Skip to main content

vpcs

Creates, updates, deletes, gets or lists a vpcs resource.

Overview​

Namevpcs
TypeResource
Idaws.ec2.vpcs

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
block_public_access_statesstringThe state of VPC Block Public Access (BPA).
cidr_blockstringThe primary IPv4 CIDR block for the VPC.
cidr_block_association_setstringInformation about the IPv4 CIDR blocks associated with the VPC.
dhcp_options_idstringThe ID of the set of DHCP options you've associated with the VPC.
encryption_controlstringDescribes the configuration and state of VPC encryption controls. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.
instance_tenancystringThe allowed tenancy of instances launched into the VPC.
ipv_6_cidr_block_association_setstringInformation about the IPv6 CIDR blocks associated with the VPC.
is_defaultbooleanIndicates whether the VPC is the default VPC.
owner_idstringThe ID of the Amazon Web Services account that owns the VPC.
statestringThe current state of the VPC.
tagsstringAny tags assigned to the VPC.
vpc_idstringThe ID of the VPC.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
describe_vpcsselectregionFilter, VpcId, NextToken, MaxResults, DryRunDescribes your VPCs. The default is to describe all your VPCs. Alternatively, you can specify specific VPC IDs or filter the results to include only the VPCs that match specific criteria.
create_vpcinsertregionCidrBlock, Ipv6Pool, Ipv6CidrBlock, Ipv4IpamPoolId, Ipv4NetmaskLength, Ipv6IpamPoolId, Ipv6NetmaskLength, Ipv6CidrBlockNetworkBorderGroup, VpcEncryptionControl, TagSpecification, DryRun, InstanceTenancy, AmazonProvidedIpv6CidrBlockCreates a VPC with the specified CIDR blocks. A VPC must have an associated IPv4 CIDR block. You can choose an IPv4 CIDR block or an IPAM-allocated IPv4 CIDR block. You can optionally associate an IPv6 CIDR block with a VPC. You can choose an IPv6 CIDR block, an Amazon-provided IPv6 CIDR block, an IPAM-allocated IPv6 CIDR block, or an IPv6 CIDR block that you brought to Amazon Web Services. For more information, see IP addressing for your VPCs and subnets in the Amazon VPC User Guide. By default, each instance that you launch in the VPC has the default DHCP options, which include only a default DNS server that we provide (AmazonProvidedDNS). For more information, see DHCP option sets in the Amazon VPC User Guide. You can specify DNS options and tenancy for a VPC when you create it. You can't change the tenancy of a VPC after you create it. For more information, see VPC configuration options in the Amazon VPC User Guide.
attach_classic_link_vpcupdateInstanceId, VpcId, SecurityGroupId, regionDryRunThis action is deprecated. Links an EC2-Classic instance to a ClassicLink-enabled VPC through one or more of the VPC security groups. You cannot link an EC2-Classic instance to more than one VPC at a time. You can only link an instance that's in the running state. An instance is automatically unlinked from a VPC when it's stopped - you can link it to the VPC again when you restart it. After you've linked an instance, you cannot change the VPC security groups that are associated with it. To change the security groups, you must first unlink the instance, and then link it again. Linking your instance to a VPC is sometimes referred to as attaching your instance.
associate_security_group_vpcupdateGroupId, VpcId, regionDryRunAssociates a security group with another VPC in the same Region. This enables you to use the same security group with network interfaces and instances in the specified VPC. The VPC you want to associate the security group with must be in the same Region. You can associate the security group with another VPC if your account owns the VPC or if the VPC was shared with you. You must own the security group. You cannot use this feature with default security groups. You cannot use this feature with the default VPC.
modify_vpc_tenancyupdateVpcId, InstanceTenancy, regionDryRunModifies the instance tenancy attribute of the specified VPC. You can change the instance tenancy attribute of a VPC to default only. You cannot change the instance tenancy attribute to dedicated. After you modify the tenancy of the VPC, any new instances that you launch into the VPC have a tenancy of default, unless you specify otherwise during launch. The tenancy of any existing instances in the VPC is not affected. For more information, see Dedicated Instances in the Amazon EC2 User Guide.
associate_vpc_cidr_blockupdateVpcId, regionCidrBlock, Ipv6CidrBlockNetworkBorderGroup, Ipv6Pool, Ipv6CidrBlock, Ipv4IpamPoolId, Ipv4NetmaskLength, Ipv6IpamPoolId, Ipv6NetmaskLength, AmazonProvidedIpv6CidrBlockAssociates a CIDR block with your VPC. You can associate a secondary IPv4 CIDR block, an Amazon-provided IPv6 CIDR block, or an IPv6 CIDR block from an IPv6 address pool that you provisioned through bring your own IP addresses (BYOIP). You must specify one of the following in the request: an IPv4 CIDR block, an IPv6 pool, or an Amazon-provided IPv6 CIDR block. For more information about associating CIDR blocks with your VPC and applicable restrictions, see IP addressing for your VPCs and subnets in the Amazon VPC User Guide.
disassociate_vpc_cidr_blockupdateAssociationId, regionDisassociates a CIDR block from a VPC. To disassociate the CIDR block, you must specify its association ID. You can get the association ID by using DescribeVpcs. You must detach or delete all gateways and resources that are associated with the CIDR block before you can disassociate it. You cannot disassociate the CIDR block with which you originally created the VPC (the primary CIDR block).
delete_vpcdeleteVpcId, regionDryRunDeletes the specified VPC. You must detach or delete all gateways and resources that are associated with the VPC before you can delete it. For example, you must terminate all instances running in the VPC, delete all security groups associated with the VPC (except the default one), delete all route tables associated with the VPC (except the default one), and so on. When you delete the VPC, it deletes the default security group, network ACL, and route table for the VPC. If you created a flow log for the VPC that you are deleting, note that flow logs for deleted VPCs are eventually automatically removed.
accept_vpc_peering_connectionexecVpcPeeringConnectionId, regionDryRunAccept a VPC peering connection request. To accept a request, the VPC peering connection must be in the pending-acceptance state, and you must be the owner of the peer VPC. Use DescribeVpcPeeringConnections to view your outstanding VPC peering connection requests. For an inter-Region VPC peering connection request, you must accept the VPC peering connection in the Region of the accepter VPC.
create_default_vpcexecregionDryRunCreates a default VPC with a size /16 IPv4 CIDR block and a default subnet in each Availability Zone. For more information about the components of a default VPC, see Default VPCs in the Amazon VPC User Guide. You cannot specify the components of the default VPC yourself. If you deleted your previous default VPC, you can create a default VPC. You cannot have more than one default VPC per Region.
detach_classic_link_vpcexecInstanceId, VpcId, regionDryRunThis action is deprecated. Unlinks (detaches) a linked EC2-Classic instance from a VPC. After the instance has been unlinked, the VPC security groups are no longer associated with it. An instance is automatically unlinked from a VPC when it's stopped.
disable_vpc_classic_linkexecVpcId, regionDryRunThis action is deprecated. Disables ClassicLink for a VPC. You cannot disable ClassicLink for a VPC that has EC2-Classic instances linked to it.
disassociate_security_group_vpcexecGroupId, VpcId, regionDryRunDisassociates a security group from a VPC. You cannot disassociate the security group if any Elastic network interfaces in the associated VPC are still associated with the security group. Note that the disassociation is asynchronous and you can check the status of the request with DescribeSecurityGroupVpcAssociations.
enable_vpc_classic_linkexecVpcId, regionDryRunThis action is deprecated. Enables a VPC for ClassicLink. You can then link EC2-Classic instances to your ClassicLink-enabled VPC to allow communication over private IP addresses. You cannot enable your VPC for ClassicLink if any of your VPC route tables have existing routes for address ranges within the 10.0.0.0/8 IP address range, excluding local routes for VPCs in the 10.0.0.0/16 and 10.1.0.0/16 IP address ranges.
reject_vpc_peering_connectionexecVpcPeeringConnectionId, regionDryRunRejects a VPC peering connection request. The VPC peering connection must be in the pending-acceptance state. Use the DescribeVpcPeeringConnections request to view your outstanding VPC peering connection requests. To delete an active VPC peering connection, or to delete a VPC peering connection request that you initiated, use DeleteVpcPeeringConnection.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
AssociationIdstringThe association ID for the CIDR block.
GroupIdstringA security group ID.
InstanceIdstringThe ID of the instance to unlink from the VPC.
InstanceTenancystringThe instance tenancy attribute for the VPC.
SecurityGroupIdarrayThe IDs of the security groups. You cannot specify security groups from a different VPC.
VpcIdstringThe ID of the VPC.
VpcPeeringConnectionIdstringThe ID of the VPC peering connection.
regionstringAWS region (default: us-east-1)
AmazonProvidedIpv6CidrBlockbooleanRequests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IPv6 addresses or the size of the CIDR block.
CidrBlockstringAn IPv4 CIDR block to associate with the VPC.
DryRunbooleanChecks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.
FilterarrayThe filters. cidr - The primary IPv4 CIDR block of the VPC. The CIDR block you specify must exactly match the VPC's CIDR block for information to be returned for the VPC. Must contain the slash followed by one or two digits (for example, /28). cidr-block-association.cidr-block - An IPv4 CIDR block associated with the VPC. cidr-block-association.association-id - The association ID for an IPv4 CIDR block associated with the VPC. cidr-block-association.state - The state of an IPv4 CIDR block associated with the VPC. dhcp-options-id - The ID of a set of DHCP options. ipv6-cidr-block-association.ipv6-cidr-block - An IPv6 CIDR block associated with the VPC. ipv6-cidr-block-association.ipv6-pool - The ID of the IPv6 address pool from which the IPv6 CIDR block is allocated. ipv6-cidr-block-association.association-id - The association ID for an IPv6 CIDR block associated with the VPC. ipv6-cidr-block-association.state - The state of an IPv6 CIDR block associated with the VPC. is-default - Indicates whether the VPC is the default VPC. owner-id - The ID of the Amazon Web Services account that owns the VPC. state - The state of the VPC (pending | available). tag - The key/value combination of a tag assigned to the resource. Use the tag key in the filter name and the tag value as the filter value. For example, to find all resources that have a tag with the key Owner and the value TeamA, specify tag:Owner for the filter name and TeamA for the filter value. tag-key - The key of a tag assigned to the resource. Use this filter to find all resources assigned a tag with a specific key, regardless of the tag value. vpc-id - The ID of the VPC.
InstanceTenancystringThe tenancy options for instances launched into the VPC. For default, instances are launched with shared tenancy by default. You can launch instances with any tenancy into a shared tenancy VPC. For dedicated, instances are launched as dedicated tenancy instances by default. You can only launch instances with a tenancy of dedicated or host into a dedicated tenancy VPC. Important: The host value cannot be used with this parameter. Use the default or dedicated values only. Default: default
Ipv4IpamPoolIdstringAssociate a CIDR allocated from an IPv4 IPAM pool to a VPC. For more information about Amazon VPC IP Address Manager (IPAM), see What is IPAM? in the Amazon VPC IPAM User Guide.
Ipv4NetmaskLengthintegerThe netmask length of the IPv4 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool. For more information about IPAM, see What is IPAM? in the Amazon VPC IPAM User Guide.
Ipv6CidrBlockstringAn IPv6 CIDR block from the IPv6 address pool. You must also specify Ipv6Pool in the request. To let Amazon choose the IPv6 CIDR block for you, omit this parameter.
Ipv6CidrBlockNetworkBorderGroupstringThe name of the location from which we advertise the IPV6 CIDR block. Use this parameter to limit the CIDR block to this location. You must set AmazonProvidedIpv6CidrBlock to true to use this parameter. You can have one IPv6 CIDR block association per network border group.
Ipv6IpamPoolIdstringAssociates a CIDR allocated from an IPv6 IPAM pool to a VPC. For more information about Amazon VPC IP Address Manager (IPAM), see What is IPAM? in the Amazon VPC IPAM User Guide.
Ipv6NetmaskLengthintegerThe netmask length of the IPv6 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool. For more information about IPAM, see What is IPAM? in the Amazon VPC IPAM User Guide.
Ipv6PoolstringThe ID of an IPv6 address pool from which to allocate the IPv6 CIDR block.
MaxResultsintegerThe maximum number of items to return for this request. To get the next page of items, make another request with the token returned in the output. For more information, see Pagination.
NextTokenstringThe token returned from a previous paginated request. Pagination continues from the end of the items returned by the previous request.
TagSpecificationarrayThe tags to assign to the VPC.
VpcEncryptionControlobjectSpecifies the encryption control configuration to apply to the VPC during creation. VPC Encryption Control enables you to enforce encryption for all data in transit within and between VPCs to meet compliance requirements. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.
VpcIdarrayThe IDs of the VPCs.

SELECT examples​

Describes your VPCs. The default is to describe all your VPCs. Alternatively, you can specify specific VPC IDs or filter the results to include only the VPCs that match specific criteria.

SELECT
block_public_access_states,
cidr_block,
cidr_block_association_set,
dhcp_options_id,
encryption_control,
instance_tenancy,
ipv_6_cidr_block_association_set,
is_default,
owner_id,
state,
tags,
vpc_id
FROM aws.ec2.vpcs
WHERE region = '{{ region }}' -- required
AND Filter = '{{ Filter }}'
AND VpcId = '{{ VpcId }}'
AND NextToken = '{{ NextToken }}'
AND MaxResults = '{{ MaxResults }}'
AND DryRun = '{{ DryRun }}'
;

INSERT examples​

Creates a VPC with the specified CIDR blocks. A VPC must have an associated IPv4 CIDR block. You can choose an IPv4 CIDR block or an IPAM-allocated IPv4 CIDR block. You can optionally associate an IPv6 CIDR block with a VPC. You can choose an IPv6 CIDR block, an Amazon-provided IPv6 CIDR block, an IPAM-allocated IPv6 CIDR block, or an IPv6 CIDR block that you brought to Amazon Web Services. For more information, see IP addressing for your VPCs and subnets in the Amazon VPC User Guide. By default, each instance that you launch in the VPC has the default DHCP options, which include only a default DNS server that we provide (AmazonProvidedDNS). For more information, see DHCP option sets in the Amazon VPC User Guide. You can specify DNS options and tenancy for a VPC when you create it. You can't change the tenancy of a VPC after you create it. For more information, see VPC configuration options in the Amazon VPC User Guide.

INSERT INTO aws.ec2.vpcs (
region,
CidrBlock,
Ipv6Pool,
Ipv6CidrBlock,
Ipv4IpamPoolId,
Ipv4NetmaskLength,
Ipv6IpamPoolId,
Ipv6NetmaskLength,
Ipv6CidrBlockNetworkBorderGroup,
VpcEncryptionControl,
TagSpecification,
DryRun,
InstanceTenancy,
AmazonProvidedIpv6CidrBlock
)
SELECT 
'{{ region }}',
'{{ CidrBlock }}',
'{{ Ipv6Pool }}',
'{{ Ipv6CidrBlock }}',
'{{ Ipv4IpamPoolId }}',
'{{ Ipv4NetmaskLength }}',
'{{ Ipv6IpamPoolId }}',
'{{ Ipv6NetmaskLength }}',
'{{ Ipv6CidrBlockNetworkBorderGroup }}',
'{{ VpcEncryptionControl }}',
'{{ TagSpecification }}',
'{{ DryRun }}',
'{{ InstanceTenancy }}',
'{{ AmazonProvidedIpv6CidrBlock }}'
RETURNING
block_public_access_states,
cidr_block,
cidr_block_association_set,
dhcp_options_id,
encryption_control,
instance_tenancy,
ipv_6_cidr_block_association_set,
is_default,
owner_id,
state,
tags,
vpc_id
;

UPDATE examples​

This action is deprecated. Links an EC2-Classic instance to a ClassicLink-enabled VPC through one or more of the VPC security groups. You cannot link an EC2-Classic instance to more than one VPC at a time. You can only link an instance that's in the running state. An instance is automatically unlinked from a VPC when it's stopped - you can link it to the VPC again when you restart it. After you've linked an instance, you cannot change the VPC security groups that are associated with it. To change the security groups, you must first unlink the instance, and then link it again. Linking your instance to a VPC is sometimes referred to as attaching your instance.

UPDATE aws.ec2.vpcs
SET 
-- No updatable properties
WHERE 
InstanceId = '{{ InstanceId }}' --required
AND VpcId = '{{ VpcId }}' --required
AND SecurityGroupId = '{{ SecurityGroupId }}' --required
AND region = '{{ region }}' --required
AND DryRun = {{ DryRun}}
RETURNING
return;

DELETE examples​

Deletes the specified VPC. You must detach or delete all gateways and resources that are associated with the VPC before you can delete it. For example, you must terminate all instances running in the VPC, delete all security groups associated with the VPC (except the default one), delete all route tables associated with the VPC (except the default one), and so on. When you delete the VPC, it deletes the default security group, network ACL, and route table for the VPC. If you created a flow log for the VPC that you are deleting, note that flow logs for deleted VPCs are eventually automatically removed.

DELETE FROM aws.ec2.vpcs
WHERE VpcId = '{{ VpcId }}' --required
AND region = '{{ region }}' --required
AND DryRun = '{{ DryRun }}'
;

Lifecycle Methods​

Accept a VPC peering connection request. To accept a request, the VPC peering connection must be in the pending-acceptance state, and you must be the owner of the peer VPC. Use DescribeVpcPeeringConnections to view your outstanding VPC peering connection requests. For an inter-Region VPC peering connection request, you must accept the VPC peering connection in the Region of the accepter VPC.

EXEC aws.ec2.vpcs.accept_vpc_peering_connection 
@VpcPeeringConnectionId='{{ VpcPeeringConnectionId }}' --required, 
@region='{{ region }}' --required, 
@DryRun={{ DryRun }}
;
Last updated on