# NetworkConnectorProps

Properties for a network connector.

Extends: NetworkConnectorProps
Used as props by: NetworkConnector

- Source: [`aws-lambda/lib/network-connector.ts`](https://github.com/aws/aws-cdk/blob/v2.276.0/packages/aws-cdk-lib/aws-lambda/lib/network-connector.ts#L186)
- Type last changed: v2.276.0 · 10 Nov 2026

## Example

```ts
import * as ec2 from 'aws-cdk-lib/aws-ec2';

declare const vpc: ec2.Vpc;
declare const code: lambda.WebFunctionCode;

const securityGroup = new ec2.SecurityGroup(this, 'EgressSecurityGroup', { vpc });

const connector = new lambda.NetworkConnector(this, 'Egress', {
  configuration: lambda.NetworkConnectorConfiguration.vpcEgress({
    computeType: lambda.NetworkConnectorComputeType.WEB_FUNCTION,
    vpc,
    vpcSubnets: { subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS },
    securityGroups: [securityGroup],
  }),
});

new lambda.WebFunction(this, 'MyWebFunction', {
  code,
  runtime: lambda.WebFunctionRuntime.NODEJS_24_X,
  defaultEndpointAuth: lambda.WebFunctionAuthType.IAM_AUTH,
  egressNetworkConnector: connector,
});
```

## Properties

- `configuration`: [NetworkConnectorConfiguration](/cdk/api/v2/docs/aws-cdk-lib.aws_lambda.NetworkConnectorConfiguration.html) (required) — The network configuration.

- `networkConnectorName`: string — A name for the connector, unique within the account and region.

  **Default:** a name is generated by CloudFormation

  Changing it replaces the connector.

- `operatorRole`: [IRoleRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_iam.IRoleRef.html) — The role the Lambda service assumes to manage the connector's network interfaces in the VPC.

  **Default:** a role is created with the `AWSLambdaNetworkConnectorOperatorPolicy` managed policy

  The `AWSLambdaNetworkConnectorOperatorPolicy` managed policy is attached to a provided role
  defined in this app, as it is to the default one. A role imported by ARN or name cannot be
  modified from this app, so a warning is emitted instead: make sure it already carries that
  policy, or equivalent permissions to manage the connector's network interfaces.

  Use a role dedicated to this connector. The service assumes it without presenting a source
  account or ARN, so its trust policy cannot be conditioned, and whatever else uses the role
  gains the permissions to manage network interfaces in the VPC. A function's execution role,
  for example, already trusts `lambda.amazonaws.com`, so passing it here would give that
  function's code those permissions.

- `tags`: { [key: string]: string } — Tags to apply to the connector.

  **Default:** No tags.