AWS::Serverless::NetworkConnector

Creates a AWS Lambda Network Connector that defines network connectivity for Lambda compute resources. A network connector specifies how compute resources connect to networks, for example by routing egress traffic through a customer VPC using elastic network interfaces (ENIs) that the service provisions in specified subnets and security groups. Each connector serves one compute type, either MicroVMs or Web Functions. To use a connector with an AWS::Serverless::WebFunction, set ComputeTypes to WebFunction and pass the connector's LatestVersionArn to the function's EgressNetworkConnectorArn property.

Note

When you deploy to AWS CloudFormation, AWS SAM transforms your AWS SAM resources into CloudFormation resources. For more information, see Generated CloudFormation resources for AWS SAM.

Syntax

To declare this entity in your AWS Serverless Application Model (AWS SAM) template, use the following syntax.

YAML

Type: AWS::Serverless::NetworkConnector
Properties:
  ComputeTypes: List
  Name: String
  OperatorRole: String
  PropagateTags: Boolean
  Tags: Map
  VpcConfig: VpcConfig

Properties

ComputeTypes

The type of Lambda compute resource that can use this network connector. Specify exactly one of the following values:

• MicroVm: The connector is used by MicroVM compute resources.

• WebFunction: The connector is used by AWS::Serverless::WebFunction resources through their EgressNetworkConnectorArn property.

Type: List

Required: No

Default: [MicroVm]

CloudFormation compatibility: This property is passed directly to the Configuration.VpcEgressConfiguration.AssociatedComputeResourceTypes property of an AWS::Lambda::NetworkConnector resource.

Name

The name of the network connector. The name must be unique within your account and Region.

Type: String

Required: No

CloudFormation compatibility: This property is passed directly to the Name property of an AWS::Lambda::NetworkConnector resource.

OperatorRole

The ARN of the IAM role that the network connector service assumes to create and manage elastic network interfaces (ENIs).

Type: String

Required: No

CloudFormation compatibility: This property is similar to the OperatorRole property of an AWS::Lambda::NetworkConnector resource. This is required in CloudFormation but not in AWS SAM. If you don't specify a role, AWS SAM creates one with a logical ID of <resource-logical-id>OperatorRole.

PropagateTags

Specifies whether to pass tags from the Tags property to generated resources, such as the auto-generated operator role.

Type: Boolean

Required: No

Default: False

CloudFormation compatibility: This property is unique to AWS SAM and doesn't have an CloudFormation equivalent.

Tags

A map of key-value pairs that specifies the tags added to this network connector.

Type: Map

Required: No

CloudFormation compatibility: This property is similar to the Tags property of an AWS::Lambda::NetworkConnector resource. The Tags property in AWS SAM consists of key-value pairs (whereas in CloudFormation this property consists of a list of Tag objects). Also, AWS SAM automatically adds a lambda:createdBy:SAM tag to this network connector, and to the default roles that are generated for it.

VpcConfig

The VPC egress configuration for the network connector. Specifies the subnets, security groups, and network protocol for routing outbound traffic through your VPC.

Type: VpcConfig

Required: Yes

CloudFormation compatibility: This property is transformed to the Configuration.VpcEgressConfiguration property of an AWS::Lambda::NetworkConnector resource. AWS SAM sets AssociatedComputeResourceTypes from the ComputeTypes property.

Return Values

Ref

When the logical ID of this resource is provided to the Ref intrinsic function, it returns the ARN of the network connector.

For more information about using the Ref function, see Ref in the AWS CloudFormation User Guide.

Fn::GetAtt

Fn::GetAtt returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using Fn::GetAtt, see Fn::GetAtt in the AWS CloudFormation User Guide.

Arn

The Amazon Resource Name (ARN) of the network connector.

LatestVersionArn

The version-qualified ARN of the latest version of the network connector, for example arn:aws:lambda:us-east-1:123456789012:network-connector:my-connector:1. Use this value for the EgressNetworkConnectorArn property of an AWS::Serverless::WebFunction.

State

The current state of the network connector. Valid values are PENDING, ACTIVE, INACTIVE, FAILED, DELETING, and DELETE_FAILED.

Examples

Basic network connector with auto-generated role

The following example creates a VPC egress network connector. AWS SAM automatically generates the operator role.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  MyVpcConnector:
    Type: AWS::Serverless::NetworkConnector
    Properties:
      Name: my-vpc-connector
      VpcConfig:
        SubnetIds:
          - subnet-0abc123def4567890
          - subnet-0def456abc7890123
        SecurityGroupIds:
          - sg-0abc1234abcde0001
        NetworkProtocol: IPv4
      Tags:
        Environment: Production

Network connector for a Web Function

The following example creates a network connector for Web Functions and uses it for a Web Function's outbound traffic.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  MyWebFunctionConnector:
    Type: AWS::Serverless::NetworkConnector
    Properties:
      ComputeTypes:
        - WebFunction
      VpcConfig:
        SubnetIds:
          - subnet-0abc123def4567890
        SecurityGroupIds:
          - sg-0abc1234abcde0001
        NetworkProtocol: IPv4

  MyWebFunction:
    Type: AWS::Serverless::WebFunction
    Properties:
      Runtime: nodejs24.x
      AuthType: IamAuth
      CodeUri: s3://amzn-s3-demo-bucket/webfn.zip
      EgressNetworkConnectorArn: !GetAtt MyWebFunctionConnector.LatestVersionArn