Skip to main content

vpn_connections

Creates, updates, deletes, gets or lists a vpn_connections resource.

Overview​

Namevpn_connections
TypeResource
Idaws.ec2.vpn_connections

Fields​

The following fields are returned by SELECT queries:

NameDatatypeDescription
categorystringThe category of the VPN connection. A value of VPN indicates an Amazon Web Services VPN connection. A value of VPN-Classic indicates an Amazon Web Services Classic VPN connection.
core_network_arnstringThe ARN of the core network.
core_network_attachment_arnstringThe ARN of the core network attachment.
customer_gateway_configurationstringThe configuration information for the VPN connection's customer gateway (in the native XML format). This element is always present in the CreateVpnConnection response; however, it's present in the DescribeVpnConnections response only if the VPN connection is in the pending or available state.
customer_gateway_idstringThe ID of the customer gateway at your end of the VPN connection.
gateway_association_statestringThe current state of the gateway association.
optionsstringThe VPN connection options.
pre_shared_key_arnstringThe Amazon Resource Name (ARN) of the Secrets Manager secret storing the pre-shared key(s) for the VPN connection.
routesstringThe static routes associated with the VPN connection.
statestringThe current state of the VPN connection.
tagsstringAny tags assigned to the VPN connection.
transit_gateway_idstringThe ID of the transit gateway associated with the VPN connection.
typestringThe type of VPN connection.
vgw_telemetrystringInformation about the VPN tunnel.
vpn_concentrator_idstringThe ID of the VPN concentrator associated with the VPN connection.
vpn_connection_idstringThe ID of the VPN connection.
vpn_gateway_idstringThe ID of the virtual private gateway at the Amazon Web Services side of the VPN connection.

Methods​

The following methods are available for this resource:

NameAccessible byRequired ParamsOptional ParamsDescription
describe_vpn_connectionsselectregionFilter, VpnConnectionId, DryRunDescribes one or more of your VPN connections. For more information, see Amazon Web Services Site-to-Site VPN in the Amazon Web Services Site-to-Site VPN User Guide.
create_vpn_connection_routeinsertDestinationCidrBlock, VpnConnectionId, regionCreates a static route associated with a VPN connection between an existing virtual private gateway and a VPN customer gateway. The static route allows traffic to be routed from the virtual private gateway to the VPN customer gateway. For more information, see Amazon Web Services Site-to-Site VPN in the Amazon Web Services Site-to-Site VPN User Guide.
create_vpn_connectioninsertCustomerGatewayId, regionType, VpnGatewayId, TransitGatewayId, VpnConcentratorId, TagSpecification, PreSharedKeyStorage, DryRun, OptionsCreates a VPN connection between an existing virtual private gateway or transit gateway and a customer gateway. The supported connection type is ipsec.1. The response includes information that you need to give to your network administrator to configure your customer gateway. We strongly recommend that you use HTTPS when calling this operation because the response contains sensitive cryptographic information for configuring your customer gateway device. If you decide to shut down your VPN connection for any reason and later create a new VPN connection, you must reconfigure your customer gateway with the new information returned from this call. This is an idempotent operation. If you perform the operation more than once, Amazon EC2 doesn't return an error. For more information, see Amazon Web Services Site-to-Site VPN in the Amazon Web Services Site-to-Site VPN User Guide.
modify_vpn_tunnel_optionsupdateVpnConnectionId, VpnTunnelOutsideIpAddress, TunnelOptions, regionDryRun, SkipTunnelReplacement, PreSharedKeyStorageModifies the options for a VPN tunnel in an Amazon Web Services Site-to-Site VPN connection. You can modify multiple options for a tunnel in a single request, but you can only modify one tunnel at a time. For more information, see Site-to-Site VPN tunnel options for your Site-to-Site VPN connection in the Amazon Web Services Site-to-Site VPN User Guide.
modify_vpn_tunnel_certificateupdateVpnConnectionId, VpnTunnelOutsideIpAddress, regionDryRunModifies the VPN tunnel endpoint certificate.
modify_vpn_connectionupdateVpnConnectionId, regionTransitGatewayId, CustomerGatewayId, VpnGatewayId, DryRunModifies the customer gateway or the target gateway of an Amazon Web Services Site-to-Site VPN connection. To modify the target gateway, the following migration options are available: An existing virtual private gateway to a new virtual private gateway An existing virtual private gateway to a transit gateway An existing transit gateway to a new transit gateway An existing transit gateway to a virtual private gateway Before you perform the migration to the new gateway, you must configure the new gateway. Use CreateVpnGateway to create a virtual private gateway, or CreateTransitGateway to create a transit gateway. This step is required when you migrate from a virtual private gateway with static routes to a transit gateway. You must delete the static routes before you migrate to the new gateway. Keep a copy of the static route before you delete it. You will need to add back these routes to the transit gateway after the VPN connection migration is complete. After you migrate to the new gateway, you might need to modify your VPC route table. Use CreateRoute and DeleteRoute to make the changes described in Update VPC route tables in the Amazon Web Services Site-to-Site VPN User Guide. When the new gateway is a transit gateway, modify the transit gateway route table to allow traffic between the VPC and the Amazon Web Services Site-to-Site VPN connection. Use CreateTransitGatewayRoute to add the routes. If you deleted VPN static routes, you must add the static routes to the transit gateway route table. After you perform this operation, the VPN endpoint's IP addresses on the Amazon Web Services side and the tunnel options remain intact. Your Amazon Web Services Site-to-Site VPN connection will be temporarily unavailable for a brief period while we provision the new endpoints.
replace_vpn_tunnelreplaceVpnConnectionId, VpnTunnelOutsideIpAddress, regionApplyPendingMaintenance, DryRunTrigger replacement of specified VPN tunnel.
delete_vpn_connection_routedeleteDestinationCidrBlock, VpnConnectionId, regionDeletes the specified static route associated with a VPN connection between an existing virtual private gateway and a VPN customer gateway. The static route allows traffic to be routed from the virtual private gateway to the VPN customer gateway.
delete_vpn_connectiondeleteVpnConnectionId, regionDryRunDeletes the specified VPN connection. If you're deleting the VPC and its associated components, we recommend that you detach the virtual private gateway from the VPC and delete the VPC before deleting the VPN connection. If you believe that the tunnel credentials for your VPN connection have been compromised, you can delete the VPN connection and create a new one that has new keys, without needing to delete the VPC or virtual private gateway. If you create a new VPN connection, you must reconfigure the customer gateway device using the new configuration information returned with the new VPN connection ID. For certificate-based authentication, delete all Certificate Manager (ACM) private certificates used for the Amazon Web Services-side tunnel endpoints for the VPN connection before deleting the VPN connection.
modify_vpn_connection_optionsexecVpnConnectionId, regionLocalIpv4NetworkCidr, RemoteIpv4NetworkCidr, LocalIpv6NetworkCidr, RemoteIpv6NetworkCidr, TunnelBandwidth, DryRunModifies the connection options for your Site-to-Site VPN connection. When you modify the VPN connection options, the VPN endpoint IP addresses on the Amazon Web Services side do not change, and the tunnel options do not change. Your VPN connection will be temporarily unavailable for a brief period while the VPN connection is updated.

Parameters​

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

NameDatatypeDescription
CustomerGatewayIdstringThe ID of the customer gateway.
DestinationCidrBlockstringThe CIDR block associated with the local subnet of the customer network.
TunnelOptionsobjectThe tunnel options to modify.
VpnConnectionIdstringThe ID of the Site-to-Site VPN connection.
VpnTunnelOutsideIpAddressstringThe external IP address of the VPN tunnel.
regionstringAWS region (default: us-east-1)
ApplyPendingMaintenancebooleanTrigger pending tunnel endpoint maintenance.
CustomerGatewayIdstringThe ID of the customer gateway at your end of the VPN connection.
DryRunbooleanChecks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.
FilterarrayOne or more filters. customer-gateway-configuration - The configuration information for the customer gateway. customer-gateway-id - The ID of a customer gateway associated with the VPN connection. state - The state of the VPN connection (pending | available | deleting | deleted). option.static-routes-only - Indicates whether the connection has static routes only. Used for devices that do not support Border Gateway Protocol (BGP). route.destination-cidr-block - The destination CIDR block. This corresponds to the subnet used in a customer data center. bgp-asn - The BGP Autonomous System Number (ASN) associated with a BGP device. tag:<key> - The key/value combination of a tag assigned to the resource. Use the tag key in the filter name and the tag value as the filter value. For example, to find all resources that have a tag with the key Owner and the value TeamA, specify tag:Owner for the filter name and TeamA for the filter value. tag-key - The key of a tag assigned to the resource. Use this filter to find all resources assigned a tag with a specific key, regardless of the tag value. type - The type of VPN connection. Currently the only supported type is ipsec.1. vpn-connection-id - The ID of the VPN connection. vpn-gateway-id - The ID of a virtual private gateway associated with the VPN connection. transit-gateway-id - The ID of a transit gateway associated with the VPN connection.
LocalIpv4NetworkCidrstringThe IPv4 CIDR on the customer gateway (on-premises) side of the VPN connection. Default: 0.0.0.0/0
LocalIpv6NetworkCidrstringThe IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection. Default: ::/0
OptionsobjectThe options for the VPN connection.
PreSharedKeyStoragestringSpecifies the storage mode for the pre-shared key (PSK). Valid values are Standard (stored in Site-to-Site VPN service) or SecretsManager (stored in Amazon Web Services Secrets Manager).
RemoteIpv4NetworkCidrstringThe IPv4 CIDR on the Amazon Web Services side of the VPN connection. Default: 0.0.0.0/0
RemoteIpv6NetworkCidrstringThe IPv6 CIDR on the Amazon Web Services side of the VPN connection. Default: ::/0
SkipTunnelReplacementbooleanChoose whether or not to trigger immediate tunnel replacement. This is only applicable when turning on or off EnableTunnelLifecycleControl. Valid values: True | False
TagSpecificationarrayThe tags to apply to the VPN connection.
TransitGatewayIdstringThe ID of the transit gateway.
TunnelBandwidthstringThe desired bandwidth specification for the VPN connection. standard supports up to 1.25 Gbps per tunnel, while large supports up to 5 Gbps per tunnel. Large bandwidth is only available for VPN connections attached to a transit gateway or to Cloud WAN. The default value is standard.
TypestringThe type of VPN connection (ipsec.1).
VpnConcentratorIdstringThe ID of the VPN concentrator to associate with the VPN connection.
VpnConnectionIdarrayOne or more VPN connection IDs. Default: Describes your VPN connections.
VpnGatewayIdstringThe ID of the virtual private gateway at the Amazon Web Services side of the VPN connection.

SELECT examples​

Describes one or more of your VPN connections. For more information, see Amazon Web Services Site-to-Site VPN in the Amazon Web Services Site-to-Site VPN User Guide.

SELECT
category,
core_network_arn,
core_network_attachment_arn,
customer_gateway_configuration,
customer_gateway_id,
gateway_association_state,
options,
pre_shared_key_arn,
routes,
state,
tags,
transit_gateway_id,
type,
vgw_telemetry,
vpn_concentrator_id,
vpn_connection_id,
vpn_gateway_id
FROM aws.ec2.vpn_connections
WHERE region = '{{ region }}' -- required
AND Filter = '{{ Filter }}'
AND VpnConnectionId = '{{ VpnConnectionId }}'
AND DryRun = '{{ DryRun }}'
;

INSERT examples​

Creates a static route associated with a VPN connection between an existing virtual private gateway and a VPN customer gateway. The static route allows traffic to be routed from the virtual private gateway to the VPN customer gateway. For more information, see Amazon Web Services Site-to-Site VPN in the Amazon Web Services Site-to-Site VPN User Guide.

INSERT INTO aws.ec2.vpn_connections (
DestinationCidrBlock,
VpnConnectionId,
region
)
SELECT 
'{{ DestinationCidrBlock }}',
'{{ VpnConnectionId }}',
'{{ region }}'
;

UPDATE examples​

Modifies the options for a VPN tunnel in an Amazon Web Services Site-to-Site VPN connection. You can modify multiple options for a tunnel in a single request, but you can only modify one tunnel at a time. For more information, see Site-to-Site VPN tunnel options for your Site-to-Site VPN connection in the Amazon Web Services Site-to-Site VPN User Guide.

UPDATE aws.ec2.vpn_connections
SET 
-- No updatable properties
WHERE 
VpnConnectionId = '{{ VpnConnectionId }}' --required
AND VpnTunnelOutsideIpAddress = '{{ VpnTunnelOutsideIpAddress }}' --required
AND TunnelOptions = '{{ TunnelOptions }}' --required
AND region = '{{ region }}' --required
AND DryRun = {{ DryRun}}
AND SkipTunnelReplacement = {{ SkipTunnelReplacement}}
AND PreSharedKeyStorage = '{{ PreSharedKeyStorage}}'
RETURNING
category,
core_network_arn,
core_network_attachment_arn,
customer_gateway_configuration,
customer_gateway_id,
gateway_association_state,
options,
pre_shared_key_arn,
routes,
state,
tags,
transit_gateway_id,
type,
vgw_telemetry,
vpn_concentrator_id,
vpn_connection_id,
vpn_gateway_id;

REPLACE examples​

Trigger replacement of specified VPN tunnel.

REPLACE aws.ec2.vpn_connections
SET 
-- No updatable properties
WHERE 
VpnConnectionId = '{{ VpnConnectionId }}' --required
AND VpnTunnelOutsideIpAddress = '{{ VpnTunnelOutsideIpAddress }}' --required
AND region = '{{ region }}' --required
AND ApplyPendingMaintenance = {{ ApplyPendingMaintenance}}
AND DryRun = {{ DryRun}}
RETURNING
return;

DELETE examples​

Deletes the specified static route associated with a VPN connection between an existing virtual private gateway and a VPN customer gateway. The static route allows traffic to be routed from the virtual private gateway to the VPN customer gateway.

DELETE FROM aws.ec2.vpn_connections
WHERE DestinationCidrBlock = '{{ DestinationCidrBlock }}' --required
AND VpnConnectionId = '{{ VpnConnectionId }}' --required
AND region = '{{ region }}' --required
;

Lifecycle Methods​

Modifies the connection options for your Site-to-Site VPN connection. When you modify the VPN connection options, the VPN endpoint IP addresses on the Amazon Web Services side do not change, and the tunnel options do not change. Your VPN connection will be temporarily unavailable for a brief period while the VPN connection is updated.

EXEC aws.ec2.vpn_connections.modify_vpn_connection_options 
@VpnConnectionId='{{ VpnConnectionId }}' --required, 
@region='{{ region }}' --required, 
@LocalIpv4NetworkCidr='{{ LocalIpv4NetworkCidr }}', 
@RemoteIpv4NetworkCidr='{{ RemoteIpv4NetworkCidr }}', 
@LocalIpv6NetworkCidr='{{ LocalIpv6NetworkCidr }}', 
@RemoteIpv6NetworkCidr='{{ RemoteIpv6NetworkCidr }}', 
@TunnelBandwidth='{{ TunnelBandwidth }}', 
@DryRun={{ DryRun }}
;
Last updated on