Sign in Dashboard Get started
  1. Registry
  2. Packages
  3. stackit
  4. API Docs
  5. VpnConnection
Viewing docs for stackit v0.0.7
published on Monday, Aug 17, 2026 by stackitcloud
Schema (JSON)
stackitcloud/pulumi-stackit

stackit.VpnConnection

stackit logo
Viewing docs for stackit v0.0.7
published on Monday, Aug 17, 2026 by stackitcloud
Schema (JSON)
stackitcloud/pulumi-stackit

    VPN Connection resource schema. Uses the defaultRegion specified in the provider configuration as a fallback in case no region is defined on resource level.

    Example Usage

    resource "stackit_vpn_connection" "example" {
  project_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  gateway_id   = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
  display_name = "example-vpn-connection"

  tunnel1 = {
    remote_address    = "198.51.100.10"
    pre_shared_key_wo = "example-super-secret-key-tunnel1"

    phase1 = {
      dh_groups             = ["ecp384"]
      encryption_algorithms = ["aes256"]
      integrity_algorithms  = ["sha2_384"]
    }

    phase2 = {
      dh_groups             = ["ecp384"]
      encryption_algorithms = ["aes256"]
      integrity_algorithms  = ["sha2_384"]
    }
  }

  tunnel2 = {
    remote_address    = "203.0.113.10"
    pre_shared_key_wo = "example-super-secret-key-tunnel2"

    phase1 = {
      dh_groups             = ["ecp384"]
      encryption_algorithms = ["aes256"]
      integrity_algorithms  = ["sha2_384"]
    }

    phase2 = {
      dh_groups             = ["ecp384"]
      encryption_algorithms = ["aes256"]
      integrity_algorithms  = ["sha2_384"]
    }
  }
}

    Create VpnConnection Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new VpnConnection(name: string, args: VpnConnectionArgs, opts?: CustomResourceOptions);
    @overload
def VpnConnection(resource_name: str,
                  args: VpnConnectionArgs,
                  opts: Optional[ResourceOptions] = None)

@overload
def VpnConnection(resource_name: str,
                  opts: Optional[ResourceOptions] = None,
                  display_name: Optional[str] = None,
                  gateway_id: Optional[str] = None,
                  project_id: Optional[str] = None,
                  tunnel1: Optional[VpnConnectionTunnel1Args] = None,
                  tunnel2: Optional[VpnConnectionTunnel2Args] = None,
                  enabled: Optional[bool] = None,
                  labels: Optional[Mapping[str, str]] = None,
                  local_subnets: Optional[Sequence[str]] = None,
                  region: Optional[str] = None,
                  remote_subnets: Optional[Sequence[str]] = None,
                  static_routes: Optional[Sequence[str]] = None)
    func NewVpnConnection(ctx *Context, name string, args VpnConnectionArgs, opts ...ResourceOption) (*VpnConnection, error)
    public VpnConnection(string name, VpnConnectionArgs args, CustomResourceOptions? opts = null)
    public VpnConnection(String name, VpnConnectionArgs args)
public VpnConnection(String name, VpnConnectionArgs args, CustomResourceOptions options)

    type: stackit:VpnConnection
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.


    resource "stackit_vpn_connection" "name" {
    # resource properties
}

    Parameters

    name string
    The unique name of the resource.
    args VpnConnectionArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args VpnConnectionArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args VpnConnectionArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args VpnConnectionArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args VpnConnectionArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var vpnConnectionResource = new Stackit.VpnConnection("vpnConnectionResource", new()
{
    DisplayName = "string",
    GatewayId = "string",
    ProjectId = "string",
    Tunnel1 = new Stackit.Inputs.VpnConnectionTunnel1Args
    {
        Phase1 = new Stackit.Inputs.VpnConnectionTunnel1Phase1Args
        {
            EncryptionAlgorithms = new[]
            {
                "string",
            },
            IntegrityAlgorithms = new[]
            {
                "string",
            },
            DhGroups = new[]
            {
                "string",
            },
            RekeyTime = 0,
        },
        Phase2 = new Stackit.Inputs.VpnConnectionTunnel1Phase2Args
        {
            EncryptionAlgorithms = new[]
            {
                "string",
            },
            IntegrityAlgorithms = new[]
            {
                "string",
            },
            DhGroups = new[]
            {
                "string",
            },
            DpdAction = "string",
            RekeyTime = 0,
            StartAction = "string",
        },
        RemoteAddress = "string",
        Bgp = new Stackit.Inputs.VpnConnectionTunnel1BgpArgs
        {
            RemoteAsn = 0,
        },
        Peering = new Stackit.Inputs.VpnConnectionTunnel1PeeringArgs
        {
            LocalAddress = "string",
            RemoteAddress = "string",
        },
        PreSharedKey = "string",
        PreSharedKeyWo = "string",
        PreSharedKeyWoVersion = 0,
    },
    Tunnel2 = new Stackit.Inputs.VpnConnectionTunnel2Args
    {
        Phase1 = new Stackit.Inputs.VpnConnectionTunnel2Phase1Args
        {
            EncryptionAlgorithms = new[]
            {
                "string",
            },
            IntegrityAlgorithms = new[]
            {
                "string",
            },
            DhGroups = new[]
            {
                "string",
            },
            RekeyTime = 0,
        },
        Phase2 = new Stackit.Inputs.VpnConnectionTunnel2Phase2Args
        {
            EncryptionAlgorithms = new[]
            {
                "string",
            },
            IntegrityAlgorithms = new[]
            {
                "string",
            },
            DhGroups = new[]
            {
                "string",
            },
            DpdAction = "string",
            RekeyTime = 0,
            StartAction = "string",
        },
        RemoteAddress = "string",
        Bgp = new Stackit.Inputs.VpnConnectionTunnel2BgpArgs
        {
            RemoteAsn = 0,
        },
        Peering = new Stackit.Inputs.VpnConnectionTunnel2PeeringArgs
        {
            LocalAddress = "string",
            RemoteAddress = "string",
        },
        PreSharedKey = "string",
        PreSharedKeyWo = "string",
        PreSharedKeyWoVersion = 0,
    },
    Enabled = false,
    Labels = 
    {
        { "string", "string" },
    },
    LocalSubnets = new[]
    {
        "string",
    },
    Region = "string",
    RemoteSubnets = new[]
    {
        "string",
    },
    StaticRoutes = new[]
    {
        "string",
    },
});

    example, err := stackit.NewVpnConnection(ctx, "vpnConnectionResource", &stackit.VpnConnectionArgs{
	DisplayName: pulumi.String("string"),
	GatewayId:   pulumi.String("string"),
	ProjectId:   pulumi.String("string"),
	Tunnel1: &stackit.VpnConnectionTunnel1Args{
		Phase1: &stackit.VpnConnectionTunnel1Phase1Args{
			EncryptionAlgorithms: pulumi.StringArray{
				pulumi.String("string"),
			},
			IntegrityAlgorithms: pulumi.StringArray{
				pulumi.String("string"),
			},
			DhGroups: pulumi.StringArray{
				pulumi.String("string"),
			},
			RekeyTime: pulumi.Int(0),
		},
		Phase2: &stackit.VpnConnectionTunnel1Phase2Args{
			EncryptionAlgorithms: pulumi.StringArray{
				pulumi.String("string"),
			},
			IntegrityAlgorithms: pulumi.StringArray{
				pulumi.String("string"),
			},
			DhGroups: pulumi.StringArray{
				pulumi.String("string"),
			},
			DpdAction:   pulumi.String("string"),
			RekeyTime:   pulumi.Int(0),
			StartAction: pulumi.String("string"),
		},
		RemoteAddress: pulumi.String("string"),
		Bgp: &stackit.VpnConnectionTunnel1BgpArgs{
			RemoteAsn: pulumi.Int(0),
		},
		Peering: &stackit.VpnConnectionTunnel1PeeringArgs{
			LocalAddress:  pulumi.String("string"),
			RemoteAddress: pulumi.String("string"),
		},
		PreSharedKey:          pulumi.String("string"),
		PreSharedKeyWo:        pulumi.String("string"),
		PreSharedKeyWoVersion: pulumi.Int(0),
	},
	Tunnel2: &stackit.VpnConnectionTunnel2Args{
		Phase1: &stackit.VpnConnectionTunnel2Phase1Args{
			EncryptionAlgorithms: pulumi.StringArray{
				pulumi.String("string"),
			},
			IntegrityAlgorithms: pulumi.StringArray{
				pulumi.String("string"),
			},
			DhGroups: pulumi.StringArray{
				pulumi.String("string"),
			},
			RekeyTime: pulumi.Int(0),
		},
		Phase2: &stackit.VpnConnectionTunnel2Phase2Args{
			EncryptionAlgorithms: pulumi.StringArray{
				pulumi.String("string"),
			},
			IntegrityAlgorithms: pulumi.StringArray{
				pulumi.String("string"),
			},
			DhGroups: pulumi.StringArray{
				pulumi.String("string"),
			},
			DpdAction:   pulumi.String("string"),
			RekeyTime:   pulumi.Int(0),
			StartAction: pulumi.String("string"),
		},
		RemoteAddress: pulumi.String("string"),
		Bgp: &stackit.VpnConnectionTunnel2BgpArgs{
			RemoteAsn: pulumi.Int(0),
		},
		Peering: &stackit.VpnConnectionTunnel2PeeringArgs{
			LocalAddress:  pulumi.String("string"),
			RemoteAddress: pulumi.String("string"),
		},
		PreSharedKey:          pulumi.String("string"),
		PreSharedKeyWo:        pulumi.String("string"),
		PreSharedKeyWoVersion: pulumi.Int(0),
	},
	Enabled: pulumi.Bool(false),
	Labels: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	LocalSubnets: pulumi.StringArray{
		pulumi.String("string"),
	},
	Region: pulumi.String("string"),
	RemoteSubnets: pulumi.StringArray{
		pulumi.String("string"),
	},
	StaticRoutes: pulumi.StringArray{
		pulumi.String("string"),
	},
})

    resource "stackit_vpn_connection" "vpnConnectionResource" {
  lifecycle {
    create_before_destroy = true
  }
  display_name = "string"
  gateway_id   = "string"
  project_id   = "string"
  tunnel1 = {
    phase1 = {
      encryption_algorithms = ["string"]
      integrity_algorithms  = ["string"]
      dh_groups             = ["string"]
      rekey_time            = 0
    }
    phase2 = {
      encryption_algorithms = ["string"]
      integrity_algorithms  = ["string"]
      dh_groups             = ["string"]
      dpd_action            = "string"
      rekey_time            = 0
      start_action          = "string"
    }
    remote_address = "string"
    bgp = {
      remote_asn = 0
    }
    peering = {
      local_address  = "string"
      remote_address = "string"
    }
    pre_shared_key            = "string"
    pre_shared_key_wo         = "string"
    pre_shared_key_wo_version = 0
  }
  tunnel2 = {
    phase1 = {
      encryption_algorithms = ["string"]
      integrity_algorithms  = ["string"]
      dh_groups             = ["string"]
      rekey_time            = 0
    }
    phase2 = {
      encryption_algorithms = ["string"]
      integrity_algorithms  = ["string"]
      dh_groups             = ["string"]
      dpd_action            = "string"
      rekey_time            = 0
      start_action          = "string"
    }
    remote_address = "string"
    bgp = {
      remote_asn = 0
    }
    peering = {
      local_address  = "string"
      remote_address = "string"
    }
    pre_shared_key            = "string"
    pre_shared_key_wo         = "string"
    pre_shared_key_wo_version = 0
  }
  enabled = false
  labels = {
    "string" = "string"
  }
  local_subnets  = ["string"]
  region         = "string"
  remote_subnets = ["string"]
  static_routes  = ["string"]
}

    var vpnConnectionResource = new VpnConnection("vpnConnectionResource", VpnConnectionArgs.builder()
    .displayName("string")
    .gatewayId("string")
    .projectId("string")
    .tunnel1(VpnConnectionTunnel1Args.builder()
        .phase1(VpnConnectionTunnel1Phase1Args.builder()
            .encryptionAlgorithms("string")
            .integrityAlgorithms("string")
            .dhGroups("string")
            .rekeyTime(0)
            .build())
        .phase2(VpnConnectionTunnel1Phase2Args.builder()
            .encryptionAlgorithms("string")
            .integrityAlgorithms("string")
            .dhGroups("string")
            .dpdAction("string")
            .rekeyTime(0)
            .startAction("string")
            .build())
        .remoteAddress("string")
        .bgp(VpnConnectionTunnel1BgpArgs.builder()
            .remoteAsn(0)
            .build())
        .peering(VpnConnectionTunnel1PeeringArgs.builder()
            .localAddress("string")
            .remoteAddress("string")
            .build())
        .preSharedKey("string")
        .preSharedKeyWo("string")
        .preSharedKeyWoVersion(0)
        .build())
    .tunnel2(VpnConnectionTunnel2Args.builder()
        .phase1(VpnConnectionTunnel2Phase1Args.builder()
            .encryptionAlgorithms("string")
            .integrityAlgorithms("string")
            .dhGroups("string")
            .rekeyTime(0)
            .build())
        .phase2(VpnConnectionTunnel2Phase2Args.builder()
            .encryptionAlgorithms("string")
            .integrityAlgorithms("string")
            .dhGroups("string")
            .dpdAction("string")
            .rekeyTime(0)
            .startAction("string")
            .build())
        .remoteAddress("string")
        .bgp(VpnConnectionTunnel2BgpArgs.builder()
            .remoteAsn(0)
            .build())
        .peering(VpnConnectionTunnel2PeeringArgs.builder()
            .localAddress("string")
            .remoteAddress("string")
            .build())
        .preSharedKey("string")
        .preSharedKeyWo("string")
        .preSharedKeyWoVersion(0)
        .build())
    .enabled(false)
    .labels(Map.of("string", "string"))
    .localSubnets("string")
    .region("string")
    .remoteSubnets("string")
    .staticRoutes("string")
    .build());

    vpn_connection_resource = stackit.VpnConnection("vpnConnectionResource",
    display_name="string",
    gateway_id="string",
    project_id="string",
    tunnel1={
        "phase1": {
            "encryption_algorithms": ["string"],
            "integrity_algorithms": ["string"],
            "dh_groups": ["string"],
            "rekey_time": 0,
        },
        "phase2": {
            "encryption_algorithms": ["string"],
            "integrity_algorithms": ["string"],
            "dh_groups": ["string"],
            "dpd_action": "string",
            "rekey_time": 0,
            "start_action": "string",
        },
        "remote_address": "string",
        "bgp": {
            "remote_asn": 0,
        },
        "peering": {
            "local_address": "string",
            "remote_address": "string",
        },
        "pre_shared_key": "string",
        "pre_shared_key_wo": "string",
        "pre_shared_key_wo_version": 0,
    },
    tunnel2={
        "phase1": {
            "encryption_algorithms": ["string"],
            "integrity_algorithms": ["string"],
            "dh_groups": ["string"],
            "rekey_time": 0,
        },
        "phase2": {
            "encryption_algorithms": ["string"],
            "integrity_algorithms": ["string"],
            "dh_groups": ["string"],
            "dpd_action": "string",
            "rekey_time": 0,
            "start_action": "string",
        },
        "remote_address": "string",
        "bgp": {
            "remote_asn": 0,
        },
        "peering": {
            "local_address": "string",
            "remote_address": "string",
        },
        "pre_shared_key": "string",
        "pre_shared_key_wo": "string",
        "pre_shared_key_wo_version": 0,
    },
    enabled=False,
    labels={
        "string": "string",
    },
    local_subnets=["string"],
    region="string",
    remote_subnets=["string"],
    static_routes=["string"])

    const vpnConnectionResource = new stackit.VpnConnection("vpnConnectionResource", {
    displayName: "string",
    gatewayId: "string",
    projectId: "string",
    tunnel1: {
        phase1: {
            encryptionAlgorithms: ["string"],
            integrityAlgorithms: ["string"],
            dhGroups: ["string"],
            rekeyTime: 0,
        },
        phase2: {
            encryptionAlgorithms: ["string"],
            integrityAlgorithms: ["string"],
            dhGroups: ["string"],
            dpdAction: "string",
            rekeyTime: 0,
            startAction: "string",
        },
        remoteAddress: "string",
        bgp: {
            remoteAsn: 0,
        },
        peering: {
            localAddress: "string",
            remoteAddress: "string",
        },
        preSharedKey: "string",
        preSharedKeyWo: "string",
        preSharedKeyWoVersion: 0,
    },
    tunnel2: {
        phase1: {
            encryptionAlgorithms: ["string"],
            integrityAlgorithms: ["string"],
            dhGroups: ["string"],
            rekeyTime: 0,
        },
        phase2: {
            encryptionAlgorithms: ["string"],
            integrityAlgorithms: ["string"],
            dhGroups: ["string"],
            dpdAction: "string",
            rekeyTime: 0,
            startAction: "string",
        },
        remoteAddress: "string",
        bgp: {
            remoteAsn: 0,
        },
        peering: {
            localAddress: "string",
            remoteAddress: "string",
        },
        preSharedKey: "string",
        preSharedKeyWo: "string",
        preSharedKeyWoVersion: 0,
    },
    enabled: false,
    labels: {
        string: "string",
    },
    localSubnets: ["string"],
    region: "string",
    remoteSubnets: ["string"],
    staticRoutes: ["string"],
});

    type: stackit:VpnConnection
properties:
    displayName: string
    enabled: false
    gatewayId: string
    labels:
        string: string
    localSubnets:
        - string
    projectId: string
    region: string
    remoteSubnets:
        - string
    staticRoutes:
        - string
    tunnel1:
        bgp:
            remoteAsn: 0
        peering:
            localAddress: string
            remoteAddress: string
        phase1:
            dhGroups:
                - string
            encryptionAlgorithms:
                - string
            integrityAlgorithms:
                - string
            rekeyTime: 0
        phase2:
            dhGroups:
                - string
            dpdAction: string
            encryptionAlgorithms:
                - string
            integrityAlgorithms:
                - string
            rekeyTime: 0
            startAction: string
        preSharedKey: string
        preSharedKeyWo: string
        preSharedKeyWoVersion: 0
        remoteAddress: string
    tunnel2:
        bgp:
            remoteAsn: 0
        peering:
            localAddress: string
            remoteAddress: string
        phase1:
            dhGroups:
                - string
            encryptionAlgorithms:
                - string
            integrityAlgorithms:
                - string
            rekeyTime: 0
        phase2:
            dhGroups:
                - string
            dpdAction: string
            encryptionAlgorithms:
                - string
            integrityAlgorithms:
                - string
            rekeyTime: 0
            startAction: string
        preSharedKey: string
        preSharedKeyWo: string
        preSharedKeyWoVersion: 0
        remoteAddress: string

    VpnConnection Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The VpnConnection resource accepts the following input properties:

    DisplayName string
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    GatewayId string
    The UUID of the parent VPN gateway.
    ProjectId string
    STACKIT project ID.
    Tunnel1 VpnConnectionTunnel1
    Configuration for the IPsec tunnel1
    Tunnel2 VpnConnectionTunnel2

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    Enabled bool
    Whether this connection is enabled. Defaults to true.
    Labels Dictionary<string, string>
    Map of custom labels.
    LocalSubnets List<string>
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    Region string
    STACKIT region.
    RemoteSubnets List<string>
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    StaticRoutes List<string>
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.
    DisplayName string
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    GatewayId string
    The UUID of the parent VPN gateway.
    ProjectId string
    STACKIT project ID.
    Tunnel1 VpnConnectionTunnel1Args
    Configuration for the IPsec tunnel1
    Tunnel2 VpnConnectionTunnel2Args

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    Enabled bool
    Whether this connection is enabled. Defaults to true.
    Labels map[string]string
    Map of custom labels.
    LocalSubnets []string
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    Region string
    STACKIT region.
    RemoteSubnets []string
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    StaticRoutes []string
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.
    display_name string
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    gateway_id string
    The UUID of the parent VPN gateway.
    project_id string
    STACKIT project ID.
    tunnel1 object
    Configuration for the IPsec tunnel1
    tunnel2 object

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    enabled bool
    Whether this connection is enabled. Defaults to true.
    labels map(string)
    Map of custom labels.
    local_subnets list(string)
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    region string
    STACKIT region.
    remote_subnets list(string)
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    static_routes list(string)
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.
    displayName String
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    gatewayId String
    The UUID of the parent VPN gateway.
    projectId String
    STACKIT project ID.
    tunnel1 VpnConnectionTunnel1
    Configuration for the IPsec tunnel1
    tunnel2 VpnConnectionTunnel2

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    enabled Boolean
    Whether this connection is enabled. Defaults to true.
    labels Map<String,String>
    Map of custom labels.
    localSubnets List<String>
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    region String
    STACKIT region.
    remoteSubnets List<String>
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    staticRoutes List<String>
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.
    displayName string
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    gatewayId string
    The UUID of the parent VPN gateway.
    projectId string
    STACKIT project ID.
    tunnel1 VpnConnectionTunnel1
    Configuration for the IPsec tunnel1
    tunnel2 VpnConnectionTunnel2

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    enabled boolean
    Whether this connection is enabled. Defaults to true.
    labels {[key: string]: string}
    Map of custom labels.
    localSubnets string[]
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    region string
    STACKIT region.
    remoteSubnets string[]
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    staticRoutes string[]
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.
    display_name str
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    gateway_id str
    The UUID of the parent VPN gateway.
    project_id str
    STACKIT project ID.
    tunnel1 VpnConnectionTunnel1Args
    Configuration for the IPsec tunnel1
    tunnel2 VpnConnectionTunnel2Args

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    enabled bool
    Whether this connection is enabled. Defaults to true.
    labels Mapping[str, str]
    Map of custom labels.
    local_subnets Sequence[str]
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    region str
    STACKIT region.
    remote_subnets Sequence[str]
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    static_routes Sequence[str]
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.
    displayName String
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    gatewayId String
    The UUID of the parent VPN gateway.
    projectId String
    STACKIT project ID.
    tunnel1 Property Map
    Configuration for the IPsec tunnel1
    tunnel2 Property Map

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    enabled Boolean
    Whether this connection is enabled. Defaults to true.
    labels Map<String>
    Map of custom labels.
    localSubnets List<String>
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    region String
    STACKIT region.
    remoteSubnets List<String>
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    staticRoutes List<String>
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the VpnConnection resource produces the following output properties:

    ConnectionId string
    The server-generated UUID of the VPN connection.
    Id string
    The provider-assigned unique ID for this managed resource.
    ConnectionId string
    The server-generated UUID of the VPN connection.
    Id string
    The provider-assigned unique ID for this managed resource.
    connection_id string
    The server-generated UUID of the VPN connection.
    id string
    The provider-assigned unique ID for this managed resource.
    connectionId String
    The server-generated UUID of the VPN connection.
    id String
    The provider-assigned unique ID for this managed resource.
    connectionId string
    The server-generated UUID of the VPN connection.
    id string
    The provider-assigned unique ID for this managed resource.
    connection_id str
    The server-generated UUID of the VPN connection.
    id str
    The provider-assigned unique ID for this managed resource.
    connectionId String
    The server-generated UUID of the VPN connection.
    id String
    The provider-assigned unique ID for this managed resource.

    Look up Existing VpnConnection Resource

    Get an existing VpnConnection resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: VpnConnectionState, opts?: CustomResourceOptions): VpnConnection
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        connection_id: Optional[str] = None,
        display_name: Optional[str] = None,
        enabled: Optional[bool] = None,
        gateway_id: Optional[str] = None,
        labels: Optional[Mapping[str, str]] = None,
        local_subnets: Optional[Sequence[str]] = None,
        project_id: Optional[str] = None,
        region: Optional[str] = None,
        remote_subnets: Optional[Sequence[str]] = None,
        static_routes: Optional[Sequence[str]] = None,
        tunnel1: Optional[VpnConnectionTunnel1Args] = None,
        tunnel2: Optional[VpnConnectionTunnel2Args] = None) -> VpnConnection
    func GetVpnConnection(ctx *Context, name string, id IDInput, state *VpnConnectionState, opts ...ResourceOption) (*VpnConnection, error)
    public static VpnConnection Get(string name, Input<string> id, VpnConnectionState? state, CustomResourceOptions? opts = null)
    public static VpnConnection get(String name, Output<String> id, VpnConnectionState state, CustomResourceOptions options)
    resources:  _:    type: stackit:VpnConnection    get:      id: ${id}
    import {
  to = stackit_vpn_connection.example
  id = "${id}"
}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    ConnectionId string
    The server-generated UUID of the VPN connection.
    DisplayName string
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    Enabled bool
    Whether this connection is enabled. Defaults to true.
    GatewayId string
    The UUID of the parent VPN gateway.
    Labels Dictionary<string, string>
    Map of custom labels.
    LocalSubnets List<string>
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    ProjectId string
    STACKIT project ID.
    Region string
    STACKIT region.
    RemoteSubnets List<string>
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    StaticRoutes List<string>
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.
    Tunnel1 VpnConnectionTunnel1
    Configuration for the IPsec tunnel1
    Tunnel2 VpnConnectionTunnel2

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    ConnectionId string
    The server-generated UUID of the VPN connection.
    DisplayName string
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    Enabled bool
    Whether this connection is enabled. Defaults to true.
    GatewayId string
    The UUID of the parent VPN gateway.
    Labels map[string]string
    Map of custom labels.
    LocalSubnets []string
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    ProjectId string
    STACKIT project ID.
    Region string
    STACKIT region.
    RemoteSubnets []string
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    StaticRoutes []string
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.
    Tunnel1 VpnConnectionTunnel1Args
    Configuration for the IPsec tunnel1
    Tunnel2 VpnConnectionTunnel2Args

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    connection_id string
    The server-generated UUID of the VPN connection.
    display_name string
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    enabled bool
    Whether this connection is enabled. Defaults to true.
    gateway_id string
    The UUID of the parent VPN gateway.
    labels map(string)
    Map of custom labels.
    local_subnets list(string)
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    project_id string
    STACKIT project ID.
    region string
    STACKIT region.
    remote_subnets list(string)
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    static_routes list(string)
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.
    tunnel1 object
    Configuration for the IPsec tunnel1
    tunnel2 object

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    connectionId String
    The server-generated UUID of the VPN connection.
    displayName String
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    enabled Boolean
    Whether this connection is enabled. Defaults to true.
    gatewayId String
    The UUID of the parent VPN gateway.
    labels Map<String,String>
    Map of custom labels.
    localSubnets List<String>
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    projectId String
    STACKIT project ID.
    region String
    STACKIT region.
    remoteSubnets List<String>
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    staticRoutes List<String>
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.
    tunnel1 VpnConnectionTunnel1
    Configuration for the IPsec tunnel1
    tunnel2 VpnConnectionTunnel2

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    connectionId string
    The server-generated UUID of the VPN connection.
    displayName string
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    enabled boolean
    Whether this connection is enabled. Defaults to true.
    gatewayId string
    The UUID of the parent VPN gateway.
    labels {[key: string]: string}
    Map of custom labels.
    localSubnets string[]
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    projectId string
    STACKIT project ID.
    region string
    STACKIT region.
    remoteSubnets string[]
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    staticRoutes string[]
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.
    tunnel1 VpnConnectionTunnel1
    Configuration for the IPsec tunnel1
    tunnel2 VpnConnectionTunnel2

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    connection_id str
    The server-generated UUID of the VPN connection.
    display_name str
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    enabled bool
    Whether this connection is enabled. Defaults to true.
    gateway_id str
    The UUID of the parent VPN gateway.
    labels Mapping[str, str]
    Map of custom labels.
    local_subnets Sequence[str]
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    project_id str
    STACKIT project ID.
    region str
    STACKIT region.
    remote_subnets Sequence[str]
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    static_routes Sequence[str]
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.
    tunnel1 VpnConnectionTunnel1Args
    Configuration for the IPsec tunnel1
    tunnel2 VpnConnectionTunnel2Args

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    connectionId String
    The server-generated UUID of the VPN connection.
    displayName String
    A user-friendly name for the connection. Must start and end with an alphanumeric character, may contain hyphens, and be 1-63 characters long.
    enabled Boolean
    Whether this connection is enabled. Defaults to true.
    gatewayId String
    The UUID of the parent VPN gateway.
    labels Map<String>
    Map of custom labels.
    localSubnets List<String>
    List of local IPv4 CIDRs to route through this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    projectId String
    STACKIT project ID.
    region String
    STACKIT region.
    remoteSubnets List<String>
    List of remote IPv4 CIDRs accessible via this connection. Optional for route-based and BGP configurations (defaults to 0.0.0.0/0). Mandatory for policy-based.
    staticRoutes List<String>
    List of static routes (IPv4 CIDRs) for route-based VPN. Mandatory for ROUTE_BASED gateways.
    tunnel1 Property Map
    Configuration for the IPsec tunnel1
    tunnel2 Property Map

    Configuration for the IPsec tunnel2

    Write-Only argument preSharedKeyWo is available to use in place of preSharedKey. Write-Only arguments are supported in HashiCorp Terraform 1.11.0 and later. Learn more.

    Supporting Types

    VpnConnectionTunnel1, VpnConnectionTunnel1Args

    Phase1 VpnConnectionTunnel1Phase1
    Phase2 VpnConnectionTunnel1Phase2
    RemoteAddress string
    Remote IPv4 address for the tunnel endpoint.
    Bgp VpnConnectionTunnel1Bgp
    Peering VpnConnectionTunnel1Peering
    PreSharedKey string
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    PreSharedKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    PreSharedKeyWoVersion int
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.
    Phase1 VpnConnectionTunnel1Phase1
    Phase2 VpnConnectionTunnel1Phase2
    RemoteAddress string
    Remote IPv4 address for the tunnel endpoint.
    Bgp VpnConnectionTunnel1Bgp
    Peering VpnConnectionTunnel1Peering
    PreSharedKey string
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    PreSharedKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    PreSharedKeyWoVersion int
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.
    phase1 object
    phase2 object
    remote_address string
    Remote IPv4 address for the tunnel endpoint.
    bgp object
    peering object
    pre_shared_key string
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    pre_shared_key_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    pre_shared_key_wo_version number
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.
    phase1 VpnConnectionTunnel1Phase1
    phase2 VpnConnectionTunnel1Phase2
    remoteAddress String
    Remote IPv4 address for the tunnel endpoint.
    bgp VpnConnectionTunnel1Bgp
    peering VpnConnectionTunnel1Peering
    preSharedKey String
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    preSharedKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    preSharedKeyWoVersion Integer
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.
    phase1 VpnConnectionTunnel1Phase1
    phase2 VpnConnectionTunnel1Phase2
    remoteAddress string
    Remote IPv4 address for the tunnel endpoint.
    bgp VpnConnectionTunnel1Bgp
    peering VpnConnectionTunnel1Peering
    preSharedKey string
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    preSharedKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    preSharedKeyWoVersion number
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.
    phase1 VpnConnectionTunnel1Phase1
    phase2 VpnConnectionTunnel1Phase2
    remote_address str
    Remote IPv4 address for the tunnel endpoint.
    bgp VpnConnectionTunnel1Bgp
    peering VpnConnectionTunnel1Peering
    pre_shared_key str
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    pre_shared_key_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    pre_shared_key_wo_version int
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.
    phase1 Property Map
    phase2 Property Map
    remoteAddress String
    Remote IPv4 address for the tunnel endpoint.
    bgp Property Map
    peering Property Map
    preSharedKey String
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    preSharedKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    preSharedKeyWoVersion Number
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.

    VpnConnectionTunnel1Bgp, VpnConnectionTunnel1BgpArgs

    RemoteAsn int
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).
    RemoteAsn int
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).
    remote_asn number
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).
    remoteAsn Integer
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).
    remoteAsn number
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).
    remote_asn int
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).
    remoteAsn Number
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).

    VpnConnectionTunnel1Peering, VpnConnectionTunnel1PeeringArgs

    LocalAddress string
    Local tunnel interface IPv4 address.
    RemoteAddress string
    Remote tunnel interface IPv4 address.
    LocalAddress string
    Local tunnel interface IPv4 address.
    RemoteAddress string
    Remote tunnel interface IPv4 address.
    local_address string
    Local tunnel interface IPv4 address.
    remote_address string
    Remote tunnel interface IPv4 address.
    localAddress String
    Local tunnel interface IPv4 address.
    remoteAddress String
    Remote tunnel interface IPv4 address.
    localAddress string
    Local tunnel interface IPv4 address.
    remoteAddress string
    Remote tunnel interface IPv4 address.
    local_address str
    Local tunnel interface IPv4 address.
    remote_address str
    Remote tunnel interface IPv4 address.
    localAddress String
    Local tunnel interface IPv4 address.
    remoteAddress String
    Remote tunnel interface IPv4 address.

    VpnConnectionTunnel1Phase1, VpnConnectionTunnel1Phase1Args

    EncryptionAlgorithms List<string>
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    IntegrityAlgorithms List<string>
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    DhGroups List<string>
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    RekeyTime int
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.
    EncryptionAlgorithms []string
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    IntegrityAlgorithms []string
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    DhGroups []string
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    RekeyTime int
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.
    encryption_algorithms list(string)
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrity_algorithms list(string)
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    dh_groups list(string)
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    rekey_time number
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.
    encryptionAlgorithms List<String>
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrityAlgorithms List<String>
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    dhGroups List<String>
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    rekeyTime Integer
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.
    encryptionAlgorithms string[]
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrityAlgorithms string[]
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    dhGroups string[]
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    rekeyTime number
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.
    encryption_algorithms Sequence[str]
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrity_algorithms Sequence[str]
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    dh_groups Sequence[str]
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    rekey_time int
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.
    encryptionAlgorithms List<String>
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrityAlgorithms List<String>
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    dhGroups List<String>
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    rekeyTime Number
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.

    VpnConnectionTunnel1Phase2, VpnConnectionTunnel1Phase2Args

    EncryptionAlgorithms List<string>
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    IntegrityAlgorithms List<string>
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    DhGroups List<string>
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    DpdAction string
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    RekeyTime int
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    StartAction string
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.
    EncryptionAlgorithms []string
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    IntegrityAlgorithms []string
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    DhGroups []string
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    DpdAction string
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    RekeyTime int
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    StartAction string
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.
    encryption_algorithms list(string)
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrity_algorithms list(string)
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    dh_groups list(string)
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    dpd_action string
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    rekey_time number
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    start_action string
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.
    encryptionAlgorithms List<String>
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrityAlgorithms List<String>
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    dhGroups List<String>
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    dpdAction String
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    rekeyTime Integer
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    startAction String
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.
    encryptionAlgorithms string[]
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrityAlgorithms string[]
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    dhGroups string[]
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    dpdAction string
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    rekeyTime number
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    startAction string
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.
    encryption_algorithms Sequence[str]
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrity_algorithms Sequence[str]
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    dh_groups Sequence[str]
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    dpd_action str
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    rekey_time int
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    start_action str
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.
    encryptionAlgorithms List<String>
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrityAlgorithms List<String>
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    dhGroups List<String>
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    dpdAction String
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    rekeyTime Number
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    startAction String
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.

    VpnConnectionTunnel2, VpnConnectionTunnel2Args

    Phase1 VpnConnectionTunnel2Phase1
    Phase2 VpnConnectionTunnel2Phase2
    RemoteAddress string
    Remote IPv4 address for the tunnel endpoint.
    Bgp VpnConnectionTunnel2Bgp
    Peering VpnConnectionTunnel2Peering
    PreSharedKey string
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    PreSharedKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    PreSharedKeyWoVersion int
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.
    Phase1 VpnConnectionTunnel2Phase1
    Phase2 VpnConnectionTunnel2Phase2
    RemoteAddress string
    Remote IPv4 address for the tunnel endpoint.
    Bgp VpnConnectionTunnel2Bgp
    Peering VpnConnectionTunnel2Peering
    PreSharedKey string
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    PreSharedKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    PreSharedKeyWoVersion int
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.
    phase1 object
    phase2 object
    remote_address string
    Remote IPv4 address for the tunnel endpoint.
    bgp object
    peering object
    pre_shared_key string
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    pre_shared_key_wo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    pre_shared_key_wo_version number
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.
    phase1 VpnConnectionTunnel2Phase1
    phase2 VpnConnectionTunnel2Phase2
    remoteAddress String
    Remote IPv4 address for the tunnel endpoint.
    bgp VpnConnectionTunnel2Bgp
    peering VpnConnectionTunnel2Peering
    preSharedKey String
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    preSharedKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    preSharedKeyWoVersion Integer
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.
    phase1 VpnConnectionTunnel2Phase1
    phase2 VpnConnectionTunnel2Phase2
    remoteAddress string
    Remote IPv4 address for the tunnel endpoint.
    bgp VpnConnectionTunnel2Bgp
    peering VpnConnectionTunnel2Peering
    preSharedKey string
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    preSharedKeyWo string
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    preSharedKeyWoVersion number
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.
    phase1 VpnConnectionTunnel2Phase1
    phase2 VpnConnectionTunnel2Phase2
    remote_address str
    Remote IPv4 address for the tunnel endpoint.
    bgp VpnConnectionTunnel2Bgp
    peering VpnConnectionTunnel2Peering
    pre_shared_key str
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    pre_shared_key_wo str
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    pre_shared_key_wo_version int
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.
    phase1 Property Map
    phase2 Property Map
    remoteAddress String
    Remote IPv4 address for the tunnel endpoint.
    bgp Property Map
    peering Property Map
    preSharedKey String
    Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only argument preSharedKeyWo should be preferred.
    preSharedKeyWo String
    NOTE: This field is write-only and its value will not be updated in state as part of read operations. Pre-shared key for the IPsec tunnel. Minimum 20 characters. Write-only - never stored in state and never returned by the API. To rotate the key, update this value AND increment presharedkeywoversion. Changing this field alone will NOT trigger an update.
    preSharedKeyWoVersion Number
    User-managed rotation counter for the pre-shared key. Must be incremented every time presharedkeywo is changed. Terraform diffs this field to detect key rotations - changing presharedkeywo alone will NOT trigger an update because it is write-only and never stored in state.

    VpnConnectionTunnel2Bgp, VpnConnectionTunnel2BgpArgs

    RemoteAsn int
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).
    RemoteAsn int
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).
    remote_asn number
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).
    remoteAsn Integer
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).
    remoteAsn number
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).
    remote_asn int
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).
    remoteAsn Number
    Remote ASN for BGP peering (private ASN range, 64512-4294967294).

    VpnConnectionTunnel2Peering, VpnConnectionTunnel2PeeringArgs

    LocalAddress string
    Local tunnel interface IPv4 address.
    RemoteAddress string
    Remote tunnel interface IPv4 address.
    LocalAddress string
    Local tunnel interface IPv4 address.
    RemoteAddress string
    Remote tunnel interface IPv4 address.
    local_address string
    Local tunnel interface IPv4 address.
    remote_address string
    Remote tunnel interface IPv4 address.
    localAddress String
    Local tunnel interface IPv4 address.
    remoteAddress String
    Remote tunnel interface IPv4 address.
    localAddress string
    Local tunnel interface IPv4 address.
    remoteAddress string
    Remote tunnel interface IPv4 address.
    local_address str
    Local tunnel interface IPv4 address.
    remote_address str
    Remote tunnel interface IPv4 address.
    localAddress String
    Local tunnel interface IPv4 address.
    remoteAddress String
    Remote tunnel interface IPv4 address.

    VpnConnectionTunnel2Phase1, VpnConnectionTunnel2Phase1Args

    EncryptionAlgorithms List<string>
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    IntegrityAlgorithms List<string>
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    DhGroups List<string>
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    RekeyTime int
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.
    EncryptionAlgorithms []string
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    IntegrityAlgorithms []string
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    DhGroups []string
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    RekeyTime int
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.
    encryption_algorithms list(string)
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrity_algorithms list(string)
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    dh_groups list(string)
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    rekey_time number
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.
    encryptionAlgorithms List<String>
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrityAlgorithms List<String>
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    dhGroups List<String>
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    rekeyTime Integer
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.
    encryptionAlgorithms string[]
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrityAlgorithms string[]
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    dhGroups string[]
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    rekeyTime number
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.
    encryption_algorithms Sequence[str]
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrity_algorithms Sequence[str]
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    dh_groups Sequence[str]
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    rekey_time int
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.
    encryptionAlgorithms List<String>
    Encryption algorithms for Phase 1. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrityAlgorithms List<String>
    Integrity algorithms for Phase 1. Possible values are: sha1, sha2256, sha2384.
    dhGroups List<String>
    Diffie-Hellman groups for key exchange. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    rekeyTime Number
    Time to schedule an IKE re-keying in seconds. Range: 900-28800. Default: 14400.

    VpnConnectionTunnel2Phase2, VpnConnectionTunnel2Phase2Args

    EncryptionAlgorithms List<string>
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    IntegrityAlgorithms List<string>
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    DhGroups List<string>
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    DpdAction string
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    RekeyTime int
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    StartAction string
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.
    EncryptionAlgorithms []string
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    IntegrityAlgorithms []string
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    DhGroups []string
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    DpdAction string
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    RekeyTime int
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    StartAction string
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.
    encryption_algorithms list(string)
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrity_algorithms list(string)
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    dh_groups list(string)
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    dpd_action string
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    rekey_time number
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    start_action string
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.
    encryptionAlgorithms List<String>
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrityAlgorithms List<String>
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    dhGroups List<String>
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    dpdAction String
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    rekeyTime Integer
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    startAction String
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.
    encryptionAlgorithms string[]
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrityAlgorithms string[]
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    dhGroups string[]
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    dpdAction string
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    rekeyTime number
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    startAction string
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.
    encryption_algorithms Sequence[str]
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrity_algorithms Sequence[str]
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    dh_groups Sequence[str]
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    dpd_action str
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    rekey_time int
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    start_action str
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.
    encryptionAlgorithms List<String>
    Encryption algorithms for Phase 2. Possible values are: aes256, aes128gcm16, aes256gcm16.
    integrityAlgorithms List<String>
    Integrity algorithms for Phase 2. Possible values are: sha1, sha2256, sha2384.
    dhGroups List<String>
    Diffie-Hellman groups for Phase 2. Possible values are: modp1024, modp2048, ecp256, ecp384, modp2048s256.
    dpdAction String
    Action to perform on DPD timeout. Default: 'restart'. Possible values are: clear, restart.
    rekeyTime Number
    Time to schedule a Child SA re-keying in seconds. Range: 900-3600. Default: 3600.
    startAction String
    Action to perform after loading the connection configuration. Default: 'start'. Possible values are: none, start.

    Import

    In Terraform v1.5.0 and later, the + "" + import + “" + block can be used with the + "” + id + “" + attribute, for example:

    # Only use the import statement, if you want to import an existing VPN connection
import {
  to = stackit_vpn_connection.example
  id = "${var.project_id},${var.region},${var.gateway_id},${var.connection_id}"
}

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    stackit stackitcloud/pulumi-stackit
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the stackit Terraform Provider.
    stackit logo
    Viewing docs for stackit v0.0.7
    published on Monday, Aug 17, 2026 by stackitcloud
    Schema (JSON)
    stackitcloud/pulumi-stackit

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial