Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. AWS
  4. API Docs
  5. ec2
  6. VpcEndpoint
Viewing docs for AWS v7.53.0
published on Monday, Nov 2, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

aws.ec2.VpcEndpoint

aws logo aws logo
Viewing docs for AWS v7.53.0
published on Monday, Nov 2, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-aws

    Provides a VPC Endpoint resource.

    NOTE on VPC Endpoints and VPC Endpoint Associations: The provider provides both standalone VPC Endpoint Associations for Route Tables - (an association between a VPC endpoint and a single routeTableId), Security Groups - (an association between a VPC endpoint and a single securityGroupId), and Subnets - (an association between a VPC endpoint and a single subnetId) and a VPC Endpoint resource with routeTableIds and subnetIds attributes. Do not use the same resource ID in both a VPC Endpoint resource and a VPC Endpoint Association resource. Doing so will cause a conflict of associations and will overwrite the association.

    Example Usage

    Basic

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const s3 = new aws.ec2.VpcEndpoint("s3", {
    vpcId: main.id,
    serviceName: "com.amazonaws.us-west-2.s3",
});

    import pulumi
import pulumi_aws as aws

s3 = aws.ec2.VpcEndpoint("s3",
    vpc_id=main["id"],
    service_name="com.amazonaws.us-west-2.s3")

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ec2.NewVpcEndpoint(ctx, "s3", &ec2.VpcEndpointArgs{
			VpcId:       pulumi.Any(main.Id),
			ServiceName: pulumi.String("com.amazonaws.us-west-2.s3"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var s3 = new Aws.Ec2.VpcEndpoint("s3", new()
    {
        VpcId = main.Id,
        ServiceName = "com.amazonaws.us-west-2.s3",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.ec2.VpcEndpoint;
import com.pulumi.aws.ec2.VpcEndpointArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var s3 = new VpcEndpoint("s3", VpcEndpointArgs.builder()
            .vpcId(main.get("id"))
            .serviceName("com.amazonaws.us-west-2.s3")
            .build());

    }
}

    resources:
  s3:
    type: aws:ec2:VpcEndpoint
    properties:
      vpcId: ${main.id}
      serviceName: com.amazonaws.us-west-2.s3

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_ec2_vpc_endpoint" "s3" {
  lifecycle {
    create_before_destroy = true
  }
  vpc_id       = main.id
  service_name = "com.amazonaws.us-west-2.s3"
}

    Basic w/ Tags

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const s3 = new aws.ec2.VpcEndpoint("s3", {
    vpcId: main.id,
    serviceName: "com.amazonaws.us-west-2.s3",
    tags: {
        Environment: "test",
    },
});

    import pulumi
import pulumi_aws as aws

s3 = aws.ec2.VpcEndpoint("s3",
    vpc_id=main["id"],
    service_name="com.amazonaws.us-west-2.s3",
    tags={
        "Environment": "test",
    })

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ec2.NewVpcEndpoint(ctx, "s3", &ec2.VpcEndpointArgs{
			VpcId:       pulumi.Any(main.Id),
			ServiceName: pulumi.String("com.amazonaws.us-west-2.s3"),
			Tags: pulumi.StringMap{
				"Environment": pulumi.String("test"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var s3 = new Aws.Ec2.VpcEndpoint("s3", new()
    {
        VpcId = main.Id,
        ServiceName = "com.amazonaws.us-west-2.s3",
        Tags = 
        {
            { "Environment", "test" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.ec2.VpcEndpoint;
import com.pulumi.aws.ec2.VpcEndpointArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var s3 = new VpcEndpoint("s3", VpcEndpointArgs.builder()
            .vpcId(main.get("id"))
            .serviceName("com.amazonaws.us-west-2.s3")
            .tags(Map.of("Environment", "test"))
            .build());

    }
}

    resources:
  s3:
    type: aws:ec2:VpcEndpoint
    properties:
      vpcId: ${main.id}
      serviceName: com.amazonaws.us-west-2.s3
      tags:
        Environment: test

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_ec2_vpc_endpoint" "s3" {
  lifecycle {
    create_before_destroy = true
  }
  vpc_id       = main.id
  service_name = "com.amazonaws.us-west-2.s3"
  tags = {
    "Environment" = "test"
  }
}

    Cross-region enabled AWS services

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const s3 = new aws.ec2.VpcEndpoint("s3", {
    region: "us-west-2",
    vpcId: main.id,
    serviceName: "com.amazonaws.us-east-2.s3",
    serviceRegion: "us-east-2",
    tags: {
        Environment: "test",
    },
});

    import pulumi
import pulumi_aws as aws

s3 = aws.ec2.VpcEndpoint("s3",
    region="us-west-2",
    vpc_id=main["id"],
    service_name="com.amazonaws.us-east-2.s3",
    service_region="us-east-2",
    tags={
        "Environment": "test",
    })

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ec2.NewVpcEndpoint(ctx, "s3", &ec2.VpcEndpointArgs{
			Region:        pulumi.String("us-west-2"),
			VpcId:         pulumi.Any(main.Id),
			ServiceName:   pulumi.String("com.amazonaws.us-east-2.s3"),
			ServiceRegion: pulumi.String("us-east-2"),
			Tags: pulumi.StringMap{
				"Environment": pulumi.String("test"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var s3 = new Aws.Ec2.VpcEndpoint("s3", new()
    {
        Region = "us-west-2",
        VpcId = main.Id,
        ServiceName = "com.amazonaws.us-east-2.s3",
        ServiceRegion = "us-east-2",
        Tags = 
        {
            { "Environment", "test" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.ec2.VpcEndpoint;
import com.pulumi.aws.ec2.VpcEndpointArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var s3 = new VpcEndpoint("s3", VpcEndpointArgs.builder()
            .region("us-west-2")
            .vpcId(main.get("id"))
            .serviceName("com.amazonaws.us-east-2.s3")
            .serviceRegion("us-east-2")
            .tags(Map.of("Environment", "test"))
            .build());

    }
}

    resources:
  s3:
    type: aws:ec2:VpcEndpoint
    properties:
      region: us-west-2
      vpcId: ${main.id}
      serviceName: com.amazonaws.us-east-2.s3
      serviceRegion: us-east-2
      tags:
        Environment: test

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_ec2_vpc_endpoint" "s3" {
  lifecycle {
    create_before_destroy = true
  }
  region         = "us-west-2"
  vpc_id         = main.id
  service_name   = "com.amazonaws.us-east-2.s3"
  service_region = "us-east-2"
  tags = {
    "Environment" = "test"
  }
}

    Interface Endpoint Type

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const ec2 = new aws.ec2.VpcEndpoint("ec2", {
    vpcId: main.id,
    serviceName: "com.amazonaws.us-west-2.ec2",
    vpcEndpointType: "Interface",
    securityGroupIds: [sg1.id],
    privateDnsEnabled: true,
});

    import pulumi
import pulumi_aws as aws

ec2 = aws.ec2.VpcEndpoint("ec2",
    vpc_id=main["id"],
    service_name="com.amazonaws.us-west-2.ec2",
    vpc_endpoint_type="Interface",
    security_group_ids=[sg1["id"]],
    private_dns_enabled=True)

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ec2.NewVpcEndpoint(ctx, "ec2", &ec2.VpcEndpointArgs{
			VpcId:           pulumi.Any(main.Id),
			ServiceName:     pulumi.String("com.amazonaws.us-west-2.ec2"),
			VpcEndpointType: pulumi.String("Interface"),
			SecurityGroupIds: pulumi.StringArray{
				sg1.Id,
			},
			PrivateDnsEnabled: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var ec2 = new Aws.Ec2.VpcEndpoint("ec2", new()
    {
        VpcId = main.Id,
        ServiceName = "com.amazonaws.us-west-2.ec2",
        VpcEndpointType = "Interface",
        SecurityGroupIds = new[]
        {
            sg1.Id,
        },
        PrivateDnsEnabled = true,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.ec2.VpcEndpoint;
import com.pulumi.aws.ec2.VpcEndpointArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var ec2 = new VpcEndpoint("ec2", VpcEndpointArgs.builder()
            .vpcId(main.get("id"))
            .serviceName("com.amazonaws.us-west-2.ec2")
            .vpcEndpointType("Interface")
            .securityGroupIds(sg1.get("id"))
            .privateDnsEnabled(true)
            .build());

    }
}

    resources:
  ec2:
    type: aws:ec2:VpcEndpoint
    properties:
      vpcId: ${main.id}
      serviceName: com.amazonaws.us-west-2.ec2
      vpcEndpointType: Interface
      securityGroupIds:
        - ${sg1.id}
      privateDnsEnabled: true

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_ec2_vpc_endpoint" "ec2" {
  lifecycle {
    create_before_destroy = true
  }
  vpc_id              = main.id
  service_name        = "com.amazonaws.us-west-2.ec2"
  vpc_endpoint_type   = "Interface"
  security_group_ids  = [sg1.id]
  private_dns_enabled = true
}

    Interface Endpoint Type with User-Defined IP Address

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const ec2 = new aws.ec2.VpcEndpoint("ec2", {
    subnetConfigurations: [
        {
            ipv4: "10.0.1.10",
            subnetId: example1.id,
        },
        {
            ipv4: "10.0.2.10",
            subnetId: example2.id,
        },
    ],
    vpcId: example.id,
    serviceName: "com.amazonaws.us-west-2.ec2",
    vpcEndpointType: "Interface",
    subnetIds: [
        example1.id,
        example2.id,
    ],
});

    import pulumi
import pulumi_aws as aws

ec2 = aws.ec2.VpcEndpoint("ec2",
    subnet_configurations=[
        {
            "ipv4": "10.0.1.10",
            "subnet_id": example1["id"],
        },
        {
            "ipv4": "10.0.2.10",
            "subnet_id": example2["id"],
        },
    ],
    vpc_id=example["id"],
    service_name="com.amazonaws.us-west-2.ec2",
    vpc_endpoint_type="Interface",
    subnet_ids=[
        example1["id"],
        example2["id"],
    ])

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ec2.NewVpcEndpoint(ctx, "ec2", &ec2.VpcEndpointArgs{
			SubnetConfigurations: ec2.VpcEndpointSubnetConfigurationArray{
				&ec2.VpcEndpointSubnetConfigurationArgs{
					Ipv4:     pulumi.String("10.0.1.10"),
					SubnetId: pulumi.Any(example1.Id),
				},
				&ec2.VpcEndpointSubnetConfigurationArgs{
					Ipv4:     pulumi.String("10.0.2.10"),
					SubnetId: pulumi.Any(example2.Id),
				},
			},
			VpcId:           pulumi.Any(example.Id),
			ServiceName:     pulumi.String("com.amazonaws.us-west-2.ec2"),
			VpcEndpointType: pulumi.String("Interface"),
			SubnetIds: pulumi.StringArray{
				example1.Id,
				example2.Id,
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var ec2 = new Aws.Ec2.VpcEndpoint("ec2", new()
    {
        SubnetConfigurations = new[]
        {
            new Aws.Ec2.Inputs.VpcEndpointSubnetConfigurationArgs
            {
                Ipv4 = "10.0.1.10",
                SubnetId = example1.Id,
            },
            new Aws.Ec2.Inputs.VpcEndpointSubnetConfigurationArgs
            {
                Ipv4 = "10.0.2.10",
                SubnetId = example2.Id,
            },
        },
        VpcId = example.Id,
        ServiceName = "com.amazonaws.us-west-2.ec2",
        VpcEndpointType = "Interface",
        SubnetIds = new[]
        {
            example1.Id,
            example2.Id,
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.ec2.VpcEndpoint;
import com.pulumi.aws.ec2.VpcEndpointArgs;
import com.pulumi.aws.ec2.inputs.VpcEndpointSubnetConfigurationArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var ec2 = new VpcEndpoint("ec2", VpcEndpointArgs.builder()
            .subnetConfigurations(            
                VpcEndpointSubnetConfigurationArgs.builder()
                    .ipv4("10.0.1.10")
                    .subnetId(example1.get("id"))
                    .build(),
                VpcEndpointSubnetConfigurationArgs.builder()
                    .ipv4("10.0.2.10")
                    .subnetId(example2.get("id"))
                    .build())
            .vpcId(example.get("id"))
            .serviceName("com.amazonaws.us-west-2.ec2")
            .vpcEndpointType("Interface")
            .subnetIds(            
                example1.get("id"),
                example2.get("id"))
            .build());

    }
}

    resources:
  ec2:
    type: aws:ec2:VpcEndpoint
    properties:
      subnetConfigurations:
        - ipv4: 10.0.1.10
          subnetId: ${example1.id}
        - ipv4: 10.0.2.10
          subnetId: ${example2.id}
      vpcId: ${example.id}
      serviceName: com.amazonaws.us-west-2.ec2
      vpcEndpointType: Interface
      subnetIds:
        - ${example1.id}
        - ${example2.id}

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_ec2_vpc_endpoint" "ec2" {
  lifecycle {
    create_before_destroy = true
  }
  subnet_configurations {
    ipv4      = "10.0.1.10"
    subnet_id = example1.id
  }
  subnet_configurations {
    ipv4      = "10.0.2.10"
    subnet_id = example2.id
  }
  vpc_id            = example.id
  service_name      = "com.amazonaws.us-west-2.ec2"
  vpc_endpoint_type = "Interface"
  subnet_ids        = [example1.id, example2.id]
}

    Gateway Load Balancer Endpoint Type

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const current = aws.getCallerIdentity({});
const example = new aws.ec2.VpcEndpointService("example", {
    acceptanceRequired: false,
    allowedPrincipals: [current.then(current => current.arn)],
    gatewayLoadBalancerArns: [exampleAwsLb.arn],
});
const exampleVpcEndpoint = new aws.ec2.VpcEndpoint("example", {
    serviceName: example.serviceName,
    subnetIds: [exampleAwsSubnet.id],
    vpcEndpointType: example.serviceType,
    vpcId: exampleAwsVpc.id,
});

    import pulumi
import pulumi_aws as aws

current = aws.get_caller_identity()
example = aws.ec2.VpcEndpointService("example",
    acceptance_required=False,
    allowed_principals=[current.arn],
    gateway_load_balancer_arns=[example_aws_lb["arn"]])
example_vpc_endpoint = aws.ec2.VpcEndpoint("example",
    service_name=example.service_name,
    subnet_ids=[example_aws_subnet["id"]],
    vpc_endpoint_type=example.service_type,
    vpc_id=example_aws_vpc["id"])

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		current, err := aws.GetCallerIdentity(ctx, &aws.GetCallerIdentityArgs{}, nil)
		if err != nil {
			return err
		}
		example, err := ec2.NewVpcEndpointService(ctx, "example", &ec2.VpcEndpointServiceArgs{
			AcceptanceRequired: pulumi.Bool(false),
			AllowedPrincipals: pulumi.StringArray{
				pulumi.String(current.Arn),
			},
			GatewayLoadBalancerArns: pulumi.StringArray{
				exampleAwsLb.Arn,
			},
		})
		if err != nil {
			return err
		}
		_, err = ec2.NewVpcEndpoint(ctx, "example", &ec2.VpcEndpointArgs{
			ServiceName: example.ServiceName,
			SubnetIds: pulumi.StringArray{
				exampleAwsSubnet.Id,
			},
			VpcEndpointType: example.ServiceType,
			VpcId:           pulumi.Any(exampleAwsVpc.Id),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var current = Aws.GetCallerIdentity.Invoke();

    var example = new Aws.Ec2.VpcEndpointService("example", new()
    {
        AcceptanceRequired = false,
        AllowedPrincipals = new[]
        {
            current.Apply(getCallerIdentityResult => getCallerIdentityResult.Arn),
        },
        GatewayLoadBalancerArns = new[]
        {
            exampleAwsLb.Arn,
        },
    });

    var exampleVpcEndpoint = new Aws.Ec2.VpcEndpoint("example", new()
    {
        ServiceName = example.ServiceName,
        SubnetIds = new[]
        {
            exampleAwsSubnet.Id,
        },
        VpcEndpointType = example.ServiceType,
        VpcId = exampleAwsVpc.Id,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.AwsFunctions;
import com.pulumi.aws.inputs.GetCallerIdentityArgs;
import com.pulumi.aws.ec2.VpcEndpointService;
import com.pulumi.aws.ec2.VpcEndpointServiceArgs;
import com.pulumi.aws.ec2.VpcEndpoint;
import com.pulumi.aws.ec2.VpcEndpointArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        final var current = AwsFunctions.getCallerIdentity(GetCallerIdentityArgs.builder()
            .build());

        var example = new VpcEndpointService("example", VpcEndpointServiceArgs.builder()
            .acceptanceRequired(false)
            .allowedPrincipals(current.arn())
            .gatewayLoadBalancerArns(exampleAwsLb.get("arn"))
            .build());

        var exampleVpcEndpoint = new VpcEndpoint("exampleVpcEndpoint", VpcEndpointArgs.builder()
            .serviceName(example.serviceName())
            .subnetIds(exampleAwsSubnet.get("id"))
            .vpcEndpointType(example.serviceType())
            .vpcId(exampleAwsVpc.get("id"))
            .build());

    }
}

    resources:
  example:
    type: aws:ec2:VpcEndpointService
    properties:
      acceptanceRequired: false
      allowedPrincipals:
        - ${current.arn}
      gatewayLoadBalancerArns:
        - ${exampleAwsLb.arn}
  exampleVpcEndpoint:
    type: aws:ec2:VpcEndpoint
    name: example
    properties:
      serviceName: ${example.serviceName}
      subnetIds:
        - ${exampleAwsSubnet.id}
      vpcEndpointType: ${example.serviceType}
      vpcId: ${exampleAwsVpc.id}
variables:
  current:
    fn::invoke:
      function: aws:getCallerIdentity
      arguments: {}

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_caller_identity" "current" {
}

resource "aws_ec2_vpc_endpoint_service" "example" {
  lifecycle {
    create_before_destroy = true
  }
  acceptance_required        = false
  allowed_principals         = [data.aws_caller_identity.current.arn]
  gateway_load_balancer_arns = [exampleAwsLb.arn]
}
resource "aws_ec2_vpc_endpoint" "example" {
  lifecycle {
    create_before_destroy = true
  }
  service_name      = aws_ec2_vpc_endpoint_service.example.service_name
  subnet_ids        = [exampleAwsSubnet.id]
  vpc_endpoint_type = aws_ec2_vpc_endpoint_service.example.service_type
  vpc_id            = exampleAwsVpc.id
}

    VPC Lattice Resource Configuration Endpoint Type

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.ec2.VpcEndpoint("example", {
    resourceConfigurationArn: exampleAwsVpclatticeResourceConfiguration.arn,
    subnetIds: [exampleAwsSubnet.id],
    vpcEndpointType: "Resource",
    vpcId: exampleAwsVpc.id,
});

    import pulumi
import pulumi_aws as aws

example = aws.ec2.VpcEndpoint("example",
    resource_configuration_arn=example_aws_vpclattice_resource_configuration["arn"],
    subnet_ids=[example_aws_subnet["id"]],
    vpc_endpoint_type="Resource",
    vpc_id=example_aws_vpc["id"])

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ec2.NewVpcEndpoint(ctx, "example", &ec2.VpcEndpointArgs{
			ResourceConfigurationArn: pulumi.Any(exampleAwsVpclatticeResourceConfiguration.Arn),
			SubnetIds: pulumi.StringArray{
				exampleAwsSubnet.Id,
			},
			VpcEndpointType: pulumi.String("Resource"),
			VpcId:           pulumi.Any(exampleAwsVpc.Id),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Ec2.VpcEndpoint("example", new()
    {
        ResourceConfigurationArn = exampleAwsVpclatticeResourceConfiguration.Arn,
        SubnetIds = new[]
        {
            exampleAwsSubnet.Id,
        },
        VpcEndpointType = "Resource",
        VpcId = exampleAwsVpc.Id,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.ec2.VpcEndpoint;
import com.pulumi.aws.ec2.VpcEndpointArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new VpcEndpoint("example", VpcEndpointArgs.builder()
            .resourceConfigurationArn(exampleAwsVpclatticeResourceConfiguration.get("arn"))
            .subnetIds(exampleAwsSubnet.get("id"))
            .vpcEndpointType("Resource")
            .vpcId(exampleAwsVpc.get("id"))
            .build());

    }
}

    resources:
  example:
    type: aws:ec2:VpcEndpoint
    properties:
      resourceConfigurationArn: ${exampleAwsVpclatticeResourceConfiguration.arn}
      subnetIds:
        - ${exampleAwsSubnet.id}
      vpcEndpointType: Resource
      vpcId: ${exampleAwsVpc.id}

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_ec2_vpc_endpoint" "example" {
  lifecycle {
    create_before_destroy = true
  }
  resource_configuration_arn = exampleAwsVpclatticeResourceConfiguration.arn
  subnet_ids                 = [exampleAwsSubnet.id]
  vpc_endpoint_type          = "Resource"
  vpc_id                     = exampleAwsVpc.id
}

    VPC Lattice Service Network Endpoint Type

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.ec2.VpcEndpoint("example", {
    serviceNetworkArn: exampleAwsVpclatticeServiceNetwork.arn,
    subnetIds: [exampleAwsSubnet.id],
    vpcEndpointType: "ServiceNetwork",
    vpcId: exampleAwsVpc.id,
});

    import pulumi
import pulumi_aws as aws

example = aws.ec2.VpcEndpoint("example",
    service_network_arn=example_aws_vpclattice_service_network["arn"],
    subnet_ids=[example_aws_subnet["id"]],
    vpc_endpoint_type="ServiceNetwork",
    vpc_id=example_aws_vpc["id"])

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ec2.NewVpcEndpoint(ctx, "example", &ec2.VpcEndpointArgs{
			ServiceNetworkArn: pulumi.Any(exampleAwsVpclatticeServiceNetwork.Arn),
			SubnetIds: pulumi.StringArray{
				exampleAwsSubnet.Id,
			},
			VpcEndpointType: pulumi.String("ServiceNetwork"),
			VpcId:           pulumi.Any(exampleAwsVpc.Id),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Ec2.VpcEndpoint("example", new()
    {
        ServiceNetworkArn = exampleAwsVpclatticeServiceNetwork.Arn,
        SubnetIds = new[]
        {
            exampleAwsSubnet.Id,
        },
        VpcEndpointType = "ServiceNetwork",
        VpcId = exampleAwsVpc.Id,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.ec2.VpcEndpoint;
import com.pulumi.aws.ec2.VpcEndpointArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new VpcEndpoint("example", VpcEndpointArgs.builder()
            .serviceNetworkArn(exampleAwsVpclatticeServiceNetwork.get("arn"))
            .subnetIds(exampleAwsSubnet.get("id"))
            .vpcEndpointType("ServiceNetwork")
            .vpcId(exampleAwsVpc.get("id"))
            .build());

    }
}

    resources:
  example:
    type: aws:ec2:VpcEndpoint
    properties:
      serviceNetworkArn: ${exampleAwsVpclatticeServiceNetwork.arn}
      subnetIds:
        - ${exampleAwsSubnet.id}
      vpcEndpointType: ServiceNetwork
      vpcId: ${exampleAwsVpc.id}

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_ec2_vpc_endpoint" "example" {
  lifecycle {
    create_before_destroy = true
  }
  service_network_arn = exampleAwsVpclatticeServiceNetwork.arn
  subnet_ids          = [exampleAwsSubnet.id]
  vpc_endpoint_type   = "ServiceNetwork"
  vpc_id              = exampleAwsVpc.id
}

    VPC Lattice Tunnel Endpoint Type

    A Tunnel endpoint connects to exactly one CIDR type aws.vpclattice.ResourceConfiguration, and consumers must send GENEVE-encapsulated traffic (UDP port 6081) to it. See Access a network segment through a tunnel VPC endpoint.

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.ec2.VpcEndpoint("example", {
    resourceConfigurationArn: exampleAwsVpclatticeResourceConfiguration.arn,
    securityGroupIds: [exampleAwsSecurityGroup.id],
    subnetIds: [
        example1.id,
        example2.id,
    ],
    vpcEndpointType: "Tunnel",
    vpcId: exampleAwsVpc.id,
});

    import pulumi
import pulumi_aws as aws

example = aws.ec2.VpcEndpoint("example",
    resource_configuration_arn=example_aws_vpclattice_resource_configuration["arn"],
    security_group_ids=[example_aws_security_group["id"]],
    subnet_ids=[
        example1["id"],
        example2["id"],
    ],
    vpc_endpoint_type="Tunnel",
    vpc_id=example_aws_vpc["id"])

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ec2.NewVpcEndpoint(ctx, "example", &ec2.VpcEndpointArgs{
			ResourceConfigurationArn: pulumi.Any(exampleAwsVpclatticeResourceConfiguration.Arn),
			SecurityGroupIds: pulumi.StringArray{
				exampleAwsSecurityGroup.Id,
			},
			SubnetIds: pulumi.StringArray{
				example1.Id,
				example2.Id,
			},
			VpcEndpointType: pulumi.String("Tunnel"),
			VpcId:           pulumi.Any(exampleAwsVpc.Id),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.Ec2.VpcEndpoint("example", new()
    {
        ResourceConfigurationArn = exampleAwsVpclatticeResourceConfiguration.Arn,
        SecurityGroupIds = new[]
        {
            exampleAwsSecurityGroup.Id,
        },
        SubnetIds = new[]
        {
            example1.Id,
            example2.Id,
        },
        VpcEndpointType = "Tunnel",
        VpcId = exampleAwsVpc.Id,
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.ec2.VpcEndpoint;
import com.pulumi.aws.ec2.VpcEndpointArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new VpcEndpoint("example", VpcEndpointArgs.builder()
            .resourceConfigurationArn(exampleAwsVpclatticeResourceConfiguration.get("arn"))
            .securityGroupIds(exampleAwsSecurityGroup.get("id"))
            .subnetIds(            
                example1.get("id"),
                example2.get("id"))
            .vpcEndpointType("Tunnel")
            .vpcId(exampleAwsVpc.get("id"))
            .build());

    }
}

    resources:
  example:
    type: aws:ec2:VpcEndpoint
    properties:
      resourceConfigurationArn: ${exampleAwsVpclatticeResourceConfiguration.arn}
      securityGroupIds:
        - ${exampleAwsSecurityGroup.id}
      subnetIds:
        - ${example1.id}
        - ${example2.id}
      vpcEndpointType: Tunnel
      vpcId: ${exampleAwsVpc.id}

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_ec2_vpc_endpoint" "example" {
  lifecycle {
    create_before_destroy = true
  }
  resource_configuration_arn = exampleAwsVpclatticeResourceConfiguration.arn
  security_group_ids         = [exampleAwsSecurityGroup.id]
  subnet_ids                 = [example1.id, example2.id]
  vpc_endpoint_type          = "Tunnel"
  vpc_id                     = exampleAwsVpc.id
}

    Non-AWS Service

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const ptfeService = new aws.ec2.VpcEndpoint("ptfe_service", {
    vpcId: vpcId,
    serviceName: ptfeServiceConfig,
    vpcEndpointType: "Interface",
    securityGroupIds: [ptfeServiceAwsSecurityGroup.id],
    subnetIds: [subnetIds],
    privateDnsEnabled: false,
});
const internal = aws.route53.getZone({
    name: "vpc.internal.",
    privateZone: true,
    vpcId: vpcId,
});
const ptfeServiceRecord = new aws.route53.Record("ptfe_service", {
    zoneId: internal.then(internal => internal.zoneId),
    name: internal.then(internal => `ptfe.${internal.name}`),
    type: aws.route53.RecordType.CNAME,
    ttl: 300,
    records: [ptfeService.dnsEntries[0].dns_name],
});

    import pulumi
import pulumi_aws as aws

ptfe_service = aws.ec2.VpcEndpoint("ptfe_service",
    vpc_id=vpc_id,
    service_name=ptfe_service_config,
    vpc_endpoint_type="Interface",
    security_group_ids=[ptfe_service_aws_security_group["id"]],
    subnet_ids=[subnet_ids],
    private_dns_enabled=False)
internal = aws.route53.get_zone(name="vpc.internal.",
    private_zone=True,
    vpc_id=vpc_id)
ptfe_service_record = aws.route53.Record("ptfe_service",
    zone_id=internal.zone_id,
    name=f"ptfe.{internal.name}",
    type=aws.route53.RecordType.CNAME,
    ttl=300,
    records=[ptfe_service.dns_entries[0].dns_name])

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/ec2"
	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/route53"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		ptfeService, err := ec2.NewVpcEndpoint(ctx, "ptfe_service", &ec2.VpcEndpointArgs{
			VpcId:           pulumi.Any(vpcId),
			ServiceName:     pulumi.Any(ptfeServiceConfig),
			VpcEndpointType: pulumi.String("Interface"),
			SecurityGroupIds: pulumi.StringArray{
				ptfeServiceAwsSecurityGroup.Id,
			},
			SubnetIds: pulumi.StringArray{
				subnetIds,
			},
			PrivateDnsEnabled: pulumi.Bool(false),
		})
		if err != nil {
			return err
		}
		internal, err := route53.LookupZone(ctx, &route53.LookupZoneArgs{
			Name:        pulumi.StringRef("vpc.internal."),
			PrivateZone: pulumi.BoolRef(true),
			VpcId:       pulumi.StringRef(vpcId),
		}, nil)
		if err != nil {
			return err
		}
		_, err = route53.NewRecord(ctx, "ptfe_service", &route53.RecordArgs{
			ZoneId: pulumi.String(internal.ZoneId),
			Name:   pulumi.Sprintf("ptfe.%v", internal.Name),
			Type:   pulumi.String(route53.RecordTypeCNAME),
			Ttl:    pulumi.Int(300),
			Records: pulumi.StringArray{
				pulumi.String(ptfeService.DnsEntries.ApplyT(func(dnsEntries []ec2.VpcEndpointDnsEntry) (interface{}, error) {
					return dnsEntries[0].Dns_name, nil
				}).(pulumi.AnyOutput)),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var ptfeService = new Aws.Ec2.VpcEndpoint("ptfe_service", new()
    {
        VpcId = vpcId,
        ServiceName = ptfeServiceConfig,
        VpcEndpointType = "Interface",
        SecurityGroupIds = new[]
        {
            ptfeServiceAwsSecurityGroup.Id,
        },
        SubnetIds = new[]
        {
            subnetIds,
        },
        PrivateDnsEnabled = false,
    });

    var @internal = Aws.Route53.GetZone.Invoke(new()
    {
        Name = "vpc.internal.",
        PrivateZone = true,
        VpcId = vpcId,
    });

    var ptfeServiceRecord = new Aws.Route53.Record("ptfe_service", new()
    {
        ZoneId = @internal.Apply(@internal => @internal.Apply(getZoneResult => getZoneResult.ZoneId)),
        Name = @internal.Apply(@internal => $"ptfe.{@internal.Apply(getZoneResult => getZoneResult.Name)}"),
        Type = Aws.Route53.RecordType.CNAME,
        Ttl = 300,
        Records = new[]
        {
            ptfeService.DnsEntries.Apply(dnsEntries => dnsEntries[0].Dns_name),
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.ec2.VpcEndpoint;
import com.pulumi.aws.ec2.VpcEndpointArgs;
import com.pulumi.aws.route53.Route53Functions;
import com.pulumi.aws.route53.inputs.GetZoneArgs;
import com.pulumi.aws.route53.Record;
import com.pulumi.aws.route53.RecordArgs;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var ptfeService = new VpcEndpoint("ptfeService", VpcEndpointArgs.builder()
            .vpcId(vpcId)
            .serviceName(ptfeServiceConfig)
            .vpcEndpointType("Interface")
            .securityGroupIds(ptfeServiceAwsSecurityGroup.get("id"))
            .subnetIds(subnetIds)
            .privateDnsEnabled(false)
            .build());

        final var internal = Route53Functions.getZone(GetZoneArgs.builder()
            .name("vpc.internal.")
            .privateZone(true)
            .vpcId(vpcId)
            .build());

        var ptfeServiceRecord = new Record("ptfeServiceRecord", RecordArgs.builder()
            .zoneId(internal.zoneId())
            .name(String.format("ptfe.%s", internal.name()))
            .type("CNAME")
            .ttl(300)
            .records(ptfeService.dnsEntries().applyValue(_dnsEntries -> _dnsEntries.get(0).dns_name()))
            .build());

    }
}

    resources:
  ptfeService:
    type: aws:ec2:VpcEndpoint
    name: ptfe_service
    properties:
      vpcId: ${vpcId}
      serviceName: ${ptfeServiceConfig}
      vpcEndpointType: Interface
      securityGroupIds:
        - ${ptfeServiceAwsSecurityGroup.id}
      subnetIds:
        - ${subnetIds}
      privateDnsEnabled: false
  ptfeServiceRecord:
    type: aws:route53:Record
    name: ptfe_service
    properties:
      zoneId: ${internal.zoneId}
      name: ptfe.${internal.name}
      type: CNAME
      ttl: '300'
      records:
        - ${ptfeService.dnsEntries[0].dns_name}
variables:
  internal:
    fn::invoke:
      function: aws:route53:getZone
      arguments:
        name: vpc.internal.
        privateZone: true
        vpcId: ${vpcId}

    terraform {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

data "aws_route53_zone" "internal" {
  name         = "vpc.internal."
  private_zone = true
  vpc_id       = vpcId
}

resource "aws_ec2_vpc_endpoint" "ptfe_service" {
  lifecycle {
    create_before_destroy = true
  }
  vpc_id              = vpcId
  service_name        = ptfeServiceConfig
  vpc_endpoint_type   = "Interface"
  security_group_ids  = [ptfeServiceAwsSecurityGroup.id]
  subnet_ids          = [subnetIds]
  private_dns_enabled = false
}
resource "aws_route53_record" "ptfe_service" {
  lifecycle {
    create_before_destroy = true
  }
  zone_id = data.aws_route53_zone.internal.zone_id
  name    ="ptfe.${data.aws_route53_zone.internal.name}"
  type    = "CNAME"
  ttl     = "300"
  records = [aws_ec2_vpc_endpoint.ptfe_service.dns_entries[0]["dns_name"]]
}

    NOTE The dnsEntry output is a list of maps: This provider interpolation support for lists of maps requires the lookup and [] until full support of lists of maps is available

    Create VpcEndpoint Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new VpcEndpoint(name: string, args: VpcEndpointArgs, opts?: CustomResourceOptions);
    @overload
def VpcEndpoint(resource_name: str,
                args: VpcEndpointArgs,
                opts: Optional[ResourceOptions] = None)

@overload
def VpcEndpoint(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                vpc_id: Optional[str] = None,
                security_group_ids: Optional[Sequence[str]] = None,
                service_network_arn: Optional[str] = None,
                policy: Optional[str] = None,
                private_dns_enabled: Optional[bool] = None,
                region: Optional[str] = None,
                resource_configuration_arn: Optional[str] = None,
                ip_address_type: Optional[str] = None,
                route_table_ids: Optional[Sequence[str]] = None,
                service_name: Optional[str] = None,
                auto_accept: Optional[bool] = None,
                service_region: Optional[str] = None,
                subnet_configurations: Optional[Sequence[VpcEndpointSubnetConfigurationArgs]] = None,
                subnet_ids: Optional[Sequence[str]] = None,
                tags: Optional[Mapping[str, str]] = None,
                vpc_endpoint_type: Optional[str] = None,
                dns_options: Optional[VpcEndpointDnsOptionsArgs] = None)
    func NewVpcEndpoint(ctx *Context, name string, args VpcEndpointArgs, opts ...ResourceOption) (*VpcEndpoint, error)
    public VpcEndpoint(string name, VpcEndpointArgs args, CustomResourceOptions? opts = null)
    public VpcEndpoint(String name, VpcEndpointArgs args)
public VpcEndpoint(String name, VpcEndpointArgs args, CustomResourceOptions options)

    type: aws:ec2:VpcEndpoint
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "aws_ec2_vpc_endpoint" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args VpcEndpointArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args VpcEndpointArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args VpcEndpointArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args VpcEndpointArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args VpcEndpointArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var vpcEndpointResource = new Aws.Ec2.VpcEndpoint("vpcEndpointResource", new()
{
    VpcId = "string",
    SecurityGroupIds = new[]
    {
        "string",
    },
    ServiceNetworkArn = "string",
    Policy = "string",
    PrivateDnsEnabled = false,
    Region = "string",
    ResourceConfigurationArn = "string",
    IpAddressType = "string",
    RouteTableIds = new[]
    {
        "string",
    },
    ServiceName = "string",
    AutoAccept = false,
    ServiceRegion = "string",
    SubnetConfigurations = new[]
    {
        new Aws.Ec2.Inputs.VpcEndpointSubnetConfigurationArgs
        {
            Ipv4 = "string",
            Ipv6 = "string",
            SubnetId = "string",
        },
    },
    SubnetIds = new[]
    {
        "string",
    },
    Tags = 
    {
        { "string", "string" },
    },
    VpcEndpointType = "string",
    DnsOptions = new Aws.Ec2.Inputs.VpcEndpointDnsOptionsArgs
    {
        DnsRecordIpType = "string",
        PrivateDnsOnlyForInboundResolverEndpoint = false,
        PrivateDnsPreference = "string",
        PrivateDnsSpecifiedDomains = new[]
        {
            "string",
        },
    },
});

    example, err := ec2.NewVpcEndpoint(ctx, "vpcEndpointResource", &ec2.VpcEndpointArgs{
	VpcId: pulumi.String("string"),
	SecurityGroupIds: pulumi.StringArray{
		pulumi.String("string"),
	},
	ServiceNetworkArn:        pulumi.String("string"),
	Policy:                   pulumi.String("string"),
	PrivateDnsEnabled:        pulumi.Bool(false),
	Region:                   pulumi.String("string"),
	ResourceConfigurationArn: pulumi.String("string"),
	IpAddressType:            pulumi.String("string"),
	RouteTableIds: pulumi.StringArray{
		pulumi.String("string"),
	},
	ServiceName:   pulumi.String("string"),
	AutoAccept:    pulumi.Bool(false),
	ServiceRegion: pulumi.String("string"),
	SubnetConfigurations: ec2.VpcEndpointSubnetConfigurationArray{
		&ec2.VpcEndpointSubnetConfigurationArgs{
			Ipv4:     pulumi.String("string"),
			Ipv6:     pulumi.String("string"),
			SubnetId: pulumi.String("string"),
		},
	},
	SubnetIds: pulumi.StringArray{
		pulumi.String("string"),
	},
	Tags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	VpcEndpointType: pulumi.String("string"),
	DnsOptions: &ec2.VpcEndpointDnsOptionsArgs{
		DnsRecordIpType:                          pulumi.String("string"),
		PrivateDnsOnlyForInboundResolverEndpoint: pulumi.Bool(false),
		PrivateDnsPreference:                     pulumi.String("string"),
		PrivateDnsSpecifiedDomains: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
})

    resource "aws_ec2_vpc_endpoint" "vpcEndpointResource" {
  lifecycle {
    create_before_destroy = true
  }
  vpc_id                     = "string"
  security_group_ids         = ["string"]
  service_network_arn        = "string"
  policy                     = "string"
  private_dns_enabled        = false
  region                     = "string"
  resource_configuration_arn = "string"
  ip_address_type            = "string"
  route_table_ids            = ["string"]
  service_name               = "string"
  auto_accept                = false
  service_region             = "string"
  subnet_configurations {
    ipv4      = "string"
    ipv6      = "string"
    subnet_id = "string"
  }
  subnet_ids = ["string"]
  tags = {
    "string" = "string"
  }
  vpc_endpoint_type = "string"
  dns_options = {
    dns_record_ip_type                             = "string"
    private_dns_only_for_inbound_resolver_endpoint = false
    private_dns_preference                         = "string"
    private_dns_specified_domains                  = ["string"]
  }
}

    var vpcEndpointResource = new com.pulumi.aws.ec2.VpcEndpoint("vpcEndpointResource", com.pulumi.aws.ec2.VpcEndpointArgs.builder()
    .vpcId("string")
    .securityGroupIds("string")
    .serviceNetworkArn("string")
    .policy("string")
    .privateDnsEnabled(false)
    .region("string")
    .resourceConfigurationArn("string")
    .ipAddressType("string")
    .routeTableIds("string")
    .serviceName("string")
    .autoAccept(false)
    .serviceRegion("string")
    .subnetConfigurations(VpcEndpointSubnetConfigurationArgs.builder()
        .ipv4("string")
        .ipv6("string")
        .subnetId("string")
        .build())
    .subnetIds("string")
    .tags(Map.of("string", "string"))
    .vpcEndpointType("string")
    .dnsOptions(VpcEndpointDnsOptionsArgs.builder()
        .dnsRecordIpType("string")
        .privateDnsOnlyForInboundResolverEndpoint(false)
        .privateDnsPreference("string")
        .privateDnsSpecifiedDomains("string")
        .build())
    .build());

    vpc_endpoint_resource = aws.ec2.VpcEndpoint("vpcEndpointResource",
    vpc_id="string",
    security_group_ids=["string"],
    service_network_arn="string",
    policy="string",
    private_dns_enabled=False,
    region="string",
    resource_configuration_arn="string",
    ip_address_type="string",
    route_table_ids=["string"],
    service_name="string",
    auto_accept=False,
    service_region="string",
    subnet_configurations=[{
        "ipv4": "string",
        "ipv6": "string",
        "subnet_id": "string",
    }],
    subnet_ids=["string"],
    tags={
        "string": "string",
    },
    vpc_endpoint_type="string",
    dns_options={
        "dns_record_ip_type": "string",
        "private_dns_only_for_inbound_resolver_endpoint": False,
        "private_dns_preference": "string",
        "private_dns_specified_domains": ["string"],
    })

    const vpcEndpointResource = new aws.ec2.VpcEndpoint("vpcEndpointResource", {
    vpcId: "string",
    securityGroupIds: ["string"],
    serviceNetworkArn: "string",
    policy: "string",
    privateDnsEnabled: false,
    region: "string",
    resourceConfigurationArn: "string",
    ipAddressType: "string",
    routeTableIds: ["string"],
    serviceName: "string",
    autoAccept: false,
    serviceRegion: "string",
    subnetConfigurations: [{
        ipv4: "string",
        ipv6: "string",
        subnetId: "string",
    }],
    subnetIds: ["string"],
    tags: {
        string: "string",
    },
    vpcEndpointType: "string",
    dnsOptions: {
        dnsRecordIpType: "string",
        privateDnsOnlyForInboundResolverEndpoint: false,
        privateDnsPreference: "string",
        privateDnsSpecifiedDomains: ["string"],
    },
});

    type: aws:ec2:VpcEndpoint
properties:
    autoAccept: false
    dnsOptions:
        dnsRecordIpType: string
        privateDnsOnlyForInboundResolverEndpoint: false
        privateDnsPreference: string
        privateDnsSpecifiedDomains:
            - string
    ipAddressType: string
    policy: string
    privateDnsEnabled: false
    region: string
    resourceConfigurationArn: string
    routeTableIds:
        - string
    securityGroupIds:
        - string
    serviceName: string
    serviceNetworkArn: string
    serviceRegion: string
    subnetConfigurations:
        - ipv4: string
          ipv6: string
          subnetId: string
    subnetIds:
        - string
    tags:
        string: string
    vpcEndpointType: string
    vpcId: string

    VpcEndpoint Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The VpcEndpoint resource accepts the following input properties:

    VpcId string
    ID of the VPC in which the endpoint will be used.
    AutoAccept bool
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    DnsOptions VpcEndpointDnsOptions
    DNS options for the endpoint. See dnsOptions below.
    IpAddressType string
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    Policy string
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    PrivateDnsEnabled bool
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    ResourceConfigurationArn string
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    RouteTableIds List<string>
    One or more route table IDs. Applicable for endpoints of type Gateway.
    SecurityGroupIds List<string>
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    ServiceName string
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    ServiceNetworkArn string
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    ServiceRegion string
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    SubnetConfigurations List<VpcEndpointSubnetConfiguration>
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    SubnetIds List<string>
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    Tags Dictionary<string, string>
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    VpcEndpointType string
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.
    VpcId string
    ID of the VPC in which the endpoint will be used.
    AutoAccept bool
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    DnsOptions VpcEndpointDnsOptionsArgs
    DNS options for the endpoint. See dnsOptions below.
    IpAddressType string
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    Policy string
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    PrivateDnsEnabled bool
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    ResourceConfigurationArn string
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    RouteTableIds []string
    One or more route table IDs. Applicable for endpoints of type Gateway.
    SecurityGroupIds []string
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    ServiceName string
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    ServiceNetworkArn string
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    ServiceRegion string
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    SubnetConfigurations []VpcEndpointSubnetConfigurationArgs
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    SubnetIds []string
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    Tags map[string]string
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    VpcEndpointType string
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.
    vpc_id string
    ID of the VPC in which the endpoint will be used.
    auto_accept bool
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    dns_options object
    DNS options for the endpoint. See dnsOptions below.
    ip_address_type string
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    policy string
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    private_dns_enabled bool
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    resource_configuration_arn string
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    route_table_ids list(string)
    One or more route table IDs. Applicable for endpoints of type Gateway.
    security_group_ids list(string)
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    service_name string
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    service_network_arn string
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    service_region string
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    subnet_configurations list(object)
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    subnet_ids list(string)
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    tags map(string)
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    vpc_endpoint_type string
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.
    vpcId String
    ID of the VPC in which the endpoint will be used.
    autoAccept Boolean
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    dnsOptions VpcEndpointDnsOptions
    DNS options for the endpoint. See dnsOptions below.
    ipAddressType String
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    policy String
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    privateDnsEnabled Boolean
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    resourceConfigurationArn String
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    routeTableIds List<String>
    One or more route table IDs. Applicable for endpoints of type Gateway.
    securityGroupIds List<String>
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    serviceName String
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    serviceNetworkArn String
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    serviceRegion String
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    subnetConfigurations List<VpcEndpointSubnetConfiguration>
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    subnetIds List<String>
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    tags Map<String,String>
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    vpcEndpointType String
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.
    vpcId string
    ID of the VPC in which the endpoint will be used.
    autoAccept boolean
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    dnsOptions VpcEndpointDnsOptions
    DNS options for the endpoint. See dnsOptions below.
    ipAddressType string
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    policy string
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    privateDnsEnabled boolean
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    resourceConfigurationArn string
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    routeTableIds string[]
    One or more route table IDs. Applicable for endpoints of type Gateway.
    securityGroupIds string[]
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    serviceName string
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    serviceNetworkArn string
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    serviceRegion string
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    subnetConfigurations VpcEndpointSubnetConfiguration[]
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    subnetIds string[]
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    tags {[key: string]: string}
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    vpcEndpointType string
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.
    vpc_id str
    ID of the VPC in which the endpoint will be used.
    auto_accept bool
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    dns_options VpcEndpointDnsOptionsArgs
    DNS options for the endpoint. See dnsOptions below.
    ip_address_type str
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    policy str
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    private_dns_enabled bool
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    resource_configuration_arn str
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    route_table_ids Sequence[str]
    One or more route table IDs. Applicable for endpoints of type Gateway.
    security_group_ids Sequence[str]
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    service_name str
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    service_network_arn str
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    service_region str
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    subnet_configurations Sequence[VpcEndpointSubnetConfigurationArgs]
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    subnet_ids Sequence[str]
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    tags Mapping[str, str]
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    vpc_endpoint_type str
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.
    vpcId String
    ID of the VPC in which the endpoint will be used.
    autoAccept Boolean
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    dnsOptions Property Map
    DNS options for the endpoint. See dnsOptions below.
    ipAddressType String
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    policy String
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    privateDnsEnabled Boolean
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    resourceConfigurationArn String
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    routeTableIds List<String>
    One or more route table IDs. Applicable for endpoints of type Gateway.
    securityGroupIds List<String>
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    serviceName String
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    serviceNetworkArn String
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    serviceRegion String
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    subnetConfigurations List<Property Map>
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    subnetIds List<String>
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    tags Map<String>
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    vpcEndpointType String
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the VpcEndpoint resource produces the following output properties:

    Arn string
    ARN of the VPC endpoint.
    CidrBlocks List<string>
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    DnsEntries List<VpcEndpointDnsEntry>
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    Id string
    The provider-assigned unique ID for this managed resource.
    NetworkInterfaceIds List<string>
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    OwnerId string
    ID of the AWS account that owns the VPC endpoint.
    PrefixListId string
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    RequesterManaged bool
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    State string
    State of the VPC endpoint.
    TagsAll Dictionary<string, string>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    Arn string
    ARN of the VPC endpoint.
    CidrBlocks []string
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    DnsEntries []VpcEndpointDnsEntry
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    Id string
    The provider-assigned unique ID for this managed resource.
    NetworkInterfaceIds []string
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    OwnerId string
    ID of the AWS account that owns the VPC endpoint.
    PrefixListId string
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    RequesterManaged bool
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    State string
    State of the VPC endpoint.
    TagsAll map[string]string
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    arn string
    ARN of the VPC endpoint.
    cidr_blocks list(string)
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    dns_entries list(object)
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    id string
    The provider-assigned unique ID for this managed resource.
    network_interface_ids list(string)
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    owner_id string
    ID of the AWS account that owns the VPC endpoint.
    prefix_list_id string
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    requester_managed bool
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    state string
    State of the VPC endpoint.
    tags_all map(string)
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    arn String
    ARN of the VPC endpoint.
    cidrBlocks List<String>
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    dnsEntries List<VpcEndpointDnsEntry>
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    id String
    The provider-assigned unique ID for this managed resource.
    networkInterfaceIds List<String>
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    ownerId String
    ID of the AWS account that owns the VPC endpoint.
    prefixListId String
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    requesterManaged Boolean
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    state String
    State of the VPC endpoint.
    tagsAll Map<String,String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    arn string
    ARN of the VPC endpoint.
    cidrBlocks string[]
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    dnsEntries VpcEndpointDnsEntry[]
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    id string
    The provider-assigned unique ID for this managed resource.
    networkInterfaceIds string[]
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    ownerId string
    ID of the AWS account that owns the VPC endpoint.
    prefixListId string
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    requesterManaged boolean
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    state string
    State of the VPC endpoint.
    tagsAll {[key: string]: string}
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    arn str
    ARN of the VPC endpoint.
    cidr_blocks Sequence[str]
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    dns_entries Sequence[VpcEndpointDnsEntry]
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    id str
    The provider-assigned unique ID for this managed resource.
    network_interface_ids Sequence[str]
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    owner_id str
    ID of the AWS account that owns the VPC endpoint.
    prefix_list_id str
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    requester_managed bool
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    state str
    State of the VPC endpoint.
    tags_all Mapping[str, str]
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    arn String
    ARN of the VPC endpoint.
    cidrBlocks List<String>
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    dnsEntries List<Property Map>
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    id String
    The provider-assigned unique ID for this managed resource.
    networkInterfaceIds List<String>
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    ownerId String
    ID of the AWS account that owns the VPC endpoint.
    prefixListId String
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    requesterManaged Boolean
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    state String
    State of the VPC endpoint.
    tagsAll Map<String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.

    Look up Existing VpcEndpoint Resource

    Get an existing VpcEndpoint resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: VpcEndpointState, opts?: CustomResourceOptions): VpcEndpoint
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        arn: Optional[str] = None,
        auto_accept: Optional[bool] = None,
        cidr_blocks: Optional[Sequence[str]] = None,
        dns_entries: Optional[Sequence[VpcEndpointDnsEntryArgs]] = None,
        dns_options: Optional[VpcEndpointDnsOptionsArgs] = None,
        ip_address_type: Optional[str] = None,
        network_interface_ids: Optional[Sequence[str]] = None,
        owner_id: Optional[str] = None,
        policy: Optional[str] = None,
        prefix_list_id: Optional[str] = None,
        private_dns_enabled: Optional[bool] = None,
        region: Optional[str] = None,
        requester_managed: Optional[bool] = None,
        resource_configuration_arn: Optional[str] = None,
        route_table_ids: Optional[Sequence[str]] = None,
        security_group_ids: Optional[Sequence[str]] = None,
        service_name: Optional[str] = None,
        service_network_arn: Optional[str] = None,
        service_region: Optional[str] = None,
        state: Optional[str] = None,
        subnet_configurations: Optional[Sequence[VpcEndpointSubnetConfigurationArgs]] = None,
        subnet_ids: Optional[Sequence[str]] = None,
        tags: Optional[Mapping[str, str]] = None,
        tags_all: Optional[Mapping[str, str]] = None,
        vpc_endpoint_type: Optional[str] = None,
        vpc_id: Optional[str] = None) -> VpcEndpoint
    func GetVpcEndpoint(ctx *Context, name string, id IDInput, state *VpcEndpointState, opts ...ResourceOption) (*VpcEndpoint, error)
    public static VpcEndpoint Get(string name, Input<string> id, VpcEndpointState? state, CustomResourceOptions? opts = null)
    public static VpcEndpoint get(String name, Output<String> id, VpcEndpointState state, CustomResourceOptions options)
    resources:  _:    type: aws:ec2:VpcEndpoint    get:      id: ${id}
    import {
  to = aws_ec2_vpc_endpoint.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Arn string
    ARN of the VPC endpoint.
    AutoAccept bool
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    CidrBlocks List<string>
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    DnsEntries List<VpcEndpointDnsEntry>
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    DnsOptions VpcEndpointDnsOptions
    DNS options for the endpoint. See dnsOptions below.
    IpAddressType string
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    NetworkInterfaceIds List<string>
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    OwnerId string
    ID of the AWS account that owns the VPC endpoint.
    Policy string
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    PrefixListId string
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    PrivateDnsEnabled bool
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    RequesterManaged bool
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    ResourceConfigurationArn string
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    RouteTableIds List<string>
    One or more route table IDs. Applicable for endpoints of type Gateway.
    SecurityGroupIds List<string>
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    ServiceName string
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    ServiceNetworkArn string
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    ServiceRegion string
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    State string
    State of the VPC endpoint.
    SubnetConfigurations List<VpcEndpointSubnetConfiguration>
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    SubnetIds List<string>
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    Tags Dictionary<string, string>
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    TagsAll Dictionary<string, string>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    VpcEndpointType string
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.
    VpcId string
    ID of the VPC in which the endpoint will be used.
    Arn string
    ARN of the VPC endpoint.
    AutoAccept bool
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    CidrBlocks []string
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    DnsEntries []VpcEndpointDnsEntryArgs
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    DnsOptions VpcEndpointDnsOptionsArgs
    DNS options for the endpoint. See dnsOptions below.
    IpAddressType string
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    NetworkInterfaceIds []string
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    OwnerId string
    ID of the AWS account that owns the VPC endpoint.
    Policy string
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    PrefixListId string
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    PrivateDnsEnabled bool
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    Region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    RequesterManaged bool
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    ResourceConfigurationArn string
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    RouteTableIds []string
    One or more route table IDs. Applicable for endpoints of type Gateway.
    SecurityGroupIds []string
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    ServiceName string
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    ServiceNetworkArn string
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    ServiceRegion string
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    State string
    State of the VPC endpoint.
    SubnetConfigurations []VpcEndpointSubnetConfigurationArgs
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    SubnetIds []string
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    Tags map[string]string
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    TagsAll map[string]string
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    VpcEndpointType string
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.
    VpcId string
    ID of the VPC in which the endpoint will be used.
    arn string
    ARN of the VPC endpoint.
    auto_accept bool
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    cidr_blocks list(string)
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    dns_entries list(object)
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    dns_options object
    DNS options for the endpoint. See dnsOptions below.
    ip_address_type string
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    network_interface_ids list(string)
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    owner_id string
    ID of the AWS account that owns the VPC endpoint.
    policy string
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    prefix_list_id string
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    private_dns_enabled bool
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    requester_managed bool
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    resource_configuration_arn string
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    route_table_ids list(string)
    One or more route table IDs. Applicable for endpoints of type Gateway.
    security_group_ids list(string)
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    service_name string
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    service_network_arn string
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    service_region string
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    state string
    State of the VPC endpoint.
    subnet_configurations list(object)
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    subnet_ids list(string)
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    tags map(string)
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tags_all map(string)
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    vpc_endpoint_type string
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.
    vpc_id string
    ID of the VPC in which the endpoint will be used.
    arn String
    ARN of the VPC endpoint.
    autoAccept Boolean
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    cidrBlocks List<String>
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    dnsEntries List<VpcEndpointDnsEntry>
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    dnsOptions VpcEndpointDnsOptions
    DNS options for the endpoint. See dnsOptions below.
    ipAddressType String
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    networkInterfaceIds List<String>
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    ownerId String
    ID of the AWS account that owns the VPC endpoint.
    policy String
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    prefixListId String
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    privateDnsEnabled Boolean
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    requesterManaged Boolean
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    resourceConfigurationArn String
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    routeTableIds List<String>
    One or more route table IDs. Applicable for endpoints of type Gateway.
    securityGroupIds List<String>
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    serviceName String
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    serviceNetworkArn String
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    serviceRegion String
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    state String
    State of the VPC endpoint.
    subnetConfigurations List<VpcEndpointSubnetConfiguration>
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    subnetIds List<String>
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    tags Map<String,String>
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll Map<String,String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    vpcEndpointType String
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.
    vpcId String
    ID of the VPC in which the endpoint will be used.
    arn string
    ARN of the VPC endpoint.
    autoAccept boolean
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    cidrBlocks string[]
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    dnsEntries VpcEndpointDnsEntry[]
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    dnsOptions VpcEndpointDnsOptions
    DNS options for the endpoint. See dnsOptions below.
    ipAddressType string
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    networkInterfaceIds string[]
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    ownerId string
    ID of the AWS account that owns the VPC endpoint.
    policy string
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    prefixListId string
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    privateDnsEnabled boolean
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    region string
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    requesterManaged boolean
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    resourceConfigurationArn string
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    routeTableIds string[]
    One or more route table IDs. Applicable for endpoints of type Gateway.
    securityGroupIds string[]
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    serviceName string
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    serviceNetworkArn string
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    serviceRegion string
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    state string
    State of the VPC endpoint.
    subnetConfigurations VpcEndpointSubnetConfiguration[]
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    subnetIds string[]
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    tags {[key: string]: string}
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll {[key: string]: string}
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    vpcEndpointType string
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.
    vpcId string
    ID of the VPC in which the endpoint will be used.
    arn str
    ARN of the VPC endpoint.
    auto_accept bool
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    cidr_blocks Sequence[str]
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    dns_entries Sequence[VpcEndpointDnsEntryArgs]
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    dns_options VpcEndpointDnsOptionsArgs
    DNS options for the endpoint. See dnsOptions below.
    ip_address_type str
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    network_interface_ids Sequence[str]
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    owner_id str
    ID of the AWS account that owns the VPC endpoint.
    policy str
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    prefix_list_id str
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    private_dns_enabled bool
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    region str
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    requester_managed bool
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    resource_configuration_arn str
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    route_table_ids Sequence[str]
    One or more route table IDs. Applicable for endpoints of type Gateway.
    security_group_ids Sequence[str]
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    service_name str
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    service_network_arn str
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    service_region str
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    state str
    State of the VPC endpoint.
    subnet_configurations Sequence[VpcEndpointSubnetConfigurationArgs]
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    subnet_ids Sequence[str]
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    tags Mapping[str, str]
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tags_all Mapping[str, str]
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    vpc_endpoint_type str
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.
    vpc_id str
    ID of the VPC in which the endpoint will be used.
    arn String
    ARN of the VPC endpoint.
    autoAccept Boolean
    Whether to accept the VPC endpoint (the VPC endpoint and service need to be in the same AWS account).
    cidrBlocks List<String>
    List of CIDR blocks for the exposed AWS service. Applicable for endpoints of type Gateway.
    dnsEntries List<Property Map>
    DNS entries for the VPC Endpoint. Applicable for endpoints of type Interface. See dnsEntry below.
    dnsOptions Property Map
    DNS options for the endpoint. See dnsOptions below.
    ipAddressType String
    IP address type for the endpoint. Valid values are ipv4, dualstack, and ipv6.
    networkInterfaceIds List<String>
    One or more network interfaces for the VPC Endpoint. Applicable for endpoints of type Interface.
    ownerId String
    ID of the AWS account that owns the VPC endpoint.
    policy String
    Policy to attach to the endpoint that controls access to the service. This is a JSON formatted string. Defaults to full access. All Gateway and some Interface endpoints support policies - see the relevant AWS documentation for more details. For more information about building AWS IAM policy documents with Pulumi, see the AWS IAM Policy Document Guide.
    prefixListId String
    Prefix list ID of the exposed AWS service. Applicable for endpoints of type Gateway.
    privateDnsEnabled Boolean
    Whether to associate a private hosted zone with the specified VPC. Available for AWS services and AWS Marketplace partner services only. Applicable for endpoints of type Interface. Most users will want this enabled to allow services within the VPC to automatically use the endpoint. Defaults to false. If vpcEndpointType is anything other than Interface, changing this value forces a new resource to be created.
    region String
    Region where this resource will be managed. Defaults to the Region set in the provider configuration.
    requesterManaged Boolean
    Whether or not the VPC Endpoint is being managed by its service - true or false.
    resourceConfigurationArn String
    ARN of a Resource Configuration to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required. Applicable for endpoints of type Resource and Tunnel. For Tunnel endpoints, the resource configuration must be of type CIDR.
    routeTableIds List<String>
    One or more route table IDs. Applicable for endpoints of type Gateway.
    securityGroupIds List<String>
    ID of one or more security groups to associate with the network interface. Applicable for endpoints of type Interface, Resource, ServiceNetwork, and Tunnel. If no security groups are specified, the VPC's default security group is associated with the endpoint.
    serviceName String
    Service name. For AWS services the service name is usually in the form com.amazonaws.<region>.<service> (the SageMaker AI Notebook service is an exception to this rule, the service name is in the form aws.sagemaker.<region>.notebook). Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    serviceNetworkArn String
    ARN of a Service Network to connect this VPC Endpoint to. Exactly one of resourceConfigurationArn, serviceName or serviceNetworkArn is required.
    serviceRegion String
    AWS region of the VPC Endpoint Service. If specified, the VPC endpoint will connect to the service in the provided region. Applicable for endpoints of type Interface.
    state String
    State of the VPC endpoint.
    subnetConfigurations List<Property Map>
    Subnet configuration for the endpoint, used to select specific IPv4 and/or IPv6 addresses to the endpoint. See subnetConfiguration below.
    subnetIds List<String>
    ID of one or more subnets in which to create a network interface for the endpoint. Applicable for endpoints of type GatewayLoadBalancer, Interface, Resource, ServiceNetwork, and Tunnel. Interface type endpoints cannot function without being assigned to a subnet. For Tunnel endpoints, the subnets must be in the Availability Zones of the resource gateway associated with the resource configuration.
    tags Map<String>
    Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll Map<String>
    Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
    vpcEndpointType String
    VPC endpoint type, Gateway, GatewayLoadBalancer, Interface, Resource, ServiceNetwork or Tunnel. Defaults to Gateway.
    vpcId String
    ID of the VPC in which the endpoint will be used.

    Supporting Types

    VpcEndpointDnsEntry, VpcEndpointDnsEntryArgs

    DnsName string
    DNS name.
    HostedZoneId string
    ID of the private hosted zone.
    DnsName string
    DNS name.
    HostedZoneId string
    ID of the private hosted zone.
    dns_name string
    DNS name.
    hosted_zone_id string
    ID of the private hosted zone.
    dnsName String
    DNS name.
    hostedZoneId String
    ID of the private hosted zone.
    dnsName string
    DNS name.
    hostedZoneId string
    ID of the private hosted zone.
    dns_name str
    DNS name.
    hosted_zone_id str
    ID of the private hosted zone.
    dnsName String
    DNS name.
    hostedZoneId String
    ID of the private hosted zone.

    VpcEndpointDnsOptions, VpcEndpointDnsOptionsArgs

    DnsRecordIpType string
    DNS records created for the endpoint. Valid values are ipv4, dualstack, service-defined, and ipv6.
    PrivateDnsOnlyForInboundResolverEndpoint bool
    Whether to enable private DNS only for inbound endpoints. This option is available only for interface endpoints of services that support both gateway and interface endpoints. A gateway endpoint for the same service must be created before an interface endpoint is created. Traffic originating from the VPC is routed to the gateway endpoint, while traffic originating from on-premises is routed to the interface endpoint. Defaults to false. This argument can be specified only if privateDnsEnabled is true.
    PrivateDnsPreference string
    Preference for which private domains have a private hosted zone created for and associated with the specified VPC. Valid values are ALL_DOMAINS, VERIFIED_DOMAINS_ONLY, VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS, and SPECIFIED_DOMAINS_ONLY. Only supported when privateDnsEnabled is true and when the vpcEndpointType is ServiceNetwork or Resource.
    PrivateDnsSpecifiedDomains List<string>
    List of private domains to create private hosted zones for and associate with the specified VPC. Must be specified when privateDnsEnabled is true and privateDnsPreference is set to either VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS or SPECIFIED_DOMAINS_ONLY. In all other cases, this argument must not be specified.
    DnsRecordIpType string
    DNS records created for the endpoint. Valid values are ipv4, dualstack, service-defined, and ipv6.
    PrivateDnsOnlyForInboundResolverEndpoint bool
    Whether to enable private DNS only for inbound endpoints. This option is available only for interface endpoints of services that support both gateway and interface endpoints. A gateway endpoint for the same service must be created before an interface endpoint is created. Traffic originating from the VPC is routed to the gateway endpoint, while traffic originating from on-premises is routed to the interface endpoint. Defaults to false. This argument can be specified only if privateDnsEnabled is true.
    PrivateDnsPreference string
    Preference for which private domains have a private hosted zone created for and associated with the specified VPC. Valid values are ALL_DOMAINS, VERIFIED_DOMAINS_ONLY, VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS, and SPECIFIED_DOMAINS_ONLY. Only supported when privateDnsEnabled is true and when the vpcEndpointType is ServiceNetwork or Resource.
    PrivateDnsSpecifiedDomains []string
    List of private domains to create private hosted zones for and associate with the specified VPC. Must be specified when privateDnsEnabled is true and privateDnsPreference is set to either VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS or SPECIFIED_DOMAINS_ONLY. In all other cases, this argument must not be specified.
    dns_record_ip_type string
    DNS records created for the endpoint. Valid values are ipv4, dualstack, service-defined, and ipv6.
    private_dns_only_for_inbound_resolver_endpoint bool
    Whether to enable private DNS only for inbound endpoints. This option is available only for interface endpoints of services that support both gateway and interface endpoints. A gateway endpoint for the same service must be created before an interface endpoint is created. Traffic originating from the VPC is routed to the gateway endpoint, while traffic originating from on-premises is routed to the interface endpoint. Defaults to false. This argument can be specified only if privateDnsEnabled is true.
    private_dns_preference string
    Preference for which private domains have a private hosted zone created for and associated with the specified VPC. Valid values are ALL_DOMAINS, VERIFIED_DOMAINS_ONLY, VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS, and SPECIFIED_DOMAINS_ONLY. Only supported when privateDnsEnabled is true and when the vpcEndpointType is ServiceNetwork or Resource.
    private_dns_specified_domains list(string)
    List of private domains to create private hosted zones for and associate with the specified VPC. Must be specified when privateDnsEnabled is true and privateDnsPreference is set to either VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS or SPECIFIED_DOMAINS_ONLY. In all other cases, this argument must not be specified.
    dnsRecordIpType String
    DNS records created for the endpoint. Valid values are ipv4, dualstack, service-defined, and ipv6.
    privateDnsOnlyForInboundResolverEndpoint Boolean
    Whether to enable private DNS only for inbound endpoints. This option is available only for interface endpoints of services that support both gateway and interface endpoints. A gateway endpoint for the same service must be created before an interface endpoint is created. Traffic originating from the VPC is routed to the gateway endpoint, while traffic originating from on-premises is routed to the interface endpoint. Defaults to false. This argument can be specified only if privateDnsEnabled is true.
    privateDnsPreference String
    Preference for which private domains have a private hosted zone created for and associated with the specified VPC. Valid values are ALL_DOMAINS, VERIFIED_DOMAINS_ONLY, VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS, and SPECIFIED_DOMAINS_ONLY. Only supported when privateDnsEnabled is true and when the vpcEndpointType is ServiceNetwork or Resource.
    privateDnsSpecifiedDomains List<String>
    List of private domains to create private hosted zones for and associate with the specified VPC. Must be specified when privateDnsEnabled is true and privateDnsPreference is set to either VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS or SPECIFIED_DOMAINS_ONLY. In all other cases, this argument must not be specified.
    dnsRecordIpType string
    DNS records created for the endpoint. Valid values are ipv4, dualstack, service-defined, and ipv6.
    privateDnsOnlyForInboundResolverEndpoint boolean
    Whether to enable private DNS only for inbound endpoints. This option is available only for interface endpoints of services that support both gateway and interface endpoints. A gateway endpoint for the same service must be created before an interface endpoint is created. Traffic originating from the VPC is routed to the gateway endpoint, while traffic originating from on-premises is routed to the interface endpoint. Defaults to false. This argument can be specified only if privateDnsEnabled is true.
    privateDnsPreference string
    Preference for which private domains have a private hosted zone created for and associated with the specified VPC. Valid values are ALL_DOMAINS, VERIFIED_DOMAINS_ONLY, VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS, and SPECIFIED_DOMAINS_ONLY. Only supported when privateDnsEnabled is true and when the vpcEndpointType is ServiceNetwork or Resource.
    privateDnsSpecifiedDomains string[]
    List of private domains to create private hosted zones for and associate with the specified VPC. Must be specified when privateDnsEnabled is true and privateDnsPreference is set to either VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS or SPECIFIED_DOMAINS_ONLY. In all other cases, this argument must not be specified.
    dns_record_ip_type str
    DNS records created for the endpoint. Valid values are ipv4, dualstack, service-defined, and ipv6.
    private_dns_only_for_inbound_resolver_endpoint bool
    Whether to enable private DNS only for inbound endpoints. This option is available only for interface endpoints of services that support both gateway and interface endpoints. A gateway endpoint for the same service must be created before an interface endpoint is created. Traffic originating from the VPC is routed to the gateway endpoint, while traffic originating from on-premises is routed to the interface endpoint. Defaults to false. This argument can be specified only if privateDnsEnabled is true.
    private_dns_preference str
    Preference for which private domains have a private hosted zone created for and associated with the specified VPC. Valid values are ALL_DOMAINS, VERIFIED_DOMAINS_ONLY, VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS, and SPECIFIED_DOMAINS_ONLY. Only supported when privateDnsEnabled is true and when the vpcEndpointType is ServiceNetwork or Resource.
    private_dns_specified_domains Sequence[str]
    List of private domains to create private hosted zones for and associate with the specified VPC. Must be specified when privateDnsEnabled is true and privateDnsPreference is set to either VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS or SPECIFIED_DOMAINS_ONLY. In all other cases, this argument must not be specified.
    dnsRecordIpType String
    DNS records created for the endpoint. Valid values are ipv4, dualstack, service-defined, and ipv6.
    privateDnsOnlyForInboundResolverEndpoint Boolean
    Whether to enable private DNS only for inbound endpoints. This option is available only for interface endpoints of services that support both gateway and interface endpoints. A gateway endpoint for the same service must be created before an interface endpoint is created. Traffic originating from the VPC is routed to the gateway endpoint, while traffic originating from on-premises is routed to the interface endpoint. Defaults to false. This argument can be specified only if privateDnsEnabled is true.
    privateDnsPreference String
    Preference for which private domains have a private hosted zone created for and associated with the specified VPC. Valid values are ALL_DOMAINS, VERIFIED_DOMAINS_ONLY, VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS, and SPECIFIED_DOMAINS_ONLY. Only supported when privateDnsEnabled is true and when the vpcEndpointType is ServiceNetwork or Resource.
    privateDnsSpecifiedDomains List<String>
    List of private domains to create private hosted zones for and associate with the specified VPC. Must be specified when privateDnsEnabled is true and privateDnsPreference is set to either VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS or SPECIFIED_DOMAINS_ONLY. In all other cases, this argument must not be specified.

    VpcEndpointSubnetConfiguration, VpcEndpointSubnetConfigurationArgs

    Ipv4 string
    IPv4 address to assign to the endpoint network interface in the subnet. You must provide an IPv4 address if the VPC endpoint supports IPv4.
    Ipv6 string
    IPv6 address to assign to the endpoint network interface in the subnet. You must provide an IPv6 address if the VPC endpoint supports IPv6.
    SubnetId string
    ID of the subnet. Must have a corresponding subnet in the subnetIds argument.
    Ipv4 string
    IPv4 address to assign to the endpoint network interface in the subnet. You must provide an IPv4 address if the VPC endpoint supports IPv4.
    Ipv6 string
    IPv6 address to assign to the endpoint network interface in the subnet. You must provide an IPv6 address if the VPC endpoint supports IPv6.
    SubnetId string
    ID of the subnet. Must have a corresponding subnet in the subnetIds argument.
    ipv4 string
    IPv4 address to assign to the endpoint network interface in the subnet. You must provide an IPv4 address if the VPC endpoint supports IPv4.
    ipv6 string
    IPv6 address to assign to the endpoint network interface in the subnet. You must provide an IPv6 address if the VPC endpoint supports IPv6.
    subnet_id string
    ID of the subnet. Must have a corresponding subnet in the subnetIds argument.
    ipv4 String
    IPv4 address to assign to the endpoint network interface in the subnet. You must provide an IPv4 address if the VPC endpoint supports IPv4.
    ipv6 String
    IPv6 address to assign to the endpoint network interface in the subnet. You must provide an IPv6 address if the VPC endpoint supports IPv6.
    subnetId String
    ID of the subnet. Must have a corresponding subnet in the subnetIds argument.
    ipv4 string
    IPv4 address to assign to the endpoint network interface in the subnet. You must provide an IPv4 address if the VPC endpoint supports IPv4.
    ipv6 string
    IPv6 address to assign to the endpoint network interface in the subnet. You must provide an IPv6 address if the VPC endpoint supports IPv6.
    subnetId string
    ID of the subnet. Must have a corresponding subnet in the subnetIds argument.
    ipv4 str
    IPv4 address to assign to the endpoint network interface in the subnet. You must provide an IPv4 address if the VPC endpoint supports IPv4.
    ipv6 str
    IPv6 address to assign to the endpoint network interface in the subnet. You must provide an IPv6 address if the VPC endpoint supports IPv6.
    subnet_id str
    ID of the subnet. Must have a corresponding subnet in the subnetIds argument.
    ipv4 String
    IPv4 address to assign to the endpoint network interface in the subnet. You must provide an IPv4 address if the VPC endpoint supports IPv4.
    ipv6 String
    IPv6 address to assign to the endpoint network interface in the subnet. You must provide an IPv6 address if the VPC endpoint supports IPv6.
    subnetId String
    ID of the subnet. Must have a corresponding subnet in the subnetIds argument.

    Import

    Identity Schema

    Required

    • id - (String) ID of the VPC endpoint.

    Optional

    • accountId (String) AWS Account where this resource is managed.
    • region (String) Region where this resource is managed.

    Using pulumi import, import VPC Endpoints using the VPC endpoint id. For example:

    $ pulumi import aws:ec2/vpcEndpoint:VpcEndpoint example vpce-3ecf2a57

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo aws logo
    Viewing docs for AWS v7.53.0
    published on Monday, Nov 2, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-aws

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial