Package com.pulumi.aws.ec2

Class VpnConnection

  • public class VpnConnection
extends com.pulumi.resources.CustomResource
    Manages a Site-to-Site VPN connection. A Site-to-Site VPN connection is an IP security (IPsec) VPN connection between a VPC and an on-premises network. Any new Site-to-Site VPN connection that you create is an [AWS VPN connection](https://docs.aws.amazon.com/vpn/latest/s2svpn/vpn-categories.html). > **Note:** The CIDR blocks in the arguments `tunnel1InsideCidr` and `tunnel2InsideCidr` must have a prefix of /30 and be a part of a specific range. [Read more about this in the AWS documentation](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_VpnTunnelOptionsSpecification.html). ## Example Usage ### EC2 Transit Gateway 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.ec2transitgateway.TransitGateway;
 import com.pulumi.aws.ec2.CustomerGateway;
 import com.pulumi.aws.ec2.CustomerGatewayArgs;
 import com.pulumi.aws.ec2.VpnConnection;
 import com.pulumi.aws.ec2.VpnConnectionArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var example = new TransitGateway("example");
 
         var exampleCustomerGateway = new CustomerGateway("exampleCustomerGateway", CustomerGatewayArgs.builder()
             .bgpAsn("65000")
             .ipAddress("172.0.0.1")
             .type("ipsec.1")
             .build());
 
         var exampleVpnConnection = new VpnConnection("exampleVpnConnection", VpnConnectionArgs.builder()
             .customerGatewayId(exampleCustomerGateway.id())
             .transitGatewayId(example.id())
             .type(exampleCustomerGateway.type())
             .build());
 
     }
 }
    ### Virtual Private Gateway 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.ec2.Vpc;
 import com.pulumi.aws.ec2.VpcArgs;
 import com.pulumi.aws.ec2.VpnGateway;
 import com.pulumi.aws.ec2.VpnGatewayArgs;
 import com.pulumi.aws.ec2.CustomerGateway;
 import com.pulumi.aws.ec2.CustomerGatewayArgs;
 import com.pulumi.aws.ec2.VpnConnection;
 import com.pulumi.aws.ec2.VpnConnectionArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var vpc = new Vpc("vpc", VpcArgs.builder()
             .cidrBlock("10.0.0.0/16")
             .build());
 
         var vpnGateway = new VpnGateway("vpnGateway", VpnGatewayArgs.builder()
             .vpcId(vpc.id())
             .build());
 
         var customerGateway = new CustomerGateway("customerGateway", CustomerGatewayArgs.builder()
             .bgpAsn("65000")
             .ipAddress("172.0.0.1")
             .type("ipsec.1")
             .build());
 
         var main = new VpnConnection("main", VpnConnectionArgs.builder()
             .vpnGatewayId(vpnGateway.id())
             .customerGatewayId(customerGateway.id())
             .type("ipsec.1")
             .staticRoutesOnly(true)
             .build());
 
     }
 }
    ### AWS Site to Site Private VPN 
     
 package generated_program;
 
 import com.pulumi.Context;
 import com.pulumi.Pulumi;
 import com.pulumi.core.Output;
 import com.pulumi.aws.directconnect.Gateway;
 import com.pulumi.aws.directconnect.GatewayArgs;
 import com.pulumi.aws.ec2transitgateway.TransitGateway;
 import com.pulumi.aws.ec2transitgateway.TransitGatewayArgs;
 import com.pulumi.aws.ec2.CustomerGateway;
 import com.pulumi.aws.ec2.CustomerGatewayArgs;
 import com.pulumi.aws.directconnect.GatewayAssociation;
 import com.pulumi.aws.directconnect.GatewayAssociationArgs;
 import com.pulumi.aws.ec2transitgateway.Ec2transitgatewayFunctions;
 import com.pulumi.aws.ec2transitgateway.inputs.GetDirectConnectGatewayAttachmentArgs;
 import com.pulumi.aws.ec2.VpnConnection;
 import com.pulumi.aws.ec2.VpnConnectionArgs;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Map;
 import java.io.File;
 import java.nio.file.Files;
 import java.nio.file.Paths;
 
 public class App {
     public static void main(String[] args) {
         Pulumi.run(App::stack);
     }
 
     public static void stack(Context ctx) {
         var exampleGateway = new Gateway("exampleGateway", GatewayArgs.builder()
             .name("example_ipsec_vpn_example")
             .amazonSideAsn("64512")
             .build());
 
         var exampleTransitGateway = new TransitGateway("exampleTransitGateway", TransitGatewayArgs.builder()
             .amazonSideAsn(64513)
             .description("example_ipsec_vpn_example")
             .transitGatewayCidrBlocks("10.0.0.0/24")
             .build());
 
         var exampleCustomerGateway = new CustomerGateway("exampleCustomerGateway", CustomerGatewayArgs.builder()
             .bgpAsn("64514")
             .ipAddress("10.0.0.1")
             .type("ipsec.1")
             .tags(Map.of("Name", "example_ipsec_vpn_example"))
             .build());
 
         var exampleGatewayAssociation = new GatewayAssociation("exampleGatewayAssociation", GatewayAssociationArgs.builder()
             .dxGatewayId(exampleGateway.id())
             .associatedGatewayId(exampleTransitGateway.id())
             .allowedPrefixes("10.0.0.0/8")
             .build());
 
         final var example = Ec2transitgatewayFunctions.getDirectConnectGatewayAttachment(GetDirectConnectGatewayAttachmentArgs.builder()
             .transitGatewayId(exampleTransitGateway.id())
             .dxGatewayId(exampleGateway.id())
             .build());
 
         var exampleVpnConnection = new VpnConnection("exampleVpnConnection", VpnConnectionArgs.builder()
             .customerGatewayId(exampleCustomerGateway.id())
             .outsideIpAddressType("PrivateIpv4")
             .transitGatewayId(exampleTransitGateway.id())
             .transportTransitGatewayAttachmentId(example.applyValue(_example -> _example.id()))
             .type("ipsec.1")
             .tags(Map.of("Name", "example_ipsec_vpn_example"))
             .build());
 
     }
 }
    ## Import Using `pulumi import`, import VPN Connections using the VPN connection `id`. For example: ```sh $ pulumi import aws:ec2/vpnConnection:VpnConnection testvpnconnection vpn-40f41529 ```

    • Constructor Detail

      • VpnConnection

        public VpnConnection​(java.lang.String name)
        Parameters:
        name - The _unique_ name of the resulting resource.

      • VpnConnection

        public VpnConnection​(java.lang.String name,
                     VpnConnectionArgs args)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.

      • VpnConnection

        public VpnConnection​(java.lang.String name,
                     VpnConnectionArgs args,
                     @Nullable
                     com.pulumi.resources.CustomResourceOptions options)
        Parameters:
        name - The _unique_ name of the resulting resource.
        args - The arguments to use to populate this resource's properties.
        options - A bag of options that control this resource's behavior.

    • Method Detail

      • arn

        public com.pulumi.core.Output<java.lang.String> arn()
        Returns:
        ARN of the VPN Connection.

      • coreNetworkArn

        public com.pulumi.core.Output<java.lang.String> coreNetworkArn()
        Returns:
        ARN of the core network.

      • coreNetworkAttachmentArn

        public com.pulumi.core.Output<java.lang.String> coreNetworkAttachmentArn()
        Returns:
        ARN of the core network attachment.

      • customerGatewayConfiguration

        public com.pulumi.core.Output<java.lang.String> customerGatewayConfiguration()
        Returns:
        Configuration information for the VPN connection's customer gateway (in the native XML format).

      • customerGatewayId

        public com.pulumi.core.Output<java.lang.String> customerGatewayId()
        Returns:
        ID of the customer gateway.

      • enableAcceleration

        public com.pulumi.core.Output<java.lang.Boolean> enableAcceleration()
        Returns:
        Whether to enable acceleration for the VPN connection. Supports only EC2 Transit Gateway.

      • localIpv4NetworkCidr

        public com.pulumi.core.Output<java.lang.String> localIpv4NetworkCidr()
        Returns:
        IPv4 CIDR on the customer gateway (on-premises) side of the VPN connection.

      • localIpv6NetworkCidr

        public com.pulumi.core.Output<java.lang.String> localIpv6NetworkCidr()
        Returns:
        IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection.

      • outsideIpAddressType

        public com.pulumi.core.Output<java.lang.String> outsideIpAddressType()
        Returns:
        Type of VPN endpoint, either a public Site-to-Site VPN or a private Site-to-Site VPN over AWS Direct Connect. Valid values are `PublicIpv4 | PrivateIpv4`.

      • presharedKeyArn

        public com.pulumi.core.Output<java.lang.String> presharedKeyArn()
        Returns:
        ARN of the Secrets Manager secret storing the pre-shared key(s) for the VPN connection. Note that even if it returns a valid Secrets Manager ARN, the pre-shared key(s) will not be stored in Secrets Manager unless the `presharedKeyStorage` argument is set to `SecretsManager`.

      • presharedKeyStorage

        public com.pulumi.core.Output<java.lang.String> presharedKeyStorage()
        Returns:
        Storage mode for the pre-shared key (PSK). Valid values are `Standard` (stored in the Site-to-Site VPN service) or `SecretsManager` (stored in AWS Secrets Manager).

      • region

        public com.pulumi.core.Output<java.lang.String> region()
        Returns:
        Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.

      • remoteIpv4NetworkCidr

        public com.pulumi.core.Output<java.lang.String> remoteIpv4NetworkCidr()
        Returns:
        IPv4 CIDR on the AWS side of the VPN connection.

      • remoteIpv6NetworkCidr

        public com.pulumi.core.Output<java.lang.String> remoteIpv6NetworkCidr()
        Returns:
        IPv6 CIDR on the AWS side of the VPN connection.

      • routes

        public com.pulumi.core.Output<java.util.List<VpnConnectionRoute>> routes()
        Returns:
        Static routes associated with the VPN connection. Detailed below.

      • staticRoutesOnly

        public com.pulumi.core.Output<java.lang.Boolean> staticRoutesOnly()
        Returns:
        Whether the VPN connection uses static routes exclusively. Static routes must be used for devices that don't support BGP.

      • tags

        public com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,​java.lang.String>>> tags()
        Returns:
        Tags to apply to the connection. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.

      • tagsAll

        public com.pulumi.core.Output<java.util.Map<java.lang.String,​java.lang.String>> tagsAll()
        Returns:
        Map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.

      • transitGatewayAttachmentId

        public com.pulumi.core.Output<java.lang.String> transitGatewayAttachmentId()
        Returns:
        When associated with an EC2 Transit Gateway (`transitGatewayId` argument), the attachment ID. See also the `aws.ec2.Tag` resource for tagging the EC2 Transit Gateway VPN Attachment.

      • transitGatewayId

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> transitGatewayId()
        Returns:
        ID of the EC2 Transit Gateway.

      • transportTransitGatewayAttachmentId

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> transportTransitGatewayAttachmentId()
        Returns:
        Attachment ID of the Transit Gateway attachment to Direct Connect Gateway. Required when `outsideIpAddressType` is set to `PrivateIpv4`. The ID is obtained through a data source only.

      • tunnel1Address

        public com.pulumi.core.Output<java.lang.String> tunnel1Address()
        Returns:
        Public IP address of the first VPN tunnel.

      • tunnel1BgpAsn

        public com.pulumi.core.Output<java.lang.String> tunnel1BgpAsn()
        Returns:
        BGP ASN number of the first VPN tunnel.

      • tunnel1BgpHoldtime

        public com.pulumi.core.Output<java.lang.Integer> tunnel1BgpHoldtime()
        Returns:
        BGP holdtime of the first VPN tunnel.

      • tunnel1CgwInsideAddress

        public com.pulumi.core.Output<java.lang.String> tunnel1CgwInsideAddress()
        Returns:
        RFC 6890 link-local address of the first VPN tunnel (Customer Gateway Side).

      • tunnel1DpdTimeoutAction

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> tunnel1DpdTimeoutAction()
        Returns:
        Action to take after DPD timeout occurs for the first VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are `clear | none | restart`.

      • tunnel1DpdTimeoutSeconds

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> tunnel1DpdTimeoutSeconds()
        Returns:
        Number of seconds after which a DPD timeout occurs for the first VPN tunnel. Valid value is equal or higher than `30`.

      • tunnel1EnableTunnelLifecycleControl

        public com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> tunnel1EnableTunnelLifecycleControl()
        Returns:
        Whether to enable the tunnel endpoint lifecycle control feature for the first VPN tunnel. Valid values are `true | false`.

      • tunnel1IkeVersions

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> tunnel1IkeVersions()
        Returns:
        IKE versions that are permitted for the first VPN tunnel. Valid values are `ikev1 | ikev2`.

      • tunnel1InsideCidr

        public com.pulumi.core.Output<java.lang.String> tunnel1InsideCidr()
        Returns:
        CIDR block of the inside IP addresses for the first VPN tunnel. Valid value is a size /30 CIDR block from the 169.254.0.0/16 range.

      • tunnel1InsideIpv6Cidr

        public com.pulumi.core.Output<java.lang.String> tunnel1InsideIpv6Cidr()
        Returns:
        Range of inside IPv6 addresses for the first VPN tunnel. Supports only EC2 Transit Gateway. Valid value is a size /126 CIDR block from the local fd00::/8 range.

      • tunnel1LogOptions

        public com.pulumi.core.Output<VpnConnectionTunnel1LogOptions> tunnel1LogOptions()
        Returns:
        Options for logging VPN tunnel activity. See `tunnel1LogOptions` below for more details.

      • tunnel1Phase1DhGroupNumbers

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.Integer>>> tunnel1Phase1DhGroupNumbers()
        Returns:
        List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are ` 2 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 `.

      • tunnel1Phase1EncryptionAlgorithms

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> tunnel1Phase1EncryptionAlgorithms()
        Returns:
        List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.

      • tunnel1Phase1IntegrityAlgorithms

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> tunnel1Phase1IntegrityAlgorithms()
        Returns:
        One or more integrity algorithms that are permitted for the first VPN tunnel for phase 1 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.

      • tunnel1Phase1LifetimeSeconds

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> tunnel1Phase1LifetimeSeconds()
        Returns:
        Lifetime for phase 1 of the IKE negotiation for the first VPN tunnel, in seconds. Valid value is between `900` and `28800`.

      • tunnel1Phase2DhGroupNumbers

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.Integer>>> tunnel1Phase2DhGroupNumbers()
        Returns:
        List of one or more Diffie-Hellman group numbers that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are `2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24`.

      • tunnel1Phase2EncryptionAlgorithms

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> tunnel1Phase2EncryptionAlgorithms()
        Returns:
        List of one or more encryption algorithms that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.

      • tunnel1Phase2IntegrityAlgorithms

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> tunnel1Phase2IntegrityAlgorithms()
        Returns:
        List of one or more integrity algorithms that are permitted for the first VPN tunnel for phase 2 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.

      • tunnel1Phase2LifetimeSeconds

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> tunnel1Phase2LifetimeSeconds()
        Returns:
        Lifetime for phase 2 of the IKE negotiation for the first VPN tunnel, in seconds. Valid value is between `900` and `3600`.

      • tunnel1PresharedKey

        public com.pulumi.core.Output<java.lang.String> tunnel1PresharedKey()
        Returns:
        Preshared key of the first VPN tunnel. The preshared key must be between 8 and 64 characters in length and cannot start with zero(0). Allowed characters are alphanumeric characters, periods(.) and underscores(_).

      • tunnel1RekeyFuzzPercentage

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> tunnel1RekeyFuzzPercentage()
        Returns:
        Percentage of the rekey window for the first VPN tunnel (determined by `tunnel1RekeyMarginTimeSeconds`) during which the rekey time is randomly selected. Valid value is between `0` and `100`.

      • tunnel1RekeyMarginTimeSeconds

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> tunnel1RekeyMarginTimeSeconds()
        Returns:
        Margin time, in seconds, before the phase 2 lifetime expires, during which the AWS side of the first VPN connection performs an IKE rekey. The exact time of the rekey is randomly selected based on the value for `tunnel1RekeyFuzzPercentage`. Valid value is between `60` and half of `tunnel1Phase2LifetimeSeconds`.

      • tunnel1ReplayWindowSize

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> tunnel1ReplayWindowSize()
        Returns:
        Number of packets in an IKE replay window for the first VPN tunnel. Valid value is between `64` and `2048`.

      • tunnel1StartupAction

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> tunnel1StartupAction()
        Returns:
        Action to take when the establishing the tunnel for the first VPN connection. By default, your customer gateway device must initiate the IKE negotiation and bring up the tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are `add | start`.

      • tunnel1VgwInsideAddress

        public com.pulumi.core.Output<java.lang.String> tunnel1VgwInsideAddress()
        Returns:
        RFC 6890 link-local address of the first VPN tunnel (VPN Gateway Side).

      • tunnel2Address

        public com.pulumi.core.Output<java.lang.String> tunnel2Address()
        Returns:
        Public IP address of the second VPN tunnel.

      • tunnel2BgpAsn

        public com.pulumi.core.Output<java.lang.String> tunnel2BgpAsn()
        Returns:
        BGP ASN number of the second VPN tunnel.

      • tunnel2BgpHoldtime

        public com.pulumi.core.Output<java.lang.Integer> tunnel2BgpHoldtime()
        Returns:
        BGP holdtime of the second VPN tunnel.

      • tunnel2CgwInsideAddress

        public com.pulumi.core.Output<java.lang.String> tunnel2CgwInsideAddress()
        Returns:
        RFC 6890 link-local address of the second VPN tunnel (Customer Gateway Side).

      • tunnel2DpdTimeoutAction

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> tunnel2DpdTimeoutAction()
        Returns:
        Action to take after DPD timeout occurs for the second VPN tunnel. Specify restart to restart the IKE initiation. Specify clear to end the IKE session. Valid values are `clear | none | restart`.

      • tunnel2DpdTimeoutSeconds

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> tunnel2DpdTimeoutSeconds()
        Returns:
        Number of seconds after which a DPD timeout occurs for the second VPN tunnel. Valid value is equal or higher than `30`.

      • tunnel2EnableTunnelLifecycleControl

        public com.pulumi.core.Output<java.util.Optional<java.lang.Boolean>> tunnel2EnableTunnelLifecycleControl()
        Returns:
        Whether to enable the tunnel endpoint lifecycle control feature for the second VPN tunnel. Valid values are `true | false`.

      • tunnel2IkeVersions

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> tunnel2IkeVersions()
        Returns:
        IKE versions that are permitted for the second VPN tunnel. Valid values are `ikev1 | ikev2`.

      • tunnel2InsideCidr

        public com.pulumi.core.Output<java.lang.String> tunnel2InsideCidr()
        Returns:
        CIDR block of the inside IP addresses for the second VPN tunnel. Valid value is a size /30 CIDR block from the 169.254.0.0/16 range.

      • tunnel2InsideIpv6Cidr

        public com.pulumi.core.Output<java.lang.String> tunnel2InsideIpv6Cidr()
        Returns:
        Range of inside IPv6 addresses for the second VPN tunnel. Supports only EC2 Transit Gateway. Valid value is a size /126 CIDR block from the local fd00::/8 range.

      • tunnel2LogOptions

        public com.pulumi.core.Output<VpnConnectionTunnel2LogOptions> tunnel2LogOptions()
        Returns:
        Options for logging VPN tunnel activity. See `tunnel2LogOptions` below for more details.

      • tunnel2Phase1DhGroupNumbers

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.Integer>>> tunnel2Phase1DhGroupNumbers()
        Returns:
        List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are ` 2 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24 `.

      • tunnel2Phase1EncryptionAlgorithms

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> tunnel2Phase1EncryptionAlgorithms()
        Returns:
        List of one or more encryption algorithms that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.

      • tunnel2Phase1IntegrityAlgorithms

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> tunnel2Phase1IntegrityAlgorithms()
        Returns:
        One or more integrity algorithms that are permitted for the second VPN tunnel for phase 1 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.

      • tunnel2Phase1LifetimeSeconds

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> tunnel2Phase1LifetimeSeconds()
        Returns:
        Lifetime for phase 1 of the IKE negotiation for the second VPN tunnel, in seconds. Valid value is between `900` and `28800`.

      • tunnel2Phase2DhGroupNumbers

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.Integer>>> tunnel2Phase2DhGroupNumbers()
        Returns:
        List of one or more Diffie-Hellman group numbers that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are `2 | 5 | 14 | 15 | 16 | 17 | 18 | 19 | 20 | 21 | 22 | 23 | 24`.

      • tunnel2Phase2EncryptionAlgorithms

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> tunnel2Phase2EncryptionAlgorithms()
        Returns:
        List of one or more encryption algorithms that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are `AES128 | AES256 | AES128-GCM-16 | AES256-GCM-16`.

      • tunnel2Phase2IntegrityAlgorithms

        public com.pulumi.core.Output<java.util.Optional<java.util.List<java.lang.String>>> tunnel2Phase2IntegrityAlgorithms()
        Returns:
        List of one or more integrity algorithms that are permitted for the second VPN tunnel for phase 2 IKE negotiations. Valid values are `SHA1 | SHA2-256 | SHA2-384 | SHA2-512`.

      • tunnel2Phase2LifetimeSeconds

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> tunnel2Phase2LifetimeSeconds()
        Returns:
        Lifetime for phase 2 of the IKE negotiation for the second VPN tunnel, in seconds. Valid value is between `900` and `3600`.

      • tunnel2PresharedKey

        public com.pulumi.core.Output<java.lang.String> tunnel2PresharedKey()
        Returns:
        Preshared key of the second VPN tunnel. The preshared key must be between 8 and 64 characters in length and cannot start with zero(0). Allowed characters are alphanumeric characters, periods(.) and underscores(_).

      • tunnel2RekeyFuzzPercentage

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> tunnel2RekeyFuzzPercentage()
        Returns:
        Percentage of the rekey window for the second VPN tunnel (determined by `tunnel2RekeyMarginTimeSeconds`) during which the rekey time is randomly selected. Valid value is between `0` and `100`.

      • tunnel2RekeyMarginTimeSeconds

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> tunnel2RekeyMarginTimeSeconds()
        Returns:
        Margin time, in seconds, before the phase 2 lifetime expires, during which the AWS side of the second VPN connection performs an IKE rekey. The exact time of the rekey is randomly selected based on the value for `tunnel2RekeyFuzzPercentage`. Valid value is between `60` and half of `tunnel2Phase2LifetimeSeconds`.

      • tunnel2ReplayWindowSize

        public com.pulumi.core.Output<java.util.Optional<java.lang.Integer>> tunnel2ReplayWindowSize()
        Returns:
        Number of packets in an IKE replay window for the second VPN tunnel. Valid value is between `64` and `2048`.

      • tunnel2StartupAction

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> tunnel2StartupAction()
        Returns:
        Action to take when the establishing the tunnel for the second VPN connection. By default, your customer gateway device must initiate the IKE negotiation and bring up the tunnel. Specify start for AWS to initiate the IKE negotiation. Valid values are `add | start`.

      • tunnel2VgwInsideAddress

        public com.pulumi.core.Output<java.lang.String> tunnel2VgwInsideAddress()
        Returns:
        RFC 6890 link-local address of the second VPN tunnel (VPN Gateway Side).

      • tunnelBandwidth

        public com.pulumi.core.Output<java.lang.String> tunnelBandwidth()
        Returns:
        Desired bandwidth specification for the VPN tunnel. Valid values are `standard | large`. `standard` supports up to 1.25 Gbps per tunnel, while `large` supports up to 5 Gbps per tunnel. Not supported when `vpnGatewayId` is specified, or `enableAcceleration` is `true`.

      • tunnelInsideIpVersion

        public com.pulumi.core.Output<java.lang.String> tunnelInsideIpVersion()
        Returns:
        Indicate whether the VPN tunnels process IPv4 or IPv6 traffic. Valid values are `ipv4 | ipv6`. `ipv6` Supports only EC2 Transit Gateway.

      • type

        public com.pulumi.core.Output<java.lang.String> type()
        Returns:
        Type of VPN connection. The only type AWS supports at this time is "ipsec.1".

      • vgwTelemetries

        public com.pulumi.core.Output<java.util.List<VpnConnectionVgwTelemetry>> vgwTelemetries()
        Returns:
        Telemetry for the VPN tunnels. Detailed below.

      • vpnConcentratorId

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> vpnConcentratorId()
        Returns:
        ID of the VPN concentrator to associate with the VPN connection.

      • vpnGatewayId

        public com.pulumi.core.Output<java.util.Optional<java.lang.String>> vpnGatewayId()
        Returns:
        ID of the Virtual Private Gateway.

      • get

        public static VpnConnection get​(java.lang.String name,
                                com.pulumi.core.Output<java.lang.String> id,
                                @Nullable
                                VpnConnectionState state,
                                @Nullable
                                com.pulumi.resources.CustomResourceOptions options)
        Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.
        Parameters:
        name - The _unique_ name of the resulting resource.
        id - The _unique_ provider ID of the resource to lookup.
        state -
        options - Optional settings to control the behavior of the CustomResource.