# CfnVPCEncryptionControlProps

Properties for defining a `CfnVPCEncryptionControl`.

Extends: CfnVPCEncryptionControlProps
Used as props by: CfnVPCEncryptionControl

- Source: Generated code
- Type last changed: v2.230.0 · 26 Nov 2025

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_ec2 as ec2 } from 'aws-cdk-lib';
const cfnVPCEncryptionControlProps: ec2.CfnVPCEncryptionControlProps = {
  egressOnlyInternetGatewayExclusionInput: 'egressOnlyInternetGatewayExclusionInput',
  elasticFileSystemExclusionInput: 'elasticFileSystemExclusionInput',
  internetGatewayExclusionInput: 'internetGatewayExclusionInput',
  lambdaExclusionInput: 'lambdaExclusionInput',
  mode: 'mode',
  natGatewayExclusionInput: 'natGatewayExclusionInput',
  tags: [{
    key: 'key',
    value: 'value',
  }],
  virtualPrivateGatewayExclusionInput: 'virtualPrivateGatewayExclusionInput',
  vpcId: 'vpcId',
  vpcLatticeExclusionInput: 'vpcLatticeExclusionInput',
  vpcPeeringExclusionInput: 'vpcPeeringExclusionInput',
};
```

## Properties

- `egressOnlyInternetGatewayExclusionInput`: string — Specifies whether to exclude egress-only internet gateway traffic from encryption enforcement.

- `elasticFileSystemExclusionInput`: string — Specifies whether to exclude Elastic File System traffic from encryption enforcement.

- `internetGatewayExclusionInput`: string — Specifies whether to exclude internet gateway traffic from encryption enforcement.

- `lambdaExclusionInput`: string — Specifies whether to exclude Lambda function traffic from encryption enforcement.

- `mode`: string — The encryption mode for the VPC Encryption Control configuration.

- `natGatewayExclusionInput`: string — Specifies whether to exclude NAT gateway traffic from encryption enforcement.

- `tags`: [CfnTag](/cdk/api/v2/docs/aws-cdk-lib.CfnTag.html)[] — The tags assigned to the VPC Encryption Control configuration.

- `virtualPrivateGatewayExclusionInput`: string — Specifies whether to exclude virtual private gateway traffic from encryption enforcement.

- `vpcId`: string — The ID of the VPC for which to create the encryption control configuration.

- `vpcLatticeExclusionInput`: string — Specifies whether to exclude VPC Lattice traffic from encryption enforcement.

- `vpcPeeringExclusionInput`: string — Specifies whether to exclude VPC peering connection traffic from encryption enforcement.