CoreNetworkConnector class

Manages an AWS Lambda Network Connector. A network connector provisions elastic network interfaces (ENIs) in the subnets you specify, routing outbound traffic from Lambda MicroVMs through your VPC — for example to reach private resources, or to give MicroVM traffic a stable source IP by exiting through your NAT gateway.

Example Usage

Basic Usage

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const exampleRole = new aws.iam.Role("example", {
    name: "example-network-connector-operator",
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Principal: {
                Service: "network-connectors.lambda.amazonaws.com",
            },
        }],
    }),
});
const example = new aws.lambda.CoreNetworkConnector("example", {
    configuration: {
        vpcEgressConfiguration: {
            associatedComputeResourceTypes: ["MicroVm"],
            networkProtocol: "IPv4",
            subnetIds: exampleAwsSubnet.map(__item => __item.id),
            securityGroupIds: [exampleAwsSecurityGroup.id],
        },
    },
    name: "example",
    operatorRole: exampleRole.arn,
});
const exampleRolePolicy = new aws.iam.RolePolicy("example", {
    name: "example-network-connector-operator",
    role: exampleRole.id,
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [
            {
                Sid: "CreateENI",
                Effect: "Allow",
                Action: "ec2:CreateNetworkInterface",
                Resource: [
                    "arn:aws:ec2:*:*:network-interface/*",
                    "arn:aws:ec2:*:*:subnet/*",
                    "arn:aws:ec2:*:*:security-group/*",
                ],
            },
            {
                Sid: "TagENI",
                Effect: "Allow",
                Action: "ec2:CreateTags",
                Resource: "arn:aws:ec2:*:*:network-interface/*",
                Condition: {
                    StringEquals: {
                        "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com",
                    },
                },
            },
        ],
    }),
});

import pulumi
import json
import pulumi_aws as aws

example_role = aws.iam.Role("example",
    name="example-network-connector-operator",
    assume_role_policy=json.dumps({
        "Version": "2012-10-17",
        "Statement": [{
            "Action": "sts:AssumeRole",
            "Effect": "Allow",
            "Principal": {
                "Service": "network-connectors.lambda.amazonaws.com",
            },
        }],
    }))
example = aws.lambda_.CoreNetworkConnector("example",
    configuration={
        "vpc_egress_configuration": {
            "associated_compute_resource_types": ["MicroVm"],
            "network_protocol": "IPv4",
            "subnet_ids": [__item["id"] for __item in example_aws_subnet],
            "security_group_ids": [example_aws_security_group["id"]],
        },
    },
    name="example",
    operator_role=example_role.arn)
example_role_policy = aws.iam.RolePolicy("example",
    name="example-network-connector-operator",
    role=example_role.id,
    policy=json.dumps({
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "CreateENI",
                "Effect": "Allow",
                "Action": "ec2:CreateNetworkInterface",
                "Resource": [
                    "arn:aws:ec2:*:*:network-interface/*",
                    "arn:aws:ec2:*:*:subnet/*",
                    "arn:aws:ec2:*:*:security-group/*",
                ],
            },
            {
                "Sid": "TagENI",
                "Effect": "Allow",
                "Action": "ec2:CreateTags",
                "Resource": "arn:aws:ec2:*:*:network-interface/*",
                "Condition": {
                    "StringEquals": {
                        "ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com",
                    },
                },
            },
        ],
    }))

using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
    var exampleRole = new Aws.Iam.Role("example", new()
    {
        Name = "example-network-connector-operator",
        AssumeRolePolicy = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["Version"] = "2012-10-17",
            ["Statement"] = new[]
            {
                new Dictionary<string, object?>
                {
                    ["Action"] = "sts:AssumeRole",
                    ["Effect"] = "Allow",
                    ["Principal"] = new Dictionary<string, object?>
                    {
                        ["Service"] = "network-connectors.lambda.amazonaws.com",
                    },
                },
            },
        }),
    });

    var example = new Aws.Lambda.CoreNetworkConnector("example", new()
    {
        Configuration = new Aws.Lambda.Inputs.CoreNetworkConnectorConfigurationArgs
        {
            VpcEgressConfiguration = new Aws.Lambda.Inputs.CoreNetworkConnectorConfigurationVpcEgressConfigurationArgs
            {
                AssociatedComputeResourceTypes = new[]
                {
                    "MicroVm",
                },
                NetworkProtocol = "IPv4",
                SubnetIds = exampleAwsSubnet.Select(__item => __item.Id).ToList(),
                SecurityGroupIds = new[]
                {
                    exampleAwsSecurityGroup.Id,
                },
            },
        },
        Name = "example",
        OperatorRole = exampleRole.Arn,
    });

    var exampleRolePolicy = new Aws.Iam.RolePolicy("example", new()
    {
        Name = "example-network-connector-operator",
        Role = exampleRole.Id,
        Policy = JsonSerializer.Serialize(new Dictionary<string, object?>
        {
            ["Version"] = "2012-10-17",
            ["Statement"] = new[]
            {
                new Dictionary<string, object?>
                {
                    ["Sid"] = "CreateENI",
                    ["Effect"] = "Allow",
                    ["Action"] = "ec2:CreateNetworkInterface",
                    ["Resource"] = new[]
                    {
                        "arn:aws:ec2:*:*:network-interface/*",
                        "arn:aws:ec2:*:*:subnet/*",
                        "arn:aws:ec2:*:*:security-group/*",
                    },
                },
                new Dictionary<string, object?>
                {
                    ["Sid"] = "TagENI",
                    ["Effect"] = "Allow",
                    ["Action"] = "ec2:CreateTags",
                    ["Resource"] = "arn:aws:ec2:*:*:network-interface/*",
                    ["Condition"] = new Dictionary<string, object?>
                    {
                        ["StringEquals"] = new Dictionary<string, object?>
                        {
                            ["ec2:ManagedResourceOperator"] = "network-connectors.lambda.amazonaws.com",
                        },
                    },
                },
            },
        }),
    });

});

package main

import (
	"encoding/json"

	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/iam"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/lambda"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
tmpJSON0, err := json.Marshal(map[string]interface{}{
"Version": "2012-10-17",
"Statement": []map[string]interface{}{
map[string]interface{}{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": map[string]string{
"Service": "network-connectors.lambda.amazonaws.com",
},
},
},
})
if err != nil {
return err
}
json0 := string(tmpJSON0)
exampleRole, err := iam.NewRole(ctx, "example", &iam.RoleArgs{
Name: pulumi.String("example-network-connector-operator"),
AssumeRolePolicy: pulumi.String(json0),
})
if err != nil {
return err
}
_, err = lambda.NewCoreNetworkConnector(ctx, "example", &lambda.CoreNetworkConnectorArgs{
Configuration: &lambda.CoreNetworkConnectorConfigurationArgs{
VpcEgressConfiguration: &lambda.CoreNetworkConnectorConfigurationVpcEgressConfigurationArgs{
AssociatedComputeResourceTypes: pulumi.StringArray{
pulumi.String("MicroVm"),
},
NetworkProtocol: pulumi.String("IPv4"),
SubnetIds: pulumi.StringArray(%!v(PANIC=Format method: fatal: A failure has occurred: unlowered splat expression @ example.pp:5,40-62)),
SecurityGroupIds: pulumi.StringArray{
exampleAwsSecurityGroup.Id,
},
},
},
Name: pulumi.String("example"),
OperatorRole: exampleRole.Arn,
})
if err != nil {
return err
}
tmpJSON1, err := json.Marshal(map[string]interface{}{
"Version": "2012-10-17",
"Statement": []interface{}{
map[string]interface{}{
"Sid": "CreateENI",
"Effect": "Allow",
"Action": "ec2:CreateNetworkInterface",
"Resource": []string{
"arn:aws:ec2:*:*:network-interface/*",
"arn:aws:ec2:*:*:subnet/*",
"arn:aws:ec2:*:*:security-group/*",
},
},
map[string]interface{}{
"Sid": "TagENI",
"Effect": "Allow",
"Action": "ec2:CreateTags",
"Resource": "arn:aws:ec2:*:*:network-interface/*",
"Condition": map[string]map[string]string{
"StringEquals": map[string]string{
"ec2:ManagedResourceOperator": "network-connectors.lambda.amazonaws.com",
},
},
},
},
})
if err != nil {
return err
}
json1 := string(tmpJSON1)
_, err = iam.NewRolePolicy(ctx, "example", &iam.RolePolicyArgs{
Name: pulumi.String("example-network-connector-operator"),
Role: exampleRole.ID().ToIDOutput().ToStringOutput(),
Policy: pulumi.String(json1),
})
if err != nil {
return err
}
return nil
})
}

pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_lambda_corenetworkconnector" "example" {
  configuration = {
    vpc_egress_configuration = {
      associated_compute_resource_types = ["MicroVm"]
      network_protocol                  = "IPv4"
      subnet_ids                        = exampleAwsSubnet[*].id
      security_group_ids                = [exampleAwsSecurityGroup.id]
    }
  }
  name          = "example"
  operator_role = aws_iam_role.example.arn
}
resource "aws_iam_role" "example" {
  name = "example-network-connector-operator"
  assume_role_policy = jsonencode({
    "Version" = "2012-10-17"
    "Statement" = [{
      "Action" = "sts:AssumeRole"
      "Effect" = "Allow"
      "Principal" = {
        "Service" = "network-connectors.lambda.amazonaws.com"
      }
    }]
  })
}
resource "aws_iam_rolepolicy" "example" {
  name = "example-network-connector-operator"
  role = aws_iam_role.example.id
  policy = jsonencode({
    "Version" = "2012-10-17"
    "Statement" = [{
      "Sid"      = "CreateENI"
      "Effect"   = "Allow"
      "Action"   = "ec2:CreateNetworkInterface"
      "Resource" = ["arn:aws:ec2:*:*:network-interface/*", "arn:aws:ec2:*:*:subnet/*", "arn:aws:ec2:*:*:security-group/*"]
      }, {
      "Sid"      = "TagENI"
      "Effect"   = "Allow"
      "Action"   = "ec2:CreateTags"
      "Resource" = "arn:aws:ec2:*:*:network-interface/*"
      "Condition" = {
        "StringEquals" = {
          "ec2:ManagedResourceOperator" = "network-connectors.lambda.amazonaws.com"
        }
      }
    }]
  })
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.iam.Role;
import com.pulumi.aws.iam.RoleArgs;
import com.pulumi.aws.lambda.CoreNetworkConnector;
import com.pulumi.aws.lambda.CoreNetworkConnectorArgs;
import com.pulumi.aws.lambda.inputs.CoreNetworkConnectorConfigurationArgs;
import com.pulumi.aws.lambda.inputs.CoreNetworkConnectorConfigurationVpcEgressConfigurationArgs;
import com.pulumi.aws.iam.RolePolicy;
import com.pulumi.aws.iam.RolePolicyArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var exampleRole = new Role("exampleRole", RoleArgs.builder()
            .name("example-network-connector-operator")
            .assumeRolePolicy(serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(jsonObject(
                        jsonProperty("Action", "sts:AssumeRole"),
                        jsonProperty("Effect", "Allow"),
                        jsonProperty("Principal", jsonObject(
                            jsonProperty("Service", "network-connectors.lambda.amazonaws.com")
                        ))
                    )))
                )))
            .build());

        var example = new CoreNetworkConnector("example", CoreNetworkConnectorArgs.builder()
            .configuration(CoreNetworkConnectorConfigurationArgs.builder()
                .vpcEgressConfiguration(CoreNetworkConnectorConfigurationVpcEgressConfigurationArgs.builder()
                    .associatedComputeResourceTypes("MicroVm")
                    .networkProtocol("IPv4")
                    .subnetIds(exampleAwsSubnet.stream().map(element -> element.id()).collect(toList()))
                    .securityGroupIds(exampleAwsSecurityGroup.id())
                    .build())
                .build())
            .name("example")
            .operatorRole(exampleRole.arn())
            .build());

        var exampleRolePolicy = new RolePolicy("exampleRolePolicy", RolePolicyArgs.builder()
            .name("example-network-connector-operator")
            .role(exampleRole.id())
            .policy(serializeJson(
                jsonObject(
                    jsonProperty("Version", "2012-10-17"),
                    jsonProperty("Statement", jsonArray(
                        jsonObject(
                            jsonProperty("Sid", "CreateENI"),
                            jsonProperty("Effect", "Allow"),
                            jsonProperty("Action", "ec2:CreateNetworkInterface"),
                            jsonProperty("Resource", jsonArray(
                                "arn:aws:ec2:*:*:network-interface/*",
                                "arn:aws:ec2:*:*:subnet/*",
                                "arn:aws:ec2:*:*:security-group/*"
                            ))
                        ),
                        jsonObject(
                            jsonProperty("Sid", "TagENI"),
                            jsonProperty("Effect", "Allow"),
                            jsonProperty("Action", "ec2:CreateTags"),
                            jsonProperty("Resource", "arn:aws:ec2:*:*:network-interface/*"),
                            jsonProperty("Condition", jsonObject(
                                jsonProperty("StringEquals", jsonObject(
                                    jsonProperty("ec2:ManagedResourceOperator", "network-connectors.lambda.amazonaws.com")
                                ))
                            ))
                        )
                    ))
                )))
            .build());

    }
}

Import

Identity Schema

Required

arn (String) ARN of the network connector.

Using pulumi import, import Lambda Network Connectors using the arn. For example:

$ pulumi import aws:lambda/coreNetworkConnector:CoreNetworkConnector example arn:aws:lambda:us-east-1:123456789012:network-connector:example

Constructors

CoreNetworkConnector(String name, {CoreNetworkConnectorArgs? args, CustomResourceOptions? options}): Creates a new CoreNetworkConnector. name The Pulumi resource name. args Arguments used to configure this CoreNetworkConnector. The set of arguments for CoreNetworkConnector. options Resource options controlling this resource's behavior.
CoreNetworkConnector.reference(String urn): Creates a typed reference to an existing CoreNetworkConnector resource.

Properties

arn ↔ Output<String>: ARN of the network connector.
latefinal
childResources → Set<Resource>: finalinherited
completionSources ↔ Map<String, IOutputCompletionSource>: latefinalinherited
configuration ↔ Output<CoreNetworkConnectorConfiguration>: Network configuration of the connector. See configuration Block below.
latefinal
hashCode → int: The hash code for this object.
no setterinherited
id ↔ Output<String>: getter/setter pairinherited
isCustom → bool: Returns whether this resource is provider-managed.
no setterinherited
isProtected → bool: Returns whether this resource is protected from deletion.
no setterinherited
isRemote → bool: Whether this resource is registered as remote.
no setterinherited
isResourceReference → bool: Whether this instance represents a resource value returned over RPC.
finalinherited
name ↔ Output<String>: Name of the network connector, unique within the account and Region. Changing this forces a new resource.
latefinal
operatorRole ↔ Output<String>: ARN of the IAM role that the network connector service assumes to manage elastic network interfaces in your VPC.
latefinal
region ↔ Output<String>: Region where this resource will be managed. Defaults to the Region set in the provider configuration.
latefinal
resourceTransforms → List<ResourceTransform>: Inherited/explicit async transforms.
no setterinherited
runtimeType → Type: A representation of the runtime type of the object.
no setterinherited
timeouts ↔ Output<CoreNetworkConnectorTimeouts?>: latefinal
transformations → List<ResourceTransformation>: Inherited/explicit legacy transformations.
no setterinherited
urn ↔ Output<String>: latefinalinherited

Methods

failId(Object error) → void: Completes this resource ID with an error when registration fails.
inherited
failOutputs(Object error) → void: Completes all output properties with error.
inherited
failUrn(Object error) → void: Completes this resource URN with an error when registration fails.
inherited
getProvider(String moduleMember) → ProviderResource?: Returns provider for moduleMember's package, if configured.
inherited
getResourceName() → String: Returns this resource's logical name.
inherited
getResourceType() → String: Returns this resource's Pulumi type token.
inherited
noSuchMethod(Invocation invocation) → dynamic: Invoked when a nonexistent method or property is accessed.
inherited
registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>: Registers a dynamic output property for this resource.
inherited
resolveId(String? value, {required bool isKnown}) → void: Resolves the provider-assigned ID for this resource.
inherited
resolveOutputs(Struct outputs) → void: Resolves all output properties from a monitor response payload.
inherited
resolveUrn(String value) → void: Resolves this resource's URN once assigned by the engine.
inherited
serializeProperties(Map<String, dynamic> properties) → Future<Struct>: Serializes resource properties for RPC transmission.
inherited
toString() → String: A string representation of this object.
inherited

Operators

operator ==(Object other) → bool: The equality operator.
inherited

Static Methods

get(String name, Input<String> id, {CoreNetworkConnectorState? state, CustomResourceOptions? options}) → CoreNetworkConnector: Gets an existing CoreNetworkConnector resource's state with the given name and id.