This is the new *CloudFormation Template Reference Guide*. Please update your bookmarks and links. For help getting started with CloudFormation, see the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html).

# AWS::EC2::VerifiedAccessEndpoint
<a name="aws-resource-ec2-verifiedaccessendpoint"></a>

An AWS Verified Access endpoint specifies the application that AWS Verified Access provides access to. It must be attached to an AWS Verified Access group. An AWS Verified Access endpoint must also have an attached access policy before you attached it to a group.

## Syntax
<a name="aws-resource-ec2-verifiedaccessendpoint-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-resource-ec2-verifiedaccessendpoint-syntax.json"></a>

```
{
  "Type" : "AWS::EC2::VerifiedAccessEndpoint",
  "Properties" : {
      "[ApplicationDomain](#cfn-ec2-verifiedaccessendpoint-applicationdomain)" : String,
      "[AttachmentType](#cfn-ec2-verifiedaccessendpoint-attachmenttype)" : String,
      "[CidrOptions](#cfn-ec2-verifiedaccessendpoint-cidroptions)" : CidrOptions,
      "[Description](#cfn-ec2-verifiedaccessendpoint-description)" : String,
      "[DomainCertificateArn](#cfn-ec2-verifiedaccessendpoint-domaincertificatearn)" : String,
      "[EndpointDomainPrefix](#cfn-ec2-verifiedaccessendpoint-endpointdomainprefix)" : String,
      "[EndpointType](#cfn-ec2-verifiedaccessendpoint-endpointtype)" : String,
      "[LoadBalancerOptions](#cfn-ec2-verifiedaccessendpoint-loadbalanceroptions)" : LoadBalancerOptions,
      "[NetworkInterfaceOptions](#cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions)" : NetworkInterfaceOptions,
      "[PolicyDocument](#cfn-ec2-verifiedaccessendpoint-policydocument)" : String,
      "[PolicyEnabled](#cfn-ec2-verifiedaccessendpoint-policyenabled)" : Boolean,
      "[RdsOptions](#cfn-ec2-verifiedaccessendpoint-rdsoptions)" : RdsOptions,
      "[SecurityGroupIds](#cfn-ec2-verifiedaccessendpoint-securitygroupids)" : [ String, ... ],
      "[SseSpecification](#cfn-ec2-verifiedaccessendpoint-ssespecification)" : SseSpecification,
      "[Tags](#cfn-ec2-verifiedaccessendpoint-tags)" : [ Tag, ... ],
      "[VerifiedAccessGroupId](#cfn-ec2-verifiedaccessendpoint-verifiedaccessgroupid)" : String
    }
}
```

### YAML
<a name="aws-resource-ec2-verifiedaccessendpoint-syntax.yaml"></a>

```
Type: AWS::EC2::VerifiedAccessEndpoint
Properties:
  [ApplicationDomain](#cfn-ec2-verifiedaccessendpoint-applicationdomain): String
  [AttachmentType](#cfn-ec2-verifiedaccessendpoint-attachmenttype): String
  [CidrOptions](#cfn-ec2-verifiedaccessendpoint-cidroptions): 
    CidrOptions
  [Description](#cfn-ec2-verifiedaccessendpoint-description): String
  [DomainCertificateArn](#cfn-ec2-verifiedaccessendpoint-domaincertificatearn): String
  [EndpointDomainPrefix](#cfn-ec2-verifiedaccessendpoint-endpointdomainprefix): String
  [EndpointType](#cfn-ec2-verifiedaccessendpoint-endpointtype): String
  [LoadBalancerOptions](#cfn-ec2-verifiedaccessendpoint-loadbalanceroptions): 
    LoadBalancerOptions
  [NetworkInterfaceOptions](#cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions): 
    NetworkInterfaceOptions
  [PolicyDocument](#cfn-ec2-verifiedaccessendpoint-policydocument): String
  [PolicyEnabled](#cfn-ec2-verifiedaccessendpoint-policyenabled): Boolean
  [RdsOptions](#cfn-ec2-verifiedaccessendpoint-rdsoptions): 
    RdsOptions
  [SecurityGroupIds](#cfn-ec2-verifiedaccessendpoint-securitygroupids): 
    - String
  [SseSpecification](#cfn-ec2-verifiedaccessendpoint-ssespecification): 
    SseSpecification
  [Tags](#cfn-ec2-verifiedaccessendpoint-tags): 
    - Tag
  [VerifiedAccessGroupId](#cfn-ec2-verifiedaccessendpoint-verifiedaccessgroupid): String
```

## Properties
<a name="aws-resource-ec2-verifiedaccessendpoint-properties"></a>

`ApplicationDomain`  <a name="cfn-ec2-verifiedaccessendpoint-applicationdomain"></a>
The DNS name for users to reach your application.  
*Required*: No  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`AttachmentType`  <a name="cfn-ec2-verifiedaccessendpoint-attachmenttype"></a>
The type of attachment used to provide connectivity between the AWS Verified Access endpoint and the application.  
*Required*: Yes  
*Type*: String  
*Allowed values*: `vpc`  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`CidrOptions`  <a name="cfn-ec2-verifiedaccessendpoint-cidroptions"></a>
The options for a CIDR endpoint.  
*Required*: No  
*Type*: [CidrOptions](aws-properties-ec2-verifiedaccessendpoint-cidroptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Description`  <a name="cfn-ec2-verifiedaccessendpoint-description"></a>
A description for the AWS Verified Access endpoint.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`DomainCertificateArn`  <a name="cfn-ec2-verifiedaccessendpoint-domaincertificatearn"></a>
The ARN of a public TLS/SSL certificate imported into or created with ACM.  
*Required*: No  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`EndpointDomainPrefix`  <a name="cfn-ec2-verifiedaccessendpoint-endpointdomainprefix"></a>
A custom identifier that is prepended to the DNS name that is generated for the endpoint.  
*Required*: No  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`EndpointType`  <a name="cfn-ec2-verifiedaccessendpoint-endpointtype"></a>
The type of AWS Verified Access endpoint. Incoming application requests will be sent to an IP address, load balancer or a network interface depending on the endpoint type specified.  
*Required*: Yes  
*Type*: String  
*Allowed values*: `load-balancer | network-interface | rds | cidr`  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`LoadBalancerOptions`  <a name="cfn-ec2-verifiedaccessendpoint-loadbalanceroptions"></a>
The load balancer details if creating the AWS Verified Access endpoint as `load-balancer`type.  
*Required*: No  
*Type*: [LoadBalancerOptions](aws-properties-ec2-verifiedaccessendpoint-loadbalanceroptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`NetworkInterfaceOptions`  <a name="cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions"></a>
The options for network-interface type endpoint.  
*Required*: No  
*Type*: [NetworkInterfaceOptions](aws-properties-ec2-verifiedaccessendpoint-networkinterfaceoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`PolicyDocument`  <a name="cfn-ec2-verifiedaccessendpoint-policydocument"></a>
The Verified Access policy document.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`PolicyEnabled`  <a name="cfn-ec2-verifiedaccessendpoint-policyenabled"></a>
The status of the Verified Access policy.  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`RdsOptions`  <a name="cfn-ec2-verifiedaccessendpoint-rdsoptions"></a>
The options for an RDS endpoint.  
*Required*: No  
*Type*: [RdsOptions](aws-properties-ec2-verifiedaccessendpoint-rdsoptions.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SecurityGroupIds`  <a name="cfn-ec2-verifiedaccessendpoint-securitygroupids"></a>
The IDs of the security groups for the endpoint.  
*Required*: No  
*Type*: Array of String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`SseSpecification`  <a name="cfn-ec2-verifiedaccessendpoint-ssespecification"></a>
 The options for additional server side encryption.   
*Required*: No  
*Type*: [SseSpecification](aws-properties-ec2-verifiedaccessendpoint-ssespecification.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Tags`  <a name="cfn-ec2-verifiedaccessendpoint-tags"></a>
The tags.  
*Required*: No  
*Type*: Array of [Tag](aws-properties-ec2-verifiedaccessendpoint-tag.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`VerifiedAccessGroupId`  <a name="cfn-ec2-verifiedaccessendpoint-verifiedaccessgroupid"></a>
The ID of the AWS Verified Access group.  
*Required*: Yes  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

## Return values
<a name="aws-resource-ec2-verifiedaccessendpoint-return-values"></a>

### Ref
<a name="aws-resource-ec2-verifiedaccessendpoint-return-values-ref"></a>

When you pass the logical ID of this resource to the intrinsic `Ref` function, `Ref` returns the ID of the Verified Access endpoint.

For more information about using the `Ref` function, see [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html).

### Fn::GetAtt
<a name="aws-resource-ec2-verifiedaccessendpoint-return-values-fn--getatt"></a>

The `Fn::GetAtt` intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the `Fn::GetAtt` intrinsic function, see [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getatt.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-getatt.html).

#### 
<a name="aws-resource-ec2-verifiedaccessendpoint-return-values-fn--getatt-fn--getatt"></a>

`CreationTime`  <a name="CreationTime-fn::getatt"></a>
The creation time.

`DeviceValidationDomain`  <a name="DeviceValidationDomain-fn::getatt"></a>
Use this to construct the redirect URI to add to your OIDC provider's allow list.

`EndpointDomain`  <a name="EndpointDomain-fn::getatt"></a>
The DNS name generated for the endpoint.

`LastUpdatedTime`  <a name="LastUpdatedTime-fn::getatt"></a>
The last updated time.

`Status`  <a name="Status-fn::getatt"></a>
The endpoint status.

`VerifiedAccessEndpointId`  <a name="VerifiedAccessEndpointId-fn::getatt"></a>
The ID of the Verified Access endpoint.

`VerifiedAccessInstanceId`  <a name="VerifiedAccessInstanceId-fn::getatt"></a>
The instance identifier.

# AWS::EC2::VerifiedAccessEndpoint CidrOptions
<a name="aws-properties-ec2-verifiedaccessendpoint-cidroptions"></a>

Describes the CIDR options for a Verified Access endpoint.

## Syntax
<a name="aws-properties-ec2-verifiedaccessendpoint-cidroptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-ec2-verifiedaccessendpoint-cidroptions-syntax.json"></a>

```
{
  "[Cidr](#cfn-ec2-verifiedaccessendpoint-cidroptions-cidr)" : String,
  "[PortRanges](#cfn-ec2-verifiedaccessendpoint-cidroptions-portranges)" : [ PortRange, ... ],
  "[Protocol](#cfn-ec2-verifiedaccessendpoint-cidroptions-protocol)" : String,
  "[SubnetIds](#cfn-ec2-verifiedaccessendpoint-cidroptions-subnetids)" : [ String, ... ]
}
```

### YAML
<a name="aws-properties-ec2-verifiedaccessendpoint-cidroptions-syntax.yaml"></a>

```
  [Cidr](#cfn-ec2-verifiedaccessendpoint-cidroptions-cidr): String
  [PortRanges](#cfn-ec2-verifiedaccessendpoint-cidroptions-portranges): 
    - PortRange
  [Protocol](#cfn-ec2-verifiedaccessendpoint-cidroptions-protocol): String
  [SubnetIds](#cfn-ec2-verifiedaccessendpoint-cidroptions-subnetids): 
    - String
```

## Properties
<a name="aws-properties-ec2-verifiedaccessendpoint-cidroptions-properties"></a>

`Cidr`  <a name="cfn-ec2-verifiedaccessendpoint-cidroptions-cidr"></a>
The CIDR.  
*Required*: No  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`PortRanges`  <a name="cfn-ec2-verifiedaccessendpoint-cidroptions-portranges"></a>
The port ranges.  
*Required*: No  
*Type*: Array of [PortRange](aws-properties-ec2-verifiedaccessendpoint-portrange.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Protocol`  <a name="cfn-ec2-verifiedaccessendpoint-cidroptions-protocol"></a>
The protocol.  
*Required*: No  
*Type*: String  
*Allowed values*: `http | https | tcp`  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`SubnetIds`  <a name="cfn-ec2-verifiedaccessendpoint-cidroptions-subnetids"></a>
The IDs of the subnets.  
*Required*: No  
*Type*: Array of String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

# AWS::EC2::VerifiedAccessEndpoint LoadBalancerOptions
<a name="aws-properties-ec2-verifiedaccessendpoint-loadbalanceroptions"></a>

Describes the load balancer options when creating an AWS Verified Access endpoint using the `load-balancer` type.

## Syntax
<a name="aws-properties-ec2-verifiedaccessendpoint-loadbalanceroptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-ec2-verifiedaccessendpoint-loadbalanceroptions-syntax.json"></a>

```
{
  "[LoadBalancerArn](#cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-loadbalancerarn)" : String,
  "[Port](#cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-port)" : Integer,
  "[PortRanges](#cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-portranges)" : [ PortRange, ... ],
  "[Protocol](#cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-protocol)" : String,
  "[SubnetIds](#cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-subnetids)" : [ String, ... ]
}
```

### YAML
<a name="aws-properties-ec2-verifiedaccessendpoint-loadbalanceroptions-syntax.yaml"></a>

```
  [LoadBalancerArn](#cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-loadbalancerarn): String
  [Port](#cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-port): Integer
  [PortRanges](#cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-portranges): 
    - PortRange
  [Protocol](#cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-protocol): String
  [SubnetIds](#cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-subnetids): 
    - String
```

## Properties
<a name="aws-properties-ec2-verifiedaccessendpoint-loadbalanceroptions-properties"></a>

`LoadBalancerArn`  <a name="cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-loadbalancerarn"></a>
The ARN of the load balancer.  
*Required*: No  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`Port`  <a name="cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-port"></a>
The IP port number.  
*Required*: No  
*Type*: Integer  
*Minimum*: `1`  
*Maximum*: `65535`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`PortRanges`  <a name="cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-portranges"></a>
The port ranges.  
*Required*: No  
*Type*: Array of [PortRange](aws-properties-ec2-verifiedaccessendpoint-portrange.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Protocol`  <a name="cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-protocol"></a>
The IP protocol.  
*Required*: No  
*Type*: String  
*Allowed values*: `http | https | tcp`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SubnetIds`  <a name="cfn-ec2-verifiedaccessendpoint-loadbalanceroptions-subnetids"></a>
The IDs of the subnets. You can specify only one subnet per Availability Zone.  
*Required*: No  
*Type*: Array of String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::EC2::VerifiedAccessEndpoint NetworkInterfaceOptions
<a name="aws-properties-ec2-verifiedaccessendpoint-networkinterfaceoptions"></a>

Describes the network interface options when creating an AWS Verified Access endpoint using the `network-interface` type.

## Syntax
<a name="aws-properties-ec2-verifiedaccessendpoint-networkinterfaceoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-ec2-verifiedaccessendpoint-networkinterfaceoptions-syntax.json"></a>

```
{
  "[NetworkInterfaceId](#cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions-networkinterfaceid)" : String,
  "[Port](#cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions-port)" : Integer,
  "[PortRanges](#cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions-portranges)" : [ PortRange, ... ],
  "[Protocol](#cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions-protocol)" : String
}
```

### YAML
<a name="aws-properties-ec2-verifiedaccessendpoint-networkinterfaceoptions-syntax.yaml"></a>

```
  [NetworkInterfaceId](#cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions-networkinterfaceid): String
  [Port](#cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions-port): Integer
  [PortRanges](#cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions-portranges): 
    - PortRange
  [Protocol](#cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions-protocol): String
```

## Properties
<a name="aws-properties-ec2-verifiedaccessendpoint-networkinterfaceoptions-properties"></a>

`NetworkInterfaceId`  <a name="cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions-networkinterfaceid"></a>
The ID of the network interface.  
*Required*: No  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`Port`  <a name="cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions-port"></a>
The IP port number.  
*Required*: No  
*Type*: Integer  
*Minimum*: `1`  
*Maximum*: `65535`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`PortRanges`  <a name="cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions-portranges"></a>
The port ranges.  
*Required*: No  
*Type*: Array of [PortRange](aws-properties-ec2-verifiedaccessendpoint-portrange.md)  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Protocol`  <a name="cfn-ec2-verifiedaccessendpoint-networkinterfaceoptions-protocol"></a>
The IP protocol.  
*Required*: No  
*Type*: String  
*Allowed values*: `http | https | tcp`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::EC2::VerifiedAccessEndpoint PortRange
<a name="aws-properties-ec2-verifiedaccessendpoint-portrange"></a>

Describes the port range for a Verified Access endpoint.

## Syntax
<a name="aws-properties-ec2-verifiedaccessendpoint-portrange-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-ec2-verifiedaccessendpoint-portrange-syntax.json"></a>

```
{
  "[FromPort](#cfn-ec2-verifiedaccessendpoint-portrange-fromport)" : Integer,
  "[ToPort](#cfn-ec2-verifiedaccessendpoint-portrange-toport)" : Integer
}
```

### YAML
<a name="aws-properties-ec2-verifiedaccessendpoint-portrange-syntax.yaml"></a>

```
  [FromPort](#cfn-ec2-verifiedaccessendpoint-portrange-fromport): Integer
  [ToPort](#cfn-ec2-verifiedaccessendpoint-portrange-toport): Integer
```

## Properties
<a name="aws-properties-ec2-verifiedaccessendpoint-portrange-properties"></a>

`FromPort`  <a name="cfn-ec2-verifiedaccessendpoint-portrange-fromport"></a>
The start of the port range.  
*Required*: No  
*Type*: Integer  
*Minimum*: `1`  
*Maximum*: `65535`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`ToPort`  <a name="cfn-ec2-verifiedaccessendpoint-portrange-toport"></a>
The end of the port range.  
*Required*: No  
*Type*: Integer  
*Minimum*: `1`  
*Maximum*: `65535`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::EC2::VerifiedAccessEndpoint RdsOptions
<a name="aws-properties-ec2-verifiedaccessendpoint-rdsoptions"></a>

Describes the RDS options for a Verified Access endpoint.

## Syntax
<a name="aws-properties-ec2-verifiedaccessendpoint-rdsoptions-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-ec2-verifiedaccessendpoint-rdsoptions-syntax.json"></a>

```
{
  "[Port](#cfn-ec2-verifiedaccessendpoint-rdsoptions-port)" : Integer,
  "[Protocol](#cfn-ec2-verifiedaccessendpoint-rdsoptions-protocol)" : String,
  "[RdsDbClusterArn](#cfn-ec2-verifiedaccessendpoint-rdsoptions-rdsdbclusterarn)" : String,
  "[RdsDbInstanceArn](#cfn-ec2-verifiedaccessendpoint-rdsoptions-rdsdbinstancearn)" : String,
  "[RdsDbProxyArn](#cfn-ec2-verifiedaccessendpoint-rdsoptions-rdsdbproxyarn)" : String,
  "[RdsEndpoint](#cfn-ec2-verifiedaccessendpoint-rdsoptions-rdsendpoint)" : String,
  "[SubnetIds](#cfn-ec2-verifiedaccessendpoint-rdsoptions-subnetids)" : [ String, ... ]
}
```

### YAML
<a name="aws-properties-ec2-verifiedaccessendpoint-rdsoptions-syntax.yaml"></a>

```
  [Port](#cfn-ec2-verifiedaccessendpoint-rdsoptions-port): Integer
  [Protocol](#cfn-ec2-verifiedaccessendpoint-rdsoptions-protocol): String
  [RdsDbClusterArn](#cfn-ec2-verifiedaccessendpoint-rdsoptions-rdsdbclusterarn): String
  [RdsDbInstanceArn](#cfn-ec2-verifiedaccessendpoint-rdsoptions-rdsdbinstancearn): String
  [RdsDbProxyArn](#cfn-ec2-verifiedaccessendpoint-rdsoptions-rdsdbproxyarn): String
  [RdsEndpoint](#cfn-ec2-verifiedaccessendpoint-rdsoptions-rdsendpoint): String
  [SubnetIds](#cfn-ec2-verifiedaccessendpoint-rdsoptions-subnetids): 
    - String
```

## Properties
<a name="aws-properties-ec2-verifiedaccessendpoint-rdsoptions-properties"></a>

`Port`  <a name="cfn-ec2-verifiedaccessendpoint-rdsoptions-port"></a>
The port.  
*Required*: No  
*Type*: Integer  
*Minimum*: `1`  
*Maximum*: `65535`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Protocol`  <a name="cfn-ec2-verifiedaccessendpoint-rdsoptions-protocol"></a>
The protocol.  
*Required*: No  
*Type*: String  
*Allowed values*: `http | https | tcp`  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`RdsDbClusterArn`  <a name="cfn-ec2-verifiedaccessendpoint-rdsoptions-rdsdbclusterarn"></a>
The ARN of the DB cluster.  
*Required*: No  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`RdsDbInstanceArn`  <a name="cfn-ec2-verifiedaccessendpoint-rdsoptions-rdsdbinstancearn"></a>
The ARN of the RDS instance.  
*Required*: No  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`RdsDbProxyArn`  <a name="cfn-ec2-verifiedaccessendpoint-rdsoptions-rdsdbproxyarn"></a>
The ARN of the RDS proxy.  
*Required*: No  
*Type*: String  
*Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement)

`RdsEndpoint`  <a name="cfn-ec2-verifiedaccessendpoint-rdsoptions-rdsendpoint"></a>
The RDS endpoint.  
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`SubnetIds`  <a name="cfn-ec2-verifiedaccessendpoint-rdsoptions-subnetids"></a>
The IDs of the subnets. You can specify only one subnet per Availability Zone.  
*Required*: No  
*Type*: Array of String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::EC2::VerifiedAccessEndpoint SseSpecification
<a name="aws-properties-ec2-verifiedaccessendpoint-ssespecification"></a>

AWS Verified Access provides server side encryption by default to data at rest using AWS-owned KMS keys. You also have the option of using customer managed KMS keys, which can be specified using the options below. 

## Syntax
<a name="aws-properties-ec2-verifiedaccessendpoint-ssespecification-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-ec2-verifiedaccessendpoint-ssespecification-syntax.json"></a>

```
{
  "[CustomerManagedKeyEnabled](#cfn-ec2-verifiedaccessendpoint-ssespecification-customermanagedkeyenabled)" : Boolean,
  "[KmsKeyArn](#cfn-ec2-verifiedaccessendpoint-ssespecification-kmskeyarn)" : String
}
```

### YAML
<a name="aws-properties-ec2-verifiedaccessendpoint-ssespecification-syntax.yaml"></a>

```
  [CustomerManagedKeyEnabled](#cfn-ec2-verifiedaccessendpoint-ssespecification-customermanagedkeyenabled): Boolean
  [KmsKeyArn](#cfn-ec2-verifiedaccessendpoint-ssespecification-kmskeyarn): String
```

## Properties
<a name="aws-properties-ec2-verifiedaccessendpoint-ssespecification-properties"></a>

`CustomerManagedKeyEnabled`  <a name="cfn-ec2-verifiedaccessendpoint-ssespecification-customermanagedkeyenabled"></a>
 Enable or disable the use of customer managed KMS keys for server side encryption.   
Valid values: `True` \$1 `False`  
*Required*: No  
*Type*: Boolean  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`KmsKeyArn`  <a name="cfn-ec2-verifiedaccessendpoint-ssespecification-kmskeyarn"></a>
 The ARN of the KMS key.   
*Required*: No  
*Type*: String  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

# AWS::EC2::VerifiedAccessEndpoint Tag
<a name="aws-properties-ec2-verifiedaccessendpoint-tag"></a>

Specifies a tag. For more information, see [Resource tags](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html).

## Syntax
<a name="aws-properties-ec2-verifiedaccessendpoint-tag-syntax"></a>

To declare this entity in your CloudFormation template, use the following syntax:

### JSON
<a name="aws-properties-ec2-verifiedaccessendpoint-tag-syntax.json"></a>

```
{
  "[Key](#cfn-ec2-verifiedaccessendpoint-tag-key)" : String,
  "[Value](#cfn-ec2-verifiedaccessendpoint-tag-value)" : String
}
```

### YAML
<a name="aws-properties-ec2-verifiedaccessendpoint-tag-syntax.yaml"></a>

```
  [Key](#cfn-ec2-verifiedaccessendpoint-tag-key): String
  [Value](#cfn-ec2-verifiedaccessendpoint-tag-value): String
```

## Properties
<a name="aws-properties-ec2-verifiedaccessendpoint-tag-properties"></a>

`Key`  <a name="cfn-ec2-verifiedaccessendpoint-tag-key"></a>
The tag key.  
*Required*: Yes  
*Type*: String  
*Minimum*: `1`  
*Maximum*: `128`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

`Value`  <a name="cfn-ec2-verifiedaccessendpoint-tag-value"></a>
The tag value.  
*Required*: Yes  
*Type*: String  
*Minimum*: `0`  
*Maximum*: `256`  
*Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)

## Examples
<a name="aws-properties-ec2-verifiedaccessendpoint-tag--examples"></a>

### 
<a name="aws-properties-ec2-verifiedaccessendpoint-tag--examples--"></a>

This example specifies two tags for the Verified Access endpoint.

#### JSON
<a name="aws-properties-ec2-verifiedaccessendpoint-tag--examples----json"></a>

```
"Tags" : [
   {
      "Key" : "key1",
      "Value" : "value1"
   },
   {
      "Key" : "key2",
      "Value" : "value2"
   }
]
```

#### YAML
<a name="aws-properties-ec2-verifiedaccessendpoint-tag--examples----yaml"></a>

```
Tags: 
  - Key: "key1"
    Value: "value1"
  - Key: "key2"
    Value: "value2"
```