Aws/ec2

@swamp/aws/ec2v2026.04.24.1· 6d agoMODELS

01README

AWS EC2 infrastructure models

02Release Notes

Updated: ec2fleet

03Models106

network_insights_path.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
SourceIp?	string	no
FilterAtSource?	object	no
FilterAtDestination?	object	no
DestinationIp?	string	no
Source	string	yes
Destination?	string	no
Protocol	enum	yes
DestinationPort?	number	no
Tags?	array	no

fn create()

Create a EC2 NetworkInsightsPath

fn get(identifier: string)

Get a EC2 NetworkInsightsPath

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkInsightsPath

fn update()

Update a EC2 NetworkInsightsPath

fn delete(identifier: string)

Delete a EC2 NetworkInsightsPath

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkInsightsPath

fn sync()

Sync EC2 NetworkInsightsPath state from AWS

verified_access_endpoint.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
VerifiedAccessGroupId	string	yes	The ID of the AWS Verified Access group.
SecurityGroupIds?	array	no	The IDs of the security groups for the endpoint.
NetworkInterfaceOptions?	object	no	The ID of the network interface.
LoadBalancerOptions?	object	no	The ARN of the load balancer.
RdsOptions?	object	no	The IP protocol.
CidrOptions?	object	no	The IP address range, in CIDR notation.
EndpointType	string	yes	The type of AWS Verified Access endpoint. Incoming application requests will be sent to an IP address, load balancer or a network interface depending on the endpoint type specified.The type of AWS Verified Access endpoint. Incoming application requests will be sent to an IP address, load balancer or a network interface depending on the endpoint type specified.
EndpointDomainPrefix?	string	no	A custom identifier that gets prepended to a DNS name that is generated for the endpoint.
DomainCertificateArn?	string	no	The ARN of a public TLS/SSL certificate imported into or created with ACM.
AttachmentType	string	yes	The type of attachment used to provide connectivity between the AWS Verified Access endpoint and the application.
ApplicationDomain?	string	no	The DNS name for users to reach your application.
Description?	string	no	A description for the AWS Verified Access endpoint.
PolicyDocument?	string	no	The AWS Verified Access policy document.
PolicyEnabled?	boolean	no	The status of the Verified Access policy.
Tags?	array	no	An array of key-value pairs to apply to this resource.
SseSpecification?	object	no	KMS Key Arn used to encrypt the group policy

fn create()

Create a EC2 VerifiedAccessEndpoint

fn get(identifier: string)

Get a EC2 VerifiedAccessEndpoint

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VerifiedAccessEndpoint

fn update()

Update a EC2 VerifiedAccessEndpoint

fn delete(identifier: string)

Delete a EC2 VerifiedAccessEndpoint

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VerifiedAccessEndpoint

fn sync()

Sync EC2 VerifiedAccessEndpoint state from AWS

carrier_gateway.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
VpcId	string	yes	The ID of the VPC.
Tags?	array	no	The tags for the carrier gateway.

fn create()

Create a EC2 CarrierGateway

fn get(identifier: string)

Get a EC2 CarrierGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 CarrierGateway

fn update()

Update a EC2 CarrierGateway

fn delete(identifier: string)

Delete a EC2 CarrierGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 CarrierGateway

fn sync()

Sync EC2 CarrierGateway state from AWS

transit_gateway_multicast_group_member.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
GroupIpAddress	string	yes	The IP address assigned to the transit gateway multicast group.
TransitGatewayMulticastDomainId	string	yes	The ID of the transit gateway multicast domain.
NetworkInterfaceId	string	yes	The ID of the transit gateway attachment.

fn create()

Create a EC2 TransitGatewayMulticastGroupMember

fn get(identifier: string)

Get a EC2 TransitGatewayMulticastGroupMember

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayMulticastGroupMember

fn delete(identifier: string)

Delete a EC2 TransitGatewayMulticastGroupMember

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayMulticastGroupMember

fn sync()

Sync EC2 TransitGatewayMulticastGroupMember state from AWS

instance.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Volumes?	array	no	The volumes to attach to the instance.
EnclaveOptions?	object	no	If this parameter is set to true, the instance is enabled for AWS Nitro Enclaves; otherwise, it is not enabled for AWS Nitro Enclaves.
ImageId?	string	no	The ID of the AMI. An AMI ID is required to launch an instance and must be specified here or in a launch template.
Tags?	array	no	The tags to add to the instance.
AdditionalInfo?	string	no	This property is reserved for internal use. If you use it, the stack fails with this error: Bad property set: [Testing this property] (Service: AmazonEC2; Status Code: 400; Error Code: InvalidParameterCombination; Request ID: 0XXXXXX-49c7-4b40-8bcc-76885dcXXXXX).
HibernationOptions?	object	no	If you set this parameter to true, your instance is enabled for hibernation.
LicenseSpecifications?	array	no	The license configurations.
MetadataOptions?	object	no	The number of network hops that the metadata token can travel. Maximum is 64.
CpuOptions?	object	no	The CPU options for the instance.
AvailabilityZone?	string	no	The Availability Zone of the instance.
PrivateDnsNameOptions?	object	no	Indicates whether to respond to DNS queries for instance hostnames with DNS A records. For more information, see Amazon EC2 instance hostname types in the Amazon Elastic Compute Cloud User Guide.
HostId?	string	no	If you specify host for the Affinity property, the ID of a dedicated host that the instance is associated with. If you don't specify an ID, Amazon EC2 launches the instance onto any available, compatible dedicated host in your account.
SecurityGroupIds?	array	no	The IDs of the security groups.
PlacementGroupName?	string	no	The name of an existing placement group that you want to launch the instance into (cluster \| partition \| spread).
SsmAssociations?	array	no	The SSM document and parameter values in AWS Systems Manager to associate with this instance.
State?	object	no	The state of the instance as a 16-bit unsigned integer.
Affinity?	enum	no	Indicates whether the instance is associated with a dedicated host. If you want the instance to always restart on the same host on which it was launched, specify host. If you want the instance to restart on any available host, but try to launch onto the last host it ran on (on a best-effort basis), specify default.
Tenancy?	string	no	The tenancy of the instance (if the instance is running in a VPC). An instance with a tenancy of dedicated runs on single-tenant hardware.
SecurityGroups?	array	no	the names of the security groups. For a nondefault VPC, you must use security group IDs instead.
PrivateIpAddress?	string	no	[EC2-VPC] The primary IPv4 address. You must specify a value from the IPv4 address range of the subnet.
UserData?	string	no	The user data to make available to the instance.
BlockDeviceMappings?	array	no	The block device mapping entries that defines the block devices to attach to the instance at launch.
IamInstanceProfile?	string	no	The IAM instance profile.
Ipv6Addresses?	array	no	[EC2-VPC] The IPv6 addresses from the range of the subnet to associate with the primary network interface.
KernelId?	string	no	The ID of the kernel.
SubnetId?	string	no	[EC2-VPC] The ID of the subnet to launch the instance into.
EbsOptimized?	boolean	no	Indicates whether the instance is optimized for Amazon EBS I/O.
PropagateTagsToVolumeOnCreation?	boolean	no	Indicates whether to assign the tags from the instance to all of the volumes attached to the instance at launch. If you specify true and you assign tags to the instance, those tags are automatically assigned to all of the volumes that you attach to the instance at launch. If you specify false, those tags are not assigned to the attached volumes.
ElasticGpuSpecifications?	array	no	An elastic GPU to associate with the instance. Amazon Elastic Graphics is no longer available.
ElasticInferenceAccelerators?	array	no	An elastic inference accelerator to associate with the instance. Amazon Elastic Inference is no longer available.
Ipv6AddressCount?	number	no	[EC2-VPC] The number of IPv6 addresses to associate with the primary network interface. Amazon EC2 chooses the IPv6 addresses from the range of your subnet.
LaunchTemplate?	object	no	The name of the launch template. You must specify the LaunchTemplateName or the LaunchTemplateId, but not both.
NetworkInterfaces?	array	no	The network interfaces to associate with the instance.
InstanceType?	string	no	The instance type.
Monitoring?	boolean	no	Specifies whether detailed monitoring is enabled for the instance.
InstanceInitiatedShutdownBehavior?	string	no	Indicates whether an instance stops or terminates when you initiate shutdown from the instance (using the operating system command for system shutdown).
HostResourceGroupArn?	string	no	The ARN of the host resource group in which to launch the instances. If you specify a host resource group ARN, omit the Tenancy parameter or set it to host.
DisableApiTermination?	boolean	no	If you set this parameter to true, you can't terminate the instance using the Amazon EC2 console, CLI, or API; otherwise, you can.
KeyName?	string	no	The name of the key pair.
RamdiskId?	string	no	The ID of the RAM disk to select.
SourceDestCheck?	boolean	no	Specifies whether to enable an instance launched in a VPC to perform NAT.
CreditSpecification?	object	no	The credit option for CPU usage of the burstable performance instance. Valid values are standard and unlimited.

fn create()

Create a EC2 Instance

fn get(identifier: string)

Get a EC2 Instance

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 Instance

fn update()

Update a EC2 Instance

fn delete(identifier: string)

Delete a EC2 Instance

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 Instance

fn sync()

Sync EC2 Instance state from AWS

local_gateway_route_table_vpcassociation.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
LocalGatewayRouteTableId	string	yes	The ID of the local gateway route table.
VpcId	string	yes	The ID of the VPC.
Tags?	array	no	The tags for the association.

fn create()

Create a EC2 LocalGatewayRouteTableVPCAssociation

fn get(identifier: string)

Get a EC2 LocalGatewayRouteTableVPCAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LocalGatewayRouteTableVPCAssociation

fn update()

Update a EC2 LocalGatewayRouteTableVPCAssociation

fn delete(identifier: string)

Delete a EC2 LocalGatewayRouteTableVPCAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LocalGatewayRouteTableVPCAssociation

fn sync()

Sync EC2 LocalGatewayRouteTableVPCAssociation state from AWS

security_group_egress.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
CidrIp?	string	no	The IPv4 address range, in CIDR format. You must specify exactly one of the following: CidrIp, CidrIpv6, DestinationPrefixListId, or DestinationSecurityGroupId. For examples of rules that you can add to security groups for specific access scenarios, see [Security group rules for different use cases](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html) in the User Guide.
CidrIpv6?	string	no	The IPv6 address range, in CIDR format. You must specify exactly one of the following: CidrIp, CidrIpv6, DestinationPrefixListId, or DestinationSecurityGroupId. For examples of rules that you can add to security groups for specific access scenarios, see [Security group rules for different use cases](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules-reference.html) in the User Guide.
Description?	string	no	The description of an egress (outbound) security group rule. Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and._-:/()#,@[]+=;{}!$*
FromPort?	number	no	If the protocol is TCP or UDP, this is the start of the port range. If the protocol is ICMP or ICMPv6, this is the ICMP type or -1 (all ICMP types).
ToPort?	number	no	If the protocol is TCP or UDP, this is the end of the port range. If the protocol is ICMP or ICMPv6, this is the ICMP code or -1 (all ICMP codes). If the start port is -1 (all ICMP types), then the end port must be -1 (all ICMP codes).
IpProtocol	string	yes	The IP protocol name ( tcp, udp, icmp, icmpv6) or number (see [Protocol Numbers](https://docs.aws.amazon.com/http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)). Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp, udp, icmp, or icmpv6 allows traffic on all ports, regardless of any port range you specify. For tcp, udp, and icmp, you must specify a port range. For icmpv6, the port range is optional; if you omit the port range, traffic for all types and codes is allowed.
DestinationSecurityGroupId?	string	no	The ID of the security group. You must specify exactly one of the following: CidrIp, CidrIpv6, DestinationPrefixListId, or DestinationSecurityGroupId.
DestinationPrefixListId?	string	no	The prefix list IDs for an AWS service. This is the AWS service to access through a VPC endpoint from instances associated with the security group. You must specify exactly one of the following: CidrIp, CidrIpv6, DestinationPrefixListId, or DestinationSecurityGroupId.
GroupId	string	yes	The ID of the security group. You must specify either the security group ID or the security group name in the request. For security groups in a nondefault VPC, you must specify the security group ID.

fn create()

Create a EC2 SecurityGroupEgress

fn get(identifier: string)

Get a EC2 SecurityGroupEgress

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SecurityGroupEgress

fn update()

Update a EC2 SecurityGroupEgress

fn delete(identifier: string)

Delete a EC2 SecurityGroupEgress

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SecurityGroupEgress

fn sync()

Sync EC2 SecurityGroupEgress state from AWS

network_insights_analysis.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
FilterOutArns?	array	no
NetworkInsightsPathId	string	yes
FilterInArns?	array	no
AdditionalAccounts?	array	no
Tags?	array	no

fn create()

Create a EC2 NetworkInsightsAnalysis

fn get(identifier: string)

Get a EC2 NetworkInsightsAnalysis

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkInsightsAnalysis

fn update()

Update a EC2 NetworkInsightsAnalysis

fn delete(identifier: string)

Delete a EC2 NetworkInsightsAnalysis

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkInsightsAnalysis

fn sync()

Sync EC2 NetworkInsightsAnalysis state from AWS

transit_gateway_route_table_association.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
TransitGatewayRouteTableId	string	yes	The ID of transit gateway route table.
TransitGatewayAttachmentId	string	yes	The ID of transit gateway attachment.

fn create()

Create a EC2 TransitGatewayRouteTableAssociation

fn get(identifier: string)

Get a EC2 TransitGatewayRouteTableAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayRouteTableAssociation

fn delete(identifier: string)

Delete a EC2 TransitGatewayRouteTableAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayRouteTableAssociation

fn sync()

Sync EC2 TransitGatewayRouteTableAssociation state from AWS

instance_connect_endpoint.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
SubnetId	string	yes	The ID of the subnet in which the EC2 Instance Connect Endpoint was created.
ClientToken?	string	no	The client token of the instance connect endpoint.
PreserveClientIp?	boolean	no	Indicates whether your client's IP address is preserved as the source when you connect to a resource.
Tags?	array	no	The tags assigned to the EC2 Instance Connect Endpoint.
SecurityGroupIds?	array	no	The security groups associated with the endpoint.
PublicDnsNames?	object	no	The IPv4-only DNS name of the EC2 Instance Connect Endpoint.

fn create()

Create a EC2 InstanceConnectEndpoint

fn get(identifier: string)

Get a EC2 InstanceConnectEndpoint

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 InstanceConnectEndpoint

fn update()

Update a EC2 InstanceConnectEndpoint

fn delete(identifier: string)

Delete a EC2 InstanceConnectEndpoint

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 InstanceConnectEndpoint

fn sync()

Sync EC2 InstanceConnectEndpoint state from AWS

transit_gateway_connect_peer.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
TransitGatewayAttachmentId	string	yes	The ID of the Connect attachment.
ConnectPeerConfiguration	object	yes	The range of interior BGP peer IP addresses.
Tags?	array	no	The tags for the Connect Peer.

fn create()

Create a EC2 TransitGatewayConnectPeer

fn get(identifier: string)

Get a EC2 TransitGatewayConnectPeer

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayConnectPeer

fn update()

Update a EC2 TransitGatewayConnectPeer

fn delete(identifier: string)

Delete a EC2 TransitGatewayConnectPeer

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayConnectPeer

fn sync()

Sync EC2 TransitGatewayConnectPeer state from AWS

volume_attachment.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
VolumeId	string	yes	The ID of the Amazon EBS volume. The volume and instance must be within the same Availability Zone. This value can be a reference to an [AWS::EC2::Volume](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-ebs-volume.html) resource, or it can be the volume ID of an existing Amazon EBS volume.
InstanceId	string	yes	The ID of the instance to which the volume attaches. This value can be a reference to an [AWS::EC2::Instance](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-instance.html) resource, or it can be the physical ID of an existing EC2 instance.
Device?	string	no	The device name (for example, /dev/sdh or xvdh).
EbsCardIndex?	number	no	The index of the EBS card. Some instance types support multiple EBS cards. The default EBS card index is 0.

fn create()

Create a EC2 VolumeAttachment

fn get(identifier: string)

Get a EC2 VolumeAttachment

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VolumeAttachment

fn delete(identifier: string)

Delete a EC2 VolumeAttachment

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VolumeAttachment

fn sync()

Sync EC2 VolumeAttachment state from AWS

security_group_ingress.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
CidrIp?	string	no	The IPv4 ranges
CidrIpv6?	string	no	[VPC only] The IPv6 ranges
Description?	string	no	Updates the description of an ingress (inbound) security group rule. You can replace an existing description, or add a description to a rule that did not have one previously
FromPort?	number	no	The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes. Use this for ICMP and any protocol that uses ports.
GroupId?	string	no	The ID of the security group. You must specify either the security group ID or the security group name in the request. For security groups in a nondefault VPC, you must specify the security group ID. You must specify the GroupName property or the GroupId property. For security groups that are in a VPC, you must use the GroupId property.
GroupName?	string	no	The name of the security group.
IpProtocol	string	yes	The IP protocol name (tcp, udp, icmp, icmpv6) or number (see Protocol Numbers). [VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp, udp, icmp, or icmpv6 allows traffic on all ports, regardless of any port range you specify. For tcp, udp, and icmp, you must specify a port range. For icmpv6, the port range is optional; if you omit the port range, traffic for all types and codes is allowed.
SourcePrefixListId?	string	no	[EC2-VPC only] The ID of a prefix list.
SourceSecurityGroupId?	string	no	The ID of the security group. You must specify either the security group ID or the security group name. For security groups in a nondefault VPC, you must specify the security group ID.
SourceSecurityGroupName?	string	no	[EC2-Classic, default VPC] The name of the source security group. You must specify the GroupName property or the GroupId property. For security groups that are in a VPC, you must use the GroupId property.
SourceSecurityGroupOwnerId?	string	no	[nondefault VPC] The AWS account ID that owns the source security group. You can't specify this property with an IP address range. If you specify SourceSecurityGroupName or SourceSecurityGroupId and that security group is owned by a different account than the account creating the stack, you must specify the SourceSecurityGroupOwnerId; otherwise, this property is optional.
ToPort?	number	no	The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes. Use this for ICMP and any protocol that uses ports.

fn create()

Create a EC2 SecurityGroupIngress

fn get(identifier: string)

Get a EC2 SecurityGroupIngress

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SecurityGroupIngress

fn update()

Update a EC2 SecurityGroupIngress

fn delete(identifier: string)

Delete a EC2 SecurityGroupIngress

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SecurityGroupIngress

fn sync()

Sync EC2 SecurityGroupIngress state from AWS

local_gateway_virtual_interface_group.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
LocalGatewayId	string	yes	The ID of the local gateway
LocalBgpAsn?	number	no	The Autonomous System Number(ASN) for the local Border Gateway Protocol (BGP)
LocalBgpAsnExtended?	number	no	The extended 32-bit ASN for the local BGP configuration
Tags?	array	no	The tags assigned to the virtual interface group

fn create()

Create a EC2 LocalGatewayVirtualInterfaceGroup

fn get(identifier: string)

Get a EC2 LocalGatewayVirtualInterfaceGroup

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LocalGatewayVirtualInterfaceGroup

fn update()

Update a EC2 LocalGatewayVirtualInterfaceGroup

fn delete(identifier: string)

Delete a EC2 LocalGatewayVirtualInterfaceGroup

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LocalGatewayVirtualInterfaceGroup

fn sync()

Sync EC2 LocalGatewayVirtualInterfaceGroup state from AWS

transit_gateway_metering_policy_entry.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
DestinationTransitGatewayAttachmentId?	string	no	The ID of the source attachment through which traffic leaves a transit gateway
SourcePortRange?	string	no	The list of ports on source instances sending traffic to the transit gateway
PolicyRuleNumber	number	yes	The rule number of the metering policy entry
DestinationTransitGatewayAttachmentType?	enum	no	The type of the attachment through which traffic leaves a transit gateway
DestinationCidrBlock?	string	no	The list of IP addresses of the instances receiving traffic from the transit gateway
TransitGatewayMeteringPolicyId	string	yes	The ID of the transit gateway metering policy for which the entry is being created
DestinationPortRange?	string	no	The list of ports on destination instances receiving traffic from the transit gateway
MeteredAccount	enum	yes	The resource owner information responsible for paying default billable charges for the traffic flow
SourceCidrBlock?	string	no	The list of IP addresses of the instances sending traffic to the transit gateway for which the metering policy entry is applicable
Protocol?	string	no	The protocol of the traffic
SourceTransitGatewayAttachmentId?	string	no	The ID of the source attachment through which traffic enters a transit gateway
SourceTransitGatewayAttachmentType?	enum	no	The type of the attachment through which traffic enters a transit gateway

fn create()

Create a EC2 TransitGatewayMeteringPolicyEntry

fn get(identifier: string)

Get a EC2 TransitGatewayMeteringPolicyEntry

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayMeteringPolicyEntry

fn delete(identifier: string)

Delete a EC2 TransitGatewayMeteringPolicyEntry

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayMeteringPolicyEntry

fn sync()

Sync EC2 TransitGatewayMeteringPolicyEntry state from AWS

verified_access_instance.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
VerifiedAccessTrustProviders?	array	no	AWS Verified Access trust providers.
VerifiedAccessTrustProviderIds?	array	no	The IDs of the AWS Verified Access trust providers.
Description?	string	no	A description for the AWS Verified Access instance.
LoggingConfigurations?	object	no	Select log version for Verified Access logs.
Tags?	array	no	An array of key-value pairs to apply to this resource.
FipsEnabled?	boolean	no	Indicates whether FIPS is enabled
CidrEndpointsCustomSubDomain?	string	no	Introduce CidrEndpointsCustomSubDomain property to represent the domain (say, ava.my-company.com)

fn create()

Create a EC2 VerifiedAccessInstance

fn get(identifier: string)

Get a EC2 VerifiedAccessInstance

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VerifiedAccessInstance

fn update()

Update a EC2 VerifiedAccessInstance

fn delete(identifier: string)

Delete a EC2 VerifiedAccessInstance

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VerifiedAccessInstance

fn sync()

Sync EC2 VerifiedAccessInstance state from AWS

vpccidr_block.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
CidrBlock?	string	no	An IPv4 CIDR block to associate with the VPC.
Ipv6Pool?	string	no	The ID of an IPv6 address pool from which to allocate the IPv6 CIDR block.
VpcId	string	yes	The ID of the VPC.
Ipv6CidrBlock?	string	no	An IPv6 CIDR block from the IPv6 address pool.
Ipv4IpamPoolId?	string	no	The ID of the IPv4 IPAM pool to Associate a CIDR from to a VPC.
Ipv4NetmaskLength?	number	no	The netmask length of the IPv4 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool.
Ipv6IpamPoolId?	string	no	The ID of the IPv6 IPAM pool to Associate a CIDR from to a VPC.
Ipv6NetmaskLength?	number	no	The netmask length of the IPv6 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool.
AmazonProvidedIpv6CidrBlock?	boolean	no	Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC. You cannot specify the range of IPv6 addresses, or the size of the CIDR block.
Ipv6CidrBlockNetworkBorderGroup?	string	no	The name of the location from which we advertise the IPV6 CIDR block.

fn create()

Create a EC2 VPCCidrBlock

fn get(identifier: string)

Get a EC2 VPCCidrBlock

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCCidrBlock

fn delete(identifier: string)

Delete a EC2 VPCCidrBlock

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCCidrBlock

fn sync()

Sync EC2 VPCCidrBlock state from AWS

traffic_mirror_session.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
NetworkInterfaceId	string	yes	The ID of the source network interface.
TrafficMirrorTargetId	string	yes	The ID of a Traffic Mirror target.
TrafficMirrorFilterId	string	yes	The ID of a Traffic Mirror filter.
PacketLength?	number	no	The number of bytes in each packet to mirror.
SessionNumber	number	yes	The session number determines the order in which sessions are evaluated when an interface is used by multiple sessions. The first session with a matching filter is the one that mirrors the packets.
VirtualNetworkId?	number	no	The VXLAN ID for the Traffic Mirror session.
Description?	string	no	The description of the Traffic Mirror session.
OwnerId?	string	no	The ID of the account that owns the Traffic Mirror session.
Tags?	array	no	The tags assigned to the Traffic Mirror session.

fn create()

Create a EC2 TrafficMirrorSession

fn get(identifier: string)

Get a EC2 TrafficMirrorSession

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TrafficMirrorSession

fn update()

Update a EC2 TrafficMirrorSession

fn delete(identifier: string)

Delete a EC2 TrafficMirrorSession

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TrafficMirrorSession

fn sync()

Sync EC2 TrafficMirrorSession state from AWS

local_gateway_route_table.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
LocalGatewayId	string	yes	The ID of the local gateway.
Mode?	string	no	The mode of the local gateway route table.
Tags?	array	no	The tags for the local gateway route table.

fn create()

Create a EC2 LocalGatewayRouteTable

fn get(identifier: string)

Get a EC2 LocalGatewayRouteTable

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LocalGatewayRouteTable

fn update()

Update a EC2 LocalGatewayRouteTable

fn delete(identifier: string)

Delete a EC2 LocalGatewayRouteTable

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LocalGatewayRouteTable

fn sync()

Sync EC2 LocalGatewayRouteTable state from AWS

vpcendpoint.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
PrivateDnsEnabled?	boolean	no	Indicate whether to associate a private hosted zone with the specified VPC. The private hosted zone contains a record set for the default public DNS name for the service for the Region (for example, kinesis.us-east-1.amazonaws.com), which resolves to the private IP addresses of the endpoint network interfaces in the VPC. This enables you to make requests to the default public DNS name for the service instead of the public DNS names that are automatically generated by the VPC endpoint service. To use a private hosted zone, you must set the following VPC attributes to true: enableDnsHostnames and enableDnsSupport. This property is supported only for interface endpoints. Default: false
IpAddressType?	enum	no	The supported IP address types.
ServiceRegion?	string	no	Describes a Region.
DnsOptions?	object	no	Indicates whether to enable private DNS only for inbound endpoints. This option is available only for services that support both gateway and interface endpoints. It routes traffic that originates from the VPC to the gateway endpoint and traffic that originates from on-premises to the interface endpoint.
ResourceConfigurationArn?	string	no	The Amazon Resource Name (ARN) of the resource configuration.
SecurityGroupIds?	array	no	The IDs of the security groups to associate with the endpoint network interfaces. If this parameter is not specified, we use the default security group for the VPC. Security groups are supported only for interface endpoints.
SubnetIds?	array	no	The IDs of the subnets in which to create endpoint network interfaces. You must specify this property for an interface endpoint or a Gateway Load Balancer endpoint. You can't specify this property for a gateway endpoint. For a Gateway Load Balancer endpoint, you can specify only one subnet.
ServiceNetworkArn?	string	no	The Amazon Resource Name (ARN) of the service network.
VpcId	string	yes	The ID of the VPC.
RouteTableIds?	array	no	The IDs of the route tables. Routing is supported only for gateway endpoints.
ServiceName?	string	no	The name of the endpoint service.
PolicyDocument?	string	no	An endpoint policy, which controls access to the service from the VPC. The default endpoint policy allows full access to the service. Endpoint policies are supported only for gateway and interface endpoints. For CloudFormation templates in YAML, you can provide the policy in JSON or YAML format. For example, if you have a JSON policy, you can convert it to YAML before including it in the YAML template, and CFNlong converts the policy to JSON format before calling the API actions for privatelink. Alternatively, you can include the JSON directly in the YAML, as shown in the following Properties section: Properties: VpcEndpointType: \'Interface\' ServiceName:!Sub \'com.amazonaws.${AWS::Region}.logs\' PolicyDocument: \'{ "Version":"2012-10-17", "Statement": [{ "Effect":"Allow", "Principal":"", "Action":["logs:Describe","logs:Get","logs:List","logs:FilterLogEvents"], "Resource":"*" }] }\'
VpcEndpointType?	enum	no	The type of endpoint. Default: Gateway
Tags?	array	no	The tags to associate with the endpoint.

fn create()

Create a EC2 VPCEndpoint

fn get(identifier: string)

Get a EC2 VPCEndpoint

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCEndpoint

fn update()

Update a EC2 VPCEndpoint

fn delete(identifier: string)

Delete a EC2 VPCEndpoint

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCEndpoint

fn sync()

Sync EC2 VPCEndpoint state from AWS

network_performance_metric_subscription.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Source	string	yes	The starting Region or Availability Zone for metric to subscribe to.
Destination	string	yes	The target Region or Availability Zone for the metric to subscribe to.
Metric	string	yes	The metric type to subscribe to.
Statistic	string	yes	The statistic to subscribe to.

fn create()

Create a EC2 NetworkPerformanceMetricSubscription

fn get(identifier: string)

Get a EC2 NetworkPerformanceMetricSubscription

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkPerformanceMetricSubscription

fn delete(identifier: string)

Delete a EC2 NetworkPerformanceMetricSubscription

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkPerformanceMetricSubscription

fn sync()

Sync EC2 NetworkPerformanceMetricSubscription state from AWS

network_interface_attachment.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
DeleteOnTermination?	boolean	no	Whether to delete the network interface when the instance terminates. By default, this value is set to true.
DeviceIndex	string	yes	The network interface's position in the attachment order. For example, the first attached network interface has a DeviceIndex of 0.
InstanceId	string	yes	The ID of the instance to which you will attach the ENI.
NetworkInterfaceId	string	yes	The ID of the ENI that you want to attach.
EnaSrdSpecification?	object	no	Indicates whether ENA Express is enabled for the network interface.
EnaQueueCount?	number	no	The number of ENA queues created with the instance.

fn create()

Create a EC2 NetworkInterfaceAttachment

fn get(identifier: string)

Get a EC2 NetworkInterfaceAttachment

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkInterfaceAttachment

fn update()

Update a EC2 NetworkInterfaceAttachment

fn delete(identifier: string)

Delete a EC2 NetworkInterfaceAttachment

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkInterfaceAttachment

fn sync()

Sync EC2 NetworkInterfaceAttachment state from AWS

capacity_reservation.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Tenancy?	string	no
EndDateType?	string	no
TagSpecifications?	array	no
UnusedReservationBillingOwnerId?	string	no
EbsOptimized?	boolean	no
OutPostArn?	string	no
InstanceType	string	yes
AvailabilityZoneId?	string	no
AvailabilityZone?	string	no
EndDate?	string	no
InstanceCount	number	yes
PlacementGroupArn?	string	no
CommitmentInfo?	object	no
InstancePlatform	string	yes
EphemeralStorage?	boolean	no
InstanceMatchCriteria?	string	no

fn create()

Create a EC2 CapacityReservation

fn get(identifier: string)

Get a EC2 CapacityReservation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 CapacityReservation

fn update()

Update a EC2 CapacityReservation

fn delete(identifier: string)

Delete a EC2 CapacityReservation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 CapacityReservation

fn sync()

Sync EC2 CapacityReservation state from AWS

ipam.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Description?	string	no
OperatingRegions?	array	no	The regions IPAM is enabled for. Allows pools to be created in these regions, as well as enabling monitoring
Tier?	enum	no	The tier of the IPAM.
EnablePrivateGua?	boolean	no	Enable provisioning of GUA space in private pools.
MeteredAccount?	enum	no	A metered account is an account that is charged for active IP addresses managed in IPAM
DefaultResourceDiscoveryOrganizationalUnitExclusions?	array	no	A set of organizational unit (OU) exclusions for the default resource discovery, created with this IPAM.
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a EC2 IPAM

fn get(identifier: string)

Get a EC2 IPAM

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAM

fn update()

Update a EC2 IPAM

fn delete(identifier: string)

Delete a EC2 IPAM

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAM

fn sync()

Sync EC2 IPAM state from AWS

ipamresource_discovery_association.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
IpamResourceDiscoveryId	string	yes	The Amazon Resource Name (ARN) of the IPAM Resource Discovery Association.
IpamId	string	yes	The Id of the IPAM this Resource Discovery is associated to.
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a EC2 IPAMResourceDiscoveryAssociation

fn get(identifier: string)

Get a EC2 IPAMResourceDiscoveryAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMResourceDiscoveryAssociation

fn update()

Update a EC2 IPAMResourceDiscoveryAssociation

fn delete(identifier: string)

Delete a EC2 IPAMResourceDiscoveryAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMResourceDiscoveryAssociation

fn sync()

Sync EC2 IPAMResourceDiscoveryAssociation state from AWS

subnet_route_table_association.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
RouteTableId	string	yes	The ID of the route table. The physical ID changes when the route table ID is changed.
SubnetId	string	yes	The ID of the subnet.

fn create()

Create a EC2 SubnetRouteTableAssociation

fn get(identifier: string)

Get a EC2 SubnetRouteTableAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SubnetRouteTableAssociation

fn delete(identifier: string)

Delete a EC2 SubnetRouteTableAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SubnetRouteTableAssociation

fn sync()

Sync EC2 SubnetRouteTableAssociation state from AWS

spot_fleet.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
SpotFleetRequestConfigData?	object	no
Tags?	array	no	The tags to specify in SpotFleetRequestConfigData

fn create()

Create a EC2 SpotFleet

fn get(identifier: string)

Get a EC2 SpotFleet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SpotFleet

fn update()

Update a EC2 SpotFleet

fn delete(identifier: string)

Delete a EC2 SpotFleet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SpotFleet

fn sync()

Sync EC2 SpotFleet state from AWS

vpcendpoint_connection_notification.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
ConnectionEvents	array	yes	The endpoint events for which to receive notifications.
VPCEndpointId?	string	no	The ID of the endpoint.
ConnectionNotificationArn	string	yes	The ARN of the SNS topic for the notifications.
ServiceId?	string	no	The ID of the endpoint service.

fn create()

Create a EC2 VPCEndpointConnectionNotification

fn get(identifier: string)

Get a EC2 VPCEndpointConnectionNotification

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCEndpointConnectionNotification

fn update()

Update a EC2 VPCEndpointConnectionNotification

fn delete(identifier: string)

Delete a EC2 VPCEndpointConnectionNotification

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCEndpointConnectionNotification

fn sync()

Sync EC2 VPCEndpointConnectionNotification state from AWS

capacity_manager_data_export.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
S3BucketName	string	yes	The name of the Amazon S3 bucket where the capacity manager data export will be stored. The bucket must exist and be accessible by EC2 Capacity Manager service.
S3BucketPrefix?	string	no	The prefix for the S3 bucket location where exported files will be placed. If not specified, files will be placed in the root of the bucket.
Schedule	enum	yes	The schedule for the capacity manager data export. Currently supports hourly exports that provide periodic snapshots of capacity manager data.
OutputFormat	enum	yes	The format of the exported capacity manager data. Choose 'csv' for comma-separated values or 'parquet' for optimized columnar storage format.
Tags?	array	no	An array of key-value pairs to apply to the capacity manager data export.

fn create()

Create a EC2 CapacityManagerDataExport

fn get(identifier: string)

Get a EC2 CapacityManagerDataExport

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 CapacityManagerDataExport

fn update()

Update a EC2 CapacityManagerDataExport

fn delete(identifier: string)

Delete a EC2 CapacityManagerDataExport

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 CapacityManagerDataExport

fn sync()

Sync EC2 CapacityManagerDataExport state from AWS

vpc.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
InstanceTenancy?	string	no	The allowed tenancy of instances launched into the VPC. default: An instance launched into the VPC runs on shared hardware by default, unless you explicitly specify a different tenancy during instance launch. dedicated: An instance launched into the VPC runs on dedicated hardware by default, unless you explicitly specify a tenancy of host during instance launch. You cannot specify a tenancy of default during instance launch. Updating InstanceTenancy requires no replacement only if you are updating its value from dedicated to default. Updating InstanceTenancy from default to dedicated requires replacement.
Ipv4NetmaskLength?	number	no	The netmask length of the IPv4 CIDR you want to allocate to this VPC from an Amazon VPC IP Address Manager (IPAM) pool. For more information about IPAM, see [What is IPAM?](https://docs.aws.amazon.com//vpc/latest/ipam/what-is-it-ipam.html) in the Amazon VPC IPAM User Guide.
CidrBlock?	string	no	The IPv4 network range for the VPC, in CIDR notation. For example, 10.0.0.0/16. We modify the specified CIDR block to its canonical form; for example, if you specify 100.68.0.18/18, we modify it to 100.68.0.0/18. You must specify either CidrBlock or Ipv4IpamPoolId.
Ipv4IpamPoolId?	string	no	The ID of an IPv4 IPAM pool you want to use for allocating this VPC's CIDR. For more information, see [What is IPAM?](https://docs.aws.amazon.com//vpc/latest/ipam/what-is-it-ipam.html) in the Amazon VPC IPAM User Guide. You must specify either CidrBlock or Ipv4IpamPoolId.
EnableDnsSupport?	boolean	no	Indicates whether the DNS resolution is supported for the VPC. If enabled, queries to the Amazon provided DNS server at the 169.254.169.253 IP address, or the reserved IP address at the base of the VPC network range "plus two" succeed. If disabled, the Amazon provided DNS service in the VPC that resolves public DNS hostnames to IP addresses is not enabled. Enabled by default. For more information, see [DNS attributes in your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-support).
EnableDnsHostnames?	boolean	no	Indicates whether the instances launched in the VPC get DNS hostnames. If enabled, instances in the VPC get DNS hostnames; otherwise, they do not. Disabled by default for nondefault VPCs. For more information, see [DNS attributes in your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-support). You can only enable DNS hostnames if you've enabled DNS support.
Tags?	array	no	The tags for the VPC.

fn create()

Create a EC2 VPC

fn get(identifier: string)

Get a EC2 VPC

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPC

fn update()

Update a EC2 VPC

fn delete(identifier: string)

Delete a EC2 VPC

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPC

fn sync()

Sync EC2 VPC state from AWS

ipampool.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
AddressFamily	string	yes	The address family of the address space in this pool. Either IPv4 or IPv6.
AllocationMinNetmaskLength?	number	no	The minimum allowed netmask length for allocations made from this pool.
AllocationDefaultNetmaskLength?	number	no	The default netmask length for allocations made from this pool. This value is used when the netmask length of an allocation isn't specified.
AllocationMaxNetmaskLength?	number	no	The maximum allowed netmask length for allocations made from this pool.
AllocationResourceTags?	array	no	When specified, an allocation will not be allowed unless a resource has a matching set of tags.
AutoImport?	boolean	no	Determines what to do if IPAM discovers resources that haven't been assigned an allocation. If set to true, an allocation will be made automatically.
AwsService?	enum	no	Limits which service in Amazon Web Services that the pool can be used in.
Description?	string	no
IpamScopeId	string	yes	The Id of the scope this pool is a part of.
Locale?	string	no	The region of this pool. If not set, this will default to "None" which will disable non-custom allocations. If the locale has been specified for the source pool, this value must match.
ProvisionedCidrs?	array	no	A list of cidrs representing the address space available for allocation in this pool.
PublicIpSource?	enum	no	The IP address source for pools in the public scope. Only used for provisioning IP address CIDRs to pools in the public scope. Default is `byoip`.
PubliclyAdvertisable?	boolean	no	Determines whether or not address space from this pool is publicly advertised. Must be set if and only if the pool is IPv6.
SourceIpamPoolId?	string	no	The Id of this pool's source. If set, all space provisioned in this pool must be free space provisioned in the parent pool.
SourceResource?	object	no	The resource associated with this pool's space. Depending on the ResourceType, setting a SourceResource changes which space can be provisioned in this pool and which types of resources can receive allocations
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a EC2 IPAMPool

fn get(identifier: string)

Get a EC2 IPAMPool

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMPool

fn update()

Update a EC2 IPAMPool

fn delete(identifier: string)

Delete a EC2 IPAMPool

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMPool

fn sync()

Sync EC2 IPAMPool state from AWS

vpcgateway_attachment.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
InternetGatewayId?	string	no	The ID of the internet gateway. You must specify either InternetGatewayId or VpnGatewayId, but not both.
VpcId	string	yes	The ID of the VPC.
VpnGatewayId?	string	no	The ID of the virtual private gateway. You must specify either InternetGatewayId or VpnGatewayId, but not both.

fn create()

Create a EC2 VPCGatewayAttachment

fn get(identifier: string)

Get a EC2 VPCGatewayAttachment

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCGatewayAttachment

fn update()

Update a EC2 VPCGatewayAttachment

fn delete(identifier: string)

Delete a EC2 VPCGatewayAttachment

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCGatewayAttachment

fn sync()

Sync EC2 VPCGatewayAttachment state from AWS

gateway_route_table_association.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
RouteTableId	string	yes	The ID of the route table.
GatewayId	string	yes	The ID of the gateway.

fn create()

Create a EC2 GatewayRouteTableAssociation

fn get(identifier: string)

Get a EC2 GatewayRouteTableAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 GatewayRouteTableAssociation

fn update()

Update a EC2 GatewayRouteTableAssociation

fn delete(identifier: string)

Delete a EC2 GatewayRouteTableAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 GatewayRouteTableAssociation

fn sync()

Sync EC2 GatewayRouteTableAssociation state from AWS

route_server_endpoint.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
RouteServerId	string	yes	Route Server ID
SubnetId	string	yes	Subnet ID
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a EC2 RouteServerEndpoint

fn get(identifier: string)

Get a EC2 RouteServerEndpoint

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 RouteServerEndpoint

fn update()

Update a EC2 RouteServerEndpoint

fn delete(identifier: string)

Delete a EC2 RouteServerEndpoint

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 RouteServerEndpoint

fn sync()

Sync EC2 RouteServerEndpoint state from AWS

ip_pool_route_table_association.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
PublicIpv4Pool	string	yes	The ID of the public IPv4 pool.
RouteTableId	string	yes	The ID of the route table.

fn create()

Create a EC2 IpPoolRouteTableAssociation

fn get(identifier: string)

Get a EC2 IpPoolRouteTableAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IpPoolRouteTableAssociation

fn delete(identifier: string)

Delete a EC2 IpPoolRouteTableAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IpPoolRouteTableAssociation

fn sync()

Sync EC2 IpPoolRouteTableAssociation state from AWS

transit_gateway_route_table.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
TransitGatewayId	string	yes	The ID of the transit gateway.
Tags?	array	no	Tags are composed of a Key/Value pair. You can use tags to categorize and track each parameter group. The tag value null is permitted.

fn create()

Create a EC2 TransitGatewayRouteTable

fn get(identifier: string)

Get a EC2 TransitGatewayRouteTable

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayRouteTable

fn update()

Update a EC2 TransitGatewayRouteTable

fn delete(identifier: string)

Delete a EC2 TransitGatewayRouteTable

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayRouteTable

fn sync()

Sync EC2 TransitGatewayRouteTable state from AWS

transit_gateway_route.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
TransitGatewayRouteTableId	string	yes	The ID of transit gateway route table.
DestinationCidrBlock	string	yes	The CIDR range used for destination matches. Routing decisions are based on the most specific match.
Blackhole?	boolean	no	Indicates whether to drop traffic that matches this route.
TransitGatewayAttachmentId?	string	no	The ID of transit gateway attachment.

fn create()

Create a EC2 TransitGatewayRoute

fn get(identifier: string)

Get a EC2 TransitGatewayRoute

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayRoute

fn delete(identifier: string)

Delete a EC2 TransitGatewayRoute

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayRoute

fn sync()

Sync EC2 TransitGatewayRoute state from AWS

transit_gateway_attachment.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Options?	object	no	Indicates whether to enable Ipv6 Support for Vpc Attachment. Valid Values: enable \| disable
TransitGatewayId	string	yes
VpcId	string	yes
SubnetIds	array	yes
Tags?	array	no

fn create()

Create a EC2 TransitGatewayAttachment

fn get(identifier: string)

Get a EC2 TransitGatewayAttachment

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayAttachment

fn update()

Update a EC2 TransitGatewayAttachment

fn delete(identifier: string)

Delete a EC2 TransitGatewayAttachment

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayAttachment

fn sync()

Sync EC2 TransitGatewayAttachment state from AWS

vpcendpoint_service.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
NetworkLoadBalancerArns?	array	no
ContributorInsightsEnabled?	boolean	no
PayerResponsibility?	string	no
AcceptanceRequired?	boolean	no
GatewayLoadBalancerArns?	array	no
Tags?	array	no	The tags to add to the VPC endpoint service.
SupportedIpAddressTypes?	array	no	Specify which Ip Address types are supported for VPC endpoint service.
SupportedRegions?	array	no	The Regions from which service consumers can access the service.

fn create()

Create a EC2 VPCEndpointService

fn get(identifier: string)

Get a EC2 VPCEndpointService

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCEndpointService

fn update()

Update a EC2 VPCEndpointService

fn delete(identifier: string)

Delete a EC2 VPCEndpointService

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCEndpointService

fn sync()

Sync EC2 VPCEndpointService state from AWS

eip.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Domain?	string	no	The network ( vpc). If you define an Elastic IP address and associate it with a VPC that is defined in the same template, you must declare a dependency on the VPC-gateway attachment by using the [DependsOn Attribute](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-dependson.html) on this resource.
NetworkBorderGroup?	string	no	A unique set of Availability Zones, Local Zones, or Wavelength Zones from which AWS advertises IP addresses. Use this parameter to limit the IP address to this location. IP addresses cannot move between network border groups. Use [DescribeAvailabilityZones](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html) to view the network border groups.
TransferAddress?	string	no	The Elastic IP address you are accepting for transfer. You can only accept one transferred address. For more information on Elastic IP address transfers, see [Transfer Elastic IP addresses](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-eips.html#transfer-EIPs-intro) in the Amazon Virtual Private Cloud User Guide.
InstanceId?	string	no	The ID of the instance. Updates to the InstanceId property may require some interruptions. Updates on an EIP reassociates the address on its associated resource.
PublicIpv4Pool?	string	no	The ID of an address pool that you own. Use this parameter to let Amazon EC2 select an address from the address pool. Updates to the PublicIpv4Pool property may require some interruptions. Updates on an EIP reassociates the address on its associated resource.
IpamPoolId?	string	no
Address?	string	no
Tags?	array	no	Any tags assigned to the Elastic IP address. Updates to the Tags property may require some interruptions. Updates on an EIP reassociates the address on its associated resource.

fn create()

Create a EC2 EIP

fn get(identifier: string)

Get a EC2 EIP

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 EIP

fn update()

Update a EC2 EIP

fn delete(identifier: string)

Delete a EC2 EIP

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 EIP

fn sync()

Sync EC2 EIP state from AWS

network_insights_access_scope.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Tags?	array	no
MatchPaths?	array	no
ExcludePaths?	array	no

fn create()

Create a EC2 NetworkInsightsAccessScope

fn get(identifier: string)

Get a EC2 NetworkInsightsAccessScope

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkInsightsAccessScope

fn update()

Update a EC2 NetworkInsightsAccessScope

fn delete(identifier: string)

Delete a EC2 NetworkInsightsAccessScope

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkInsightsAccessScope

fn sync()

Sync EC2 NetworkInsightsAccessScope state from AWS

ipamresource_discovery.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
OperatingRegions?	array	no	The regions Resource Discovery is enabled for. Allows resource discoveries to be created in these regions, as well as enabling monitoring
Description?	string	no
OrganizationalUnitExclusions?	array	no	A set of organizational unit (OU) exclusions for this resource.
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a EC2 IPAMResourceDiscovery

fn get(identifier: string)

Get a EC2 IPAMResourceDiscovery

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMResourceDiscovery

fn update()

Update a EC2 IPAMResourceDiscovery

fn delete(identifier: string)

Delete a EC2 IPAMResourceDiscovery

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMResourceDiscovery

fn sync()

Sync EC2 IPAMResourceDiscovery state from AWS

customer_gateway.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Type	string	yes	The type of VPN connection that this customer gateway supports ( ipsec.1).
IpAddress	string	yes	The IP address for the customer gateway device's outside interface. The address must be static. If OutsideIpAddressType in your VPN connection options is set to PrivateIpv4, you can use an RFC6598 or RFC1918 private IPv4 address. If OutsideIpAddressType is set to Ipv6, you can use an IPv6 address.
BgpAsnExtended?	number	no	For customer gateway devices that support BGP, specify the device's ASN. You must specify either BgpAsn or BgpAsnExtended when creating the customer gateway. If the ASN is larger than 2,147,483,647, you must use BgpAsnExtended. Valid values: 2,147,483,648 to 4,294,967,295
BgpAsn?	number	no	For customer gateway devices that support BGP, specify the device's ASN. You must specify either BgpAsn or BgpAsnExtended when creating the customer gateway. If the ASN is larger than 2,147,483,647, you must use BgpAsnExtended. Default: 65000 Valid values: 1 to 2,147,483,647
Tags?	array	no	One or more tags for the customer gateway.
CertificateArn?	string	no	The Amazon Resource Name (ARN) for the customer gateway certificate.
DeviceName?	string	no	The name of customer gateway device.

fn create()

Create a EC2 CustomerGateway

fn get(identifier: string)

Get a EC2 CustomerGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 CustomerGateway

fn update()

Update a EC2 CustomerGateway

fn delete(identifier: string)

Delete a EC2 CustomerGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 CustomerGateway

fn sync()

Sync EC2 CustomerGateway state from AWS

snapshot_block_public_access.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
State	enum	yes	The state of EBS Snapshot Block Public Access.

fn create()

Create a EC2 SnapshotBlockPublicAccess

fn get(identifier: string)

Get a EC2 SnapshotBlockPublicAccess

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SnapshotBlockPublicAccess

fn update()

Update a EC2 SnapshotBlockPublicAccess

fn delete(identifier: string)

Delete a EC2 SnapshotBlockPublicAccess

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SnapshotBlockPublicAccess

fn sync()

Sync EC2 SnapshotBlockPublicAccess state from AWS

route_server_association.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
RouteServerId	string	yes	Route Server ID
VpcId	string	yes	VPC ID

fn create()

Create a EC2 RouteServerAssociation

fn get(identifier: string)

Get a EC2 RouteServerAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 RouteServerAssociation

fn delete(identifier: string)

Delete a EC2 RouteServerAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 RouteServerAssociation

fn sync()

Sync EC2 RouteServerAssociation state from AWS

transit_gateway_multicast_domain.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
TransitGatewayId	string	yes	The ID of the transit gateway.
Tags?	array	no	The tags for the transit gateway multicast domain.
Options?	object	no	Indicates whether to automatically cross-account subnet associations that are associated with the transit gateway multicast domain. Valid Values: enable \| disable

fn create()

Create a EC2 TransitGatewayMulticastDomain

fn get(identifier: string)

Get a EC2 TransitGatewayMulticastDomain

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayMulticastDomain

fn update()

Update a EC2 TransitGatewayMulticastDomain

fn delete(identifier: string)

Delete a EC2 TransitGatewayMulticastDomain

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayMulticastDomain

fn sync()

Sync EC2 TransitGatewayMulticastDomain state from AWS

placement_group.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Strategy?	string	no	The placement strategy.
SpreadLevel?	string	no	The Spread Level of Placement Group is an enum where it accepts either host or rack when strategy is spread
PartitionCount?	number	no	The number of partitions. Valid only when Strategy is set to `partition`
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a EC2 PlacementGroup

fn get(identifier: string)

Get a EC2 PlacementGroup

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 PlacementGroup

fn delete(identifier: string)

Delete a EC2 PlacementGroup

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 PlacementGroup

fn sync()

Sync EC2 PlacementGroup state from AWS

host.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
AutoPlacement?	enum	no	Indicates whether the host accepts any untargeted instance launches that match its instance type configuration, or if it only accepts Host tenancy instance launches that specify its unique host ID.
AvailabilityZone	string	yes	The Availability Zone in which to allocate the Dedicated Host.
HostRecovery?	enum	no	Indicates whether to enable or disable host recovery for the Dedicated Host. Host recovery is disabled by default.
InstanceType?	string	no	Specifies the instance type to be supported by the Dedicated Hosts. If you specify an instance type, the Dedicated Hosts support instances of the specified instance type only.
InstanceFamily?	string	no	Specifies the instance family to be supported by the Dedicated Hosts. If you specify an instance family, the Dedicated Hosts support multiple instance types within that instance family.
OutpostArn?	string	no	The Amazon Resource Name (ARN) of the Amazon Web Services Outpost on which to allocate the Dedicated Host.
HostMaintenance?	enum	no	Automatically allocates a new dedicated host and moves your instances on to it if a degradation is detected on your current host.
AssetId?	string	no	The ID of the Outpost hardware asset.
Tags?	array	no	Any tags assigned to the Host.

fn create()

Create a EC2 Host

fn get(identifier: string)

Get a EC2 Host

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 Host

fn update()

Update a EC2 Host

fn delete(identifier: string)

Delete a EC2 Host

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 Host

fn sync()

Sync EC2 Host state from AWS

local_gateway_route.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
DestinationCidrBlock?	string	no	The CIDR block used for destination matches.
LocalGatewayRouteTableId?	string	no	The ID of the local gateway route table.
LocalGatewayVirtualInterfaceGroupId?	string	no	The ID of the virtual interface group.
NetworkInterfaceId?	string	no	The ID of the network interface.

fn create()

Create a EC2 LocalGatewayRoute

fn get(identifier: string)

Get a EC2 LocalGatewayRoute

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LocalGatewayRoute

fn update()

Update a EC2 LocalGatewayRoute

fn delete(identifier: string)

Delete a EC2 LocalGatewayRoute

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LocalGatewayRoute

fn sync()

Sync EC2 LocalGatewayRoute state from AWS

transit_gateway_vpc_attachment.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
TransitGatewayId	string	yes
VpcId	string	yes
SubnetIds	array	yes
AddSubnetIds?	array	no
RemoveSubnetIds?	array	no
Tags?	array	no
Options?	object	no	Indicates whether to enable DNS Support for Vpc Attachment. Valid Values: enable \| disable

fn create()

Create a EC2 TransitGatewayVpcAttachment

fn get(identifier: string)

Get a EC2 TransitGatewayVpcAttachment

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayVpcAttachment

fn update()

Update a EC2 TransitGatewayVpcAttachment

fn delete(identifier: string)

Delete a EC2 TransitGatewayVpcAttachment

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayVpcAttachment

fn sync()

Sync EC2 TransitGatewayVpcAttachment state from AWS

local_gateway_virtual_interface.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
LocalGatewayVirtualInterfaceGroupId	string	yes	The ID of the virtual interface group
OutpostLagId	string	yes	The Outpost LAG ID.
Vlan	number	yes	The ID of the VLAN.
LocalAddress	string	yes	The local address.
PeerAddress	string	yes	The peer address.
PeerBgpAsn?	number	no	The peer BGP ASN.
PeerBgpAsnExtended?	number	no	The extended 32-bit ASN of the BGP peer for use with larger ASN values.
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a EC2 LocalGatewayVirtualInterface

fn get(identifier: string)

Get a EC2 LocalGatewayVirtualInterface

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LocalGatewayVirtualInterface

fn update()

Update a EC2 LocalGatewayVirtualInterface

fn delete(identifier: string)

Delete a EC2 LocalGatewayVirtualInterface

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LocalGatewayVirtualInterface

fn sync()

Sync EC2 LocalGatewayVirtualInterface state from AWS

subnet.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
AssignIpv6AddressOnCreation?	boolean	no	Indicates whether a network interface created in this subnet receives an IPv6 address. The default value is false. If you specify AssignIpv6AddressOnCreation, you must also specify an IPv6 CIDR block.
VpcId	string	yes	The ID of the VPC the subnet is in. If you update this property, you must also update the CidrBlock property.
MapPublicIpOnLaunch?	boolean	no	Indicates whether instances launched in this subnet receive a public IPv4 address. The default value is false. AWS charges for all public IPv4 addresses, including public IPv4 addresses associated with running instances and Elastic IP addresses. For more information, see the Public IPv4 Address tab on the [VPC pricing page](https://docs.aws.amazon.com/vpc/pricing/).
EnableLniAtDeviceIndex?	number	no	Indicates the device position for local network interfaces in this subnet. For example, 1 indicates local network interfaces in this subnet are the secondary network interface (eth1).
AvailabilityZone?	string	no	The Availability Zone of the subnet. If you update this property, you must also update the CidrBlock property.
AvailabilityZoneId?	string	no	The AZ ID of the subnet.
CidrBlock?	string	no	The IPv4 CIDR block assigned to the subnet. If you update this property, we create a new subnet, and then delete the existing one.
Ipv6CidrBlock?	string	no	The IPv6 CIDR block. If you specify AssignIpv6AddressOnCreation, you must also specify an IPv6 CIDR block.
OutpostArn?	string	no	The Amazon Resource Name (ARN) of the Outpost.
Ipv6Native?	boolean	no	Indicates whether this is an IPv6 only subnet. For more information, see [Subnet basics](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html#subnet-basics) in the User Guide.
EnableDns64?	boolean	no	Indicates whether DNS queries made to the Amazon-provided DNS Resolver in this subnet should return synthetic IPv6 addresses for IPv4-only destinations. You must first configure a NAT gateway in a public subnet (separate from the subnet containing the IPv6-only workloads). For example, the subnet containing the NAT gateway should have a 0.0.0.0/0 route pointing to the internet gateway. For more information, see [Configure DNS64 and NAT64](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-nat64-dns64.html#nat-gateway-nat64-dns64-walkthrough) in the User Guide.
PrivateDnsNameOptionsOnLaunch?	object	no	The hostname type for EC2 instances launched into this subnet and how DNS A and AAAA record queries to the instances should be handled. For more information, see [Amazon EC2 instance hostname types](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-naming.html) in the User Guide. Available options: EnableResourceNameDnsAAAARecord (true \| false) EnableResourceNameDnsARecord (true \| false) HostnameType (ip-name \| resource-name)
Tags?	array	no	Any tags assigned to the subnet.
Ipv4IpamPoolId?	string	no	An IPv4 IPAM pool ID for the subnet.
Ipv4NetmaskLength?	number	no	An IPv4 netmask length for the subnet.
Ipv6IpamPoolId?	string	no	An IPv6 IPAM pool ID for the subnet.
Ipv6NetmaskLength?	number	no	An IPv6 netmask length for the subnet.
BlockPublicAccessStates?	object	no	The mode of VPC BPA. Options here are off, block-bidirectional, block-ingress

fn create()

Create a EC2 Subnet

fn get(identifier: string)

Get a EC2 Subnet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 Subnet

fn update()

Update a EC2 Subnet

fn delete(identifier: string)

Delete a EC2 Subnet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 Subnet

fn sync()

Sync EC2 Subnet state from AWS

flow_log.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
DeliverCrossAccountRole?	string	no	The ARN of the IAM role that allows Amazon EC2 to publish flow logs across accounts.
DeliverLogsPermissionArn?	string	no	The ARN for the IAM role that permits Amazon EC2 to publish flow logs to a CloudWatch Logs log group in your account. If you specify LogDestinationType as s3 or kinesis-data-firehose, do not specify DeliverLogsPermissionArn or LogGroupName.
LogDestination?	string	no	Specifies the destination to which the flow log data is to be published. Flow log data can be published to a CloudWatch Logs log group, an Amazon S3 bucket, or a Kinesis Firehose stream. The value specified for this parameter depends on the value specified for LogDestinationType.
LogDestinationType?	enum	no	Specifies the type of destination to which the flow log data is to be published. Flow log data can be published to CloudWatch Logs or Amazon S3.
LogFormat?	string	no	The fields to include in the flow log record, in the order in which they should appear.
LogGroupName?	string	no	The name of a new or existing CloudWatch Logs log group where Amazon EC2 publishes your flow logs. If you specify LogDestinationType as s3 or kinesis-data-firehose, do not specify DeliverLogsPermissionArn or LogGroupName.
MaxAggregationInterval?	number	no	The maximum interval of time during which a flow of packets is captured and aggregated into a flow log record. You can specify 60 seconds (1 minute) or 600 seconds (10 minutes).
ResourceId	string	yes	The ID of the subnet, network interface, or VPC for which you want to create a flow log.
ResourceType	enum	yes	The type of resource for which to create the flow log. For example, if you specified a VPC ID for the ResourceId property, specify VPC for this property.
Tags?	array	no	The tags to apply to the flow logs.
TrafficType?	enum	no	The type of traffic to log. You can log traffic that the resource accepts or rejects, or all traffic.
DestinationOptions?	object	no

fn create()

Create a EC2 FlowLog

fn get(identifier: string)

Get a EC2 FlowLog

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 FlowLog

fn update()

Update a EC2 FlowLog

fn delete(identifier: string)

Delete a EC2 FlowLog

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 FlowLog

fn sync()

Sync EC2 FlowLog state from AWS

nat_gateway.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
SubnetId?	string	no	The ID of the subnet in which the NAT gateway is located.
ConnectivityType?	string	no	Indicates whether the NAT gateway supports public or private connectivity. The default is public connectivity.
PrivateIpAddress?	string	no	The private IPv4 address to assign to the NAT gateway. If you don't provide an address, a private IPv4 address will be automatically assigned.
Tags?	array	no	The tags for the NAT gateway.
AllocationId?	string	no	[Public NAT gateway only] The allocation ID of the Elastic IP address that's associated with the NAT gateway. This property is required for a public NAT gateway and cannot be specified with a private NAT gateway.
SecondaryAllocationIds?	array	no	Secondary EIP allocation IDs. For more information, see [Create a NAT gateway](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateway-working-with.html) in the Amazon VPC User Guide.
SecondaryPrivateIpAddresses?	array	no	Secondary private IPv4 addresses. For more information about secondary addresses, see [Create a NAT gateway](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html#nat-gateway-creating) in the Amazon Virtual Private Cloud User Guide. SecondaryPrivateIpAddressCount and SecondaryPrivateIpAddresses cannot be set at the same time.
SecondaryPrivateIpAddressCount?	number	no	[Private NAT gateway only] The number of secondary private IPv4 addresses you want to assign to the NAT gateway. For more information about secondary addresses, see [Create a NAT gateway](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html#nat-gateway-creating) in the Amazon Virtual Private Cloud User Guide. SecondaryPrivateIpAddressCount and SecondaryPrivateIpAddresses cannot be set at the same time.
MaxDrainDurationSeconds?	number	no	The maximum amount of time to wait (in seconds) before forcibly releasing the IP addresses if connections are still in progress. Default value is 350 seconds.
VpcId?	string	no	The ID of the VPC in which the NAT gateway is located.
AvailabilityMode?	string	no	Indicates whether this is a zonal (single-AZ) or regional (multi-AZ) NAT gateway. A zonal NAT gateway is a NAT Gateway that provides redundancy and scalability within a single availability zone. A regional NAT gateway is a single NAT Gateway that works across multiple availability zones (AZs) in your VPC, providing redundancy, scalability and availability across all the AZs in a Region. For more information, see [Regional NAT gateways for automatic multi-AZ expansion](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateways-regional.html) in the Amazon VPC User Guide.
AvailabilityZoneAddresses?	array	no	For regional NAT gateways only: Specifies which Availability Zones you want the NAT gateway to support and the Elastic IP addresses (EIPs) to use in each AZ. The regional NAT gateway uses these EIPs to handle outbound NAT traffic from their respective AZs. If not specified, the NAT gateway will automatically expand to new AZs and associate EIPs upon detection of an elastic network interface. If you specify this parameter, auto-expansion is disabled and you must manually manage AZ coverage. A regional NAT gateway is a single NAT Gateway that works across multiple availability zones (AZs) in your VPC, providing redundancy, scalability and availability across all the AZs in a Region. For more information, see [Regional NAT gateways for automatic multi-AZ expansion](https://docs.aws.amazon.com/vpc/latest/userguide/nat-gateways-regional.html) in the Amazon VPC User Guide.

fn create()

Create a EC2 NatGateway

fn get(identifier: string)

Get a EC2 NatGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NatGateway

fn update()

Update a EC2 NatGateway

fn delete(identifier: string)

Delete a EC2 NatGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NatGateway

fn sync()

Sync EC2 NatGateway state from AWS

vpngateway.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
AmazonSideAsn?	number	no	The private Autonomous System Number (ASN) for the Amazon side of a BGP session.
Tags?	array	no	Any tags assigned to the virtual private gateway.
Type	string	yes	The type of VPN connection the virtual private gateway supports.

fn create()

Create a EC2 VPNGateway

fn get(identifier: string)

Get a EC2 VPNGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPNGateway

fn update()

Update a EC2 VPNGateway

fn delete(identifier: string)

Delete a EC2 VPNGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPNGateway

fn sync()

Sync EC2 VPNGateway state from AWS

vpnconnection.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
RemoteIpv6NetworkCidr?	string	no	The IPv6 CIDR on the AWS side of the VPN connection. Default:::/0
RemoteIpv4NetworkCidr?	string	no	The IPv4 CIDR on the AWS side of the VPN connection. Default: 0.0.0.0/0
VpnTunnelOptionsSpecifications?	array	no	The tunnel options for the VPN connection.
CustomerGatewayId	string	yes	The ID of the customer gateway at your end of the VPN connection.
OutsideIpAddressType?	string	no	The type of IP address assigned to the outside interface of the customer gateway device. Valid values: PrivateIpv4 \| PublicIpv4 \| Ipv6 Default: PublicIpv4
StaticRoutesOnly?	boolean	no	Indicates whether the VPN connection uses static routes only. Static routes must be used for devices that don't support BGP. If you are creating a VPN connection for a device that does not support Border Gateway Protocol (BGP), you must specify true.
EnableAcceleration?	boolean	no	Indicate whether to enable acceleration for the VPN connection. Default: false
TransitGatewayId?	string	no	The ID of the transit gateway associated with the VPN connection. You must specify either TransitGatewayId or VpnGatewayId, but not both.
Type	string	yes	The type of VPN connection.
TunnelBandwidth?	enum	no	The desired bandwidth specification for the VPN tunnel, used when creating or modifying VPN connection options to set the tunnel's throughput capacity. standard supports up to 1.25 Gbps per tunnel, while large supports up to 5 Gbps per tunnel. The default value is standard. Existing VPN connections without a bandwidth setting will automatically default to standard.
LocalIpv4NetworkCidr?	string	no	The IPv4 CIDR on the customer gateway (on-premises) side of the VPN connection. Default: 0.0.0.0/0
VpnGatewayId?	string	no	The ID of the virtual private gateway at the AWS side of the VPN connection. You must specify either TransitGatewayId or VpnGatewayId, but not both.
VpnConcentratorId?	string	no	The ID of the VPN concentrator to associate with the VPN connection.
PreSharedKeyStorage?	enum	no	Describes the storage location for an instance store-backed AMI.
TransportTransitGatewayAttachmentId?	string	no	The transit gateway attachment ID to use for the VPN tunnel. Required if OutsideIpAddressType is set to PrivateIpv4.
LocalIpv6NetworkCidr?	string	no	The IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection. Default:::/0
TunnelInsideIpVersion?	string	no	Indicate whether the VPN tunnels process IPv4 or IPv6 traffic. Default: ipv4
Tags?	array	no	Any tags assigned to the VPN connection.

fn create()

Create a EC2 VPNConnection

fn get(identifier: string)

Get a EC2 VPNConnection

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPNConnection

fn update()

Update a EC2 VPNConnection

fn delete(identifier: string)

Delete a EC2 VPNConnection

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPNConnection

fn sync()

Sync EC2 VPNConnection state from AWS

vpcdhcpoptions_association.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
DhcpOptionsId	string	yes	The ID of the DHCP options set, or default to associate no DHCP options with the VPC.
VpcId	string	yes	The ID of the VPC.

fn create()

Create a EC2 VPCDHCPOptionsAssociation

fn get(identifier: string)

Get a EC2 VPCDHCPOptionsAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCDHCPOptionsAssociation

fn update()

Update a EC2 VPCDHCPOptionsAssociation

fn delete(identifier: string)

Delete a EC2 VPCDHCPOptionsAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCDHCPOptionsAssociation

fn sync()

Sync EC2 VPCDHCPOptionsAssociation state from AWS

security_group_vpc_association.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
GroupId	string	yes	The group ID of the specified security group.
VpcId	string	yes	The ID of the VPC in the security group vpc association.

fn create()

Create a EC2 SecurityGroupVpcAssociation

fn get(identifier: string)

Get a EC2 SecurityGroupVpcAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SecurityGroupVpcAssociation

fn delete(identifier: string)

Delete a EC2 SecurityGroupVpcAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SecurityGroupVpcAssociation

fn sync()

Sync EC2 SecurityGroupVpcAssociation state from AWS

vpnconnection_route.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
DestinationCidrBlock	string	yes	The CIDR block associated with the local subnet of the customer network.
VpnConnectionId	string	yes	The ID of the VPN connection.

fn create()

Create a EC2 VPNConnectionRoute

fn get(identifier: string)

Get a EC2 VPNConnectionRoute

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPNConnectionRoute

fn delete(identifier: string)

Delete a EC2 VPNConnectionRoute

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPNConnectionRoute

fn sync()

Sync EC2 VPNConnectionRoute state from AWS

ipamallocation.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
IpamPoolId	string	yes	Id of the IPAM Pool.
Cidr?	string	no	Represents an IPAM custom allocation of a single IPv4 or IPv6 CIDR
NetmaskLength?	number	no	The desired netmask length of the allocation. If set, IPAM will choose a block of free space with this size and return the CIDR representing it.
Description?	string	no

fn create()

Create a EC2 IPAMAllocation

fn get(identifier: string)

Get a EC2 IPAMAllocation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMAllocation

fn delete(identifier: string)

Delete a EC2 IPAMAllocation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMAllocation

fn sync()

Sync EC2 IPAMAllocation state from AWS

transit_gateway_multicast_domain_association.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
TransitGatewayMulticastDomainId	string	yes	The ID of the transit gateway multicast domain.
TransitGatewayAttachmentId	string	yes	The ID of the transit gateway attachment.
SubnetId	string	yes	The IDs of the subnets to associate with the transit gateway multicast domain.

fn create()

Create a EC2 TransitGatewayMulticastDomainAssociation

fn get(identifier: string)

Get a EC2 TransitGatewayMulticastDomainAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayMulticastDomainAssociation

fn delete(identifier: string)

Delete a EC2 TransitGatewayMulticastDomainAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayMulticastDomainAssociation

fn sync()

Sync EC2 TransitGatewayMulticastDomainAssociation state from AWS

local_gateway_route_table_virtual_interface_group_association.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
LocalGatewayRouteTableId	string	yes	The ID of the local gateway route table.
LocalGatewayVirtualInterfaceGroupId	string	yes	The ID of the local gateway route table virtual interface group.
Tags?	array	no	The tags for the local gateway route table virtual interface group association.

fn create()

Create a EC2 LocalGatewayRouteTableVirtualInterfaceGroupAssociation

fn get(identifier: string)

Get a EC2 LocalGatewayRouteTableVirtualInterfaceGroupAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LocalGatewayRouteTableVirtualInterfaceGroupAssociation

fn update()

Update a EC2 LocalGatewayRouteTableVirtualInterfaceGroupAssociation

fn delete(identifier: string)

Delete a EC2 LocalGatewayRouteTableVirtualInterfaceGroupAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LocalGatewayRouteTableVirtualInterfaceGroupAssociation

fn sync()

Sync EC2 LocalGatewayRouteTableVirtualInterfaceGroupAssociation state from AWS

transit_gateway_metering_policy.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
TransitGatewayId	string	yes	The Id of transit gateway
MiddleboxAttachmentIds?	array	no	Middle box attachment Ids
Tags?	array	no

fn create()

Create a EC2 TransitGatewayMeteringPolicy

fn get(identifier: string)

Get a EC2 TransitGatewayMeteringPolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayMeteringPolicy

fn update()

Update a EC2 TransitGatewayMeteringPolicy

fn delete(identifier: string)

Delete a EC2 TransitGatewayMeteringPolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayMeteringPolicy

fn sync()

Sync EC2 TransitGatewayMeteringPolicy state from AWS

traffic_mirror_target.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
NetworkLoadBalancerArn?	string	no	The Amazon Resource Name (ARN) of the Network Load Balancer that is associated with the target.
Description?	string	no	The description of the Traffic Mirror target.
NetworkInterfaceId?	string	no	The network interface ID that is associated with the target.
GatewayLoadBalancerEndpointId?	string	no	The ID of the Gateway Load Balancer endpoint.
Tags?	array	no	The tags to assign to the Traffic Mirror target.

fn create()

Create a EC2 TrafficMirrorTarget

fn get(identifier: string)

Get a EC2 TrafficMirrorTarget

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TrafficMirrorTarget

fn update()

Update a EC2 TrafficMirrorTarget

fn delete(identifier: string)

Delete a EC2 TrafficMirrorTarget

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TrafficMirrorTarget

fn sync()

Sync EC2 TrafficMirrorTarget state from AWS

transit_gateway_route_table_propagation.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
TransitGatewayRouteTableId	string	yes	The ID of transit gateway route table.
TransitGatewayAttachmentId	string	yes	The ID of transit gateway attachment.

fn create()

Create a EC2 TransitGatewayRouteTablePropagation

fn get(identifier: string)

Get a EC2 TransitGatewayRouteTablePropagation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayRouteTablePropagation

fn delete(identifier: string)

Delete a EC2 TransitGatewayRouteTablePropagation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayRouteTablePropagation

fn sync()

Sync EC2 TransitGatewayRouteTablePropagation state from AWS

vpcendpoint_service_permissions.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
AllowedPrincipals?	array	no
ServiceId	string	yes

fn create()

Create a EC2 VPCEndpointServicePermissions

fn get(identifier: string)

Get a EC2 VPCEndpointServicePermissions

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCEndpointServicePermissions

fn update()

Update a EC2 VPCEndpointServicePermissions

fn delete(identifier: string)

Delete a EC2 VPCEndpointServicePermissions

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCEndpointServicePermissions

fn sync()

Sync EC2 VPCEndpointServicePermissions state from AWS

network_interface.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Description?	string	no	A description for the network interface.
PrivateIpAddress?	string	no	Assigns a single private IP address to the network interface, which is used as the primary private IP address. If you want to specify multiple private IP address, use the PrivateIpAddresses property.
PrivateIpAddresses?	array	no	Assigns a list of private IP addresses to the network interface. You can specify a primary private IP address by setting the value of the Primary property to true in the PrivateIpAddressSpecification property. If you want EC2 to automatically assign private IP addresses, use the SecondaryPrivateIpAddressCount property and do not specify this property.
SecondaryPrivateIpAddressCount?	number	no	The number of secondary private IPv4 addresses to assign to a network interface. When you specify a number of secondary IPv4 addresses, Amazon EC2 selects these IP addresses within the subnet's IPv4 CIDR range. You can't specify this option and specify more than one private IP address using privateIpAddresses
Ipv4Prefixes?	array	no	Assigns a list of IPv4 prefixes to the network interface. If you want EC2 to automatically assign IPv4 prefixes, use the Ipv4PrefixCount property and do not specify this property. Presently, only /28 prefixes are supported. You can't specify IPv4 prefixes if you've specified one of the following: a count of IPv4 prefixes, specific private IPv4 addresses, or a count of private IPv4 addresses.
Ipv4PrefixCount?	number	no	The number of IPv4 prefixes to assign to a network interface. When you specify a number of IPv4 prefixes, Amazon EC2 selects these prefixes from your existing subnet CIDR reservations, if available, or from free spaces in the subnet. By default, these will be /28 prefixes. You can't specify a count of IPv4 prefixes if you've specified one of the following: specific IPv4 prefixes, specific private IPv4 addresses, or a count of private IPv4 addresses.
GroupSet?	array	no	A list of security group IDs associated with this network interface.
Ipv6Addresses?	array	no	One or more specific IPv6 addresses from the IPv6 CIDR block range of your subnet to associate with the network interface. If you're specifying a number of IPv6 addresses, use the Ipv6AddressCount property and don't specify this property.
Ipv6Prefixes?	array	no	Assigns a list of IPv6 prefixes to the network interface. If you want EC2 to automatically assign IPv6 prefixes, use the Ipv6PrefixCount property and do not specify this property. Presently, only /80 prefixes are supported. You can't specify IPv6 prefixes if you've specified one of the following: a count of IPv6 prefixes, specific IPv6 addresses, or a count of IPv6 addresses.
Ipv6PrefixCount?	number	no	The number of IPv6 prefixes to assign to a network interface. When you specify a number of IPv6 prefixes, Amazon EC2 selects these prefixes from your existing subnet CIDR reservations, if available, or from free spaces in the subnet. By default, these will be /80 prefixes. You can't specify a count of IPv6 prefixes if you've specified one of the following: specific IPv6 prefixes, specific IPv6 addresses, or a count of IPv6 addresses.
SubnetId	string	yes	The ID of the subnet to associate with the network interface.
SourceDestCheck?	boolean	no	Indicates whether traffic to or from the instance is validated.
InterfaceType?	string	no	Indicates the type of network interface.
Ipv6AddressCount?	number	no	The number of IPv6 addresses to assign to a network interface. Amazon EC2 automatically selects the IPv6 addresses from the subnet range. To specify specific IPv6 addresses, use the Ipv6Addresses property and don't specify this property.
EnablePrimaryIpv6?	boolean	no	If you have instances or ENIs that rely on the IPv6 address not changing, to avoid disrupting traffic to instances or ENIs, you can enable a primary IPv6 address. Enable this option to automatically assign an IPv6 associated with the ENI attached to your instance to be the primary IPv6 address. When you enable an IPv6 address to be a primary IPv6, you cannot disable it. Traffic will be routed to the primary IPv6 address until the instance is terminated or the ENI is detached. If you have multiple IPv6 addresses associated with an ENI and you enable a primary IPv6 address, the first IPv6 address associated with the ENI becomes the primary IPv6 address.
ConnectionTrackingSpecification?	object	no
Tags?	array	no	An arbitrary set of tags (key-value pairs) for this network interface.
PublicIpDnsHostnameTypeSpecification?	enum	no	Public IP DNS hostname type
PublicIpDnsNameOptions?	object	no	Describes the public hostname type options, including public hostname type, IPv4-enabled public hostname, IPv6-enabled public hostname, and dual-stack public hostname.

fn create()

Create a EC2 NetworkInterface

fn get(identifier: string)

Get a EC2 NetworkInterface

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkInterface

fn update()

Update a EC2 NetworkInterface

fn delete(identifier: string)

Delete a EC2 NetworkInterface

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkInterface

fn sync()

Sync EC2 NetworkInterface state from AWS

route_table.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
VpcId	string	yes	The ID of the VPC.
Tags?	array	no	Any tags assigned to the route table.

fn create()

Create a EC2 RouteTable

fn get(identifier: string)

Get a EC2 RouteTable

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 RouteTable

fn update()

Update a EC2 RouteTable

fn delete(identifier: string)

Delete a EC2 RouteTable

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 RouteTable

fn sync()

Sync EC2 RouteTable state from AWS

transit_gateway_multicast_group_source.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
GroupIpAddress	string	yes	The IP address assigned to the transit gateway multicast group.
TransitGatewayMulticastDomainId	string	yes	The ID of the transit gateway multicast domain.
NetworkInterfaceId	string	yes	The ID of the transit gateway attachment.

fn create()

Create a EC2 TransitGatewayMulticastGroupSource

fn get(identifier: string)

Get a EC2 TransitGatewayMulticastGroupSource

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayMulticastGroupSource

fn delete(identifier: string)

Delete a EC2 TransitGatewayMulticastGroupSource

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayMulticastGroupSource

fn sync()

Sync EC2 TransitGatewayMulticastGroupSource state from AWS

eipassociation.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
PrivateIpAddress?	string	no	The primary or secondary private IP address to associate with the Elastic IP address. If no private IP address is specified, the Elastic IP address is associated with the primary private IP address.
InstanceId?	string	no	The ID of the instance. The instance must have exactly one attached network interface. You can specify either the instance ID or the network interface ID, but not both.
AllocationId?	string	no	The allocation ID. This is required.
NetworkInterfaceId?	string	no	The ID of the network interface. If the instance has more than one network interface, you must specify a network interface ID. You can specify either the instance ID or the network interface ID, but not both.
EIP?	string	no

fn create()

Create a EC2 EIPAssociation

fn get(identifier: string)

Get a EC2 EIPAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 EIPAssociation

fn delete(identifier: string)

Delete a EC2 EIPAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 EIPAssociation

fn sync()

Sync EC2 EIPAssociation state from AWS

ipampool_cidr.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
IpamPoolId	string	yes	Id of the IPAM Pool.
Cidr?	string	no	Represents a single IPv4 or IPv6 CIDR
NetmaskLength?	number	no	The desired netmask length of the provision. If set, IPAM will choose a block of free space with this size and return the CIDR representing it.

fn create()

Create a EC2 IPAMPoolCidr

fn get(identifier: string)

Get a EC2 IPAMPoolCidr

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMPoolCidr

fn delete(identifier: string)

Delete a EC2 IPAMPoolCidr

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMPoolCidr

fn sync()

Sync EC2 IPAMPoolCidr state from AWS

ipamscope.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
IpamId	string	yes	The Id of the IPAM this scope is a part of.
Description?	string	no
Tags?	array	no	An array of key-value pairs to apply to this resource.
ExternalAuthorityConfiguration?	object	no	An external service connecting to your AWS IPAM scope.

fn create()

Create a EC2 IPAMScope

fn get(identifier: string)

Get a EC2 IPAMScope

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMScope

fn update()

Update a EC2 IPAMScope

fn delete(identifier: string)

Delete a EC2 IPAMScope

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMScope

fn sync()

Sync EC2 IPAMScope state from AWS

key_pair.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
KeyName	string	yes	A unique name for the key pair. Constraints: Up to 255 ASCII characters
KeyType?	enum	no	The type of key pair. Note that ED25519 keys are not supported for Windows instances. If the PublicKeyMaterial property is specified, the KeyType property is ignored, and the key type is inferred from the PublicKeyMaterial value. Default: rsa
KeyFormat?	enum	no	The format of the key pair. Default: pem
PublicKeyMaterial?	string	no	The public key material. The PublicKeyMaterial property is used to import a key pair. If this property is not specified, then a new key pair will be created.
Tags?	array	no	The tags to apply to the key pair.

fn create()

Create a EC2 KeyPair

fn get(identifier: string)

Get a EC2 KeyPair

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 KeyPair

fn delete(identifier: string)

Delete a EC2 KeyPair

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 KeyPair

fn sync()

Sync EC2 KeyPair state from AWS

traffic_mirror_filter_rule.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
DestinationPortRange?	object	no	The first port in the Traffic Mirror port range.
Description?	string	no	The description of the Traffic Mirror Filter rule.
SourcePortRange?	object	no	The first port in the Traffic Mirror port range.
RuleAction	string	yes	The action to take on the filtered traffic (accept/reject).
SourceCidrBlock	string	yes	The source CIDR block to assign to the Traffic Mirror Filter rule.
RuleNumber	number	yes	The number of the Traffic Mirror rule.
DestinationCidrBlock	string	yes	The destination CIDR block to assign to the Traffic Mirror rule.
TrafficMirrorFilterId	string	yes	The ID of the filter that this rule is associated with.
TrafficDirection	string	yes	The direction of traffic (ingress/egress).
Protocol?	number	no	The number of protocol, for example 17 (UDP), to assign to the Traffic Mirror rule.
Tags?	array	no	Any tags assigned to the Traffic Mirror Filter rule.

fn create()

Create a EC2 TrafficMirrorFilterRule

fn get(identifier: string)

Get a EC2 TrafficMirrorFilterRule

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TrafficMirrorFilterRule

fn update()

Update a EC2 TrafficMirrorFilterRule

fn delete(identifier: string)

Delete a EC2 TrafficMirrorFilterRule

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TrafficMirrorFilterRule

fn sync()

Sync EC2 TrafficMirrorFilterRule state from AWS

route.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
CarrierGatewayId?	string	no	The ID of the carrier gateway. You can only use this option when the VPC contains a subnet which is associated with a Wavelength Zone.
CoreNetworkArn?	string	no	The Amazon Resource Name (ARN) of the core network.
DestinationCidrBlock?	string	no	The IPv4 CIDR address block used for the destination match. Routing decisions are based on the most specific match. We modify the specified CIDR block to its canonical form; for example, if you specify 100.68.0.18/18, we modify it to 100.68.0.0/18.
DestinationIpv6CidrBlock?	string	no	The IPv6 CIDR block used for the destination match. Routing decisions are based on the most specific match.
DestinationPrefixListId?	string	no	The ID of a prefix list used for the destination match.
EgressOnlyInternetGatewayId?	string	no	[IPv6 traffic only] The ID of an egress-only internet gateway.
GatewayId?	string	no	The ID of an internet gateway or virtual private gateway attached to your VPC.
InstanceId?	string	no	The ID of a NAT instance in your VPC. The operation fails if you specify an instance ID unless exactly one network interface is attached.
LocalGatewayId?	string	no	The ID of the local gateway.
NatGatewayId?	string	no	[IPv4 traffic only] The ID of a NAT gateway.
NetworkInterfaceId?	string	no	The ID of a network interface.
RouteTableId	string	yes	The ID of the route table for the route.
TransitGatewayId?	string	no	The ID of a transit gateway.
VpcEndpointId?	string	no	The ID of a VPC endpoint. Supported for Gateway Load Balancer endpoints only.
VpcPeeringConnectionId?	string	no	The ID of a VPC peering connection.

fn create()

Create a EC2 Route

fn get(identifier: string)

Get a EC2 Route

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 Route

fn update()

Update a EC2 Route

fn delete(identifier: string)

Delete a EC2 Route

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 Route

fn sync()

Sync EC2 Route state from AWS

capacity_reservation_fleet.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
AllocationStrategy?	string	no
TagSpecifications?	array	no
InstanceTypeSpecifications?	array	no
TotalTargetCapacity?	number	no
EndDate?	string	no
InstanceMatchCriteria?	enum	no
Tenancy?	enum	no
RemoveEndDate?	boolean	no
NoRemoveEndDate?	boolean	no

fn create()

Create a EC2 CapacityReservationFleet

fn get(identifier: string)

Get a EC2 CapacityReservationFleet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 CapacityReservationFleet

fn update()

Update a EC2 CapacityReservationFleet

fn delete(identifier: string)

Delete a EC2 CapacityReservationFleet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 CapacityReservationFleet

fn sync()

Sync EC2 CapacityReservationFleet state from AWS

transit_gateway_connect.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
TransportTransitGatewayAttachmentId	string	yes	The ID of the attachment from which the Connect attachment was created.
Tags?	array	no	The tags for the attachment.
Options?	object	no	The tunnel protocol.

fn create()

Create a EC2 TransitGatewayConnect

fn get(identifier: string)

Get a EC2 TransitGatewayConnect

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayConnect

fn update()

Update a EC2 TransitGatewayConnect

fn delete(identifier: string)

Delete a EC2 TransitGatewayConnect

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayConnect

fn sync()

Sync EC2 TransitGatewayConnect state from AWS

dhcpoptions.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
DomainName?	string	no	This value is used to complete unqualified DNS hostnames.
DomainNameServers?	array	no	The IPv4 addresses of up to four domain name servers, or AmazonProvidedDNS.
NetbiosNameServers?	array	no	The IPv4 addresses of up to four NetBIOS name servers.
NetbiosNodeType?	number	no	The NetBIOS node type (1, 2, 4, or 8).
NtpServers?	array	no	The IPv4 addresses of up to four Network Time Protocol (NTP) servers.
Ipv6AddressPreferredLeaseTime?	number	no	The preferred Lease Time for ipV6 address in seconds.
Tags?	array	no	Any tags assigned to the DHCP options set.

fn create()

Create a EC2 DHCPOptions

fn get(identifier: string)

Get a EC2 DHCPOptions

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 DHCPOptions

fn update()

Update a EC2 DHCPOptions

fn delete(identifier: string)

Delete a EC2 DHCPOptions

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 DHCPOptions

fn sync()

Sync EC2 DHCPOptions state from AWS

route_server_peer.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
RouteServerEndpointId	string	yes	Route Server Endpoint ID
PeerAddress	string	yes	IP address of the Route Server Peer
BgpOptions?	object	no	BGP ASN of the Route Server Peer
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a EC2 RouteServerPeer

fn get(identifier: string)

Get a EC2 RouteServerPeer

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 RouteServerPeer

fn update()

Update a EC2 RouteServerPeer

fn delete(identifier: string)

Delete a EC2 RouteServerPeer

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 RouteServerPeer

fn sync()

Sync EC2 RouteServerPeer state from AWS

transit_gateway_peering_attachment.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Status?	object	no	The status message, if applicable.
TransitGatewayId	string	yes	The ID of the transit gateway.
PeerTransitGatewayId	string	yes	The ID of the peer transit gateway.
PeerAccountId	string	yes	The ID of the peer account
PeerRegion	string	yes	Peer Region
Tags?	array	no	The tags for the transit gateway peering attachment.

fn create()

Create a EC2 TransitGatewayPeeringAttachment

fn get(identifier: string)

Get a EC2 TransitGatewayPeeringAttachment

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayPeeringAttachment

fn update()

Update a EC2 TransitGatewayPeeringAttachment

fn delete(identifier: string)

Delete a EC2 TransitGatewayPeeringAttachment

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGatewayPeeringAttachment

fn sync()

Sync EC2 TransitGatewayPeeringAttachment state from AWS

internet_gateway.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Tags?	array	no	Any tags to assign to the internet gateway.

fn create()

Create a EC2 InternetGateway

fn get(identifier: string)

Get a EC2 InternetGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 InternetGateway

fn update()

Update a EC2 InternetGateway

fn delete(identifier: string)

Delete a EC2 InternetGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 InternetGateway

fn sync()

Sync EC2 InternetGateway state from AWS

ec2fleet.tsv2026.04.24.1

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Context?	string	no
TargetCapacitySpecification?	object	no
OnDemandOptions?	object	no
ExcessCapacityTerminationPolicy?	enum	no
TagSpecifications?	array	no
SpotOptions?	object	no
LaunchTemplateConfigs	array	yes
TerminateInstancesWithExpiration?	boolean	no
ValidUntil?	string	no
Type?	enum	no
ReservedCapacityOptions?	object	no
ValidFrom?	string	no
ReplaceUnhealthyInstances?	boolean	no

fn create()

Create a EC2 EC2Fleet

fn get(identifier: string)

Get a EC2 EC2Fleet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 EC2Fleet

fn update()

Update a EC2 EC2Fleet

fn delete(identifier: string)

Delete a EC2 EC2Fleet

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 EC2Fleet

fn sync()

Sync EC2 EC2Fleet state from AWS

transit_gateway.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
DefaultRouteTablePropagation?	string	no
Description?	string	no
AutoAcceptSharedAttachments?	string	no
DefaultRouteTableAssociation?	string	no
VpnEcmpSupport?	string	no
DnsSupport?	string	no
SecurityGroupReferencingSupport?	string	no
MulticastSupport?	string	no
AmazonSideAsn?	number	no
TransitGatewayCidrBlocks?	array	no
Tags?	array	no
AssociationDefaultRouteTableId?	string	no
PropagationDefaultRouteTableId?	string	no
EncryptionSupport?	enum	no

fn create()

Create a EC2 TransitGateway

fn get(identifier: string)

Get a EC2 TransitGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGateway

fn update()

Update a EC2 TransitGateway

fn delete(identifier: string)

Delete a EC2 TransitGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TransitGateway

fn sync()

Sync EC2 TransitGateway state from AWS

route_server_propagation.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
RouteServerId	string	yes	Route Server ID
RouteTableId	string	yes	Route Table ID

fn create()

Create a EC2 RouteServerPropagation

fn get(identifier: string)

Get a EC2 RouteServerPropagation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 RouteServerPropagation

fn delete(identifier: string)

Delete a EC2 RouteServerPropagation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 RouteServerPropagation

fn sync()

Sync EC2 RouteServerPropagation state from AWS

volume.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
MultiAttachEnabled?	boolean	no	Indicates whether Amazon EBS Multi-Attach is enabled. CFNlong does not currently support updating a single-attach volume to be multi-attach enabled, updating a multi-attach enabled volume to be single-attach, or updating the size or number of I/O operations per second (IOPS) of a multi-attach enabled volume.
KmsKeyId?	string	no	The identifier of the kms-key-long to use for Amazon EBS encryption. If KmsKeyId is specified, the encrypted state must be true. If you omit this property and your account is enabled for encryption by default, or Encrypted is set to true, then the volume is encrypted using the default key specified for your account. If your account does not have a default key, then the volume is encrypted using the aws-managed-key. Alternatively, if you want to specify a different key, you can specify one of the following: Key ID. For example, 1234abcd-12ab-34cd-56ef-1234567890ab. Key alias. Specify the alias for the key, prefixed with alias/. For example, for a key with the alias my_cmk, use alias/my_cmk. Or to specify the aws-managed-key, use alias/aws/ebs. Key ARN. For example, arn:aws:kms:us-east-1:012345678910:key/1234abcd-12ab-34cd-56ef-1234567890ab. Alias ARN. For example, arn:aws:kms:us-east-1:012345678910:alias/ExampleAlias. If you are creating a volume copy, omit this parameter. The volume is automatically encrypted with the same KMS key as the source volume. You can't copy unencrypted volumes.
Encrypted?	boolean	no	Indicates whether the volume should be encrypted. The effect of setting the encryption state to true depends on the volume origin (new, from a snapshot, or from an existing volume), starting encryption state, ownership, and whether encryption by default is enabled. For more information, see [Encryption by default](https://docs.aws.amazon.com/ebs/latest/userguide/work-with-ebs-encr.html#encryption-by-default) in the Amazon EBS User Guide. If you are creating a volume copy, omit this parameter. The volume is automatically encrypted with the same KMS key as the source volume. You can't copy unencrypted volumes.
Size?	number	no	The size of the volume, in GiBs. Required for new empty volumes. Optional for volumes created from snapshots and volume copies. In this case, the size defaults to the size of the snapshot or source volume. You can optionally specify a size that is equal to or larger than the size of the source snapshot or volume. Supported volume sizes: gp2: 1 - 16,384 GiB gp3: 1 - 65,536 GiB io1: 4 - 16,384 GiB io2: 4 - 65,536 GiB st1 and sc1: 125 - 16,384 GiB standard: 1 - 1024 GiB
AutoEnableIO?	boolean	no	Indicates whether the volume is auto-enabled for I/O operations. By default, EBS disables I/O to the volume from attached EC2 instances when it determines that a volume's data is potentially inconsistent. If the consistency of the volume is not a concern, and you prefer that the volume be made available immediately if it's impaired, you can configure the volume to automatically enable I/O.
OutpostArn?	string	no	The Amazon Resource Name (ARN) of the Outpost on which to create the volume. If you intend to use a volume with an instance running on an outpost, then you must create the volume on the same outpost as the instance. You can't use a volume created in an AWS Region with an instance on an AWS outpost, or the other way around.
AvailabilityZone?	string	no	The ID of the Availability Zone in which to create the volume. For example, us-east-1a. Either AvailabilityZone or AvailabilityZoneId must be specified, but not both. If you are creating a volume copy, omit this parameter. The volume copy is created in the same Availability Zone as the source volume.
AvailabilityZoneId?	string	no	The ID of the Availability Zone in which to create the volume. For example, use1-az1. Either AvailabilityZone or AvailabilityZoneId must be specified, but not both. If you are creating a volume copy, omit this parameter. The volume copy is created in the same Availability Zone as the source volume.
Throughput?	number	no	The throughput to provision for a volume, with a maximum of 2,000 MiB/s. This parameter is valid only for gp3 volumes. The default value is 125. Valid Range: Minimum value of 125. Maximum value of 2000. The maximum ratio of throughput to IOPS is 0.25 MiB/s per IOPS. For example, a volume with 3,000 IOPS can have a maximum throughput of 750 MiB/s (3,000 x 0.25).
Iops?	number	no	The number of I/O operations per second (IOPS) to provision for the volume. Required for io1 and io2 volumes. Optional for gp3 volumes. Omit for all other volume types. Valid ranges: gp3: 3,000 (default) - 80,000 IOPS io1: 100 - 64,000 IOPS io2: 100 - 256,000 IOPS [Instances built on the Nitro System](https://docs.aws.amazon.com/ec2/latest/instancetypes/ec2-nitro-instances.html) can support up to 256,000 IOPS. Other instances can support up to 32,000 IOPS.
SnapshotId?	string	no	The snapshot from which to create the volume. Only specify to create a volume from a snapshot. To create a new empty volume, omit this parameter and specify a value for Size instead. To create a volume copy, omit this parameter and specify SourceVolumeId instead.
SourceVolumeId?	string	no	The ID of the source EBS volume to copy. When specified, the volume is created as an exact copy of the specified volume. Only specify to create a volume copy. To create a new empty volume or to create a volume from a snapshot, omit this parameter,
VolumeType?	string	no	The volume type. This parameter can be one of the following values: General Purpose SSD: gp2 \| gp3 Provisioned IOPS SSD: io1 \| io2 Throughput Optimized HDD: st1 Cold HDD: sc1 Magnetic: standard Throughput Optimized HDD ( st1) and Cold HDD ( sc1) volumes can't be used as boot volumes. For more information, see [Amazon EBS volume types](https://docs.aws.amazon.com/ebs/latest/userguide/ebs-volume-types.html) in the Amazon EBS User Guide. Default: gp2
Tags?	array	no	The tags to apply to the volume during creation.
VolumeInitializationRate?	number	no	Specifies the Amazon EBS Provisioned Rate for Volume Initialization (volume initialization rate), in MiB/s, at which to download the snapshot blocks from Amazon S3 to the volume. This is also known as volume initialization. Specifying a volume initialization rate ensures that the volume is initialized at a predictable and consistent rate after creation. This parameter is supported only for volumes created from snapshots. Omit this parameter if: You want to create the volume using fast snapshot restore. You must specify a snapshot that is enabled for fast snapshot restore. In this case, the volume is fully initialized at creation. If you specify a snapshot that is enabled for fast snapshot restore and a volume initialization rate, the volume will be initialized at the specified rate instead of fast snapshot restore. You want to create a volume that is initialized at the default rate. For more information, see [Initialize Amazon EBS volumes](https://docs.aws.amazon.com/ebs/latest/userguide/initalize-volume.html) in the Amazon EC2 User Guide. Valid range: 100 - 300 MiB/s

fn create()

Create a EC2 Volume

fn get(identifier: string)

Get a EC2 Volume

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 Volume

fn update()

Update a EC2 Volume

fn delete(identifier: string)

Delete a EC2 Volume

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 Volume

fn sync()

Sync EC2 Volume state from AWS

vpcblock_public_access_options.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
InternetGatewayBlockMode	enum	yes	The desired Block Public Access mode for Internet Gateways in your account. We do not allow to create in a off mode as this is the default value

fn create()

Create a EC2 VPCBlockPublicAccessOptions

fn get(identifier: string)

Get a EC2 VPCBlockPublicAccessOptions

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCBlockPublicAccessOptions

fn update()

Update a EC2 VPCBlockPublicAccessOptions

fn delete(identifier: string)

Delete a EC2 VPCBlockPublicAccessOptions

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCBlockPublicAccessOptions

fn sync()

Sync EC2 VPCBlockPublicAccessOptions state from AWS

ipamprefix_list_resolver.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
IpamId?	string	no	The Id of the IPAM this Prefix List Resolver is a part of.
AddressFamily	string	yes	The address family of the address space in this Prefix List Resolver. Either IPv4 or IPv6.
Description?	string	no
Rules?	array	no	Rules define the business logic for selecting CIDRs from IPAM.
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a EC2 IPAMPrefixListResolver

fn get(identifier: string)

Get a EC2 IPAMPrefixListResolver

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMPrefixListResolver

fn update()

Update a EC2 IPAMPrefixListResolver

fn delete(identifier: string)

Delete a EC2 IPAMPrefixListResolver

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMPrefixListResolver

fn sync()

Sync EC2 IPAMPrefixListResolver state from AWS

vpcpeering_connection.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
PeerRoleArn?	string	no	The Amazon Resource Name (ARN) of the VPC peer role for the peering connection in another AWS account.
VpcId	string	yes	The ID of the VPC.
PeerVpcId	string	yes	The ID of the VPC with which you are creating the VPC peering connection. You must specify this parameter in the request.
AssumeRoleRegion?	string	no	The Region code to use when calling Security Token Service (STS) to assume the PeerRoleArn, if provided.
PeerRegion?	string	no	The Region code for the accepter VPC, if the accepter VPC is located in a Region other than the Region in which you make the request.
PeerOwnerId?	string	no	The AWS account ID of the owner of the accepter VPC.
Tags?	array	no

fn create()

Create a EC2 VPCPeeringConnection

fn get(identifier: string)

Get a EC2 VPCPeeringConnection

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCPeeringConnection

fn update()

Update a EC2 VPCPeeringConnection

fn delete(identifier: string)

Delete a EC2 VPCPeeringConnection

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCPeeringConnection

fn sync()

Sync EC2 VPCPeeringConnection state from AWS

network_acl.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
VpcId	string	yes	The ID of the VPC for the network ACL.
Tags?	array	no	The tags for the network ACL.

fn create()

Create a EC2 NetworkAcl

fn get(identifier: string)

Get a EC2 NetworkAcl

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkAcl

fn update()

Update a EC2 NetworkAcl

fn delete(identifier: string)

Delete a EC2 NetworkAcl

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkAcl

fn sync()

Sync EC2 NetworkAcl state from AWS

vpcencryption_control.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Tags?	array	no	The tags to assign to the VPC encryption control.
VpcId?	string	no	The VPC on which this VPC encryption control is applied.
Mode?	enum	no	The VPC encryption control mode, either monitor or enforce.
InternetGatewayExclusionInput?	enum	no	Used to enable or disable IGW exclusion
EgressOnlyInternetGatewayExclusionInput?	enum	no	Used to enable or disable EIGW exclusion
NatGatewayExclusionInput?	enum	no	Used to enable or disable Nat gateway exclusion
VirtualPrivateGatewayExclusionInput?	enum	no	Used to enable or disable VGW exclusion
VpcPeeringExclusionInput?	enum	no	Used to enable or disable VPC peering exclusion
VpcLatticeExclusionInput?	enum	no	Used to enable or disable Vpc Lattice exclusion
ElasticFileSystemExclusionInput?	enum	no	Used to enable or disable EFS exclusion
LambdaExclusionInput?	enum	no	Used to enable or disable Lambda exclusion

fn create()

Create a EC2 VPCEncryptionControl

fn get(identifier: string)

Get a EC2 VPCEncryptionControl

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCEncryptionControl

fn update()

Update a EC2 VPCEncryptionControl

fn delete(identifier: string)

Delete a EC2 VPCEncryptionControl

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCEncryptionControl

fn sync()

Sync EC2 VPCEncryptionControl state from AWS

vpnconcentrator.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
TransitGatewayId	string	yes	The ID of the transit gateway associated with the VPN concentrator.
Type	string	yes	The type of VPN concentrator.
Tags?	array	no	Any tags assigned to the VPN concentrator.

fn create()

Create a EC2 VPNConcentrator

fn get(identifier: string)

Get a EC2 VPNConcentrator

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPNConcentrator

fn update()

Update a EC2 VPNConcentrator

fn delete(identifier: string)

Delete a EC2 VPNConcentrator

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPNConcentrator

fn sync()

Sync EC2 VPNConcentrator state from AWS

verified_access_trust_provider.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
TrustProviderType	string	yes	Type of trust provider. Possible values: user\|device
DeviceTrustProviderType?	string	no	The type of device-based trust provider. Possible values: jamf\|crowdstrike
UserTrustProviderType?	string	no	The type of device-based trust provider. Possible values: oidc\|iam-identity-center
OidcOptions?	object	no	The OIDC issuer.
DeviceOptions?	object	no	The ID of the tenant application with the device-identity provider.
PolicyReferenceName	string	yes	The identifier to be used when working with policy rules.
Description?	string	no	A description for the Amazon Web Services Verified Access trust provider.
Tags?	array	no	An array of key-value pairs to apply to this resource.
SseSpecification?	object	no	KMS Key Arn used to encrypt the group policy
NativeApplicationOidcOptions?	object	no	The OIDC issuer.

fn create()

Create a EC2 VerifiedAccessTrustProvider

fn get(identifier: string)

Get a EC2 VerifiedAccessTrustProvider

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VerifiedAccessTrustProvider

fn update()

Update a EC2 VerifiedAccessTrustProvider

fn delete(identifier: string)

Delete a EC2 VerifiedAccessTrustProvider

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VerifiedAccessTrustProvider

fn sync()

Sync EC2 VerifiedAccessTrustProvider state from AWS

subnet_cidr_block.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
Ipv6CidrBlock?	string	no	The IPv6 network range for the subnet, in CIDR notation. The subnet size must use a /64 prefix length
Ipv6IpamPoolId?	string	no	The ID of an IPv6 Amazon VPC IP Address Manager (IPAM) pool from which to allocate, to get the subnet's CIDR
Ipv6NetmaskLength?	number	no	The netmask length of the IPv6 CIDR to allocate to the subnet from an IPAM pool
SubnetId	string	yes	The ID of the subnet

fn create()

Create a EC2 SubnetCidrBlock

fn get(identifier: string)

Get a EC2 SubnetCidrBlock

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SubnetCidrBlock

fn delete(identifier: string)

Delete a EC2 SubnetCidrBlock

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SubnetCidrBlock

fn sync()

Sync EC2 SubnetCidrBlock state from AWS

prefix_list.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
PrefixListName	string	yes	Name of Prefix List.
AddressFamily	enum	yes	Ip Version of Prefix List.
MaxEntries?	number	no	Max Entries of Prefix List.
Tags?	array	no	Tags for Prefix List
Entries?	array	no	Entries of Prefix List.

fn create()

Create a EC2 PrefixList

fn get(identifier: string)

Get a EC2 PrefixList

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 PrefixList

fn update()

Update a EC2 PrefixList

fn delete(identifier: string)

Delete a EC2 PrefixList

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 PrefixList

fn sync()

Sync EC2 PrefixList state from AWS

network_insights_access_scope_analysis.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
NetworkInsightsAccessScopeId	string	yes
Tags?	array	no

fn create()

Create a EC2 NetworkInsightsAccessScopeAnalysis

fn get(identifier: string)

Get a EC2 NetworkInsightsAccessScopeAnalysis

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkInsightsAccessScopeAnalysis

fn update()

Update a EC2 NetworkInsightsAccessScopeAnalysis

fn delete(identifier: string)

Delete a EC2 NetworkInsightsAccessScopeAnalysis

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 NetworkInsightsAccessScopeAnalysis

fn sync()

Sync EC2 NetworkInsightsAccessScopeAnalysis state from AWS

subnet_network_acl_association.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
SubnetId	string	yes	The ID of the subnet
NetworkAclId	string	yes	The ID of the network ACL

fn create()

Create a EC2 SubnetNetworkAclAssociation

fn get(identifier: string)

Get a EC2 SubnetNetworkAclAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SubnetNetworkAclAssociation

fn delete(identifier: string)

Delete a EC2 SubnetNetworkAclAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SubnetNetworkAclAssociation

fn sync()

Sync EC2 SubnetNetworkAclAssociation state from AWS

route_server.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
AmazonSideAsn	number	yes	The Amazon-side ASN of the Route Server.
PersistRoutes?	enum	no	Whether to enable persistent routes
PersistRoutesDuration?	number	no	The duration of persistent routes in minutes
SnsNotificationsEnabled?	boolean	no	Whether to enable SNS notifications
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a EC2 RouteServer

fn get(identifier: string)

Get a EC2 RouteServer

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 RouteServer

fn update()

Update a EC2 RouteServer

fn delete(identifier: string)

Delete a EC2 RouteServer

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 RouteServer

fn sync()

Sync EC2 RouteServer state from AWS

enclave_certificate_iam_role_association.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
CertificateArn	string	yes	The Amazon Resource Name (ARN) of the ACM certificate with which to associate the IAM role.
RoleArn	string	yes	The Amazon Resource Name (ARN) of the IAM role to associate with the ACM certificate. You can associate up to 16 IAM roles with an ACM certificate.

fn create()

Create a EC2 EnclaveCertificateIamRoleAssociation

fn get(identifier: string)

Get a EC2 EnclaveCertificateIamRoleAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 EnclaveCertificateIamRoleAssociation

fn delete(identifier: string)

Delete a EC2 EnclaveCertificateIamRoleAssociation

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 EnclaveCertificateIamRoleAssociation

fn sync()

Sync EC2 EnclaveCertificateIamRoleAssociation state from AWS

ipamprefix_list_resolver_target.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
IpamPrefixListResolverId	string	yes	The Id of the IPAM Prefix List Resolver associated with this Target.
PrefixListId	string	yes	The Id of the Managed Prefix List.
PrefixListRegion	string	yes	The region that the Managed Prefix List is located in.
DesiredVersion?	number	no	The desired version of the Prefix List Resolver that this Target should synchronize with.
TrackLatestVersion	boolean	yes	Indicates whether this Target automatically tracks the latest version of the Prefix List Resolver.
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a EC2 IPAMPrefixListResolverTarget

fn get(identifier: string)

Get a EC2 IPAMPrefixListResolverTarget

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMPrefixListResolverTarget

fn update()

Update a EC2 IPAMPrefixListResolverTarget

fn delete(identifier: string)

Delete a EC2 IPAMPrefixListResolverTarget

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 IPAMPrefixListResolverTarget

fn sync()

Sync EC2 IPAMPrefixListResolverTarget state from AWS

sql_ha_standby_detected_instance.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
InstanceId	string	yes	The ID of the EC2 instance to enable for SQL Server high availability standby detection.
SqlServerCredentials?	string	no	The ARN of the AWS Secrets Manager secret containing SQL Server access credentials to the EC2 instance. If not specified, AWS Systems Manager agent will use default local user credentials.

fn create()

Create a EC2 SqlHaStandbyDetectedInstance

fn get(identifier: string)

Get a EC2 SqlHaStandbyDetectedInstance

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SqlHaStandbyDetectedInstance

fn update()

Update a EC2 SqlHaStandbyDetectedInstance

fn delete(identifier: string)

Delete a EC2 SqlHaStandbyDetectedInstance

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SqlHaStandbyDetectedInstance

fn sync()

Sync EC2 SqlHaStandbyDetectedInstance state from AWS

security_group.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
GroupDescription	string	yes	A description for the security group.
GroupName?	string	no	The name of the security group.
VpcId?	string	no	The ID of the VPC for the security group.
SecurityGroupIngress?	array	no	The inbound rules associated with the security group. There is a short interruption during which you cannot connect to the security group.
SecurityGroupEgress?	array	no	[VPC only] The outbound rules associated with the security group. There is a short interruption during which you cannot connect to the security group.
Tags?	array	no	Any tags assigned to the security group.

fn create()

Create a EC2 SecurityGroup

fn get(identifier: string)

Get a EC2 SecurityGroup

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SecurityGroup

fn update()

Update a EC2 SecurityGroup

fn delete(identifier: string)

Delete a EC2 SecurityGroup

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 SecurityGroup

fn sync()

Sync EC2 SecurityGroup state from AWS

launch_template.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
LaunchTemplateName?	string	no	A name for the launch template.
LaunchTemplateData?	object	no	The names of the security groups. For a nondefault VPC, you must use security group IDs instead. If you specify a network interface, you must specify any security groups as part of the network interface instead of using this parameter.
VersionDescription?	string	no	A description for the first version of the launch template.
TagSpecifications?	array	no	The tags to apply to the launch template on creation. To tag the launch template, the resource type must be launch-template. To specify the tags for resources that are created during instance launch, use [TagSpecifications](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-launchtemplate-launchtemplatedata.html#cfn-ec2-launchtemplate-launchtemplatedata-tagspecifications).

fn create()

Create a EC2 LaunchTemplate

fn get(identifier: string)

Get a EC2 LaunchTemplate

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LaunchTemplate

fn update()

Update a EC2 LaunchTemplate

fn delete(identifier: string)

Delete a EC2 LaunchTemplate

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 LaunchTemplate

fn sync()

Sync EC2 LaunchTemplate state from AWS

vpcblock_public_access_exclusion.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
InternetGatewayExclusionMode	enum	yes	The desired Block Public Access Exclusion Mode for a specific VPC/Subnet.
VpcId?	string	no	The ID of the vpc. Required only if you don't specify SubnetId.
SubnetId?	string	no	The ID of the subnet. Required only if you don't specify VpcId
Tags?	array	no	An array of key-value pairs to apply to this resource.

fn create()

Create a EC2 VPCBlockPublicAccessExclusion

fn get(identifier: string)

Get a EC2 VPCBlockPublicAccessExclusion

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCBlockPublicAccessExclusion

fn update()

Update a EC2 VPCBlockPublicAccessExclusion

fn delete(identifier: string)

Delete a EC2 VPCBlockPublicAccessExclusion

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VPCBlockPublicAccessExclusion

fn sync()

Sync EC2 VPCBlockPublicAccessExclusion state from AWS

traffic_mirror_filter.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
NetworkServices?	array	no	The network service that is associated with the traffic mirror filter.
Description?	string	no	The description of a traffic mirror filter.
Tags?	array	no	The tags for a traffic mirror filter.

fn create()

Create a EC2 TrafficMirrorFilter

fn get(identifier: string)

Get a EC2 TrafficMirrorFilter

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TrafficMirrorFilter

fn update()

Update a EC2 TrafficMirrorFilter

fn delete(identifier: string)

Delete a EC2 TrafficMirrorFilter

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 TrafficMirrorFilter

fn sync()

Sync EC2 TrafficMirrorFilter state from AWS

verified_access_group.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
VerifiedAccessInstanceId	string	yes	The ID of the AWS Verified Access instance.
Description?	string	no	A description for the AWS Verified Access group.
PolicyDocument?	string	no	The AWS Verified Access policy document.
PolicyEnabled?	boolean	no	The status of the Verified Access policy.
Tags?	array	no	An array of key-value pairs to apply to this resource.
SseSpecification?	object	no	KMS Key Arn used to encrypt the group policy

fn create()

Create a EC2 VerifiedAccessGroup

fn get(identifier: string)

Get a EC2 VerifiedAccessGroup

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VerifiedAccessGroup

fn update()

Update a EC2 VerifiedAccessGroup

fn delete(identifier: string)

Delete a EC2 VerifiedAccessGroup

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 VerifiedAccessGroup

fn sync()

Sync EC2 VerifiedAccessGroup state from AWS

egress_only_internet_gateway.tsv2026.04.23.2

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
VpcId	string	yes	The ID of the VPC for which to create the egress-only internet gateway.
Tags?	array	no	Any tags assigned to the egress only internet gateway.

fn create()

Create a EC2 EgressOnlyInternetGateway

fn get(identifier: string)

Get a EC2 EgressOnlyInternetGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 EgressOnlyInternetGateway

fn update()

Update a EC2 EgressOnlyInternetGateway

fn delete(identifier: string)

Delete a EC2 EgressOnlyInternetGateway

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the EC2 EgressOnlyInternetGateway

fn sync()

Sync EC2 EgressOnlyInternetGateway state from AWS

04Previous Versions11

2026.04.23.3Apr 23, 2026

2026.04.23.2Apr 23, 2026

Updated: capacity_manager_data_export, capacity_reservation, capacity_reservation_fleet, carrier_gateway, customer_gateway, dhcpoptions, ec2fleet, eip, eipassociation, egress_only_internet_gateway, enclave_certificate_iam_role_association, flow_log, gateway_route_table_association, host, ipam, ipamallocation, ipampool, ipampool_cidr, ipamprefix_list_resolver, ipamprefix_list_resolver_target, ipamresource_discovery, ipamresource_discovery_association, ipamscope, instance, instance_connect_endpoint, internet_gateway, ip_pool_route_table_association, key_pair, launch_template, local_gateway_route, local_gateway_route_table, local_gateway_route_table_vpcassociation, local_gateway_route_table_virtual_interface_group_association, local_gateway_virtual_interface, local_gateway_virtual_interface_group, nat_gateway, network_acl, network_insights_access_scope, network_insights_access_scope_analysis, network_insights_analysis, network_insights_path, network_interface, network_interface_attachment, network_performance_metric_subscription, placement_group, prefix_list, route, route_server, route_server_association, route_server_endpoint, route_server_peer, route_server_propagation, route_table, security_group, security_group_egress, security_group_ingress, security_group_vpc_association, snapshot_block_public_access, spot_fleet, sql_ha_standby_detected_instance, subnet, subnet_cidr_block, subnet_network_acl_association, subnet_route_table_association, traffic_mirror_filter, traffic_mirror_filter_rule, traffic_mirror_session, traffic_mirror_target, transit_gateway, transit_gateway_attachment, transit_gateway_connect, transit_gateway_connect_peer, transit_gateway_metering_policy, transit_gateway_metering_policy_entry, transit_gateway_multicast_domain, transit_gateway_multicast_domain_association, transit_gateway_multicast_group_member, transit_gateway_multicast_group_source, transit_gateway_peering_attachment, transit_gateway_route, transit_gateway_route_table, transit_gateway_route_table_association, transit_gateway_route_table_propagation, transit_gateway_vpc_attachment, vpc, vpcblock_public_access_exclusion, vpcblock_public_access_options, vpccidr_block, vpcdhcpoptions_association, vpcencryption_control, vpcendpoint, vpcendpoint_connection_notification, vpcendpoint_service, vpcendpoint_service_permissions, vpcgateway_attachment, vpcpeering_connection, vpnconcentrator, vpnconnection, vpnconnection_route, vpngateway, verified_access_endpoint, verified_access_group, verified_access_instance, verified_access_trust_provider, volume, volume_attachment

2026.04.19.1Apr 19, 2026

Updated: ec2fleet

2026.04.03.2Apr 3, 2026

Updated: capacity_manager_data_export, capacity_reservation, capacity_reservation_fleet, carrier_gateway, customer_gateway, dhcpoptions, ec2fleet, eip, eipassociation, egress_only_internet_gateway, enclave_certificate_iam_role_association, flow_log, gateway_route_table_association, host, ipam, ipamallocation, ipampool, ipampool_cidr, ipamprefix_list_resolver, ipamprefix_list_resolver_target, ipamresource_discovery, ipamresource_discovery_association, ipamscope, instance, instance_connect_endpoint, internet_gateway, ip_pool_route_table_association, key_pair, launch_template, local_gateway_route, local_gateway_route_table, local_gateway_route_table_vpcassociation, local_gateway_route_table_virtual_interface_group_association, local_gateway_virtual_interface, local_gateway_virtual_interface_group, nat_gateway, network_acl, network_insights_access_scope, network_insights_access_scope_analysis, network_insights_analysis, network_insights_path, network_interface, network_interface_attachment, network_performance_metric_subscription, placement_group, prefix_list, route, route_server, route_server_association, route_server_endpoint, route_server_peer, route_server_propagation, route_table, security_group, security_group_egress, security_group_ingress, security_group_vpc_association, snapshot_block_public_access, spot_fleet, sql_ha_standby_detected_instance, subnet, subnet_cidr_block, subnet_network_acl_association, subnet_route_table_association, traffic_mirror_filter, traffic_mirror_filter_rule, traffic_mirror_session, traffic_mirror_target, transit_gateway, transit_gateway_attachment, transit_gateway_connect, transit_gateway_connect_peer, transit_gateway_metering_policy, transit_gateway_metering_policy_entry, transit_gateway_multicast_domain, transit_gateway_multicast_domain_association, transit_gateway_multicast_group_member, transit_gateway_multicast_group_source, transit_gateway_peering_attachment, transit_gateway_route, transit_gateway_route_table, transit_gateway_route_table_association, transit_gateway_route_table_propagation, transit_gateway_vpc_attachment, vpc, vpcblock_public_access_exclusion, vpcblock_public_access_options, vpccidr_block, vpcdhcpoptions_association, vpcencryption_control, vpcendpoint, vpcendpoint_connection_notification, vpcendpoint_service, vpcendpoint_service_permissions, vpcgateway_attachment, vpcpeering_connection, vpnconcentrator, vpnconnection, vpnconnection_route, vpngateway, verified_access_endpoint, verified_access_group, verified_access_instance, verified_access_trust_provider, volume, volume_attachment

2026.03.25.1Mar 25, 2026

Updated: ec2fleet

2026.03.23.1Mar 23, 2026

Added: sql_ha_standby_detected_instance
Updated: instance_connect_endpoint

2026.03.19.1Mar 19, 2026

Updated: capacity_manager_data_export, capacity_reservation, capacity_reservation_fleet, carrier_gateway, customer_gateway, dhcpoptions, ec2fleet, eip, eipassociation, egress_only_internet_gateway, enclave_certificate_iam_role_association, flow_log, gateway_route_table_association, host, ipam, ipamallocation, ipampool, ipampool_cidr, ipamprefix_list_resolver, ipamprefix_list_resolver_target, ipamresource_discovery, ipamresource_discovery_association, ipamscope, instance, instance_connect_endpoint, internet_gateway, ip_pool_route_table_association, key_pair, launch_template, local_gateway_route, local_gateway_route_table, local_gateway_route_table_vpcassociation, local_gateway_route_table_virtual_interface_group_association, local_gateway_virtual_interface, local_gateway_virtual_interface_group, nat_gateway, network_acl, network_insights_access_scope, network_insights_access_scope_analysis, network_insights_analysis, network_insights_path, network_interface, network_interface_attachment, network_performance_metric_subscription, placement_group, prefix_list, route, route_server, route_server_association, route_server_endpoint, route_server_peer, route_server_propagation, route_table, security_group, security_group_egress, security_group_ingress, security_group_vpc_association, snapshot_block_public_access, spot_fleet, subnet, subnet_cidr_block, subnet_network_acl_association, subnet_route_table_association, traffic_mirror_filter, traffic_mirror_filter_rule, traffic_mirror_session, traffic_mirror_target, transit_gateway, transit_gateway_attachment, transit_gateway_connect, transit_gateway_connect_peer, transit_gateway_metering_policy, transit_gateway_metering_policy_entry, transit_gateway_multicast_domain, transit_gateway_multicast_domain_association, transit_gateway_multicast_group_member, transit_gateway_multicast_group_source, transit_gateway_peering_attachment, transit_gateway_route, transit_gateway_route_table, transit_gateway_route_table_association, transit_gateway_route_table_propagation, transit_gateway_vpc_attachment, vpc, vpcblock_public_access_exclusion, vpcblock_public_access_options, vpccidr_block, vpcdhcpoptions_association, vpcencryption_control, vpcendpoint, vpcendpoint_connection_notification, vpcendpoint_service, vpcendpoint_service_permissions, vpcgateway_attachment, vpcpeering_connection, vpnconcentrator, vpnconnection, vpnconnection_route, vpngateway, verified_access_endpoint, verified_access_group, verified_access_instance, verified_access_trust_provider, volume, volume_attachment

2026.03.18.1Mar 18, 2026

Added: ipamprefix_list_resolver_target

2026.03.16.1Mar 16, 2026

Updated: capacity_manager_data_export, capacity_reservation, capacity_reservation_fleet, carrier_gateway, customer_gateway, dhcpoptions, ec2fleet, eip, eipassociation, egress_only_internet_gateway, enclave_certificate_iam_role_association, flow_log, gateway_route_table_association, host, ipam, ipamallocation, ipampool, ipampool_cidr, ipamprefix_list_resolver, ipamresource_discovery, ipamresource_discovery_association, ipamscope, instance, instance_connect_endpoint, internet_gateway, ip_pool_route_table_association, key_pair, launch_template, local_gateway_route, local_gateway_route_table, local_gateway_route_table_vpcassociation, local_gateway_route_table_virtual_interface_group_association, local_gateway_virtual_interface, local_gateway_virtual_interface_group, nat_gateway, network_acl, network_insights_access_scope, network_insights_access_scope_analysis, network_insights_analysis, network_insights_path, network_interface, network_interface_attachment, network_performance_metric_subscription, placement_group, prefix_list, route, route_server, route_server_association, route_server_endpoint, route_server_peer, route_server_propagation, route_table, security_group, security_group_egress, security_group_ingress, security_group_vpc_association, snapshot_block_public_access, spot_fleet, subnet, subnet_cidr_block, subnet_network_acl_association, subnet_route_table_association, traffic_mirror_filter, traffic_mirror_filter_rule, traffic_mirror_session, traffic_mirror_target, transit_gateway, transit_gateway_attachment, transit_gateway_connect, transit_gateway_connect_peer, transit_gateway_metering_policy, transit_gateway_metering_policy_entry, transit_gateway_multicast_domain, transit_gateway_multicast_domain_association, transit_gateway_multicast_group_member, transit_gateway_multicast_group_source, transit_gateway_peering_attachment, transit_gateway_route, transit_gateway_route_table, transit_gateway_route_table_association, transit_gateway_route_table_propagation, transit_gateway_vpc_attachment, vpc, vpcblock_public_access_exclusion, vpcblock_public_access_options, vpccidr_block, vpcdhcpoptions_association, vpcencryption_control, vpcendpoint, vpcendpoint_connection_notification, vpcendpoint_service, vpcendpoint_service_permissions, vpcgateway_attachment, vpcpeering_connection, vpnconcentrator, vpnconnection, vpnconnection_route, vpngateway, verified_access_endpoint, verified_access_group, verified_access_instance, verified_access_trust_provider, volume, volume_attachment

2026.03.13.1Mar 13, 2026

Updated: ec2fleet, transit_gateway_metering_policy_entry

2026.03.10.5Mar 10, 2026

05Stats

100 / 100

Downloads

197

Archive size

20.2 MB

Verified by Swamp

Has README or module doc2/2earned
README has a code example1/1earned
README is substantive1/1earned
Most symbols documented1/1earned
No slow types1/1earned
Has description1/1earned
At least one platform tag (or universal)1/1earned
Two or more platform tags (or universal)1/1earned
License declared1/1earned
Verified public repository2/2earned

Repository

https://github.com/systeminit/swamp-extensions

06Platforms

linux · x86_64 linux · aarch64 macOS · x86_64 macOS · aarch64

07Labels

#aws #ec2 #cloud #infrastructure