimum and maximum number of vCPUs.
CfnSubnet.IPrivateDnsNameOptionsOnLaunchProperty	Describes the options for instance hostnames.
CfnTrafficMirrorFilterRule.ITrafficMirrorPortRangeProperty	Describes the Traffic Mirror port range.
CfnTransitGatewayAttachment.IOptionsProperty	Describes the VPC attachment options.
CfnTransitGatewayConnect.ITransitGatewayConnectOptionsProperty	Describes the Connect attachment options.
CfnTransitGatewayMulticastDomain.IOptionsProperty	The options for the transit gateway multicast domain.
CfnTransitGatewayPeeringAttachment.IPeeringAttachmentStatusProperty	The status of the transit gateway peering attachment.
CfnTransitGatewayVpcAttachment.IOptionsProperty	Describes the VPC attachment options.
CfnVerifiedAccessEndpoint.ILoadBalancerOptionsProperty	Describes the load balancer options when creating an AWS Verified Access endpoint using the `load-balancer` type.
CfnVerifiedAccessEndpoint.INetworkInterfaceOptionsProperty	Describes the network interface options when creating an AWS Verified Access endpoint using the `network-interface` type.
CfnVerifiedAccessInstance.ICloudWatchLogsProperty	Options for CloudWatch Logs as a logging destination.
CfnVerifiedAccessInstance.IKinesisDataFirehoseProperty	Options for Kinesis as a logging destination.
CfnVerifiedAccessInstance.IS3Property	Options for Amazon S3 as a logging destination.
CfnVerifiedAccessInstance.IVerifiedAccessLogsProperty	Describes the destinations for Verified Access logs.
CfnVerifiedAccessInstance.IVerifiedAccessTrustProviderProperty	Describes a Verified Access trust provider.
CfnVerifiedAccessTrustProvider.IDeviceOptionsProperty	Describes the options for an AWS Verified Access device-identity based trust provider.
CfnVerifiedAccessTrustProvider.IOidcOptionsProperty	Describes the options for an OpenID Connect-compatible user-identity trust provider.
CfnVPNConnection.IVpnTunnelOptionsSpecificationProperty	The tunnel options for a single VPN tunnel.
IAclCidrConfig	Acl Configuration for CIDR.
IAclIcmp	Properties to create Icmp.
IAclPortRange	Properties to create PortRange.
IAclTrafficConfig	Acl Configuration for traffic.
IAddRouteOptions	Options for adding a new route to a subnet.
IAmazonLinuxImageProps	Amazon Linux image properties.
IApplyCloudFormationInitOptions	Options for applying CloudFormation init to an instance or instance group.
IAttachInitOptions	Options for attaching a CloudFormationInit to a resource.
IBastionHostLinuxProps	Properties of the bastion host.
IBlockDevice	Block device.
ICfnCapacityReservationFleetProps	Properties for defining a `CfnCapacityReservationFleet`.
ICfnCapacityReservationProps	Properties for defining a `CfnCapacityReservation`.
ICfnCarrierGatewayProps	Properties for defining a `CfnCarrierGateway`.
ICfnClientVpnAuthorizationRuleProps	Properties for defining a `CfnClientVpnAuthorizationRule`.
ICfnClientVpnEndpointProps	Properties for defining a `CfnClientVpnEndpoint`.
ICfnClientVpnRouteProps	Properties for defining a `CfnClientVpnRoute`.
ICfnClientVpnTargetNetworkAssociationProps	Properties for defining a `CfnClientVpnTargetNetworkAssociation`.
ICfnCustomerGatewayProps	Properties for defining a `CfnCustomerGateway`.
ICfnDHCPOptionsProps	Properties for defining a `CfnDHCPOptions`.
ICfnEC2FleetProps	Properties for defining a `CfnEC2Fleet`.
ICfnEgressOnlyInternetGatewayProps	Properties for defining a `CfnEgressOnlyInternetGateway`.
ICfnEIPAssociationProps	Properties for defining a `CfnEIPAssociation`.
ICfnEIPProps	Properties for defining a `CfnEIP`.
ICfnEnclaveCertificateIamRoleAssociationProps	Properties for defining a `CfnEnclaveCertificateIamRoleAssociation`.
ICfnFlowLogProps	Properties for defining a `CfnFlowLog`.
ICfnGatewayRouteTableAssociationProps	Properties for defining a `CfnGatewayRouteTableAssociation`.
ICfnHostProps	Properties for defining a `CfnHost`.
ICfnInstanceProps	Properties for defining a `CfnInstance`.
ICfnInternetGatewayProps	Properties for defining a `CfnInternetGateway`.
ICfnIPAMAllocationProps	Properties for defining a `CfnIPAMAllocation`.
ICfnIPAMPoolCidrProps	Properties for defining a `CfnIPAMPoolCidr`.
ICfnIPAMPoolProps	Properties for defining a `CfnIPAMPool`.
ICfnIPAMProps	Properties for defining a `CfnIPAM`.
ICfnIPAMResourceDiscoveryAssociationProps	Properties for defining a `CfnIPAMResourceDiscoveryAssociation`.
ICfnIPAMResourceDiscoveryProps	Properties for defining a `CfnIPAMResourceDiscovery`.
ICfnIPAMScopeProps	Properties for defining a `CfnIPAMScope`.
ICfnKeyPairProps	Properties for defining a `CfnKeyPair`.
ICfnLaunchTemplateProps	Properties for defining a `CfnLaunchTemplate`.
ICfnLocalGatewayRouteProps	Properties for defining a `CfnLocalGatewayRoute`.
ICfnLocalGatewayRouteTableProps	Properties for defining a `CfnLocalGatewayRouteTable`.
ICfnLocalGatewayRouteTableVirtualInterfaceGroupAssociationProps	Properties for defining a `CfnLocalGatewayRouteTableVirtualInterfaceGroupAssociation`.
ICfnLocalGatewayRouteTableVPCAssociationProps	Properties for defining a `CfnLocalGatewayRouteTableVPCAssociation`.
ICfnNatGatewayProps	Properties for defining a `CfnNatGateway`.
ICfnNetworkAclEntryProps	Properties for defining a `CfnNetworkAclEntry`.
ICfnNetworkAclProps	Properties for defining a `CfnNetworkAcl`.
ICfnNetworkInsightsAccessScopeAnalysisProps	Properties for defining a `CfnNetworkInsightsAccessScopeAnalysis`.
ICfnNetworkInsightsAccessScopeProps	Properties for defining a `CfnNetworkInsightsAccessScope`.
ICfnNetworkInsightsAnalysisProps	Properties for defining a `CfnNetworkInsightsAnalysis`.
ICfnNetworkInsightsPathProps	Properties for defining a `CfnNetworkInsightsPath`.
ICfnNetworkInterfaceAttachmentProps	Properties for defining a `CfnNetworkInterfaceAttachment`.
ICfnNetworkInterfacePermissionProps	Properties for defining a `CfnNetworkInterfacePermission`.
ICfnNetworkInterfaceProps	Properties for defining a `CfnNetworkInterface`.
ICfnNetworkPerformanceMetricSubscriptionProps	Properties for defining a `CfnNetworkPerformanceMetricSubscription`.
ICfnPlacementGroupProps	Properties for defining a `CfnPlacementGroup`.
ICfnPrefixListProps	Properties for defining a `CfnPrefixList`.
ICfnRouteProps	Properties for defining a `CfnRoute`.
ICfnRouteTableProps	Properties for defining a `CfnRouteTable`.
ICfnSecurityGroupEgressProps	Properties for defining a `CfnSecurityGroupEgress`.
ICfnSecurityGroupIngressProps	Properties for defining a `CfnSecurityGroupIngress`.
ICfnSecurityGroupProps	Properties for defining a `CfnSecurityGroup`.
ICfnSpotFleetProps	Properties for defining a `CfnSpotFleet`.
ICfnSubnetCidrBlockProps	Properties for defining a `CfnSubnetCidrBlock`.
ICfnSubnetNetworkAclAssociationProps	Properties for defining a `CfnSubnetNetworkAclAssociation`.
ICfnSubnetProps	Properties for defining a `CfnSubnet`.
ICfnSubnetRouteTableAssociationProps	Properties for defining a `CfnSubnetRouteTableAssociation`.
ICfnTrafficMirrorFilterProps	Properties for defining a `CfnTrafficMirrorFilter`.
ICfnTrafficMirrorFilterRuleProps	Properties for defining a `CfnTrafficMirrorFilterRule`.
ICfnTrafficMirrorSessionProps	Properties for defining a `CfnTrafficMirrorSession`.
ICfnTrafficMirrorTargetProps	Properties for defining a `CfnTrafficMirrorTarget`.
ICfnTransitGatewayAttachmentProps	Properties for defining a `CfnTransitGatewayAttachment`.
ICfnTransitGatewayConnectProps	Properties for defining a `CfnTransitGatewayConnect`.
ICfnTransitGatewayMulticastDomainAssociationProps	Properties for defining a `CfnTransitGatewayMulticastDomainAssociation`.
ICfnTransitGatewayMulticastDomainProps	Properties for defining a `CfnTransitGatewayMulticastDomain`.
ICfnTransitGatewayMulticastGroupMemberProps	Properties for defining a `CfnTransitGatewayMulticastGroupMember`.
ICfnTransitGatewayMulticastGroupSourceProps	Properties for defining a `CfnTransitGatewayMulticastGroupSource`.
ICfnTransitGatewayPeeringAttachmentProps	Properties for defining a `CfnTransitGatewayPeeringAttachment`.
ICfnTransitGatewayProps	Properties for defining a `CfnTransitGateway`.
ICfnTransitGatewayRouteProps	Properties for defining a `CfnTransitGatewayRoute`.
ICfnTransitGatewayRouteTableAssociationProps	Properties for defining a `CfnTransitGatewayRouteTableAssociation`.
ICfnTransitGatewayRouteTablePropagationProps	Properties for defining a `CfnTransitGatewayRouteTablePropagation`.
ICfnTransitGatewayRouteTableProps	Properties for defining a `CfnTransitGatewayRouteTable`.
ICfnTransitGatewayVpcAttachmentProps	Properties for defining a `CfnTransitGatewayVpcAttachment`.
ICfnVerifiedAccessEndpointProps	Properties for defining a `CfnVerifiedAccessEndpoint`.
ICfnVerifiedAccessGroupProps	Properties for defining a `CfnVerifiedAccessGroup`.
ICfnVerifiedAccessInstanceProps	Properties for defining a `CfnVerifiedAccessInstance`.
ICfnVerifiedAccessTrustProviderProps	Properties for defining a `CfnVerifiedAccessTrustProvider`.
ICfnVolumeAttachmentProps	Properties for defining a `CfnVolumeAttachment`.
ICfnVolumeProps	Properties for defining a `CfnVolume`.
ICfnVPCCidrBlockProps	Properties for defining a `CfnVPCCidrBlock`.
ICfnVPCDHCPOptionsAssociationProps	Properties for defining a `CfnVPCDHCPOptionsAssociation`.
ICfnVPCEndpointConnectionNotificationProps	Properties for defining a `CfnVPCEndpointConnectionNotification`.
ICfnVPCEndpointProps	Properties for defining a `CfnVPCEndpoint`.
ICfnVPCEndpointServicePermissionsProps	Properties for defining a `CfnVPCEndpointServicePermissions`.
ICfnVPCEndpointServiceProps	Properties for defining a `CfnVPCEndpointService`.
ICfnVPCGatewayAttachmentProps	Properties for defining a `CfnVPCGatewayAttachment`.
ICfnVPCPeeringConnectionProps	Properties for defining a `CfnVPCPeeringConnection`.
ICfnVPCProps	Properties for defining a `CfnVPC`.
ICfnVPNConnectionProps	Properties for defining a `CfnVPNConnection`.
ICfnVPNConnectionRouteProps	Properties for defining a `CfnVPNConnectionRoute`.
ICfnVPNGatewayProps	Properties for defining a `CfnVPNGateway`.
ICfnVPNGatewayRoutePropagationProps	Properties for defining a `CfnVPNGatewayRoutePropagation`.
IClientVpnAuthorizationRuleOptions	Options for a ClientVpnAuthorizationRule.
IClientVpnAuthorizationRuleProps	Properties for a ClientVpnAuthorizationRule.
IClientVpnConnectionHandler	A connection handler for client VPN endpoints.
IClientVpnEndpoint	A client VPN endpoint.
IClientVpnEndpointAttributes	Attributes when importing an existing client VPN endpoint.
IClientVpnEndpointOptions	Options for a client VPN endpoint.
IClientVpnEndpointProps	Properties for a client VPN endpoint.
IClientVpnRouteOptions	Options for a ClientVpnRoute.
IClientVpnRouteProps	Properties for a ClientVpnRoute.
ICommonNetworkAclEntryOptions	Basic NetworkACL entry props.
IConfigSetProps	Options for CloudFormationInit.withConfigSets.
IConfigureNatOptions	Options passed by the VPC when NAT needs to be configured.
IConnectable	An object that has a Connections object.
IConnectionRule
IConnectionsProps	Properties to intialize a new Connections object.
IEbsDeviceOptions	Block device options for an EBS volume.
IEbsDeviceOptionsBase	Base block device options for an EBS volume.
IEbsDeviceProps	Properties of an EBS block device.
IEbsDeviceSnapshotOptions	Block device options for an EBS volume created from a snapshot.
IEnableVpnGatewayOptions	Options for the Vpc.enableVpnGateway() method.
IExecuteFileOptions	Options when executing a file.
IFlowLog	A FlowLog.
IFlowLogDestinationConfig	Flow Log Destination configuration.
IFlowLogOptions	Options to add a flow log to a VPC.
IFlowLogProps	Properties of a VPC Flow Log.
IGatewayConfig	Pair represents a gateway created by NAT Provider.
IGatewayVpcEndpoint	A gateway VPC endpoint.
IGatewayVpcEndpointOptions	Options to add a gateway endpoint to a VPC.
IGatewayVpcEndpointProps	Construction properties for a GatewayVpcEndpoint.
IGatewayVpcEndpointService	A service for a gateway VPC endpoint.
IGenericLinuxImageProps	Configuration options for GenericLinuxImage.
IGenericWindowsImageProps	Configuration options for GenericWindowsImage.
IInitCommandOptions	Options for InitCommand.
IInitFileAssetOptions	Additional options for creating an InitFile from an asset.
IInitFileOptions	Options for InitFile.
IInitServiceOptions	Options for an InitService.
IInitSourceAssetOptions	Additional options for an InitSource that builds an asset from local files.
IInitSourceOptions	Additional options for an InitSource.
IInitUserOptions	Optional parameters used when creating a user.
IInstance
IInstanceProps	Properties of an EC2 Instance.
IInstanceRequireImdsv2AspectProps	Properties for `InstanceRequireImdsv2Aspect`.
IInterfaceVpcEndpoint	An interface VPC endpoint.
IInterfaceVpcEndpointAttributes	Construction properties for an ImportedInterfaceVpcEndpoint.
IInterfaceVpcEndpointOptions	Options to add an interface endpoint to a VPC.
IInterfaceVpcEndpointProps	Construction properties for an InterfaceVpcEndpoint.
IInterfaceVpcEndpointService	A service for an interface VPC endpoint.
ILaunchTemplate	Interface for LaunchTemplate-like objects.
ILaunchTemplateAttributes	Attributes for an imported LaunchTemplate.
ILaunchTemplateProps	Properties of a LaunchTemplate.
ILaunchTemplateRequireImdsv2AspectProps	Properties for `LaunchTemplateRequireImdsv2Aspect`.
ILaunchTemplateSpotOptions	Interface for the Spot market instance options provided in a LaunchTemplate.
ILinuxUserDataOptions	Options when constructing UserData for Linux.
ILocationPackageOptions	Options for InitPackage.rpm/InitPackage.msi.
ILookupMachineImageProps	Properties for looking up an image.
IMachineImage	Interface for classes that can select an appropriate machine image to use.
IMachineImageConfig	Configuration for a machine image.
IMultipartBodyOptions	Options when creating `MultipartBody`.
IMultipartUserDataOptions	Options for creating {@link MultipartUserData}.
INamedPackageOptions	Options for InitPackage.yum/apt/rubyGem/python.
INatGatewayProps	Properties for a NAT gateway.
INatInstanceProps	Properties for a NAT instance.
INetworkAcl	A NetworkAcl.
INetworkAclEntry	A NetworkAclEntry.
INetworkAclEntryProps	Properties to create NetworkAclEntry.
INetworkAclProps	Properties to create NetworkAcl.
IPeer	Interface for classes that provide the peer-specification parts of a security group rule.
IPortProps	Properties to create a port range.
IPrivateSubnet
IPrivateSubnetAttributes
IPrivateSubnetProps
IPublicSubnet
IPublicSubnetAttributes
IPublicSubnetProps
IRouteTable	An abstract route table.
IS3DownloadOptions	Options when downloading files from S3.
ISecurityGroup	Interface for security group-like objects.
ISecurityGroupImportOptions	Additional options for imported security groups.
ISecurityGroupProps
ISelectedSubnets	Result of selecting a subset of subnets from a VPC.
ISsmParameterImageOptions	Properties for GenericSsmParameterImage.
ISubnet
ISubnetAttributes
ISubnetConfiguration	Specify configuration parameters for a single subnet group in a VPC.
ISubnetNetworkAclAssociation	A SubnetNetworkAclAssociation.
ISubnetNetworkAclAssociationProps	Properties to create a SubnetNetworkAclAssociation.
ISubnetProps	Specify configuration parameters for a VPC subnet.
ISubnetSelection	Customize subnets that are selected for placement of ENIs.
IVolume	An EBS Volume in AWS EC2.
IVolumeAttributes	Attributes required to import an existing EBS Volume into the Stack.
IVolumeProps	Properties of an EBS Volume.
IVpc
IVpcAttributes	Properties that reference an external Vpc.
IVpcEndpoint	A VPC endpoint.
IVpcEndpointService	A VPC endpoint service.
IVpcEndpointServiceLoadBalancer	A load balancer that can host a VPC Endpoint Service.
IVpcEndpointServiceProps	Construction properties for a VpcEndpointService.
IVpcLookupOptions	Properties for looking up an existing VPC.
IVpcProps	Configuration for Vpc.
IVpnConnection
IVpnConnectionAttributes	Attributes of an imported VpnConnection.
IVpnConnectionOptions
IVpnConnectionProps
IVpnGateway	The virtual private gateway interface.
IVpnGatewayProps	The VpnGateway Properties.
IVpnTunnelOption
IWindowsImageProps	Configuration options for WindowsImage.