NatInstanceProps Struct
Properties for a NAT instance.
Example
ts
declare const instanceType: ec2.InstanceType;
const provider = ec2.NatProvider.instanceV2({
instanceType,
defaultAllowedTraffic: ec2.NatTrafficDirection.OUTBOUND_ONLY,
});
new ec2.Vpc(this, 'TheVPC', {
natGatewayProvider: provider,
});
provider.connections.allowFrom(ec2.Peer.ipv4('1.2.3.4/8'), ec2.Port.HTTP);
python
# instance_type: ec2.InstanceType
provider = ec2.NatProvider.instance_v2(
instance_type=instance_type,
default_allowed_traffic=ec2.NatTrafficDirection.OUTBOUND_ONLY
)
ec2.Vpc(self, "TheVPC",
nat_gateway_provider=provider
)
provider.connections.allow_from(ec2.Peer.ipv4("1.2.3.4/8"), ec2.Port.HTTP)
java
InstanceType instanceType;
NatInstanceProviderV2 provider = NatProvider.instanceV2(NatInstanceProps.builder()
.instanceType(instanceType)
.defaultAllowedTraffic(NatTrafficDirection.OUTBOUND_ONLY)
.build());
Vpc.Builder.create(this, "TheVPC")
.natGatewayProvider(provider)
.build();
provider.connections.allowFrom(Peer.ipv4("1.2.3.4/8"), Port.HTTP);
csharp
// Install: dotnet add package Amazon.CDK.Lib
InstanceType instanceType;
var provider = NatProvider.InstanceV2(new NatInstanceProps {
InstanceType = instanceType,
DefaultAllowedTraffic = NatTrafficDirection.OUTBOUND_ONLY
});
new Vpc(this, "TheVPC", new VpcProps {
NatGatewayProvider = provider
});
provider.Connections.AllowFrom(Peer.Ipv4("1.2.3.4/8"), Port.HTTP);
go
// Install: go get github.com/aws/aws-cdk-go/awscdk/v2
var instanceType InstanceType
provider := ec2.NatProvider_InstanceV2(&NatInstanceProps{
InstanceType: InstanceType,
DefaultAllowedTraffic: ec2.NatTrafficDirection_OUTBOUND_ONLY,
})
ec2.NewVpc(this, jsii.String("TheVPC"), &VpcProps{
NatGatewayProvider: provider,
})
provider.connections.AllowFrom(ec2.Peer_Ipv4(jsii.String("1.2.3.4/8")), ec2.Port_HTTP())
Properties
associatePublicIpAddressoptionalbooleanassociate_public_ip_addressoptionalboolassociatePublicIpAddressoptionalBooleanAssociatePublicIpAddressoptionalboolAssociatePublicIpAddressoptional*bool#Whether to associate a public IP address to the primary network interface attached to this instance.
Default: undefined - No public IP address associated
creditSpecificationoptionalCpuCreditscredit_specificationoptionalCpuCreditscreditSpecificationoptionalCpuCreditsCreditSpecificationoptionalCpuCreditsCreditSpecificationoptionalCpuCredits#Specifying the CPU credit type for burstable EC2 instance types (T2, T3, T3a, etc).
Default: T2 instances are standard, while T3, T4g, and T3a instances are unlimited.
The unlimited CPU credit option is not supported for T3 instances with dedicated host (host) tenancy.
defaultAllowedTrafficoptionalNatTrafficDirectiondefault_allowed_trafficoptionalNatTrafficDirectiondefaultAllowedTrafficoptionalNatTrafficDirectionDefaultAllowedTrafficoptionalNatTrafficDirectionDefaultAllowedTrafficoptionalNatTrafficDirection#Direction to allow all traffic through the NAT instance by default.
Default: NatTrafficDirection.INBOUND_AND_OUTBOUND
notes
By default, inbound and outbound traffic is allowed.
If you set this to another value than INBOUND_AND_OUTBOUND, you must configure the NAT instance's security groups in another way, either by passing in a fully configured Security Group using the securityGroup property, or by configuring it using the .securityGroup or .connections members after passing the NAT Instance Provider to a Vpc.
instanceTypeInstanceTypeinstance_typeInstanceTypeinstanceTypeInstanceTypeInstanceTypeInstanceTypeInstanceTypeInstanceTyperequired#Instance type of the NAT instance.
keyNameoptionalstringkey_nameoptionalstrkeyNameoptionalStringKeyNameoptionalstringKeyNameoptional*stringdeprecated#- Use `keyPair` instead - https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2-readme.html#using-an-existing-ec2-key-pair
Default: No SSH access will be possible.
keyPairoptionalIKeyPairkey_pairoptionalIKeyPairkeyPairoptionalIKeyPairKeyPairoptionalIKeyPairKeyPairoptionalIKeyPair#The SSH keypair to grant access to the instance.
Default: No SSH access will be possible.
machineImageoptionalIMachineImagemachine_imageoptionalIMachineImagemachineImageoptionalIMachineImageMachineImageoptionalIMachineImageMachineImageoptionalIMachineImage#The machine image (AMI) to use.
Default: Latest NAT instance image
notes
By default, will do an AMI lookup for the latest NAT instance image.
If you have a specific AMI ID you want to use, pass a GenericLinuxImage. For example:
ts
ec2.NatProvider.instance({
instanceType: new ec2.InstanceType('t3.micro'),
machineImage: new ec2.GenericLinuxImage({
'us-east-2': 'ami-0f9c61b5a562a16af'
})
})
securityGroupoptionalISecurityGroupsecurity_groupoptionalISecurityGroupsecurityGroupoptionalISecurityGroupSecurityGroupoptionalISecurityGroupSecurityGroupoptionalISecurityGroupdeprecated#- Cannot create a new security group before the VPC is created, and cannot create the VPC without the NAT provider. Set {@link defaultAllowedTraffic } to {@link NatTrafficDirection.NONE } and use {@link NatInstanceProviderV2.gatewayInstances } to retrieve the instances on the fly and add security groups
Default: A new security group will be created
example
ts
const natGatewayProvider = ec2.NatProvider.instanceV2({
instanceType: new ec2.InstanceType('t3.small'),
defaultAllowedTraffic: ec2.NatTrafficDirection.NONE,
});
const vpc = new ec2.Vpc(this, 'Vpc', { natGatewayProvider });
const securityGroup = new ec2.SecurityGroup(this, 'SecurityGroup', {
vpc,
allowAllOutbound: false,
});
securityGroup.addEgressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443));
for (const gatewayInstance of natGatewayProvider.gatewayInstances) {
gatewayInstance.addSecurityGroup(securityGroup);
}
userDataoptionalUserDatauser_dataoptionalUserDatauserDataoptionalUserDataUserDataoptionalUserDataUserDataoptionalUserData#Custom user data to run on the NAT instances.
Default: UserData.forLinux().addCommands(...NatInstanceProviderV2.DEFAULT_USER_DATA_COMMANDS); - Appropriate user data commands to initialize and configure the NAT instances