# ResourceExclusionsProperty

Information about resource exclusions for the VPC Encryption Control configuration.

- Source: Generated code
- Type last changed: v2.230.0 · 26 Nov 2025

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_ec2 as ec2 } from 'aws-cdk-lib';
const resourceExclusionsProperty: ec2.CfnVPCEncryptionControl.ResourceExclusionsProperty = {
  egressOnlyInternetGateway: {
    state: 'state',
    stateMessage: 'stateMessage',
  },
  elasticFileSystem: {
    state: 'state',
    stateMessage: 'stateMessage',
  },
  internetGateway: {
    state: 'state',
    stateMessage: 'stateMessage',
  },
  lambda: {
    state: 'state',
    stateMessage: 'stateMessage',
  },
  natGateway: {
    state: 'state',
    stateMessage: 'stateMessage',
  },
  virtualPrivateGateway: {
    state: 'state',
    stateMessage: 'stateMessage',
  },
  vpcLattice: {
    state: 'state',
    stateMessage: 'stateMessage',
  },
  vpcPeering: {
    state: 'state',
    stateMessage: 'stateMessage',
  },
};
```

## Properties

- `egressOnlyInternetGateway`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty.html) — Specifies whether to exclude egress-only internet gateway traffic from encryption enforcement.

- `elasticFileSystem`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty.html) — Specifies whether to exclude Elastic File System traffic from encryption enforcement.

- `internetGateway`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty.html) — Specifies whether to exclude internet gateway traffic from encryption enforcement.

- `lambda`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty.html) — Specifies whether to exclude Lambda function traffic from encryption enforcement.

- `natGateway`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty.html) — Specifies whether to exclude NAT gateway traffic from encryption enforcement.

- `virtualPrivateGateway`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty.html) — Specifies whether to exclude virtual private gateway traffic from encryption enforcement.

- `vpcLattice`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty.html) — Specifies whether to exclude VPC Lattice traffic from encryption enforcement.

- `vpcPeering`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnVPCEncryptionControl.VpcEncryptionControlExclusionProperty.html) — Specifies whether to exclude VPC peering connection traffic from encryption enforcement.