[ aws . networkmanager ]

update-attachment-nat-configuration

Description

Updates the NAT configuration of a core network attachment. You can enable or disable NAT gateway support, specify whether the core network installs system routes for the NAT CIDR blocks, and replace the NAT rules of the attachment. Specify at least one of NatGatewaySupport , NatSystemRouteSupport , or NatGatewayRules .

Only the core network owner can update the NAT configuration of an attachment. The attachment must be in the AVAILABLE , PENDING_ATTACHMENT_ACCEPTANCE , or PENDING_TAG_ACCEPTANCE state. Changes are applied asynchronously, and the attachment is in the UPDATING state while they are applied. If the attachment is pending acceptance, the NAT configuration is stored and is applied after the attachment is accepted.

See also: AWS API Documentation

Synopsis

  update-attachment-nat-configuration
--attachment-id <value>
[--nat-gateway-support <value>]
[--nat-system-route-support | --no-nat-system-route-support]
[--nat-gateway-rules <value>]
[--client-token <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]
[--cli-error-format <value>]

Options

--attachment-id (string) [required]

The ID of the attachment to update the NAT configuration for.

Constraints:

• min: 0
• max: 50
• pattern: ^attachment-([0-9a-f]{8,17})$

--nat-gateway-support (string)

Specifies whether to enable or disable NAT gateway support on the attachment. When you disable NAT gateway support, the attachment keeps its NAT rules but doesn’t apply them. To enable NAT gateway support, the attachment must have at least one NAT rule, either specified in this request or already configured on the attachment. If you omit this parameter, NAT gateway support is unchanged.

Possible values:

• ENABLE
• DISABLE

--nat-system-route-support | --no-nat-system-route-support (boolean)

Specifies whether the core network installs system routes for the NAT CIDR blocks of the attachment’s NAT rules. System routes have a route type of SYSTEM . NAT is applied to traffic whether or not this option is enabled. If you omit this parameter, the current value is unchanged.

--nat-gateway-rules (list)

The complete set of NAT rules for the attachment, up to 50 rules. The rules that you specify replace the existing rules of the attachment, matched by rule number. Existing rules that aren’t included in the request are deleted. To delete all NAT rules, specify an empty list. You can delete all NAT rules only when NAT gateway support is disabled, or when you disable it in the same request. If you omit this parameter, the existing rules are unchanged.

Constraints:

• min: 0
• max: 50

(structure)

Describes a NAT rule to configure on an attachment. Source addresses in the source CIDR block of traffic from the attachment are translated to the same host addresses in the NAT CIDR block. Traffic to an address in the NAT CIDR block is translated back to the matching address in the source CIDR block.

RuleNumber -> (integer) [required]

The rule number, from 1 to 32766. Each rule number must be unique for the attachment.

Constraints:

• min: 1
• max: 32766

MatchSourceCidr -> (string) [required]

The IPv4 CIDR block to match against the source address of traffic from the attachment. The CIDR block can’t overlap with the multicast range (224.0.0.0/4).

Constraints:

• min: 1
• max: 50
• pattern: [\s\S]*

NatCidr -> (string) [required]

The IPv4 CIDR block to translate matching source addresses to. The prefix length must be the same as the prefix length of MatchSourceCidr . The CIDR block must be within a private (RFC 1918) or shared address space (RFC 6598) range. The CIDR blocks of the NAT rules of an attachment can’t overlap with each other.

Constraints:

• min: 1
• max: 50
• pattern: [\s\S]*

Shorthand Syntax:

RuleNumber=integer,MatchSourceCidr=string,NatCidr=string ...

JSON Syntax:

[
  {
    "RuleNumber": integer,
    "MatchSourceCidr": "string",
    "NatCidr": "string"
  }
  ...
]

--client-token (string)

The client token associated with the request.

Constraints:

• min: 0
• max: 256
• pattern: [\s\S]*

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

Global Options

--debug (boolean)

Turn on debug logging.

--endpoint-url (string)

Override command’s default URL with the given URL.

--no-verify-ssl (boolean)

By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.

--no-paginate (boolean)

Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.

--output (string)

The formatting style for command output.

• json
• text
• table
• yaml
• yaml-stream
• off

--query (string)

A JMESPath query to use in filtering the response data.

--profile (string)

Use a specific profile from your credential file.

--region (string)

The region to use. Overrides config/env settings.

--version (string)

Display the version of this tool.

--color (string)

Turn on/off color output.

• on
• off
• auto

--no-sign-request (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

--ca-bundle (string)

The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.

--cli-read-timeout (int)

The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.

--cli-connect-timeout (int)

The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.

--cli-binary-format (string)

The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob fileb:// will always be treated as binary and use the file contents directly regardless of the cli-binary-format setting. When using file:// the file contents will need to properly formatted for the configured cli-binary-format.

• base64
• raw-in-base64-out

--no-cli-pager (boolean)

Disable cli pager for output.

--cli-auto-prompt (boolean)

Automatically prompt for CLI input parameters.

--no-cli-auto-prompt (boolean)

Disable automatically prompt for CLI input parameters.

--cli-error-format (string)

The formatting style for error output. By default, errors are displayed in enhanced format.

• legacy
• json
• yaml
• text
• table
• enhanced

Output

AttachmentId -> (string)

The ID of the attachment.

Constraints:

• min: 0
• max: 50
• pattern: ^attachment-([0-9a-f]{8,17})$

NatGatewaySupport -> (string)

The state of NAT gateway support on the attachment. The transitional states ENABLING and DISABLING change to ENABLED or DISABLED after the update is applied. The state is PENDING_ATTACHMENT_ACCEPTANCE when NAT gateway support is enabled on an attachment that is pending acceptance.

Possible values:

• ENABLED
• ENABLING
• DISABLED
• DISABLING
• PENDING_ATTACHMENT_ACCEPTANCE

NatSystemRouteSupport -> (boolean)

Indicates whether the core network installs system routes for the NAT CIDR blocks of the attachment’s NAT rules.

NatGatewayRules -> (list)

The NAT rules of the attachment, including rules that are being deleted.

Constraints:

• min: 0
• max: 50

(structure)

Describes a NAT rule of an attachment.

RuleNumber -> (integer)

The rule number. Rule numbers identify the rules of an attachment and don’t set the order in which rules are evaluated.

Constraints:

• min: 1
• max: 32766

MatchSourceCidr -> (string)

The source CIDR block that the rule matches for traffic from the attachment.

Constraints:

• min: 1
• max: 50
• pattern: [\s\S]*

NatCidr -> (string)

The CIDR block that matching source addresses are translated to.

Constraints:

• min: 1
• max: 50
• pattern: [\s\S]*

State -> (string)

The state of the NAT rule. The possible values are the following:

• CREATING : The rule is being created.
• MODIFYING : The rule is being modified.
• DELETING : The rule is being deleted.
• ACTIVATING : NAT gateway support is being enabled, and the rule is being applied.
• ACTIVATED : NAT gateway support is enabled, and the rule is applied.
• DEACTIVATING : NAT gateway support is being disabled, and the rule is being removed from use.
• DEACTIVATED : NAT gateway support is disabled, and the rule isn’t applied.
• FAILED : The attachment failed to be created, and the rule isn’t applied.
• PENDING_ATTACHMENT_ACCEPTANCE : The attachment is pending acceptance. The rule is applied after the attachment is accepted.

Possible values:

• CREATING
• MODIFYING
• DELETING
• ACTIVATED
• ACTIVATING
• DEACTIVATED
• DEACTIVATING
• FAILED
• PENDING_ATTACHMENT_ACCEPTANCE