aws-cdk-lib.aws_ec2.NatInstanceProps

NatInstanceProps Struct

Properties for a NAT instance.

NatInstanceProps

used as props by

• NatInstanceProvider,
• NatInstanceProviderV2

Source

aws-ec2/lib/nat.ts

Type last changed

v2.164.0 · 24 Oct 2024

Example

declare const instanceType: ec2.InstanceType;

const provider = ec2.NatProvider.instanceV2({
  instanceType,
  defaultAllowedTraffic: ec2.NatTrafficDirection.OUTBOUND_ONLY,
});
new ec2.Vpc(this, 'TheVPC', {
  natGatewayProvider: provider,
});
provider.connections.allowFrom(ec2.Peer.ipv4('1.2.3.4/8'), ec2.Port.HTTP);

Properties

associatePublicIpAddress?optionalbooleanassociate_public_ip_address?optionalboolassociatePublicIpAddress?optionalBooleanAssociatePublicIpAddress?optionalboolAssociatePublicIpAddress?optional*bool#

Whether to associate a public IP address to the primary network interface attached to this instance.

Default: undefined - No public IP address associated

creditSpecification?optionalCpuCreditscredit_specification?optionalCpuCreditscreditSpecification?optionalCpuCreditsCreditSpecification?optionalCpuCreditsCreditSpecification?optionalCpuCredits#

Specifying the CPU credit type for burstable EC2 instance types (T2, T3, T3a, etc).

Default: T2 instances are standard, while T3, T4g, and T3a instances are unlimited.

The unlimited CPU credit option is not supported for T3 instances with dedicated host (host) tenancy.

defaultAllowedTraffic?optionalNatTrafficDirectiondefault_allowed_traffic?optionalNatTrafficDirectiondefaultAllowedTraffic?optionalNatTrafficDirectionDefaultAllowedTraffic?optionalNatTrafficDirectionDefaultAllowedTraffic?optionalNatTrafficDirection#

Direction to allow all traffic through the NAT instance by default.

Default: NatTrafficDirection.INBOUND_AND_OUTBOUND

notes

By default, inbound and outbound traffic is allowed.

If you set this to another value than INBOUND_AND_OUTBOUND, you must configure the NAT instance's security groups in another way, either by passing in a fully configured Security Group using the securityGroup property, or by configuring it using the .securityGroup or .connections members after passing the NAT Instance Provider to a Vpc.

instanceTypeInstanceTypeinstance_typeInstanceTypeinstanceTypeInstanceTypeInstanceTypeInstanceTypeInstanceTypeInstanceTyperequired#

Instance type of the NAT instance.

keyName?optionalstringkey_name?optionalstrkeyName?optionalStringKeyName?optionalstringKeyName?optional*stringdeprecated#

- Use `keyPair` instead - https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2-readme.html#using-an-existing-ec2-key-pair

Default: No SSH access will be possible.

keyPair?optionalIKeyPairkey_pair?optionalIKeyPairkeyPair?optionalIKeyPairKeyPair?optionalIKeyPairKeyPair?optionalIKeyPair#

The SSH keypair to grant access to the instance.

Default: No SSH access will be possible.

machineImage?optionalIMachineImagemachine_image?optionalIMachineImagemachineImage?optionalIMachineImageMachineImage?optionalIMachineImageMachineImage?optionalIMachineImage#

The machine image (AMI) to use.

Default: Latest NAT instance image

notes

By default, will do an AMI lookup for the latest NAT instance image.

If you have a specific AMI ID you want to use, pass a GenericLinuxImage. For example:

ec2.NatProvider.instance({
  instanceType: new ec2.InstanceType('t3.micro'),
  machineImage: new ec2.GenericLinuxImage({
    'us-east-2': 'ami-0f9c61b5a562a16af'
  })
})

securityGroup?optionalISecurityGroupsecurity_group?optionalISecurityGroupsecurityGroup?optionalISecurityGroupSecurityGroup?optionalISecurityGroupSecurityGroup?optionalISecurityGroupdeprecated#

- Cannot create a new security group before the VPC is created, and cannot create the VPC without the NAT provider. Set {@link defaultAllowedTraffic } to {@link NatTrafficDirection.NONE } and use {@link NatInstanceProviderV2.gatewayInstances } to retrieve the instances on the fly and add security groups

Default: A new security group will be created

example

const natGatewayProvider = ec2.NatProvider.instanceV2({
  instanceType: new ec2.InstanceType('t3.small'),
  defaultAllowedTraffic: ec2.NatTrafficDirection.NONE,
});
const vpc = new ec2.Vpc(this, 'Vpc', { natGatewayProvider });

const securityGroup = new ec2.SecurityGroup(this, 'SecurityGroup', {
  vpc,
  allowAllOutbound: false,
});
securityGroup.addEgressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443));
for (const gatewayInstance of natGatewayProvider.gatewayInstances) {
   gatewayInstance.addSecurityGroup(securityGroup);
}

userData?optionalUserDatauser_data?optionalUserDatauserData?optionalUserDataUserData?optionalUserDataUserData?optionalUserData#

Custom user data to run on the NAT instances.

Default: UserData.forLinux().addCommands(...NatInstanceProviderV2.DEFAULT_USER_DATA_COMMANDS); - Appropriate user data commands to initialize and configure the NAT instances