vpc_encryption_controls

Creates, updates, deletes, gets or lists a vpc_encryption_controls resource.

Overview

Name	vpc_encryption_controls
Type	Resource
Id	aws.ec2.vpc_encryption_controls

Fields

The following fields are returned by SELECT queries:

describe_vpc_encryption_controls

Name	Datatype	Description
mode	string	The encryption mode for the VPC Encryption Control configuration.
resource_exclusions	string	Information about resource exclusions for the VPC Encryption Control configuration.
state	string	The current state of the VPC Encryption Control configuration.
state_message	string	A message providing additional information about the encryption control state.
tags	string	The tags assigned to the VPC Encryption Control configuration.
vpc_encryption_control_id	string	The ID of the VPC Encryption Control configuration.
vpc_id	string	The ID of the VPC associated with the encryption control configuration.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_vpc_encryption_controls	select	region	DryRun, Filter, VpcEncryptionControlId, VpcId, NextToken, MaxResults	Describes one or more VPC Encryption Control configurations. VPC Encryption Control enables you to enforce encryption for all data in transit within and between VPCs to meet compliance requirements You can filter the results to return information about specific encryption controls or VPCs. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.
create_vpc_encryption_control	insert	VpcId, region	DryRun, TagSpecification	Creates a VPC Encryption Control configuration for a specified VPC. VPC Encryption Control enables you to enforce encryption for all data in transit within and between VPCs to meet compliance requirements for standards like HIPAA, FedRAMP, and PCI DSS. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.
modify_vpc_encryption_control	update	VpcEncryptionControlId, region	DryRun, Mode, InternetGatewayExclusion, EgressOnlyInternetGatewayExclusion, NatGatewayExclusion, VirtualPrivateGatewayExclusion, VpcPeeringExclusion, LambdaExclusion, VpcLatticeExclusion, ElasticFileSystemExclusion	Modifies the encryption control configuration for a VPC. You can update the encryption mode and exclusion settings for various gateway types and peering connections. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.
delete_vpc_encryption_control	delete	VpcEncryptionControlId, region	DryRun	Deletes a VPC Encryption Control configuration. This removes the encryption policy enforcement from the specified VPC. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
VpcEncryptionControlId	string	The ID of the VPC Encryption Control resource to delete.
VpcId	string	The ID of the VPC for which to create the encryption control configuration.
region	string	AWS region (default: us-east-1)
DryRun	boolean	Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.
EgressOnlyInternetGatewayExclusion	string	Specifies whether to exclude egress-only internet gateway traffic from encryption enforcement.
ElasticFileSystemExclusion	string	Specifies whether to exclude Elastic File System traffic from encryption enforcement.
Filter	array	The filters to apply to the request.
InternetGatewayExclusion	string	Specifies whether to exclude internet gateway traffic from encryption enforcement.
LambdaExclusion	string	Specifies whether to exclude Lambda function traffic from encryption enforcement.
MaxResults	integer	The maximum number of items to return for this request. To get the next page of items, make another request with the token returned in the output. For more information, see Pagination.
Mode	string	The encryption mode for the VPC Encryption Control configuration.
NatGatewayExclusion	string	Specifies whether to exclude NAT gateway traffic from encryption enforcement.
NextToken	string	The token returned from a previous paginated request. Pagination continues from the end of the items returned by the previous request.
TagSpecification	array	The tags to apply to the VPC Encryption Control resource.
VirtualPrivateGatewayExclusion	string	Specifies whether to exclude virtual private gateway traffic from encryption enforcement.
VpcEncryptionControlId	array	The IDs of the VPC Encryption Control configurations to describe.
VpcId	array	The IDs of the VPCs to describe encryption control configurations for.
VpcLatticeExclusion	string	Specifies whether to exclude VPC Lattice traffic from encryption enforcement.
VpcPeeringExclusion	string	Specifies whether to exclude VPC peering connection traffic from encryption enforcement.

SELECT examples

describe_vpc_encryption_controls

Describes one or more VPC Encryption Control configurations. VPC Encryption Control enables you to enforce encryption for all data in transit within and between VPCs to meet compliance requirements You can filter the results to return information about specific encryption controls or VPCs. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.

SELECT
mode,
resource_exclusions,
state,
state_message,
tags,
vpc_encryption_control_id,
vpc_id
FROM aws.ec2.vpc_encryption_controls
WHERE region = '{{ region }}' -- required
AND DryRun = '{{ DryRun }}'
AND Filter = '{{ Filter }}'
AND VpcEncryptionControlId = '{{ VpcEncryptionControlId }}'
AND VpcId = '{{ VpcId }}'
AND NextToken = '{{ NextToken }}'
AND MaxResults = '{{ MaxResults }}'
;

INSERT examples

create_vpc_encryption_control

Creates a VPC Encryption Control configuration for a specified VPC. VPC Encryption Control enables you to enforce encryption for all data in transit within and between VPCs to meet compliance requirements for standards like HIPAA, FedRAMP, and PCI DSS. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.

INSERT INTO aws.ec2.vpc_encryption_controls (
VpcId,
region,
DryRun,
TagSpecification
)
SELECT 
'{{ VpcId }}',
'{{ region }}',
'{{ DryRun }}',
'{{ TagSpecification }}'
RETURNING
mode,
resource_exclusions,
state,
state_message,
tags,
vpc_encryption_control_id,
vpc_id
;

Manifest

# Description fields are for documentation purposes
- name: vpc_encryption_controls
props:
  - name: VpcId
    value: "{{ VpcId }}"
    description: Required parameter for the vpc_encryption_controls resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the vpc_encryption_controls resource.
  - name: DryRun
    value: {{ DryRun }}
    description: Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.
    description: Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.
  - name: TagSpecification
    value: "{{ TagSpecification }}"
    description: The tags to apply to the VPC Encryption Control resource.
    description: The tags to apply to the VPC Encryption Control resource.

UPDATE examples

modify_vpc_encryption_control

Modifies the encryption control configuration for a VPC. You can update the encryption mode and exclusion settings for various gateway types and peering connections. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.

UPDATE aws.ec2.vpc_encryption_controls
SET 
-- No updatable properties
WHERE 
VpcEncryptionControlId = '{{ VpcEncryptionControlId }}' --required
AND region = '{{ region }}' --required
AND DryRun = {{ DryRun}}
AND Mode = '{{ Mode}}'
AND InternetGatewayExclusion = '{{ InternetGatewayExclusion}}'
AND EgressOnlyInternetGatewayExclusion = '{{ EgressOnlyInternetGatewayExclusion}}'
AND NatGatewayExclusion = '{{ NatGatewayExclusion}}'
AND VirtualPrivateGatewayExclusion = '{{ VirtualPrivateGatewayExclusion}}'
AND VpcPeeringExclusion = '{{ VpcPeeringExclusion}}'
AND LambdaExclusion = '{{ LambdaExclusion}}'
AND VpcLatticeExclusion = '{{ VpcLatticeExclusion}}'
AND ElasticFileSystemExclusion = '{{ ElasticFileSystemExclusion}}'
RETURNING
mode,
resource_exclusions,
state,
state_message,
tags,
vpc_encryption_control_id,
vpc_id;

DELETE examples

delete_vpc_encryption_control

Deletes a VPC Encryption Control configuration. This removes the encryption policy enforcement from the specified VPC. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.

DELETE FROM aws.ec2.vpc_encryption_controls
WHERE VpcEncryptionControlId = '{{ VpcEncryptionControlId }}' --required
AND region = '{{ region }}' --required
AND DryRun = '{{ DryRun }}'
;