Class VpcTemplatesConfig

NetworkConfig / VpcTemplatesConfig

Virtual Private Cloud (VPC) templates configuration. Use this configuration to define a VPC using a standard configuration that is deployed to multiple account(s)/OU(s) defined using a deploymentTargets property. With Amazon Virtual Private Cloud (Amazon VPC), you can launch AWS resources in a logically isolated virtual network that you've defined. This virtual network closely resembles a traditional network that you'd operate in your own data center, with the benefits of using the scalable infrastructure of AWS.

Static CIDR:

vpcTemplates:
  - name: Accelerator-Template
    deploymentTargets:
      organizationalUnits:
        - Infrastructure
    region: us-east-1
    cidrs:
      - 10.0.0.0/24
    enableDnsHostnames: true
    enableDnsSupport: true
    instanceTenancy: default
    routeTables: []
    subnets: []
    natGateways: []
    transitGatewayAttachments: []
    tags: []

IPAM allocation:

vpcTemplates:
  - name: Accelerator-Template
    deploymentTargets:
      organizationalUnits:
        - Infrastructure
    region: us-east-1
    ipamAllocations:
      - ipamPoolName: accelerator-regional-pool
        netmaskLength: 24
    enableDnsHostnames: true
    enableDnsSupport: true
    instanceTenancy: default
    routeTables: []
    subnets: []
    natGateways: []
    transitGatewayAttachments: []
    tags: []

Hierarchy

VpcTemplatesConfig

Implements

TypeOf<typeof vpcTemplatesConfig>

Constructors

constructor

new VpcTemplatesConfig(): VpcTemplatesConfig
Returns VpcTemplatesConfig

Properties

`Readonly` cidrs

cidrs: undefined | string[] = undefined

(OPTIONAL) A list of CIDRs to associate with the VPC.

Remarks

CAUTION: Changing or removing an existing CIDR value after initial deployment causes the VPC to be recreated. Please be aware that any downstream dependencies may cause this property update to fail. You can add additional CIDRs to the VPC without this recreation occurring.

NOTE: Expanding a VPC with additional CIDRs is subject to these restrictions.

At least one CIDR should be provided if not using ipamAllocations.

Use CIDR notation, i.e. 10.0.0.0/16

`Readonly` defaultSecurityGroupRulesDeletion

defaultSecurityGroupRulesDeletion: undefined | boolean = false

(OPTIONAL) Determine if the all traffic ingress and egress rules are deleted in the default security group of a VPC.

Remarks

If the defaultSecurityGroupRulesDeletion parameter is set to true, the solution will proceed in removing the default ingress and egress All Traffic (0.0.0.0/0) for that respective VPC's default security group.

See

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/default-custom-security-groups.html#default-security-group

`Readonly` deploymentTargets

deploymentTargets: DeploymentTargets = ...

VPC deployment targets.

Remarks

Targets can be account names and/or organizational units. The excludedRegions property is ignored for VPC templates, as a VPC template can only be deployed to a single region.

See

DeploymentTargets

`Readonly` dhcpOptions

dhcpOptions: undefined | string = undefined

(OPTIONAL) The friendly name of a custom DHCP options set.

Remarks

This is the logical name property of the DHCP options set as defined in network-config.yaml.

See

DhcpOptsConfig

`Readonly` dnsFirewallRuleGroups

dnsFirewallRuleGroups: undefined | {
    mutationProtection: undefined | "ENABLED" | "DISABLED";
    name: string;
    priority: number;
    tags: undefined | ({ key: string; value: string; })[];
}[] = undefined

(OPTIONAL) An array of DNS firewall VPC association configurations. Use this property to associate Route 53 resolver DNS firewall rule groups with the VPC.

See

Remarks

The DNS firewall rule groups must be deployed in the same region of the VPC and shareTargets must be configured to capture the account(s)/OU(s) that this VPC template is deployed to. If deploying this VPC to the delegated admin account, shareTargets is not required for that account.

`Readonly` enableDnsHostnames

enableDnsHostnames: undefined | boolean = true

Enable DNS hostname support for the VPC.

See

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html

`Readonly` enableDnsSupport

enableDnsSupport: undefined | boolean = true

Enable DNS support for the VPC.

See

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html

`Readonly` gatewayEndpoints

gatewayEndpoints: undefined | GatewayEndpointConfig = undefined

(OPTIONAL) An array of gateway endpoints for the VPC. Use this property to define S3 or DynamoDB gateway endpoints for the VPC.

See

GatewayEndpointConfig

`Readonly` instanceTenancy

instanceTenancy: undefined | "default" | "dedicated" = 'default'

(OPTIONAL) Define instance tenancy for the VPC. The default value is default.

See

https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/dedicated-instance.html

`Readonly` interfaceEndpoints

interfaceEndpoints: undefined | InterfaceEndpointConfig = undefined

(OPTIONAL) A list of VPC interface endpoints. Use this property to define VPC interface endpoints for the VPC.

See

InterfaceEndpointConfig

`Readonly` internetGateway

internetGateway: undefined | boolean = undefined

Defines if an internet gateway should be added to the VPC

`Readonly` ipamAllocations

ipamAllocations: undefined | IpamAllocationConfig[] = undefined

(OPTIONAL) An array of IPAM allocation configurations.

See

Remarks

CAUTION: Changing or removing an existing IPAM allocation value after initial deployment causes the VPC to be recreated. Please be aware that any downstream dependencies may cause this property update to fail. You can add additional IPAM allocations to the VPC without this recreation occurring.

NOTE: Expanding a VPC with additional CIDRs is subject to these restrictions.

IPAM pools defined in network-config.yaml must be deployed to the same region of the VPC and shareTargets must be configured to capture the account(s)/OU(s) that this VPC template is deployed to. If deploying this VPC to the delegated admin account, shareTargets is not required for that account.

`Readonly` loadBalancers

loadBalancers: undefined | LoadBalancersConfig = undefined

Elastic Load Balancing configuration. Use this property to define Elastic Load Balancers for this VPC.

See

LoadBalancersConfig

`Readonly` name

name: string = ''

The friendly name of the VPC.

The value of this property will be utilized as the logical id for this resource. Any references to this object should specify this value.

Remarks

CAUTION: Changing this property value after initial deployment causes the VPC to be recreated. Please be aware that any downstream dependencies may cause this property update to fail.

`Readonly` natGateways

natGateways: undefined | NatGatewayConfig[] = undefined

(OPTIONAL) An array of NAT gateway configurations for the VPC. Use this property to configure the NAT gateways for the VPC.

See

NatGatewayConfig

`Readonly` networkAcls

networkAcls: undefined | NetworkAclConfig[] = undefined

(OPTIONAL) A list of Network Access Control Lists (ACLs) to deploy for this VPC

Default

undefined

See

NetworkAclConfig

`Readonly` queryLogs

queryLogs: undefined | string[] = undefined

(OPTIONAL) A list of DNS query log configuration names.

Remarks

This is the logical name property of the Route 53 resolver query logs configuration as defined in network-config.yaml. The shareTargets property must be configured to capture the account(s)/OUs that this VPC template is deployed to. If deploying this VPC to the delegated admin account, shareTargets is not required for that account.

See

DnsQueryLogsConfig

`Readonly` region

region: string = 'us-east-1'

The AWS region to deploy the VPCs to

`Readonly` resolverRules

resolverRules: undefined | string[] = undefined

(OPTIONAL) A list of Route 53 resolver rule names.

Remarks

This is the logical name property of the Route 53 resolver rules configuration as defined in network-config.yaml. The shareTargets property must be configured to capture the account(s)/OUs that this VPC template is deployed to. If deploying this VPC to the delegated admin account, shareTargets is not required for that account.

See

ResolverRuleConfig

`Readonly` routeTables

routeTables: undefined | RouteTableConfig[] = undefined

(OPTIONAL) An array of route table configurations for the VPC. Use this property to configure the route tables for the VPC.

See

RouteTableConfig

`Readonly` securityGroups

securityGroups: undefined | SecurityGroupConfig[] = undefined

(OPTIONAL) A list of Security Groups to deploy for this VPC

Default

undefined

`Readonly` subnets

subnets: undefined | SubnetConfig[] = undefined

(OPTIONAL) An array of subnet configurations for the VPC. Use this property to configure the subnets for the VPC.

See

SubnetConfig

`Readonly` tags

tags: undefined | Tag[] = undefined

(OPTIONAL) A list of tags to apply to this VPC

Default

undefined

`Readonly` targetGroups

targetGroups: undefined | TargetGroupItemConfig[] = undefined

Target group configuration. Use this property to define target groups for this VPC.

See

TargetGroupItemConfig

`Readonly` transitGatewayAttachments

transitGatewayAttachments: undefined | TransitGatewayAttachmentConfig[] = undefined

(OPTIONAL) An array of Transit Gateway attachment configurations. Use this property to configure the Transit Gateway attachments for the VPC.

See

TransitGatewayAttachmentConfig

`Readonly` useCentralEndpoints

useCentralEndpoints: undefined | boolean = false

(OPTIONAL) When set to true, this VPC will be configured to utilize centralized endpoints. This includes having the Route 53 Private Hosted Zone associated with this VPC. Centralized endpoints are configured per region, and can span to spoke accounts

Default

false

Remarks

A VPC deployed in the same region as this VPC in network-config.yaml must be configured with InterfaceEndpointConfig central property set to true to utilize centralized endpoints.

`Readonly` virtualPrivateGateway

virtualPrivateGateway: undefined | VirtualPrivateGatewayConfig = undefined

(OPTIONAL) Virtual Private Gateway configuration. Use this property to configure a Virtual Private Gateway for the VPC.

Default

undefined

`Readonly` vpcFlowLogs

vpcFlowLogs: undefined | VpcFlowLogsConfig = undefined

VPC flog log configuration. Use this property to define a VPC-specific VPC flow logs configuration.

Remarks

If defined, this configuration is preferred over a global VPC flow logs configuration.

See

VpcFlowLogsConfig

Class VpcTemplatesConfig

Hierarchy

Implements

Index

Constructors

Properties

Constructors

constructor

Returns VpcTemplatesConfig

Properties

Readonly cidrs

Remarks

Readonly defaultSecurityGroupRulesDeletion

Remarks

See

Readonly deploymentTargets

Remarks

See

Readonly dhcpOptions

Remarks

See

Readonly dnsFirewallRuleGroups

See

Remarks

Readonly enableDnsHostnames

See

Readonly enableDnsSupport

See

Readonly gatewayEndpoints

See

Readonly instanceTenancy

See

Readonly interfaceEndpoints

See

Readonly internetGateway

Readonly ipamAllocations

See

Remarks

Readonly loadBalancers

See

Readonly name

Remarks

Readonly natGateways

See

Readonly networkAcls

Default

See

Readonly queryLogs

Remarks

See

Readonly region

Readonly resolverRules

Remarks

See

Readonly routeTables

See

Readonly securityGroups

Default

Readonly subnets

See

Readonly tags

Default

Readonly targetGroups

See

Readonly transitGatewayAttachments

See

Readonly useCentralEndpoints

Default

Remarks

Readonly virtualPrivateGateway

Default

Readonly vpcFlowLogs

Remarks

See

Settings

Member Visibility

Theme

`Readonly` cidrs

`Readonly` defaultSecurityGroupRulesDeletion

`Readonly` deploymentTargets

`Readonly` dhcpOptions

`Readonly` dnsFirewallRuleGroups

`Readonly` enableDnsHostnames

`Readonly` enableDnsSupport

`Readonly` gatewayEndpoints

`Readonly` instanceTenancy

`Readonly` interfaceEndpoints

`Readonly` internetGateway

`Readonly` ipamAllocations

`Readonly` loadBalancers

`Readonly` name

`Readonly` natGateways

`Readonly` networkAcls

`Readonly` queryLogs

`Readonly` region

`Readonly` resolverRules

`Readonly` routeTables

`Readonly` securityGroups

`Readonly` subnets

`Readonly` tags

`Readonly` targetGroups

`Readonly` transitGatewayAttachments

`Readonly` useCentralEndpoints

`Readonly` virtualPrivateGateway

`Readonly` vpcFlowLogs