# CfnVPNConnectionProps

Properties for defining a `CfnVPNConnection`.

Extends: CfnVPNConnectionProps
Used as props by: CfnVPNConnection

- Source: Generated code
- Type last changed: v2.227.0 · 21 Nov 2025

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_ec2 as ec2 } from 'aws-cdk-lib';
const cfnVPNConnectionProps: ec2.CfnVPNConnectionProps = {
  customerGatewayId: 'customerGatewayId',
  type: 'type',

  // the properties below are optional
  enableAcceleration: false,
  localIpv4NetworkCidr: 'localIpv4NetworkCidr',
  localIpv6NetworkCidr: 'localIpv6NetworkCidr',
  outsideIpAddressType: 'outsideIpAddressType',
  preSharedKeyStorage: 'preSharedKeyStorage',
  remoteIpv4NetworkCidr: 'remoteIpv4NetworkCidr',
  remoteIpv6NetworkCidr: 'remoteIpv6NetworkCidr',
  staticRoutesOnly: false,
  tags: [{
    key: 'key',
    value: 'value',
  }],
  transitGatewayId: 'transitGatewayId',
  transportTransitGatewayAttachmentId: 'transportTransitGatewayAttachmentId',
  tunnelBandwidth: 'tunnelBandwidth',
  tunnelInsideIpVersion: 'tunnelInsideIpVersion',
  vpnConcentratorId: 'vpnConcentratorId',
  vpnGatewayId: 'vpnGatewayId',
  vpnTunnelOptionsSpecifications: [{
    dpdTimeoutAction: 'dpdTimeoutAction',
    dpdTimeoutSeconds: 123,
    enableTunnelLifecycleControl: false,
    ikeVersions: [{
      value: 'value',
    }],
    logOptions: {
      cloudwatchLogOptions: {
        bgpLogEnabled: false,
        bgpLogGroupArn: 'bgpLogGroupArn',
        bgpLogOutputFormat: 'bgpLogOutputFormat',
        logEnabled: false,
        logGroupArn: 'logGroupArn',
        logOutputFormat: 'logOutputFormat',
      },
    },
    phase1DhGroupNumbers: [{
      value: 123,
    }],
    phase1EncryptionAlgorithms: [{
      value: 'value',
    }],
    phase1IntegrityAlgorithms: [{
      value: 'value',
    }],
    phase1LifetimeSeconds: 123,
    phase2DhGroupNumbers: [{
      value: 123,
    }],
    phase2EncryptionAlgorithms: [{
      value: 'value',
    }],
    phase2IntegrityAlgorithms: [{
      value: 'value',
    }],
    phase2LifetimeSeconds: 123,
    preSharedKey: 'preSharedKey',
    rekeyFuzzPercentage: 123,
    rekeyMarginTimeSeconds: 123,
    replayWindowSize: 123,
    startupAction: 'startupAction',
    tunnelInsideCidr: 'tunnelInsideCidr',
    tunnelInsideIpv6Cidr: 'tunnelInsideIpv6Cidr',
  }],
};
```

## Properties

- `customerGatewayId`: string | [ICustomerGatewayRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_ec2.ICustomerGatewayRef.html) (required) — The ID of the customer gateway at your end of the VPN connection.

- `enableAcceleration`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — Indicate whether to enable acceleration for the VPN connection.

  Default: `false`

- `localIpv4NetworkCidr`: string — The IPv4 CIDR on the customer gateway (on-premises) side of the VPN connection.

  Default: `0.0.0.0/0`

- `localIpv6NetworkCidr`: string — The IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection.

  Default: `::/0`

- `outsideIpAddressType`: string — The type of IP address assigned to the outside interface of the customer gateway device.

  Valid values: `PrivateIpv4` | `PublicIpv4` | `Ipv6`

  Default: `PublicIpv4`

- `preSharedKeyStorage`: string — Describes the storage location for an instance store-backed AMI.

- `remoteIpv4NetworkCidr`: string — The IPv4 CIDR on the AWS side of the VPN connection.

  Default: `0.0.0.0/0`

- `remoteIpv6NetworkCidr`: string — The IPv6 CIDR on the AWS side of the VPN connection.

  Default: `::/0`

- `staticRoutesOnly`: boolean | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) — Indicates whether the VPN connection uses static routes only.

  Static routes must be used for devices that don't support BGP.

  If you are creating a VPN connection for a device that does not support Border Gateway Protocol (BGP), you must specify `true` .

- `tags`: [CfnTag](/cdk/api/v2/docs/aws-cdk-lib.CfnTag.html)[] — Any tags assigned to the VPN connection.

- `transitGatewayId`: string | [ITransitGatewayRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_ec2.ITransitGatewayRef.html) — The ID of the transit gateway associated with the VPN connection.

  You must specify either `TransitGatewayId` or `VpnGatewayId` , but not both.

- `transportTransitGatewayAttachmentId`: string — The transit gateway attachment ID to use for the VPN tunnel.

  Required if `OutsideIpAddressType` is set to `PrivateIpv4` .

- `tunnelBandwidth`: string = "standard" — The desired bandwidth specification for the VPN tunnel, used when creating or modifying VPN connection options to set the tunnel's throughput capacity.

  `standard` supports up to 1.25 Gbps per tunnel, while `large` supports up to 5 Gbps per tunnel. The default value is `standard` . Existing VPN connections without a bandwidth setting will automatically default to `standard` .

- `tunnelInsideIpVersion`: string — Indicate whether the VPN tunnels process IPv4 or IPv6 traffic.

  Default: `ipv4`

- `type`: string (required) — The type of VPN connection.

- `vpnConcentratorId`: string — The ID of the VPN concentrator to associate with the VPN connection.

- `vpnGatewayId`: string | [IVPNGatewayRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_ec2.IVPNGatewayRef.html) — The ID of the virtual private gateway at the AWS side of the VPN connection.

  You must specify either `TransitGatewayId` or `VpnGatewayId` , but not both.

- `vpnTunnelOptionsSpecifications`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnVPNConnection.VpnTunnelOptionsSpecificationProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnVPNConnection.VpnTunnelOptionsSpecificationProperty.html)[] — The tunnel options for the VPN connection.