NetworkConnectorProps Struct Added in v2.276.0
Properties for a network connector.
Example
import * as ec2 from 'aws-cdk-lib/aws-ec2';
declare const vpc: ec2.Vpc;
declare const code: lambda.WebFunctionCode;
const securityGroup = new ec2.SecurityGroup(this, 'EgressSecurityGroup', { vpc });
const connector = new lambda.NetworkConnector(this, 'Egress', {
configuration: lambda.NetworkConnectorConfiguration.vpcEgress({
computeType: lambda.NetworkConnectorComputeType.WEB_FUNCTION,
vpc,
vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
securityGroups: [securityGroup],
}),
});
new lambda.WebFunction(this, 'MyWebFunction', {
code,
runtime: lambda.WebFunctionRuntime.NODEJS_24_X,
defaultEndpointAuth: lambda.WebFunctionAuthType.IAM_AUTH,
egressNetworkConnector: connector,
});
Properties
configurationNetworkConnectorConfigurationconfigurationNetworkConnectorConfigurationconfigurationNetworkConnectorConfigurationConfigurationNetworkConnectorConfigurationConfigurationNetworkConnectorConfigurationrequired#networkConnectorNameoptionalstringnetwork_connector_nameoptionalstrnetworkConnectorNameoptionalStringNetworkConnectorNameoptionalstringNetworkConnectorNameoptional*string#Default: a name is generated by CloudFormation
Changing it replaces the connector.
operatorRoleoptionalIRoleRefoperator_roleoptionalIRoleRefoperatorRoleoptionalIRoleRefOperatorRoleoptionalIRoleRefOperatorRoleoptionalIRoleRef#Default: a role is created with the AWSLambdaNetworkConnectorOperatorPolicy managed policy
notes
The AWSLambdaNetworkConnectorOperatorPolicy managed policy is attached to a provided role defined in this app, as it is to the default one. A role imported by ARN or name cannot be modified from this app, so a warning is emitted instead: make sure it already carries that policy, or equivalent permissions to manage the connector's network interfaces.
Use a role dedicated to this connector. The service assumes it without presenting a source account or ARN, so its trust policy cannot be conditioned, and whatever else uses the role gains the permissions to manage network interfaces in the VPC. A function's execution role, for example, already trusts lambda.amazonaws.com, so passing it here would give that function's code those permissions.
tagsoptional{ [key: string]: string }tagsoptionaltyping.Mapping[str, str]tagsoptionalMap<String, String>TagsoptionalIDictionary<string, string>Tagsoptional*map[string]*string#Default: No tags.