AWS CDK Reference

Appearance

v2.273.0

NatInstanceProps Struct ​

Properties for a NAT instance.

Source
aws-ec2/lib/nat.ts
Type last changed
v2.164.0 · 24 Oct 2024

Example ​

ts
declare const instanceType: ec2.InstanceType;

const provider = ec2.NatProvider.instanceV2({
  instanceType,
  defaultAllowedTraffic: ec2.NatTrafficDirection.OUTBOUND_ONLY,
});
new ec2.Vpc(this, 'TheVPC', {
  natGatewayProvider: provider,
});
provider.connections.allowFrom(ec2.Peer.ipv4('1.2.3.4/8'), ec2.Port.HTTP);

Properties ​

associatePublicIpAddressbooleanassociate_public_ip_addressboolassociatePublicIpAddressBooleanAssociatePublicIpAddressboolAssociatePublicIpAddress*bool= undefined - No public IP address…#
Whether to associate a public IP address to the primary network interface attached to this instance.
default

Default: undefined - No public IP address associated

creditSpecificationCpuCreditscredit_specificationCpuCreditscreditSpecificationCpuCreditsCreditSpecificationCpuCreditsCreditSpecificationCpuCredits= T2 instances are standard, while…#
Specifying the CPU credit type for burstable EC2 instance types (T2, T3, T3a, etc).

The unlimited CPU credit option is not supported for T3 instances with dedicated host (host) tenancy.

default

Default: T2 instances are standard, while T3, T4g, and T3a instances are unlimited.

defaultAllowedTrafficNatTrafficDirectiondefault_allowed_trafficNatTrafficDirectiondefaultAllowedTrafficNatTrafficDirectionDefaultAllowedTrafficNatTrafficDirectionDefaultAllowedTrafficNatTrafficDirection= NatTrafficDirection.INBOUND_AND_…#
Direction to allow all traffic through the NAT instance by default.
notes · default

By default, inbound and outbound traffic is allowed.

If you set this to another value than INBOUND_AND_OUTBOUND, you must configure the NAT instance's security groups in another way, either by passing in a fully configured Security Group using the securityGroup property, or by configuring it using the .securityGroup or .connections members after passing the NAT Instance Provider to a Vpc.

Default: NatTrafficDirection.INBOUND_AND_OUTBOUND

instanceTypeInstanceTypeinstance_typeInstanceTypeinstanceTypeInstanceTypeInstanceTypeInstanceTypeInstanceTypeInstanceTyperequired#
Instance type of the NAT instance.
keyNamestringkey_namestrkeyNameStringKeyNamestringKeyName*string= No SSH access will be possible.deprecated#
- Use `keyPair` instead - https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2-readme.html#using-an-existing-ec2-key-pair
keyPairIKeyPairkey_pairIKeyPairkeyPairIKeyPairKeyPairIKeyPairKeyPairIKeyPair= No SSH access will be possible.#
The SSH keypair to grant access to the instance.
machineImageIMachineImagemachine_imageIMachineImagemachineImageIMachineImageMachineImageIMachineImageMachineImageIMachineImage= Latest NAT instance image#
The machine image (AMI) to use.
notes

By default, will do an AMI lookup for the latest NAT instance image.

If you have a specific AMI ID you want to use, pass a GenericLinuxImage. For example:

ts
ec2.NatProvider.instance({
  instanceType: new ec2.InstanceType('t3.micro'),
  machineImage: new ec2.GenericLinuxImage({
    'us-east-2': 'ami-0f9c61b5a562a16af'
  })
})
securityGroupISecurityGroupsecurity_groupISecurityGroupsecurityGroupISecurityGroupSecurityGroupISecurityGroupSecurityGroupISecurityGroup= A new security group will be cre…deprecated#
- Cannot create a new security group before the VPC is created, and cannot create the VPC without the NAT provider. Set {@link defaultAllowedTraffic } to {@link NatTrafficDirection.NONE } and use {@link NatInstanceProviderV2.gatewayInstances } to retrieve the instances on the fly and add security groups
default · example

Default: A new security group will be created

ts
const natGatewayProvider = ec2.NatProvider.instanceV2({
  instanceType: new ec2.InstanceType('t3.small'),
  defaultAllowedTraffic: ec2.NatTrafficDirection.NONE,
});
const vpc = new ec2.Vpc(this, 'Vpc', { natGatewayProvider });

const securityGroup = new ec2.SecurityGroup(this, 'SecurityGroup', {
  vpc,
  allowAllOutbound: false,
});
securityGroup.addEgressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(443));
for (const gatewayInstance of natGatewayProvider.gatewayInstances) {
   gatewayInstance.addSecurityGroup(securityGroup);
}
userDataUserDatauser_dataUserDatauserDataUserDataUserDataUserDataUserDataUserData= UserData.forLinux().addCommands(…#
Custom user data to run on the NAT instances.
default

Default: UserData.forLinux().addCommands(...NatInstanceProviderV2.DEFAULT_USER_DATA_COMMANDS); - Appropriate user data commands to initialize and configure the NAT instances

Used as props by ​