# VpcEncryptionControlProperty

Describes the configuration and state of VPC encryption controls.

For more information, see [Enforce VPC encryption in transit](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-encryption-controls.html) in the *Amazon VPC User Guide*.

- Source: Generated code
- Type last changed: v2.264.0 · 10 Aug 2026

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_ec2 as ec2 } from 'aws-cdk-lib';
const vpcEncryptionControlProperty: ec2.CfnVPC.VpcEncryptionControlProperty = {
  egressOnlyInternetGatewayExclusion: 'egressOnlyInternetGatewayExclusion',
  elasticFileSystemExclusion: 'elasticFileSystemExclusion',
  internetGatewayExclusion: 'internetGatewayExclusion',
  lambdaExclusion: 'lambdaExclusion',
  mode: 'mode',
  natGatewayExclusion: 'natGatewayExclusion',
  resourceExclusions: {
    egressOnlyInternetGateway: {
      state: 'state',
      stateMessage: 'stateMessage',
    },
    elasticFileSystem: {
      state: 'state',
      stateMessage: 'stateMessage',
    },
    internetGateway: {
      state: 'state',
      stateMessage: 'stateMessage',
    },
    lambda: {
      state: 'state',
      stateMessage: 'stateMessage',
    },
    natGateway: {
      state: 'state',
      stateMessage: 'stateMessage',
    },
    virtualPrivateGateway: {
      state: 'state',
      stateMessage: 'stateMessage',
    },
    vpcLattice: {
      state: 'state',
      stateMessage: 'stateMessage',
    },
    vpcPeering: {
      state: 'state',
      stateMessage: 'stateMessage',
    },
  },
  state: 'state',
  stateMessage: 'stateMessage',
  virtualPrivateGatewayExclusion: 'virtualPrivateGatewayExclusion',
  vpcEncryptionControlId: 'vpcEncryptionControlId',
  vpcId: 'vpcId',
  vpcLatticeExclusion: 'vpcLatticeExclusion',
  vpcPeeringExclusion: 'vpcPeeringExclusion',
};
```

## Properties

- `egressOnlyInternetGatewayExclusion`: string

- `elasticFileSystemExclusion`: string

- `internetGatewayExclusion`: string

- `lambdaExclusion`: string

- `mode`: string — The encryption mode for the VPC Encryption Control configuration.

- `natGatewayExclusion`: string

- `resourceExclusions`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnVPC.VpcEncryptionControlExclusionsProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnVPC.VpcEncryptionControlExclusionsProperty.html) — Describes the exclusion configurations for various resource types in VPC Encryption Control.

  For more information, see [Enforce VPC encryption in transit](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-encryption-controls.html) in the *Amazon VPC User Guide*.

- `state`: string — The current state of the VPC Encryption Control configuration.

- `stateMessage`: string — A message providing additional information about the encryption control state.

- `virtualPrivateGatewayExclusion`: string

- `vpcEncryptionControlId`: string — The ID of the VPC Encryption Control configuration.

- `vpcId`: string — The ID of the VPC associated with the encryption control configuration.

- `vpcLatticeExclusion`: string

- `vpcPeeringExclusion`: string