EC2 & VPC

112 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

AMI # GA

AMI is the Schema for managing EC2 Amazon Machine Images.

kubectl get amis · example on GitHub

Example

# AMI — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ami
apiVersion: aws.konfig.io/v1alpha1
kind: AMI
metadata:
  name: example-ami
  namespace: default
spec:
  architecture: x86_64
  blockDeviceMappings:
  - deleteOnTermination: false
    deviceName: example-ami
    encrypted: true
    volumeSize: 2
    volumeType: example
  description: Managed by konfig-konector
  enaSupport: false
  name: example-ami
  providerRef:
    name: example-ami
    region: us-east-1
  rootDeviceName: example-ami
  sriovNetSupport: example
  tags:
    environment: dev
    team: platform
  virtualizationType: hvm

Spec

Field	Type	Required	Description
`architecture`	enum	—	Architecture is the CPU architecture (x86_64 or arm64). Allowed: `x86_64, arm64, i386`
`blockDeviceMappings`	array<object>	—	BlockDeviceMappings defines the EBS volumes and snapshots to attach.
`blockDeviceMappings[].deleteOnTermination`	boolean	—	DeleteOnTermination controls whether to delete on instance termination.
`blockDeviceMappings[].deviceName`	string	yes	DeviceName is the device name (e.g.
`blockDeviceMappings[].encrypted`	boolean	—	Encrypted enables encryption for this volume.
`blockDeviceMappings[].snapshotId`	string	—	SnapshotID is the snapshot to use for this device.
`blockDeviceMappings[].volumeSize`	integer	—	VolumeSize is the size of the volume in GiB.
`blockDeviceMappings[].volumeType`	string	—	VolumeType is the EBS volume type.
`description`	string	—	Description is an optional description.
`enaSupport`	boolean	—	ENASupport enables enhanced networking with ENA.
`kernelId`	string	—	KernelID is an optional kernel ID (for paravirtual).
`name`	string	yes	Name is the AMI name.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`ramdiskId`	string	—	RamdiskID is an optional ramdisk ID.
`rootDeviceName`	string	—	RootDeviceName is the root device name (e.g.
`sriovNetSupport`	string	—	SRIOVNetSupport enables SR-IOV networking (set to "simple").
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`virtualizationType`	enum	—	VirtualizationType is hvm or paravirtual. Allowed: `hvm, paravirtual`

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`imageId`	string	—	ImageID is the AMI ID.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the current state of the AMI (pending, available, failed, etc.).

CapacityReservation # GA

CapacityReservation is the Schema for managing EC2 capacity reservations.

kubectl get capacityreservations · example on GitHub

Example

# CapacityReservation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#capacityreservation
apiVersion: aws.konfig.io/v1alpha1
kind: CapacityReservation
metadata:
  name: example-capacityreservation
  namespace: default
spec:
  availabilityZone: us-east-1a
  endDate: '2026-01-01T00:00:00Z'
  endDateType: unlimited
  instanceCount: 1
  instancePlatform: example
  instanceType: example
  providerRef:
    name: example-capacityreservation
    region: us-east-1
  tags:
    environment: dev
    team: platform
  tenancy: default

Spec

Field	Type	Required	Description
`availabilityZone`	string	yes	AvailabilityZone in which to create the reservation.
`endDate`	string	—	EndDate is when the reservation expires (required when endDateType is limited).
`endDateType`	enum	—	EndDateType indicates how the reservation ends. Allowed: `unlimited, limited`
`instanceCount`	integer	yes	InstanceCount is the number of instances to reserve capacity for.
`instancePlatform`	string	yes	InstancePlatform is the operating system type for the reserved capacity (e.g.
`instanceType`	string	yes	InstanceType for which to reserve capacity.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`tenancy`	enum	—	Tenancy of the reservation. Allowed: `default, dedicated`

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the reservation.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`capacityReservationId`	string	—	CapacityReservationID is the AWS capacity reservation identifier.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the lifecycle state reported by AWS.

CustomerGateway # GA

CustomerGateway is the Schema for managing EC2 customer gateways.

kubectl get customergateways · example on GitHub

Example

# CustomerGateway — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#customergateway
apiVersion: aws.konfig.io/v1alpha1
kind: CustomerGateway
metadata:
  name: example-customergateway
  namespace: default
spec:
  bgpAsn: 1
  deviceName: example-customergateway
  ipAddress: example
  providerRef:
    name: example-customergateway
    region: us-east-1
  tags:
    environment: dev
    team: platform
  type: ipsec.1

Spec

Field	Type	Required	Description
`bgpAsn`	integer	yes	BGPASN is the customer gateway device's Border Gateway Protocol Autonomous System Number.
`deviceName`	string	—	DeviceName is a name for the customer gateway device.
`ipAddress`	string	yes	IPAddress is the internet-routable IP address of the customer gateway device's outside interface.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`type`	enum	—	Type of VPN connection this customer gateway supports. Allowed: `ipsec.1`

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`customerGatewayId`	string	—	CustomerGatewayID is the AWS customer gateway identifier.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the lifecycle state reported by AWS.

EBSVolume # GA

EBSVolume is the Schema for managing EBS Volumes.

kubectl get ebsvolumes · example on GitHub

Example

# EBSVolume — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ebsvolume
apiVersion: aws.konfig.io/v1alpha1
kind: EBSVolume
metadata:
  name: example-ebsvolume
  namespace: default
spec:
  availabilityZone: us-east-1a
  encrypted: true
  iops: 1
  kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab
  multiAttachEnabled: true
  providerRef:
    name: example-ebsvolume
    region: us-east-1
  size: 1
  tags:
    environment: dev
    team: platform
  throughput: 1
  volumeType: gp2

Spec

Field	Type	Required	Description
`availabilityZone`	string	yes	AvailabilityZone is the AZ in which to create the volume.
`encrypted`	boolean	—	Encrypted enables EBS encryption.
`iops`	integer	—	IOPS is the requested IOPS (for io1, io2, gp3).
`kmsKeyId`	string	—	KMSKeyID is the KMS key ID/ARN for encryption.
`multiAttachEnabled`	boolean	—	MultiAttachEnabled enables Multi-Attach for io1/io2 volumes.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`size`	integer	—	Size is the volume size in GiB.
`snapshotId`	string	—	SnapshotID creates the volume from an existing snapshot.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`throughput`	integer	—	Throughput is the throughput in MiB/s (for gp3).
`volumeType`	enum	—	VolumeType is the EBS volume type (gp2, gp3, io1, io2, sc1, st1, standard). Allowed: `gp2, gp3, io1, io2, sc1, st1, standard`

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the current state of the volume.
`volumeId`	string	—	VolumeID is the EBS volume ID.

EC2ApplicationStatusCheck # CLOUD CONTROL · AWS::EC2::ApplicationStatusCheck

EC2ApplicationStatusCheck manages AWS::EC2::ApplicationStatusCheck through the AWS Cloud Control API.

kubectl get ec2applicationstatuschecks · example on GitHub

Example

# EC2ApplicationStatusCheck — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2applicationstatuscheck
apiVersion: aws.konfig.io/v1alpha1
kind: EC2ApplicationStatusCheck
metadata:
  name: example-ec2applicationstatuscheck
  namespace: default
spec:
  aggregation: included
  deviceIndex: 1
  failureThreshold: 1
  initializationGracePeriodSeconds: 1
  interval: 1
  ipScope: private
  ipVersion: ipv4
  path: example
  port: 1
  protocol: http
  providerRef:
    name: example-ec2applicationstatuscheck
    region: us-east-1
  statusCodeMatcher: example
  successThreshold: 1
  tags:
  - key: example
    value: example
  timeout: 300

Spec

Field	Type	Required	Description
`aggregation`	enum	—	Whether this check is included in the rolled-up application status. Allowed: `included, excluded`
`deviceIndex`	integer	—	The network interface device index used for the health check.
`failureThreshold`	integer	—	The number of consecutive failed probes required to mark the instance unhealthy.
`healthCheckPaths`	array<object>	—	The source/destination network paths used for the health check.
`healthCheckPaths[].destinations`	array<object>	—
`healthCheckPaths[].destinations[].securityGroupId`	string	—
`healthCheckPaths[].destinations[].subnetId`	string	—
`healthCheckPaths[].source`	object	—	EC2ApplicationStatusCheckHealthCheckPathSource is a nested property type of AWS::EC2::ApplicationStatusCheck.
`healthCheckPaths[].source.securityGroupId`	string	—
`healthCheckPaths[].source.subnetId`	string	—
`initializationGracePeriodSeconds`	integer	—	Seconds to wait after instance launch before beginning health checks.
`interval`	integer	—	The interval, in seconds, between health check probes.
`ipScope`	enum	—	The IP scope used for the health check. Allowed: `private`
`ipVersion`	enum	—	The IP version used for the health check. Allowed: `ipv4, ipv6`
`path`	string	—	The HTTP path used for the health check.
`port`	integer	yes	The port used for the health check.
`protocol`	enum	yes	The network protocol used for the health check. Allowed: `http, https`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`statusCodeMatcher`	string	—	The HTTP status codes considered successful (e.g., "200-299").
`successThreshold`	integer	—	The number of consecutive successful probes required to mark the instance healthy.
`tags`	array<object>	—	Tags to apply to the application status check.
`tags[].key`	string	yes
`tags[].value`	string	yes
`timeout`	integer	—	The timeout, in seconds, for each health check probe.

Status

Field	Type	Required	Description
`applicationStatusCheckId`	string	—	The unique identifier of the application status check.
`arn`	string	—	The Amazon Resource Name (ARN) of the application status check.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	When the application status check was created (ISO 8601).
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2CapacityManagerDataExport # CLOUD CONTROL · AWS::EC2::CapacityManagerDataExport

EC2CapacityManagerDataExport manages AWS::EC2::CapacityManagerDataExport through the AWS Cloud Control API.

kubectl get ec2capacitymanagerdataexports · example on GitHub

Example

# EC2CapacityManagerDataExport — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2capacitymanagerdataexport
apiVersion: aws.konfig.io/v1alpha1
kind: EC2CapacityManagerDataExport
metadata:
  name: example-ec2capacitymanagerdataexport
  namespace: default
spec:
  outputFormat: csv
  providerRef:
    name: example-ec2capacitymanagerdataexport
    region: us-east-1
  s3BucketName: example-ec2capacitymanagerdataexport
  s3BucketPrefix: example
  schedule: hourly
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`outputFormat`	enum	yes	The format of the exported capacity manager data. Allowed: `csv, parquet`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`s3BucketName`	string	yes	The name of the Amazon S3 bucket where the capacity manager data export will be stored.
`s3BucketPrefix`	string	—	The prefix for the S3 bucket location where exported files will be placed.
`schedule`	enum	yes	The schedule for the capacity manager data export. Allowed: `hourly`
`tags`	array<object>	—	An array of key-value pairs to apply to the capacity manager data export.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`capacityManagerDataExportId`	string	—	The unique identifier of the capacity manager data export.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2CapacityReservationFleet # CLOUD CONTROL · AWS::EC2::CapacityReservationFleet

EC2CapacityReservationFleet manages AWS::EC2::CapacityReservationFleet through the AWS Cloud Control API.

kubectl get ec2capacityreservationfleets · example on GitHub

Example

# EC2CapacityReservationFleet — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2capacityreservationfleet
apiVersion: aws.konfig.io/v1alpha1
kind: EC2CapacityReservationFleet
metadata:
  name: example-ec2capacityreservationfleet
  namespace: default
spec:
  allocationStrategy: example
  endDate: example
  instanceMatchCriteria: open
  instanceTypeSpecifications:
  - availabilityZone: us-east-1a
    availabilityZoneId: us-east-1a
    ebsOptimized: false
    instancePlatform: example
    instanceType: example
    priority: 1
    weight: 1
  noRemoveEndDate: false
  providerRef:
    name: example-ec2capacityreservationfleet
    region: us-east-1
  removeEndDate: false
  tagSpecifications:
  - resourceType: example
    tags:
    - key: example
      value: example
  tenancy: default
  totalTargetCapacity: 1

Spec

Field	Type	Required	Description
`allocationStrategy`	string	—	Create-only in AWS: changing it requires replacing the resource.
`endDate`	string	—	Create-only in AWS: changing it requires replacing the resource.
`instanceMatchCriteria`	enum	—	Create-only in AWS: changing it requires replacing the resource. Allowed: `open`
`instanceTypeSpecifications`	array<object>	—	Create-only in AWS: changing it requires replacing the resource.
`instanceTypeSpecifications[].availabilityZone`	string	—
`instanceTypeSpecifications[].availabilityZoneId`	string	—
`instanceTypeSpecifications[].ebsOptimized`	boolean	—
`instanceTypeSpecifications[].instancePlatform`	string	—
`instanceTypeSpecifications[].instanceType`	string	—
`instanceTypeSpecifications[].priority`	integer	—
`instanceTypeSpecifications[].weight`	number	—
`noRemoveEndDate`	boolean	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`removeEndDate`	boolean	—
`tagSpecifications`	array<object>	—	Create-only in AWS: changing it requires replacing the resource.
`tagSpecifications[].resourceType`	string	—
`tagSpecifications[].tags`	array<object>	—
`tagSpecifications[].tags[].key`	string	yes
`tagSpecifications[].tags[].value`	string	yes
`tenancy`	enum	—	Create-only in AWS: changing it requires replacing the resource. Allowed: `default`
`totalTargetCapacity`	integer	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`capacityReservationFleetId`	string	—	Read-only: reported by AWS after creation.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2CarrierGateway # CLOUD CONTROL · AWS::EC2::CarrierGateway

EC2CarrierGateway manages AWS::EC2::CarrierGateway through the AWS Cloud Control API.

kubectl get ec2carriergateways · example on GitHub

Example

# EC2CarrierGateway — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2carriergateway
apiVersion: aws.konfig.io/v1alpha1
kind: EC2CarrierGateway
metadata:
  name: example-ec2carriergateway
  namespace: default
spec:
  providerRef:
    name: example-ec2carriergateway
    region: us-east-1
  tags:
  - key: example
    value: example
  vpcId: vpc-0abc12def3456789

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the carrier gateway.
`tags[].key`	string	yes
`tags[].value`	string	yes
`vpcId`	string	yes	The ID of the VPC.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`carrierGatewayId`	string	—	The ID of the carrier gateway.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`ownerId`	string	—	The ID of the owner.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	The state of the carrier gateway.

EC2DHCPOptions # CLOUD CONTROL · AWS::EC2::DHCPOptions

EC2DHCPOptions manages AWS::EC2::DHCPOptions through the AWS Cloud Control API.

kubectl get ec2dhcpoptions · example on GitHub

Example

# EC2DHCPOptions — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2dhcpoptions
apiVersion: aws.konfig.io/v1alpha1
kind: EC2DHCPOptions
metadata:
  name: example-ec2dhcpoptions
  namespace: default
spec:
  domainName: example-ec2dhcpoptions
  domainNameServers:
  - example
  ipv6AddressPreferredLeaseTime: 1
  netbiosNameServers:
  - example
  netbiosNodeType: 1
  ntpServers:
  - example
  providerRef:
    name: example-ec2dhcpoptions
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`domainName`	string	—	This value is used to complete unqualified DNS hostnames.
`domainNameServers`	array<string>	—	The IPv4 addresses of up to four domain name servers, or AmazonProvidedDNS.
`ipv6AddressPreferredLeaseTime`	integer	—	The preferred Lease Time for ipV6 address in seconds.
`netbiosNameServers`	array<string>	—	The IPv4 addresses of up to four NetBIOS name servers.
`netbiosNodeType`	integer	—	The NetBIOS node type (1, 2, 4, or 8).
`ntpServers`	array<string>	—	The IPv4 addresses of up to four Network Time Protocol (NTP) servers.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Any tags assigned to the DHCP options set.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`dhcpOptionsId`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2EC2Fleet # CLOUD CONTROL · AWS::EC2::EC2Fleet

EC2EC2Fleet manages AWS::EC2::EC2Fleet through the AWS Cloud Control API.

kubectl get ec2ec2fleets · example on GitHub

Example

# EC2EC2Fleet — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2ec2fleet
apiVersion: aws.konfig.io/v1alpha1
kind: EC2EC2Fleet
metadata:
  name: example-ec2ec2fleet
  namespace: default
spec:
  context: example
  excessCapacityTerminationPolicy: termination
  launchTemplateConfigs:
  - launchTemplateSpecification:
      launchTemplateName: example-ec2ec2fleet
      launchTemplateSpecificationUserData: example
      version: '1.0'
    overrides:
    - availabilityZone: us-east-1a
      availabilityZoneId: us-east-1a
      blockDeviceMappings:
      - deviceName: example-ec2ec2fleet
        noDevice: example
        virtualName: example-ec2ec2fleet
      instanceType: example
      keyName: example-ec2ec2fleet
      maxPrice: example
      networkInterfaces:
      - associatePublicIpAddress: false
        deleteOnTermination: false
        description: Managed by konfig-konector
        deviceIndex: 1
        groups:
        - example
        interfaceType: example
        ipv6AddressCount: 2
        ipv6Addresses:
        - ipv6Address: example
        networkCardIndex: 1
        privateIpAddress: example
        privateIpAddresses:
        - primary: false
          privateIpAddress: example
        secondaryPrivateIpAddressCount: 2
      priority: 1
      weightedCapacity: 2
  onDemandOptions:
    allocationStrategy: example
    capacityReservationOptions:
      usageStrategy: use-capacity-reservations-first
    maxTotalPrice: example
    minTargetCapacity: 2
    singleAvailabilityZone: false
    singleInstanceType: false
  providerRef:
    name: example-ec2ec2fleet
    region: us-east-1
  replaceUnhealthyInstances: false
  reservedCapacityOptions:
    allocationStrategy: prioritized
    capacityReservationTarget:
      capacityReservationIds:
      - example
      capacityReservationResourceGroupArns:
      - example
    reservationTypes:
    - example
    reservedCapacityFallbackOptions:
      marketTypes:
      - example
  spotOptions:
    allocationStrategy: lowest-price
    instanceInterruptionBehavior: hibernate
    instancePoolsToUseCount: 2
    maintenanceStrategies:
      capacityRebalance:
        replacementStrategy: launch
        terminationDelay: 1
    maxTotalPrice: example
    minTargetCapacity: 2
    singleAvailabilityZone: false
    singleInstanceType: false
  tagSpecifications:
  - resourceType: client-vpn-endpoint
    tags:
    - key: example
      value: example
  targetCapacitySpecification:
    defaultTargetCapacityType: on-demand
    onDemandTargetCapacity: 2
    spotTargetCapacity: 2
    targetCapacityUnitType: vcpu
    totalTargetCapacity: 2
  terminateInstancesWithExpiration: false
  type: maintain
  validFrom: example
  validUntil: example

Spec

Field	Type	Required	Description
`context`	string	—
`excessCapacityTerminationPolicy`	enum	—	Allowed: `termination, no-termination`
`launchTemplateConfigs`	array<object>	yes	Create-only in AWS: changing it requires replacing the resource.
`launchTemplateConfigs[].launchTemplateSpecification`	object	—	EC2EC2FleetFleetLaunchTemplateSpecificationRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].launchTemplateSpecification.launchTemplateId`	string	—
`launchTemplateConfigs[].launchTemplateSpecification.launchTemplateName`	string	—
`launchTemplateConfigs[].launchTemplateSpecification.launchTemplateSpecificationUserData`	string	—
`launchTemplateConfigs[].launchTemplateSpecification.version`	string	yes
`launchTemplateConfigs[].overrides`	array<object>	—
`launchTemplateConfigs[].overrides[].availabilityZone`	string	—
`launchTemplateConfigs[].overrides[].availabilityZoneId`	string	—
`launchTemplateConfigs[].overrides[].blockDeviceMappings`	array<object>	—
`launchTemplateConfigs[].overrides[].blockDeviceMappings[].deviceName`	string	—
`launchTemplateConfigs[].overrides[].blockDeviceMappings[].ebs`	object	—	EC2EC2FleetEbsBlockDevice is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].blockDeviceMappings[].ebs.deleteOnTermination`	boolean	—
`launchTemplateConfigs[].overrides[].blockDeviceMappings[].ebs.encrypted`	boolean	—
`launchTemplateConfigs[].overrides[].blockDeviceMappings[].ebs.iops`	integer	—
`launchTemplateConfigs[].overrides[].blockDeviceMappings[].ebs.kmsKeyId`	string	—
`launchTemplateConfigs[].overrides[].blockDeviceMappings[].ebs.snapshotId`	string	—
`launchTemplateConfigs[].overrides[].blockDeviceMappings[].ebs.volumeSize`	integer	—
`launchTemplateConfigs[].overrides[].blockDeviceMappings[].ebs.volumeType`	string	—
`launchTemplateConfigs[].overrides[].blockDeviceMappings[].noDevice`	string	—
`launchTemplateConfigs[].overrides[].blockDeviceMappings[].virtualName`	string	—
`launchTemplateConfigs[].overrides[].iamInstanceProfile`	object	—	EC2EC2FleetIamInstanceProfileSpecification is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].iamInstanceProfile.arn`	string	—
`launchTemplateConfigs[].overrides[].iamInstanceProfile.name`	string	—
`launchTemplateConfigs[].overrides[].instanceRequirements`	object	—	EC2EC2FleetInstanceRequirementsRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].instanceRequirements.acceleratorCount`	object	—	EC2EC2FleetAcceleratorCountRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].instanceRequirements.acceleratorCount.max`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.acceleratorCount.min`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.acceleratorManufacturers`	array<string>	—
`launchTemplateConfigs[].overrides[].instanceRequirements.acceleratorNames`	array<string>	—
`launchTemplateConfigs[].overrides[].instanceRequirements.acceleratorTotalMemoryMiB`	object	—	EC2EC2FleetAcceleratorTotalMemoryMiBRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].instanceRequirements.acceleratorTotalMemoryMiB.max`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.acceleratorTotalMemoryMiB.min`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.acceleratorTypes`	array<string>	—
`launchTemplateConfigs[].overrides[].instanceRequirements.allowedInstanceTypes`	array<string>	—
`launchTemplateConfigs[].overrides[].instanceRequirements.bareMetal`	enum	—	Allowed: `included, required, excluded`
`launchTemplateConfigs[].overrides[].instanceRequirements.baselineEbsBandwidthMbps`	object	—	EC2EC2FleetBaselineEbsBandwidthMbpsRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].instanceRequirements.baselineEbsBandwidthMbps.max`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.baselineEbsBandwidthMbps.min`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.baselinePerformanceFactors`	object	—	EC2EC2FleetBaselinePerformanceFactorsRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].instanceRequirements.baselinePerformanceFactors.cpu`	object	—	EC2EC2FleetCpuPerformanceFactorRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].instanceRequirements.baselinePerformanceFactors.cpu.references`	array<object>	—
`launchTemplateConfigs[].overrides[].instanceRequirements.burstablePerformance`	enum	—	Allowed: `included, required, excluded`
`launchTemplateConfigs[].overrides[].instanceRequirements.cpuManufacturers`	array<string>	—
`launchTemplateConfigs[].overrides[].instanceRequirements.excludedInstanceTypes`	array<string>	—
`launchTemplateConfigs[].overrides[].instanceRequirements.instanceGenerations`	array<string>	—
`launchTemplateConfigs[].overrides[].instanceRequirements.localStorage`	enum	—	Allowed: `included, required, excluded`
`launchTemplateConfigs[].overrides[].instanceRequirements.localStorageTypes`	array<string>	—
`launchTemplateConfigs[].overrides[].instanceRequirements.maxSpotPriceAsPercentageOfOptimalOnDemandPrice`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.memoryGiBPerVCpu`	object	—	EC2EC2FleetMemoryGiBPerVCpuRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].instanceRequirements.memoryGiBPerVCpu.max`	number	—
`launchTemplateConfigs[].overrides[].instanceRequirements.memoryGiBPerVCpu.min`	number	—
`launchTemplateConfigs[].overrides[].instanceRequirements.memoryMiB`	object	—	EC2EC2FleetMemoryMiBRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].instanceRequirements.memoryMiB.max`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.memoryMiB.min`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.networkBandwidthGbps`	object	—	EC2EC2FleetNetworkBandwidthGbpsRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].instanceRequirements.networkBandwidthGbps.max`	number	—
`launchTemplateConfigs[].overrides[].instanceRequirements.networkBandwidthGbps.min`	number	—
`launchTemplateConfigs[].overrides[].instanceRequirements.networkInterfaceCount`	object	—	EC2EC2FleetNetworkInterfaceCountRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].instanceRequirements.networkInterfaceCount.max`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.networkInterfaceCount.min`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.onDemandMaxPricePercentageOverLowestPrice`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.requireEncryptionInTransit`	boolean	—
`launchTemplateConfigs[].overrides[].instanceRequirements.requireHibernateSupport`	boolean	—
`launchTemplateConfigs[].overrides[].instanceRequirements.spotMaxPricePercentageOverLowestPrice`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.totalLocalStorageGB`	object	—	EC2EC2FleetTotalLocalStorageGBRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].instanceRequirements.totalLocalStorageGB.max`	number	—
`launchTemplateConfigs[].overrides[].instanceRequirements.totalLocalStorageGB.min`	number	—
`launchTemplateConfigs[].overrides[].instanceRequirements.vCpuCount`	object	—	EC2EC2FleetVCpuCountRangeRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].instanceRequirements.vCpuCount.max`	integer	—
`launchTemplateConfigs[].overrides[].instanceRequirements.vCpuCount.min`	integer	—
`launchTemplateConfigs[].overrides[].instanceType`	string	—
`launchTemplateConfigs[].overrides[].keyName`	string	—
`launchTemplateConfigs[].overrides[].maxPrice`	string	—
`launchTemplateConfigs[].overrides[].metadataOptions`	object	—	EC2EC2FleetInstanceMetadataOptionsRequest is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].metadataOptions.httpEndpoint`	enum	—	Allowed: `disabled, enabled`
`launchTemplateConfigs[].overrides[].metadataOptions.httpPutResponseHopLimit`	integer	—
`launchTemplateConfigs[].overrides[].metadataOptions.httpTokens`	enum	—	Allowed: `optional, required`
`launchTemplateConfigs[].overrides[].networkInterfaces`	array<object>	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].associatePublicIpAddress`	boolean	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].deleteOnTermination`	boolean	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].description`	string	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].deviceIndex`	integer	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].groups`	array<string>	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].interfaceType`	string	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].ipv6AddressCount`	integer	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].ipv6Addresses`	array<object>	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].ipv6Addresses[].ipv6Address`	string	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].networkCardIndex`	integer	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].networkInterfaceId`	string	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].privateIpAddress`	string	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].privateIpAddresses`	array<object>	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].privateIpAddresses[].primary`	boolean	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].privateIpAddresses[].privateIpAddress`	string	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].secondaryPrivateIpAddressCount`	integer	—
`launchTemplateConfigs[].overrides[].networkInterfaces[].subnetId`	string	—
`launchTemplateConfigs[].overrides[].placement`	object	—	EC2EC2FleetPlacement is a nested property type of AWS::EC2::EC2Fleet.
`launchTemplateConfigs[].overrides[].placement.affinity`	string	—
`launchTemplateConfigs[].overrides[].placement.availabilityZone`	string	—
`launchTemplateConfigs[].overrides[].placement.groupName`	string	—
`launchTemplateConfigs[].overrides[].placement.hostId`	string	—
`launchTemplateConfigs[].overrides[].placement.hostResourceGroupArn`	string	—
`launchTemplateConfigs[].overrides[].placement.partitionNumber`	integer	—
`launchTemplateConfigs[].overrides[].placement.spreadDomain`	string	—
`launchTemplateConfigs[].overrides[].placement.tenancy`	string	—
`launchTemplateConfigs[].overrides[].priority`	number	—
`launchTemplateConfigs[].overrides[].subnetId`	string	—
`launchTemplateConfigs[].overrides[].weightedCapacity`	number	—
`onDemandOptions`	object	—	Create-only in AWS: changing it requires replacing the resource.
`onDemandOptions.allocationStrategy`	string	—
`onDemandOptions.capacityReservationOptions`	object	—	EC2EC2FleetCapacityReservationOptionsRequest is a nested property type of AWS::EC2::EC2Fleet.
`onDemandOptions.capacityReservationOptions.usageStrategy`	enum	—	Allowed: `use-capacity-reservations-first`
`onDemandOptions.maxTotalPrice`	string	—
`onDemandOptions.minTargetCapacity`	integer	—
`onDemandOptions.singleAvailabilityZone`	boolean	—
`onDemandOptions.singleInstanceType`	boolean	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`replaceUnhealthyInstances`	boolean	—	Create-only in AWS: changing it requires replacing the resource.
`reservedCapacityOptions`	object	—	Create-only in AWS: changing it requires replacing the resource.
`reservedCapacityOptions.allocationStrategy`	enum	—	Allowed: `prioritized`
`reservedCapacityOptions.capacityReservationTarget`	object	—	EC2EC2FleetCapacityReservationTargetRequest is a nested property type of AWS::EC2::EC2Fleet.
`reservedCapacityOptions.capacityReservationTarget.capacityReservationIds`	array<string>	—
`reservedCapacityOptions.capacityReservationTarget.capacityReservationResourceGroupArns`	array<string>	—
`reservedCapacityOptions.reservationTypes`	array<string>	—
`reservedCapacityOptions.reservedCapacityFallbackOptions`	object	—	EC2EC2FleetReservedCapacityFallbackOptionsRequest is a nested property type of AWS::EC2::EC2Fleet.
`reservedCapacityOptions.reservedCapacityFallbackOptions.marketTypes`	array<string>	—
`spotOptions`	object	—	Create-only in AWS: changing it requires replacing the resource.
`spotOptions.allocationStrategy`	enum	—	Allowed: `lowest-price, lowestPrice, diversified, capacityOptimized, capacity-optimized, capacityOptimizedPrioritized, capacity-optimized-prioritized, priceCapacityOptimized…`
`spotOptions.instanceInterruptionBehavior`	enum	—	Allowed: `hibernate, stop, terminate`
`spotOptions.instancePoolsToUseCount`	integer	—
`spotOptions.maintenanceStrategies`	object	—	EC2EC2FleetMaintenanceStrategies is a nested property type of AWS::EC2::EC2Fleet.
`spotOptions.maintenanceStrategies.capacityRebalance`	object	—	EC2EC2FleetCapacityRebalance is a nested property type of AWS::EC2::EC2Fleet.
`spotOptions.maintenanceStrategies.capacityRebalance.replacementStrategy`	enum	—	Allowed: `launch, launch-before-terminate`
`spotOptions.maintenanceStrategies.capacityRebalance.terminationDelay`	integer	—
`spotOptions.maxTotalPrice`	string	—
`spotOptions.minTargetCapacity`	integer	—
`spotOptions.singleAvailabilityZone`	boolean	—
`spotOptions.singleInstanceType`	boolean	—
`tagSpecifications`	array<object>	—	Create-only in AWS: changing it requires replacing the resource.
`tagSpecifications[].resourceType`	enum	—	Allowed: `client-vpn-endpoint, customer-gateway, dedicated-host, dhcp-options, egress-only-internet-gateway, elastic-gpu, elastic-ip, export-image-task…`
`tagSpecifications[].tags`	array<object>	—
`tagSpecifications[].tags[].key`	string	yes
`tagSpecifications[].tags[].value`	string	yes
`targetCapacitySpecification`	object	yes	EC2EC2FleetTargetCapacitySpecificationRequest is a nested property type of AWS::EC2::EC2Fleet.
`targetCapacitySpecification.defaultTargetCapacityType`	enum	—	Allowed: `on-demand, spot, capacity-block, reserved-capacity`
`targetCapacitySpecification.onDemandTargetCapacity`	integer	—
`targetCapacitySpecification.spotTargetCapacity`	integer	—
`targetCapacitySpecification.targetCapacityUnitType`	enum	—	Allowed: `vcpu, memory-mib, units`
`targetCapacitySpecification.totalTargetCapacity`	integer	yes
`terminateInstancesWithExpiration`	boolean	—	Create-only in AWS: changing it requires replacing the resource.
`type`	enum	—	Create-only in AWS: changing it requires replacing the resource. Allowed: `maintain, request, instant`
`validFrom`	string	—	Create-only in AWS: changing it requires replacing the resource.
`validUntil`	string	—	Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`fleetId`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2EnclaveCertificateIamRoleAssociation # CLOUD CONTROL · AWS::EC2::EnclaveCertificateIamRoleAssociation

EC2EnclaveCertificateIamRoleAssociation manages AWS::EC2::EnclaveCertificateIamRoleAssociation through the AWS Cloud Control API.

kubectl get ec2enclavecertificateiamroleassociations · example on GitHub

Example

# EC2EnclaveCertificateIamRoleAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2enclavecertificateiamroleassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2EnclaveCertificateIamRoleAssociation
metadata:
  name: example-ec2enclavecertificateiamroleassociation
  namespace: default
spec:
  certificateArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-ec2enclavecertificateiamroleassociation
    region: us-east-1
  roleArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`certificateArn`	string	yes	The Amazon Resource Name (ARN) of the ACM certificate with which to associate the IAM role.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`roleArn`	string	yes	The Amazon Resource Name (ARN) of the IAM role to associate with the ACM certificate.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`certificateS3BucketName`	string	—	The name of the Amazon S3 bucket to which the certificate was uploaded.
`certificateS3ObjectKey`	string	—	The Amazon S3 object key where the certificate, certificate chain, and encrypted private key bundle are stored.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`encryptionKmsKeyId`	string	—	The ID of the AWS KMS CMK used to encrypt the private key of the certificate.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2FpgaImage # CLOUD CONTROL · AWS::EC2::FpgaImage

EC2FpgaImage manages AWS::EC2::FpgaImage through the AWS Cloud Control API.

kubectl get ec2fpgaimages · example on GitHub

Example

# EC2FpgaImage — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2fpgaimage
apiVersion: aws.konfig.io/v1alpha1
kind: EC2FpgaImage
metadata:
  name: example-ec2fpgaimage
  namespace: default
spec:
  description: Managed by konfig-konector
  inputStorageLocation:
    bucket: example
    key: example
  logsStorageLocation:
    bucket: example
    key: example
  name: example-ec2fpgaimage
  providerRef:
    name: example-ec2fpgaimage
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`description`	string	—	A description for the AFI.
`inputStorageLocation`	object	—	The location of the encrypted design checkpoint in Amazon S3.
`inputStorageLocation.bucket`	string	—	The name of the S3 bucket.
`inputStorageLocation.key`	string	—	The key.
`logsStorageLocation`	object	—	The location in Amazon S3 for the output logs.
`logsStorageLocation.bucket`	string	—	The name of the S3 bucket.
`logsStorageLocation.key`	string	—	The key.
`name`	string	—	A name for the AFI.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags assigned to the FPGA image.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	The ARN of the FPGA image.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createTime`	string	—	The date and time the AFI was created.
`dataRetentionSupport`	boolean	—	Indicates whether data retention support is enabled for the AFI.
`fpgaImageGlobalId`	string	—	The global FPGA image identifier (AGFI ID).
`fpgaImageId`	string	—	The FPGA image identifier (AFI ID).
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`ownerId`	string	—	The ID of the AWS account that owns the AFI.
`public`	boolean	—	Indicates whether the AFI is public.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	The state of the AFI (pending \| available \| failed \| unavailable).
`updateTime`	string	—	The time of the most recent update to the AFI.

EC2GatewayRouteTableAssociation # CLOUD CONTROL · AWS::EC2::GatewayRouteTableAssociation

EC2GatewayRouteTableAssociation manages AWS::EC2::GatewayRouteTableAssociation through the AWS Cloud Control API.

kubectl get ec2gatewayroutetableassociations · example on GitHub

Example

# EC2GatewayRouteTableAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2gatewayroutetableassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2GatewayRouteTableAssociation
metadata:
  name: example-ec2gatewayroutetableassociation
  namespace: default
spec:
  gatewayId: example-id
  providerRef:
    name: example-ec2gatewayroutetableassociation
    region: us-east-1
  routeTableId: example-id

Spec

Field	Type	Required	Description
`gatewayId`	string	yes	The ID of the gateway.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`routeTableId`	string	yes	The ID of the route table.

Status

Field	Type	Required	Description
`associationId`	string	—	The route table association ID.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2Host # CLOUD CONTROL · AWS::EC2::Host

EC2Host manages AWS::EC2::Host through the AWS Cloud Control API.

kubectl get ec2hosts · example on GitHub

Example

# EC2Host — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2host
apiVersion: aws.konfig.io/v1alpha1
kind: EC2Host
metadata:
  name: example-ec2host
  namespace: default
spec:
  autoPlacement: 'on'
  availabilityZone: us-east-1a
  hostMaintenance: 'on'
  hostRecovery: 'on'
  instanceFamily: example
  instanceType: example
  outpostArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-ec2host
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`assetId`	string	—	The ID of the Outpost hardware asset.
`autoPlacement`	enum	—	Indicates whether the host accepts any untargeted instance launches that match its instance type configuration, or if it only accepts Host tenancy instance launches that specify its unique host ID. Allowed: `on, off`
`availabilityZone`	string	yes	The Availability Zone in which to allocate the Dedicated Host.
`hostMaintenance`	enum	—	Automatically allocates a new dedicated host and moves your instances on to it if a degradation is detected on your current host. Allowed: `on, off`
`hostRecovery`	enum	—	Indicates whether to enable or disable host recovery for the Dedicated Host. Allowed: `on, off`
`instanceFamily`	string	—	Specifies the instance family to be supported by the Dedicated Hosts.
`instanceType`	string	—	Specifies the instance type to be supported by the Dedicated Hosts.
`outpostArn`	string	—	The Amazon Resource Name (ARN) of the Amazon Web Services Outpost on which to allocate the Dedicated Host.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Any tags assigned to the Host.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`hostId`	string	—	ID of the host created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2IPAM # CLOUD CONTROL · AWS::EC2::IPAM

EC2IPAM manages AWS::EC2::IPAM through the AWS Cloud Control API.

kubectl get ec2ipams · example on GitHub

Example

# EC2IPAM — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2ipam
apiVersion: aws.konfig.io/v1alpha1
kind: EC2IPAM
metadata:
  name: example-ec2ipam
  namespace: default
spec:
  defaultResourceDiscoveryOrganizationalUnitExclusions:
  - organizationsEntityPath: example
  description: Managed by konfig-konector
  enablePrivateGua: true
  meteredAccount: ipam-owner
  operatingRegions:
  - regionName: example-ec2ipam
  providerRef:
    name: example-ec2ipam
    region: us-east-1
  tags:
  - key: example
    value: example
  tier: free

Spec

Field	Type	Required	Description
`defaultResourceDiscoveryOrganizationalUnitExclusions`	array<object>	—	A set of organizational unit (OU) exclusions for the default resource discovery, created with this IPAM.
`defaultResourceDiscoveryOrganizationalUnitExclusions[].organizationsEntityPath`	string	yes	An AWS Organizations entity path.
`description`	string	—
`enablePrivateGua`	boolean	—	Enable provisioning of GUA space in private pools.
`meteredAccount`	enum	—	A metered account is an account that is charged for active IP addresses managed in IPAM Allowed: `ipam-owner, resource-owner`
`operatingRegions`	array<object>	—	The regions IPAM is enabled for.
`operatingRegions[].regionName`	string	yes	The name of the region.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes
`tier`	enum	—	The tier of the IPAM. Allowed: `free, advanced`

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the IPAM.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`defaultResourceDiscoveryAssociationId`	string	—	The Id of the default association to the default resource discovery, created with this IPAM.
`defaultResourceDiscoveryId`	string	—	The Id of the default resource discovery, created with this IPAM.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`ipamId`	string	—	Id of the IPAM.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`privateDefaultScopeId`	string	—	The Id of the default scope for publicly routable IP space, created with this IPAM.
`publicDefaultScopeId`	string	—	The Id of the default scope for publicly routable IP space, created with this IPAM.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`resourceDiscoveryAssociationCount`	integer	—	The count of resource discoveries associated with this IPAM.
`scopeCount`	integer	—	The number of scopes that currently exist in this IPAM.

EC2IPAMAllocation # CLOUD CONTROL · AWS::EC2::IPAMAllocation

EC2IPAMAllocation manages AWS::EC2::IPAMAllocation through the AWS Cloud Control API.

kubectl get ec2ipamallocations · example on GitHub

Example

# EC2IPAMAllocation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2ipamallocation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2IPAMAllocation
metadata:
  name: example-ec2ipamallocation
  namespace: default
spec:
  cidr: 10.0.0.0/16
  description: Managed by konfig-konector
  ipamPoolId: example-id
  netmaskLength: 1
  providerRef:
    name: example-ec2ipamallocation
    region: us-east-1

Spec

Field	Type	Required	Description
`cidr`	string	—	Create-only in AWS: changing it requires replacing the resource.
`description`	string	—	Create-only in AWS: changing it requires replacing the resource.
`ipamPoolId`	string	yes	Id of the IPAM Pool.
`netmaskLength`	integer	—	The desired netmask length of the allocation.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`ipamPoolAllocationId`	string	—	Id of the allocation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2IPAMPool # CLOUD CONTROL · AWS::EC2::IPAMPool

EC2IPAMPool manages AWS::EC2::IPAMPool through the AWS Cloud Control API.

kubectl get ec2ipampools · example on GitHub

Example

# EC2IPAMPool — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2ipampool
apiVersion: aws.konfig.io/v1alpha1
kind: EC2IPAMPool
metadata:
  name: example-ec2ipampool
  namespace: default
spec:
  addressFamily: example
  allocationDefaultNetmaskLength: 1
  allocationMaxNetmaskLength: 1
  allocationMinNetmaskLength: 1
  allocationResourceTags:
  - key: example
    value: example
  autoImport: false
  awsService: ec2
  description: Managed by konfig-konector
  ipamScopeId: example-id
  locale: example
  providerRef:
    name: example-ec2ipampool
    region: us-east-1
  provisionedCidrs:
  - cidr: 10.0.0.0/16
  publicIpSource: byoip
  publiclyAdvertisable: false
  sourceResource:
    resourceId: example-id
    resourceOwner: example
    resourceRegion: example
    resourceType: example
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`addressFamily`	string	yes	The address family of the address space in this pool.
`allocationDefaultNetmaskLength`	integer	—	The default netmask length for allocations made from this pool.
`allocationMaxNetmaskLength`	integer	—	The maximum allowed netmask length for allocations made from this pool.
`allocationMinNetmaskLength`	integer	—	The minimum allowed netmask length for allocations made from this pool.
`allocationResourceTags`	array<object>	—	When specified, an allocation will not be allowed unless a resource has a matching set of tags.
`allocationResourceTags[].key`	string	yes
`allocationResourceTags[].value`	string	yes
`autoImport`	boolean	—	Determines what to do if IPAM discovers resources that haven't been assigned an allocation.
`awsService`	enum	—	Limits which service in Amazon Web Services that the pool can be used in. Allowed: `ec2, global-services`
`description`	string	—
`ipamScopeId`	string	yes	The Id of the scope this pool is a part of.
`locale`	string	—	The region of this pool.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`provisionedCidrs`	array<object>	—	A list of cidrs representing the address space available for allocation in this pool.
`provisionedCidrs[].cidr`	string	yes
`publicIpSource`	enum	—	The IP address source for pools in the public scope. Allowed: `byoip, amazon`
`publiclyAdvertisable`	boolean	—	Determines whether or not address space from this pool is publicly advertised.
`sourceIpamPoolId`	string	—	The Id of this pool's source.
`sourceResource`	object	—	Create-only in AWS: changing it requires replacing the resource.
`sourceResource.resourceId`	string	yes
`sourceResource.resourceOwner`	string	yes
`sourceResource.resourceRegion`	string	yes
`sourceResource.resourceType`	string	yes
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the IPAM Pool.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`ipamArn`	string	—	The Amazon Resource Name (ARN) of the IPAM this pool is a part of.
`ipamPoolId`	string	—	Id of the IPAM Pool.
`ipamScopeArn`	string	—	The Amazon Resource Name (ARN) of the scope this pool is a part of.
`ipamScopeType`	enum	—	Determines whether this scope contains publicly routable space or space for a private network Read-only: reported by AWS after creation. Allowed: `public, private`
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`poolDepth`	integer	—	The depth of this pool in the source pool hierarchy.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	enum	—	The state of this pool. Allowed: `create-in-progress, create-complete, modify-in-progress, modify-complete, delete-in-progress, delete-complete`
`stateMessage`	string	—	An explanation of how the pool arrived at it current state.

EC2IPAMPoolCidr # CLOUD CONTROL · AWS::EC2::IPAMPoolCidr

EC2IPAMPoolCidr manages AWS::EC2::IPAMPoolCidr through the AWS Cloud Control API.

kubectl get ec2ipampoolcidrs · example on GitHub

Example

# EC2IPAMPoolCidr — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2ipampoolcidr
apiVersion: aws.konfig.io/v1alpha1
kind: EC2IPAMPoolCidr
metadata:
  name: example-ec2ipampoolcidr
  namespace: default
spec:
  cidr: 10.0.0.0/16
  ipamPoolId: example-id
  netmaskLength: 1
  providerRef:
    name: example-ec2ipampoolcidr
    region: us-east-1

Spec

Field	Type	Required	Description
`cidr`	string	—	Represents a single IPv4 or IPv6 CIDR Create-only in AWS: changing it requires replacing the resource.
`ipamPoolId`	string	yes	Id of the IPAM Pool.
`netmaskLength`	integer	—	The desired netmask length of the provision.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`ipamPoolCidrId`	string	—	Id of the IPAM Pool Cidr.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	Provisioned state of the cidr.

EC2IPAMPrefixListResolver # CLOUD CONTROL · AWS::EC2::IPAMPrefixListResolver

EC2IPAMPrefixListResolver manages AWS::EC2::IPAMPrefixListResolver through the AWS Cloud Control API.

kubectl get ec2ipamprefixlistresolvers · example on GitHub

Example

# EC2IPAMPrefixListResolver — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2ipamprefixlistresolver
apiVersion: aws.konfig.io/v1alpha1
kind: EC2IPAMPrefixListResolver
metadata:
  name: example-ec2ipamprefixlistresolver
  namespace: default
spec:
  addressFamily: example
  description: Managed by konfig-konector
  providerRef:
    name: example-ec2ipamprefixlistresolver
    region: us-east-1
  rules:
  - conditions:
    - cidr: 10.0.0.0/16
      operation: equals
      resourceOwner: example
      resourceRegion: example
    resourceType: vpc
    ruleType: static-cidr
    staticCidr: 10.0.0.0/16
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`addressFamily`	string	yes	The address family of the address space in this Prefix List Resolver.
`description`	string	—
`ipamId`	string	—	The Id of the IPAM this Prefix List Resolver is a part of.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`rules`	array<object>	—	Rules define the business logic for selecting CIDRs from IPAM.
`rules[].conditions`	array<object>	—	Two of the rule types allow you to add conditions to the rules.
`rules[].conditions[].cidr`	string	—	Condition for the IPAM Resource CIDR rule type.
`rules[].conditions[].ipamPoolId`	string	—	Condition for the IPAM Pool CIDR rule type.
`rules[].conditions[].operation`	enum	—	Equals, Not equals, or Subnet Of. Allowed: `equals, not-equals, subnet-of`
`rules[].conditions[].resourceId`	string	—	Condition for the IPAM Resource CIDR rule type.
`rules[].conditions[].resourceOwner`	string	—	Condition for the IPAM Resource CIDR rule type.
`rules[].conditions[].resourceRegion`	string	—	Condition for the IPAM Resource CIDR rule type.
`rules[].conditions[].resourceTag`	object	—	Condition for the IPAM Resource CIDR rule type.
`rules[].conditions[].resourceTag.key`	string	yes
`rules[].conditions[].resourceTag.value`	string	yes
`rules[].ipamScopeId`	string	—	This rule will only match resources that are in this IPAM Scope.
`rules[].resourceType`	enum	—	The resourceType property only applies to ipam-resource-cidr rules; this property specifies what type of resources this rule will apply to, such as VPCs or Subnets. Allowed: `vpc, subnet, eip, public-ipv4-pool`
`rules[].ruleType`	enum	yes	There are three rule types: (1) Static CIDR: A fixed list of CIDRs that don't change (like a manual list replicated across Regions). Allowed: `static-cidr, ipam-resource-cidr, ipam-pool-cidr`
`rules[].staticCidr`	string	—	A fixed CIDR that doesn't change
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`ipamArn`	string	—	The Amazon Resource Name (ARN) of the IPAM this Prefix List Resolver is a part of.
`ipamPrefixListResolverArn`	string	—	The Amazon Resource Name (ARN) of the IPAM Prefix List Resolver Read-only: reported by AWS after creation.
`ipamPrefixListResolverId`	string	—	Id of the IPAM Prefix List Resolver.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2IPAMPrefixListResolverTarget # CLOUD CONTROL · AWS::EC2::IPAMPrefixListResolverTarget

EC2IPAMPrefixListResolverTarget manages AWS::EC2::IPAMPrefixListResolverTarget through the AWS Cloud Control API.

kubectl get ec2ipamprefixlistresolvertargets · example on GitHub

Example

# EC2IPAMPrefixListResolverTarget — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2ipamprefixlistresolvertarget
apiVersion: aws.konfig.io/v1alpha1
kind: EC2IPAMPrefixListResolverTarget
metadata:
  name: example-ec2ipamprefixlistresolvertarget
  namespace: default
spec:
  desiredVersion: 1
  ipamPrefixListResolverId: example-id
  prefixListId: example-id
  prefixListRegion: example
  providerRef:
    name: example-ec2ipamprefixlistresolvertarget
    region: us-east-1
  tags:
  - key: example
    value: example
  trackLatestVersion: false

Spec

Field	Type	Required	Description
`desiredVersion`	integer	—	The desired version of the Prefix List Resolver that this Target should synchronize with.
`ipamPrefixListResolverId`	string	yes	The Id of the IPAM Prefix List Resolver associated with this Target.
`prefixListId`	string	yes	The Id of the Managed Prefix List.
`prefixListRegion`	string	yes	The region that the Managed Prefix List is located in.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes
`trackLatestVersion`	boolean	yes	Indicates whether this Target automatically tracks the latest version of the Prefix List Resolver.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`ipamPrefixListResolverTargetArn`	string	—	Id of the IPAM Prefix List Resolver Target.
`ipamPrefixListResolverTargetId`	string	—	Id of the IPAM Prefix List Resolver Target.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2IPAMResourceDiscovery # CLOUD CONTROL · AWS::EC2::IPAMResourceDiscovery

EC2IPAMResourceDiscovery manages AWS::EC2::IPAMResourceDiscovery through the AWS Cloud Control API.

kubectl get ec2ipamresourcediscoveries · example on GitHub

Example

# EC2IPAMResourceDiscovery — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2ipamresourcediscovery
apiVersion: aws.konfig.io/v1alpha1
kind: EC2IPAMResourceDiscovery
metadata:
  name: example-ec2ipamresourcediscovery
  namespace: default
spec:
  description: Managed by konfig-konector
  operatingRegions:
  - regionName: example-ec2ipamresourcediscovery
  organizationalUnitExclusions:
  - organizationsEntityPath: example
  providerRef:
    name: example-ec2ipamresourcediscovery
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`description`	string	—
`operatingRegions`	array<object>	—	The regions Resource Discovery is enabled for.
`operatingRegions[].regionName`	string	yes	The name of the region.
`organizationalUnitExclusions`	array<object>	—	A set of organizational unit (OU) exclusions for this resource.
`organizationalUnitExclusions[].organizationsEntityPath`	string	yes	An AWS Organizations entity path.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`ipamResourceDiscoveryArn`	string	—	Amazon Resource Name (Arn) for the Resource Discovery.
`ipamResourceDiscoveryId`	string	—	Id of the IPAM Pool.
`ipamResourceDiscoveryRegion`	string	—	The region the resource discovery is setup in.
`isDefault`	boolean	—	Determines whether or not address space from this pool is publicly advertised.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`ownerId`	string	—	Owner Account ID of the Resource Discovery Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	The state of this Resource Discovery.

EC2IPAMResourceDiscoveryAssociation # CLOUD CONTROL · AWS::EC2::IPAMResourceDiscoveryAssociation

EC2IPAMResourceDiscoveryAssociation manages AWS::EC2::IPAMResourceDiscoveryAssociation through the AWS Cloud Control API.

kubectl get ec2ipamresourcediscoveryassociations · example on GitHub

Example

# EC2IPAMResourceDiscoveryAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2ipamresourcediscoveryassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2IPAMResourceDiscoveryAssociation
metadata:
  name: example-ec2ipamresourcediscoveryassociation
  namespace: default
spec:
  ipamId: example-id
  ipamResourceDiscoveryId: example-id
  providerRef:
    name: example-ec2ipamresourcediscoveryassociation
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`ipamId`	string	yes	The Id of the IPAM this Resource Discovery is associated to.
`ipamResourceDiscoveryId`	string	yes	The Amazon Resource Name (ARN) of the IPAM Resource Discovery Association.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`ipamArn`	string	—	Arn of the IPAM.
`ipamRegion`	string	—	The home region of the IPAM.
`ipamResourceDiscoveryAssociationArn`	string	—	The Amazon Resource Name (ARN) of the resource discovery association is a part of.
`ipamResourceDiscoveryAssociationId`	string	—	Id of the IPAM Resource Discovery Association.
`isDefault`	boolean	—	If the Resource Discovery Association exists due as part of CreateIpam.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`ownerId`	string	—	The AWS Account ID for the account where the shared IPAM exists.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`resourceDiscoveryStatus`	string	—	The status of the resource discovery.
`state`	string	—	The operational state of the Resource Discovery Association.

EC2IPAMScope # CLOUD CONTROL · AWS::EC2::IPAMScope

EC2IPAMScope manages AWS::EC2::IPAMScope through the AWS Cloud Control API.

kubectl get ec2ipamscopes · example on GitHub

Example

# EC2IPAMScope — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2ipamscope
apiVersion: aws.konfig.io/v1alpha1
kind: EC2IPAMScope
metadata:
  name: example-ec2ipamscope
  namespace: default
spec:
  description: Managed by konfig-konector
  externalAuthorityConfiguration:
    externalResourceIdentifier: example
    ipamScopeExternalAuthorityType: infoblox
  ipamId: example-id
  providerRef:
    name: example-ec2ipamscope
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`description`	string	—
`externalAuthorityConfiguration`	object	—	EC2IPAMScopeIpamScopeExternalAuthorityConfiguration is a nested property type of AWS::EC2::IPAMScope.
`externalAuthorityConfiguration.externalResourceIdentifier`	string	yes	Resource identifier of the scope in the external service connecting to your AWS IPAM scope.
`externalAuthorityConfiguration.ipamScopeExternalAuthorityType`	enum	yes	An external service connecting to your AWS IPAM scope. Allowed: `infoblox`
`ipamId`	string	yes	The Id of the IPAM this scope is a part of.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the IPAM scope.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`ipamArn`	string	—	The Amazon Resource Name (ARN) of the IPAM this scope is a part of.
`ipamScopeId`	string	—	Id of the IPAM scope.
`ipamScopeType`	enum	—	Determines whether this scope contains publicly routable space or space for a private network Read-only: reported by AWS after creation. Allowed: `public, private`
`isDefault`	boolean	—	Is this one of the default scopes created with the IPAM.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`poolCount`	integer	—	The number of pools that currently exist in this scope.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2Instance # GA

EC2Instance is the Schema for managing EC2 Instances.

kubectl get ec2instances · example on GitHub

Example

# EC2Instance — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2instance
apiVersion: aws.konfig.io/v1alpha1
kind: EC2Instance
metadata:
  name: example-ec2instance
  namespace: default
spec:
  associatePublicIpAddress: false
  iamInstanceProfile: example
  imageId: ami-0abc1234def567890
  instanceType: example
  keyName: example-ec2instance
  providerRef:
    name: example-ec2instance
    region: us-east-1
  securityGroupRefs:
  - name: example-securitygrouprefs
  subnetRef: example
  tags:
    environment: dev
    team: platform
  userData: example

Spec

Field	Type	Required	Description
`associatePublicIpAddress`	boolean	—	AssociatePublicIPAddress controls whether a public IP is assigned.
`iamInstanceProfile`	string	—	IAMInstanceProfile is the name or ARN of the IAM instance profile.
`imageId`	string	yes	ImageID is the AMI ID.
`instanceType`	string	yes	InstanceType is the EC2 instance type (e.g.
`keyName`	string	—	KeyName is the name of the key pair to associate with the instance.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`securityGroupRefs`	array<object>	—	SecurityGroupRefs is the list of SecurityGroup CRs (or direct IDs) to attach.
`securityGroupRefs[].id`	string	—	ID is a direct AWS Security Group ID (e.g.
`securityGroupRefs[].name`	string	—	Name of a SecurityGroup CR in the same namespace.
`subnetRef`	string	—	SubnetRef is the name of a Subnet CR in the same namespace.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`userData`	string	—	UserData is the base64-encoded user data script.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`instanceId`	string	—	InstanceID is the EC2 instance ID.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`privateIp`	string	—	PrivateIP is the private IPv4 address.
`publicIp`	string	—	PublicIP is the public IPv4 address (if assigned).
`state`	string	—	State is the current instance state (pending, running, stopped, terminated).

EC2InstanceConnectEndpoint # CLOUD CONTROL · AWS::EC2::InstanceConnectEndpoint

EC2InstanceConnectEndpoint manages AWS::EC2::InstanceConnectEndpoint through the AWS Cloud Control API.

kubectl get ec2instanceconnectendpoints · example on GitHub

Example

# EC2InstanceConnectEndpoint — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2instanceconnectendpoint
apiVersion: aws.konfig.io/v1alpha1
kind: EC2InstanceConnectEndpoint
metadata:
  name: example-ec2instanceconnectendpoint
  namespace: default
spec:
  clientToken: example
  preserveClientIp: false
  providerRef:
    name: example-ec2instanceconnectendpoint
    region: us-east-1
  securityGroupIds:
  - example
  subnetId: subnet-0abc12def3456789
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`clientToken`	string	—	The client token of the instance connect endpoint.
`preserveClientIp`	boolean	—	Indicates whether your client's IP address is preserved as the source when you connect to a resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`securityGroupIds`	array<string>	—	The security groups associated with the endpoint.
`subnetId`	string	yes	The ID of the subnet in which the EC2 Instance Connect Endpoint was created.
`tags`	array<object>	—	The tags assigned to the EC2 Instance Connect Endpoint.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`availabilityZone`	string	—	The Availability Zone of the EC2 Instance Connect Endpoint Read-only: reported by AWS after creation.
`availabilityZoneId`	string	—	The ID of the Availability Zone of the EC2 Instance Connect Endpoint Read-only: reported by AWS after creation.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The date and time that the EC2 Instance Connect Endpoint was created Read-only: reported by AWS after creation.
`id`	string	—	The ID of the EC2 Instance Connect Endpoint.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`instanceConnectEndpointArn`	string	—	The Amazon Resource Name (ARN) of the EC2 Instance Connect Endpoint Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`networkInterfaceIds`	array<string>	—	The ID of the elastic network interface that Amazon EC2 automatically created when creating the EC2 Instance Connect Endpoint Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`ownerId`	string	—	The ID of the AWS account that created the EC2 Instance Connect Endpoint Read-only: reported by AWS after creation.
`publicDnsNames`	object	—	The public DNS names of the endpoint Read-only: reported by AWS after creation.
`publicDnsNames.dualstack`	object	—	The dualstack DNS name of the EC2 Instance Connect Endpoint.
`publicDnsNames.dualstack.dnsName`	string	—	The DNS name of the EC2 Instance Connect Endpoint.
`publicDnsNames.dualstack.fipsDnsName`	string	—	The Federal Information Processing Standards (FIPS) compliant DNS name of the EC2 Instance Connect Endpoint.
`publicDnsNames.ipv4`	object	—	The IPv4-only DNS name of the EC2 Instance Connect Endpoint.
`publicDnsNames.ipv4.dnsName`	string	—	The DNS name of the EC2 Instance Connect Endpoint.
`publicDnsNames.ipv4.fipsDnsName`	string	—	The Federal Information Processing Standards (FIPS) compliant DNS name of the EC2 Instance Connect Endpoint.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	enum	—	The current state of the EC2 Instance Connect Endpoint Read-only: reported by AWS after creation. Allowed: `create-in-progress, create-complete, create-failed, delete-in-progress, delete-complete, delete-failed, update-in-progress, update-complete…`
`stateMessage`	string	—	The message for the current state of the EC2 Instance Connect Endpoint.
`vpcId`	string	—	The ID of the VPC in which the EC2 Instance Connect Endpoint was created Read-only: reported by AWS after creation.

EC2IpPoolRouteTableAssociation # CLOUD CONTROL · AWS::EC2::IpPoolRouteTableAssociation

EC2IpPoolRouteTableAssociation manages AWS::EC2::IpPoolRouteTableAssociation through the AWS Cloud Control API.

kubectl get ec2ippoolroutetableassociations · example on GitHub

Example

# EC2IpPoolRouteTableAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2ippoolroutetableassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2IpPoolRouteTableAssociation
metadata:
  name: example-ec2ippoolroutetableassociation
  namespace: default
spec:
  providerRef:
    name: example-ec2ippoolroutetableassociation
    region: us-east-1
  publicIpv4Pool: example
  routeTableId: example-id

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`publicIpv4Pool`	string	yes	The ID of the public IPv4 pool.
`routeTableId`	string	yes	The ID of the route table.

Status

Field	Type	Required	Description
`associationId`	string	—	The route table association ID.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2IpamExternalResourceVerificationToken # CLOUD CONTROL · AWS::EC2::IpamExternalResourceVerificationToken

EC2IpamExternalResourceVerificationToken manages AWS::EC2::IpamExternalResourceVerificationToken through the AWS Cloud Control API.

kubectl get ec2ipamexternalresourceverificationtokens · example on GitHub

Example

# EC2IpamExternalResourceVerificationToken — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2ipamexternalresourceverificationtoken
apiVersion: aws.konfig.io/v1alpha1
kind: EC2IpamExternalResourceVerificationToken
metadata:
  name: example-ec2ipamexternalresourceverificationtoken
  namespace: default
spec:
  ipamId: example-id
  providerRef:
    name: example-ec2ipamexternalresourceverificationtoken
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`ipamId`	string	yes	The ID of the IPAM that will create the token.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the token.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`ipamArn`	string	—	The ARN of the IPAM that created the token.
`ipamExternalResourceVerificationTokenArn`	string	—	The ARN of the IPAM external resource verification token.
`ipamExternalResourceVerificationTokenId`	string	—	The ID of the token.
`ipamRegion`	string	—	The Region of the IPAM that created the token.
`lastSyncTime`	string	—
`notAfter`	string	—	The token expiration.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	enum	—	The token state. Allowed: `create-in-progress, create-complete, create-failed, delete-in-progress, delete-complete, delete-failed`
`status`	enum	—	The token status. Allowed: `valid, expired`
`tokenName`	string	—	The token name.
`tokenValue`	string	—	The token value.

EC2LocalGatewayRoute # CLOUD CONTROL · AWS::EC2::LocalGatewayRoute

EC2LocalGatewayRoute manages AWS::EC2::LocalGatewayRoute through the AWS Cloud Control API.

kubectl get ec2localgatewayroutes · example on GitHub

Example

# EC2LocalGatewayRoute — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2localgatewayroute
apiVersion: aws.konfig.io/v1alpha1
kind: EC2LocalGatewayRoute
metadata:
  name: example-ec2localgatewayroute
  namespace: default
spec:
  destinationCidrBlock: 10.0.0.0/16
  providerRef:
    name: example-ec2localgatewayroute
    region: us-east-1

Spec

Field	Type	Required	Description
`destinationCidrBlock`	string	—	The CIDR block used for destination matches.
`localGatewayRouteTableId`	string	—	The ID of the local gateway route table.
`localGatewayVirtualInterfaceGroupId`	string	—	The ID of the virtual interface group.
`networkInterfaceId`	string	—	The ID of the network interface.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	The state of the route.
`type`	string	—	The route type.

EC2LocalGatewayRouteTable # CLOUD CONTROL · AWS::EC2::LocalGatewayRouteTable

EC2LocalGatewayRouteTable manages AWS::EC2::LocalGatewayRouteTable through the AWS Cloud Control API.

kubectl get ec2localgatewayroutetables · example on GitHub

Example

# EC2LocalGatewayRouteTable — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2localgatewayroutetable
apiVersion: aws.konfig.io/v1alpha1
kind: EC2LocalGatewayRouteTable
metadata:
  name: example-ec2localgatewayroutetable
  namespace: default
spec:
  localGatewayId: example-id
  mode: example
  providerRef:
    name: example-ec2localgatewayroutetable
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`localGatewayId`	string	yes	The ID of the local gateway.
`mode`	string	—	The mode of the local gateway route table.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the local gateway route table.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`localGatewayRouteTableArn`	string	—	The ARN of the local gateway route table.
`localGatewayRouteTableId`	string	—	The ID of the local gateway route table.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`outpostArn`	string	—	The ARN of the outpost.
`ownerId`	string	—	The owner of the local gateway route table.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	The state of the local gateway route table.

EC2LocalGatewayRouteTableVPCAssociation # CLOUD CONTROL · AWS::EC2::LocalGatewayRouteTableVPCAssociation

EC2LocalGatewayRouteTableVPCAssociation manages AWS::EC2::LocalGatewayRouteTableVPCAssociation through the AWS Cloud Control API.

kubectl get ec2localgatewayroutetablevpcassociations · example on GitHub

Example

# EC2LocalGatewayRouteTableVPCAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2localgatewayroutetablevpcassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2LocalGatewayRouteTableVPCAssociation
metadata:
  name: example-ec2localgatewayroutetablevpcassociation
  namespace: default
spec:
  localGatewayRouteTableId: example-id
  providerRef:
    name: example-ec2localgatewayroutetablevpcassociation
    region: us-east-1
  tags:
  - key: example
    value: example
  vpcId: vpc-0abc12def3456789

Spec

Field	Type	Required	Description
`localGatewayRouteTableId`	string	yes	The ID of the local gateway route table.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the association.
`tags[].key`	string	yes
`tags[].value`	string	yes
`vpcId`	string	yes	The ID of the VPC.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`localGatewayId`	string	—	The ID of the local gateway.
`localGatewayRouteTableVpcAssociationId`	string	—	The ID of the association.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	The state of the association.

EC2LocalGatewayRouteTableVirtualInterfaceGroupAssociation # CLOUD CONTROL · AWS::EC2::LocalGatewayRouteTableVirtualInterfaceGroupAssociation

EC2LocalGatewayRouteTableVirtualInterfaceGroupAssociation manages AWS::EC2::LocalGatewayRouteTableVirtualInterfaceGroupAssociation through the AWS Cloud Control API.

kubectl get ec2localgatewayroutetablevirtualinterfacegroupassociations · example on GitHub

Example

# EC2LocalGatewayRouteTableVirtualInterfaceGroupAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2localgatewayroutetablevirtualinterfacegroupassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2LocalGatewayRouteTableVirtualInterfaceGroupAssociation
metadata:
  name: example-ec2localgatewayroutetablevirtualinterfacegroupassociation
  namespace: default
spec:
  localGatewayRouteTableId: example-id
  localGatewayVirtualInterfaceGroupId: example-id
  providerRef:
    name: example-ec2localgatewayroutetablevirtualinterfacegroupassociation
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`localGatewayRouteTableId`	string	yes	The ID of the local gateway route table.
`localGatewayVirtualInterfaceGroupId`	string	yes	The ID of the local gateway route table virtual interface group.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the local gateway route table virtual interface group association.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`localGatewayId`	string	—	The ID of the local gateway.
`localGatewayRouteTableArn`	string	—	The ARN of the local gateway route table.
`localGatewayRouteTableVirtualInterfaceGroupAssociationId`	string	—	The ID of the local gateway route table virtual interface group association.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`ownerId`	string	—	The owner of the local gateway route table virtual interface group association.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	The state of the local gateway route table virtual interface group association.

EC2LocalGatewayVirtualInterface # CLOUD CONTROL · AWS::EC2::LocalGatewayVirtualInterface

EC2LocalGatewayVirtualInterface manages AWS::EC2::LocalGatewayVirtualInterface through the AWS Cloud Control API.

kubectl get ec2localgatewayvirtualinterfaces · example on GitHub

Example

# EC2LocalGatewayVirtualInterface — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2localgatewayvirtualinterface
apiVersion: aws.konfig.io/v1alpha1
kind: EC2LocalGatewayVirtualInterface
metadata:
  name: example-ec2localgatewayvirtualinterface
  namespace: default
spec:
  localAddress: example
  localGatewayVirtualInterfaceGroupId: example-id
  outpostLagId: example-id
  peerAddress: example
  peerBgpAsn: 1
  peerBgpAsnExtended: 1
  providerRef:
    name: example-ec2localgatewayvirtualinterface
    region: us-east-1
  tags:
  - key: example
    value: example
  vlan: 1

Spec

Field	Type	Required	Description
`localAddress`	string	yes	The local address.
`localGatewayVirtualInterfaceGroupId`	string	yes	The ID of the virtual interface group Create-only in AWS: changing it requires replacing the resource.
`outpostLagId`	string	yes	The Outpost LAG ID.
`peerAddress`	string	yes	The peer address.
`peerBgpAsn`	integer	—	The peer BGP ASN.
`peerBgpAsnExtended`	integer	—	The extended 32-bit ASN of the BGP peer for use with larger ASN values.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes
`vlan`	integer	yes	The ID of the VLAN.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`configurationState`	string	—	The current state of the local gateway virtual interface Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`localBgpAsn`	integer	—	The Autonomous System Number(ASN) for the local Border Gateway Protocol (BGP) Read-only: reported by AWS after creation.
`localGatewayId`	string	—	The ID of the local gateway Read-only: reported by AWS after creation.
`localGatewayVirtualInterfaceId`	string	—	The ID of the virtual interface Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`ownerId`	string	—	The ID of the Amazon Web Services account that owns the local gateway virtual interface group Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2LocalGatewayVirtualInterfaceGroup # CLOUD CONTROL · AWS::EC2::LocalGatewayVirtualInterfaceGroup

EC2LocalGatewayVirtualInterfaceGroup manages AWS::EC2::LocalGatewayVirtualInterfaceGroup through the AWS Cloud Control API.

kubectl get ec2localgatewayvirtualinterfacegroups · example on GitHub

Example

# EC2LocalGatewayVirtualInterfaceGroup — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2localgatewayvirtualinterfacegroup
apiVersion: aws.konfig.io/v1alpha1
kind: EC2LocalGatewayVirtualInterfaceGroup
metadata:
  name: example-ec2localgatewayvirtualinterfacegroup
  namespace: default
spec:
  localBgpAsn: 1
  localBgpAsnExtended: 1
  localGatewayId: example-id
  providerRef:
    name: example-ec2localgatewayvirtualinterfacegroup
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`localBgpAsn`	integer	—	The Autonomous System Number(ASN) for the local Border Gateway Protocol (BGP) Create-only in AWS: changing it requires replacing the resource.
`localBgpAsnExtended`	integer	—	The extended 32-bit ASN for the local BGP configuration Create-only in AWS: changing it requires replacing the resource.
`localGatewayId`	string	yes	The ID of the local gateway Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags assigned to the virtual interface group
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`configurationState`	string	—	The current state of the local gateway virtual interface group Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`localGatewayVirtualInterfaceGroupArn`	string	—	The Amazon Resource Number (ARN) of the local gateway virtual interface group Read-only: reported by AWS after creation.
`localGatewayVirtualInterfaceGroupId`	string	—	The ID of the virtual interface group Read-only: reported by AWS after creation.
`localGatewayVirtualInterfaceIds`	array<string>	—	The IDs of the virtual interfaces Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`ownerId`	string	—	The ID of the Amazon Web Services account that owns the local gateway virtual interface group Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2NetworkInsightsAccessScope # CLOUD CONTROL · AWS::EC2::NetworkInsightsAccessScope

EC2NetworkInsightsAccessScope manages AWS::EC2::NetworkInsightsAccessScope through the AWS Cloud Control API.

kubectl get ec2networkinsightsaccessscopes · example on GitHub

Example

# EC2NetworkInsightsAccessScope — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2networkinsightsaccessscope
apiVersion: aws.konfig.io/v1alpha1
kind: EC2NetworkInsightsAccessScope
metadata:
  name: example-ec2networkinsightsaccessscope
  namespace: default
spec:
  providerRef:
    name: example-ec2networkinsightsaccessscope
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`excludePaths`	array<object>	—	Create-only in AWS: changing it requires replacing the resource.
`excludePaths[].destination`	object	—	EC2NetworkInsightsAccessScopePathStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`excludePaths[].destination.packetHeaderStatement`	object	—	EC2NetworkInsightsAccessScopePacketHeaderStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`excludePaths[].destination.packetHeaderStatement.destinationAddresses`	array<string>	—
`excludePaths[].destination.packetHeaderStatement.destinationPorts`	array<string>	—
`excludePaths[].destination.packetHeaderStatement.destinationPrefixLists`	array<string>	—
`excludePaths[].destination.packetHeaderStatement.protocols`	array<string>	—
`excludePaths[].destination.packetHeaderStatement.sourceAddresses`	array<string>	—
`excludePaths[].destination.packetHeaderStatement.sourcePorts`	array<string>	—
`excludePaths[].destination.packetHeaderStatement.sourcePrefixLists`	array<string>	—
`excludePaths[].destination.resourceStatement`	object	—	EC2NetworkInsightsAccessScopeResourceStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`excludePaths[].destination.resourceStatement.resourceTypes`	array<string>	—
`excludePaths[].destination.resourceStatement.resources`	array<string>	—
`excludePaths[].source`	object	—	EC2NetworkInsightsAccessScopePathStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`excludePaths[].source.packetHeaderStatement`	object	—	EC2NetworkInsightsAccessScopePacketHeaderStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`excludePaths[].source.packetHeaderStatement.destinationAddresses`	array<string>	—
`excludePaths[].source.packetHeaderStatement.destinationPorts`	array<string>	—
`excludePaths[].source.packetHeaderStatement.destinationPrefixLists`	array<string>	—
`excludePaths[].source.packetHeaderStatement.protocols`	array<string>	—
`excludePaths[].source.packetHeaderStatement.sourceAddresses`	array<string>	—
`excludePaths[].source.packetHeaderStatement.sourcePorts`	array<string>	—
`excludePaths[].source.packetHeaderStatement.sourcePrefixLists`	array<string>	—
`excludePaths[].source.resourceStatement`	object	—	EC2NetworkInsightsAccessScopeResourceStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`excludePaths[].source.resourceStatement.resourceTypes`	array<string>	—
`excludePaths[].source.resourceStatement.resources`	array<string>	—
`excludePaths[].throughResources`	array<object>	—
`excludePaths[].throughResources[].resourceStatement`	object	—	EC2NetworkInsightsAccessScopeResourceStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`excludePaths[].throughResources[].resourceStatement.resourceTypes`	array<string>	—
`excludePaths[].throughResources[].resourceStatement.resources`	array<string>	—
`matchPaths`	array<object>	—	Create-only in AWS: changing it requires replacing the resource.
`matchPaths[].destination`	object	—	EC2NetworkInsightsAccessScopePathStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`matchPaths[].destination.packetHeaderStatement`	object	—	EC2NetworkInsightsAccessScopePacketHeaderStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`matchPaths[].destination.packetHeaderStatement.destinationAddresses`	array<string>	—
`matchPaths[].destination.packetHeaderStatement.destinationPorts`	array<string>	—
`matchPaths[].destination.packetHeaderStatement.destinationPrefixLists`	array<string>	—
`matchPaths[].destination.packetHeaderStatement.protocols`	array<string>	—
`matchPaths[].destination.packetHeaderStatement.sourceAddresses`	array<string>	—
`matchPaths[].destination.packetHeaderStatement.sourcePorts`	array<string>	—
`matchPaths[].destination.packetHeaderStatement.sourcePrefixLists`	array<string>	—
`matchPaths[].destination.resourceStatement`	object	—	EC2NetworkInsightsAccessScopeResourceStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`matchPaths[].destination.resourceStatement.resourceTypes`	array<string>	—
`matchPaths[].destination.resourceStatement.resources`	array<string>	—
`matchPaths[].source`	object	—	EC2NetworkInsightsAccessScopePathStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`matchPaths[].source.packetHeaderStatement`	object	—	EC2NetworkInsightsAccessScopePacketHeaderStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`matchPaths[].source.packetHeaderStatement.destinationAddresses`	array<string>	—
`matchPaths[].source.packetHeaderStatement.destinationPorts`	array<string>	—
`matchPaths[].source.packetHeaderStatement.destinationPrefixLists`	array<string>	—
`matchPaths[].source.packetHeaderStatement.protocols`	array<string>	—
`matchPaths[].source.packetHeaderStatement.sourceAddresses`	array<string>	—
`matchPaths[].source.packetHeaderStatement.sourcePorts`	array<string>	—
`matchPaths[].source.packetHeaderStatement.sourcePrefixLists`	array<string>	—
`matchPaths[].source.resourceStatement`	object	—	EC2NetworkInsightsAccessScopeResourceStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`matchPaths[].source.resourceStatement.resourceTypes`	array<string>	—
`matchPaths[].source.resourceStatement.resources`	array<string>	—
`matchPaths[].throughResources`	array<object>	—
`matchPaths[].throughResources[].resourceStatement`	object	—	EC2NetworkInsightsAccessScopeResourceStatementRequest is a nested property type of AWS::EC2::NetworkInsightsAccessScope.
`matchPaths[].throughResources[].resourceStatement.resourceTypes`	array<string>	—
`matchPaths[].throughResources[].resourceStatement.resources`	array<string>	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdDate`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`networkInsightsAccessScopeArn`	string	—	Read-only: reported by AWS after creation.
`networkInsightsAccessScopeId`	string	—	Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`updatedDate`	string	—	Read-only: reported by AWS after creation.

EC2NetworkInsightsAccessScopeAnalysis # CLOUD CONTROL · AWS::EC2::NetworkInsightsAccessScopeAnalysis

EC2NetworkInsightsAccessScopeAnalysis manages AWS::EC2::NetworkInsightsAccessScopeAnalysis through the AWS Cloud Control API.

kubectl get ec2networkinsightsaccessscopeanalyses · example on GitHub

Example

# EC2NetworkInsightsAccessScopeAnalysis — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2networkinsightsaccessscopeanalysis
apiVersion: aws.konfig.io/v1alpha1
kind: EC2NetworkInsightsAccessScopeAnalysis
metadata:
  name: example-ec2networkinsightsaccessscopeanalysis
  namespace: default
spec:
  networkInsightsAccessScopeId: example-id
  providerRef:
    name: example-ec2networkinsightsaccessscopeanalysis
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`networkInsightsAccessScopeId`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`analyzedEniCount`	integer	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`endDate`	string	—	Read-only: reported by AWS after creation.
`findingsFound`	enum	—	Read-only: reported by AWS after creation. Allowed: `True, False, unknown`
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`networkInsightsAccessScopeAnalysisArn`	string	—	Read-only: reported by AWS after creation.
`networkInsightsAccessScopeAnalysisId`	string	—	Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`startDate`	string	—	Read-only: reported by AWS after creation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `running, failed, succeeded`
`statusMessage`	string	—	Read-only: reported by AWS after creation.

EC2NetworkInsightsAnalysis # CLOUD CONTROL · AWS::EC2::NetworkInsightsAnalysis

EC2NetworkInsightsAnalysis manages AWS::EC2::NetworkInsightsAnalysis through the AWS Cloud Control API.

kubectl get ec2networkinsightsanalyses · example on GitHub

Example

# EC2NetworkInsightsAnalysis — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2networkinsightsanalysis
apiVersion: aws.konfig.io/v1alpha1
kind: EC2NetworkInsightsAnalysis
metadata:
  name: example-ec2networkinsightsanalysis
  namespace: default
spec:
  additionalAccounts:
  - example
  filterInArns:
  - example
  filterOutArns:
  - example
  networkInsightsPathId: example-id
  providerRef:
    name: example-ec2networkinsightsanalysis
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`additionalAccounts`	array<string>	—
`filterInArns`	array<string>	—	Create-only in AWS: changing it requires replacing the resource.
`filterOutArns`	array<string>	—	Create-only in AWS: changing it requires replacing the resource.
`networkInsightsPathId`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`alternatePathHints`	array<object>	—	Read-only: reported by AWS after creation.
`alternatePathHints[].componentArn`	string	—
`alternatePathHints[].componentId`	string	—
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`explanations`	array<object>	—	Read-only: reported by AWS after creation.
`explanations[].acl`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].acl.arn`	string	—
`explanations[].acl.id`	string	—
`explanations[].aclRule`	object	—	EC2NetworkInsightsAnalysisAnalysisAclRule is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].aclRule.cidr`	string	—
`explanations[].aclRule.egress`	boolean	—
`explanations[].aclRule.portRange`	object	—	EC2NetworkInsightsAnalysisPortRange is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].aclRule.portRange.from`	integer	—
`explanations[].aclRule.portRange.to`	integer	—
`explanations[].aclRule.protocol`	string	—
`explanations[].aclRule.ruleAction`	string	—
`explanations[].aclRule.ruleNumber`	integer	—
`explanations[].address`	string	—
`explanations[].addresses`	array<string>	—
`explanations[].attachedTo`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].attachedTo.arn`	string	—
`explanations[].attachedTo.id`	string	—
`explanations[].availabilityZones`	array<string>	—
`explanations[].cidrs`	array<string>	—
`explanations[].classicLoadBalancerListener`	object	—	EC2NetworkInsightsAnalysisAnalysisLoadBalancerListener is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].classicLoadBalancerListener.instancePort`	integer	—
`explanations[].classicLoadBalancerListener.loadBalancerPort`	integer	—
`explanations[].component`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].component.arn`	string	—
`explanations[].component.id`	string	—
`explanations[].componentAccount`	string	—
`explanations[].componentRegion`	string	—
`explanations[].customerGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].customerGateway.arn`	string	—
`explanations[].customerGateway.id`	string	—
`explanations[].destination`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].destination.arn`	string	—
`explanations[].destination.id`	string	—
`explanations[].destinationVpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].destinationVpc.arn`	string	—
`explanations[].destinationVpc.id`	string	—
`explanations[].direction`	string	—
`explanations[].elasticLoadBalancerListener`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].elasticLoadBalancerListener.arn`	string	—
`explanations[].elasticLoadBalancerListener.id`	string	—
`explanations[].explanationCode`	string	—
`explanations[].ingressRouteTable`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].ingressRouteTable.arn`	string	—
`explanations[].ingressRouteTable.id`	string	—
`explanations[].internetGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].internetGateway.arn`	string	—
`explanations[].internetGateway.id`	string	—
`explanations[].loadBalancerArn`	string	—
`explanations[].loadBalancerListenerPort`	integer	—
`explanations[].loadBalancerTarget`	object	—	EC2NetworkInsightsAnalysisAnalysisLoadBalancerTarget is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].loadBalancerTarget.address`	string	—
`explanations[].loadBalancerTarget.availabilityZone`	string	—
`explanations[].loadBalancerTarget.instance`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].loadBalancerTarget.instance.arn`	string	—
`explanations[].loadBalancerTarget.instance.id`	string	—
`explanations[].loadBalancerTarget.port`	integer	—
`explanations[].loadBalancerTargetGroup`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].loadBalancerTargetGroup.arn`	string	—
`explanations[].loadBalancerTargetGroup.id`	string	—
`explanations[].loadBalancerTargetGroups`	array<object>	—
`explanations[].loadBalancerTargetGroups[].arn`	string	—
`explanations[].loadBalancerTargetGroups[].id`	string	—
`explanations[].loadBalancerTargetPort`	integer	—
`explanations[].missingComponent`	string	—
`explanations[].natGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].natGateway.arn`	string	—
`explanations[].natGateway.id`	string	—
`explanations[].networkInterface`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].networkInterface.arn`	string	—
`explanations[].networkInterface.id`	string	—
`explanations[].packetField`	string	—
`explanations[].port`	integer	—
`explanations[].portRanges`	array<object>	—
`explanations[].portRanges[].from`	integer	—
`explanations[].portRanges[].to`	integer	—
`explanations[].prefixList`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].prefixList.arn`	string	—
`explanations[].prefixList.id`	string	—
`explanations[].protocols`	array<string>	—
`explanations[].routeTable`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].routeTable.arn`	string	—
`explanations[].routeTable.id`	string	—
`explanations[].routeTableRoute`	object	—	EC2NetworkInsightsAnalysisAnalysisRouteTableRoute is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].routeTableRoute.destinationCidr`	string	—
`explanations[].routeTableRoute.destinationPrefixListId`	string	—
`explanations[].routeTableRoute.egressOnlyInternetGatewayId`	string	—
`explanations[].routeTableRoute.gatewayId`	string	—
`explanations[].routeTableRoute.instanceId`	string	—
`explanations[].routeTableRoute.natGatewayId`	string	—
`explanations[].routeTableRoute.networkInterfaceId`	string	—
`explanations[].routeTableRoute.origin`	string	—
`explanations[].routeTableRoute.state`	string	—
`explanations[].routeTableRoute.transitGatewayId`	string	—
`explanations[].routeTableRoute.vpcPeeringConnectionId`	string	—
`explanations[].securityGroup`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].securityGroup.arn`	string	—
`explanations[].securityGroup.id`	string	—
`explanations[].securityGroupRule`	object	—	EC2NetworkInsightsAnalysisAnalysisSecurityGroupRule is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].securityGroupRule.cidr`	string	—
`explanations[].securityGroupRule.direction`	string	—
`explanations[].securityGroupRule.portRange`	object	—	EC2NetworkInsightsAnalysisPortRange is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].securityGroupRule.portRange.from`	integer	—
`explanations[].securityGroupRule.portRange.to`	integer	—
`explanations[].securityGroupRule.prefixListId`	string	—
`explanations[].securityGroupRule.protocol`	string	—
`explanations[].securityGroupRule.securityGroupId`	string	—
`explanations[].securityGroups`	array<object>	—
`explanations[].securityGroups[].arn`	string	—
`explanations[].securityGroups[].id`	string	—
`explanations[].sourceVpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].sourceVpc.arn`	string	—
`explanations[].sourceVpc.id`	string	—
`explanations[].state`	string	—
`explanations[].subnet`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].subnet.arn`	string	—
`explanations[].subnet.id`	string	—
`explanations[].subnetRouteTable`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].subnetRouteTable.arn`	string	—
`explanations[].subnetRouteTable.id`	string	—
`explanations[].transitGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].transitGateway.arn`	string	—
`explanations[].transitGateway.id`	string	—
`explanations[].transitGatewayAttachment`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].transitGatewayAttachment.arn`	string	—
`explanations[].transitGatewayAttachment.id`	string	—
`explanations[].transitGatewayRouteTable`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].transitGatewayRouteTable.arn`	string	—
`explanations[].transitGatewayRouteTable.id`	string	—
`explanations[].transitGatewayRouteTableRoute`	object	—	EC2NetworkInsightsAnalysisTransitGatewayRouteTableRoute is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].transitGatewayRouteTableRoute.attachmentId`	string	—
`explanations[].transitGatewayRouteTableRoute.destinationCidr`	string	—
`explanations[].transitGatewayRouteTableRoute.prefixListId`	string	—
`explanations[].transitGatewayRouteTableRoute.resourceId`	string	—
`explanations[].transitGatewayRouteTableRoute.resourceType`	string	—
`explanations[].transitGatewayRouteTableRoute.routeOrigin`	string	—
`explanations[].transitGatewayRouteTableRoute.state`	string	—
`explanations[].vpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].vpc.arn`	string	—
`explanations[].vpc.id`	string	—
`explanations[].vpcEndpoint`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].vpcEndpoint.arn`	string	—
`explanations[].vpcEndpoint.id`	string	—
`explanations[].vpcPeeringConnection`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].vpcPeeringConnection.arn`	string	—
`explanations[].vpcPeeringConnection.id`	string	—
`explanations[].vpnConnection`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].vpnConnection.arn`	string	—
`explanations[].vpnConnection.id`	string	—
`explanations[].vpnGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`explanations[].vpnGateway.arn`	string	—
`explanations[].vpnGateway.id`	string	—
`forwardPathComponents`	array<object>	—	Read-only: reported by AWS after creation.
`forwardPathComponents[].aclRule`	object	—	EC2NetworkInsightsAnalysisAnalysisAclRule is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].aclRule.cidr`	string	—
`forwardPathComponents[].aclRule.egress`	boolean	—
`forwardPathComponents[].aclRule.portRange`	object	—	EC2NetworkInsightsAnalysisPortRange is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].aclRule.portRange.from`	integer	—
`forwardPathComponents[].aclRule.portRange.to`	integer	—
`forwardPathComponents[].aclRule.protocol`	string	—
`forwardPathComponents[].aclRule.ruleAction`	string	—
`forwardPathComponents[].aclRule.ruleNumber`	integer	—
`forwardPathComponents[].additionalDetails`	array<object>	—
`forwardPathComponents[].additionalDetails[].additionalDetailType`	string	—
`forwardPathComponents[].additionalDetails[].component`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].additionalDetails[].component.arn`	string	—
`forwardPathComponents[].additionalDetails[].component.id`	string	—
`forwardPathComponents[].additionalDetails[].loadBalancers`	array<object>	—
`forwardPathComponents[].additionalDetails[].loadBalancers[].arn`	string	—
`forwardPathComponents[].additionalDetails[].loadBalancers[].id`	string	—
`forwardPathComponents[].additionalDetails[].serviceName`	string	—
`forwardPathComponents[].component`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].component.arn`	string	—
`forwardPathComponents[].component.id`	string	—
`forwardPathComponents[].destinationVpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].destinationVpc.arn`	string	—
`forwardPathComponents[].destinationVpc.id`	string	—
`forwardPathComponents[].elasticLoadBalancerListener`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].elasticLoadBalancerListener.arn`	string	—
`forwardPathComponents[].elasticLoadBalancerListener.id`	string	—
`forwardPathComponents[].explanations`	array<object>	—
`forwardPathComponents[].explanations[].acl`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].acl.arn`	string	—
`forwardPathComponents[].explanations[].acl.id`	string	—
`forwardPathComponents[].explanations[].aclRule`	object	—	EC2NetworkInsightsAnalysisAnalysisAclRule is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].aclRule.cidr`	string	—
`forwardPathComponents[].explanations[].aclRule.egress`	boolean	—
`forwardPathComponents[].explanations[].aclRule.portRange`	object	—	EC2NetworkInsightsAnalysisPortRange is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].aclRule.portRange.from`	integer	—
`forwardPathComponents[].explanations[].aclRule.portRange.to`	integer	—
`forwardPathComponents[].explanations[].aclRule.protocol`	string	—
`forwardPathComponents[].explanations[].aclRule.ruleAction`	string	—
`forwardPathComponents[].explanations[].aclRule.ruleNumber`	integer	—
`forwardPathComponents[].explanations[].address`	string	—
`forwardPathComponents[].explanations[].addresses`	array<string>	—
`forwardPathComponents[].explanations[].attachedTo`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].attachedTo.arn`	string	—
`forwardPathComponents[].explanations[].attachedTo.id`	string	—
`forwardPathComponents[].explanations[].availabilityZones`	array<string>	—
`forwardPathComponents[].explanations[].cidrs`	array<string>	—
`forwardPathComponents[].explanations[].classicLoadBalancerListener`	object	—	EC2NetworkInsightsAnalysisAnalysisLoadBalancerListener is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].classicLoadBalancerListener.instancePort`	integer	—
`forwardPathComponents[].explanations[].classicLoadBalancerListener.loadBalancerPort`	integer	—
`forwardPathComponents[].explanations[].component`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].component.arn`	string	—
`forwardPathComponents[].explanations[].component.id`	string	—
`forwardPathComponents[].explanations[].componentAccount`	string	—
`forwardPathComponents[].explanations[].componentRegion`	string	—
`forwardPathComponents[].explanations[].customerGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].customerGateway.arn`	string	—
`forwardPathComponents[].explanations[].customerGateway.id`	string	—
`forwardPathComponents[].explanations[].destination`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].destination.arn`	string	—
`forwardPathComponents[].explanations[].destination.id`	string	—
`forwardPathComponents[].explanations[].destinationVpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].destinationVpc.arn`	string	—
`forwardPathComponents[].explanations[].destinationVpc.id`	string	—
`forwardPathComponents[].explanations[].direction`	string	—
`forwardPathComponents[].explanations[].elasticLoadBalancerListener`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].elasticLoadBalancerListener.arn`	string	—
`forwardPathComponents[].explanations[].elasticLoadBalancerListener.id`	string	—
`forwardPathComponents[].explanations[].explanationCode`	string	—
`forwardPathComponents[].explanations[].ingressRouteTable`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].ingressRouteTable.arn`	string	—
`forwardPathComponents[].explanations[].ingressRouteTable.id`	string	—
`forwardPathComponents[].explanations[].internetGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].internetGateway.arn`	string	—
`forwardPathComponents[].explanations[].internetGateway.id`	string	—
`forwardPathComponents[].explanations[].loadBalancerArn`	string	—
`forwardPathComponents[].explanations[].loadBalancerListenerPort`	integer	—
`forwardPathComponents[].explanations[].loadBalancerTarget`	object	—	EC2NetworkInsightsAnalysisAnalysisLoadBalancerTarget is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].loadBalancerTarget.address`	string	—
`forwardPathComponents[].explanations[].loadBalancerTarget.availabilityZone`	string	—
`forwardPathComponents[].explanations[].loadBalancerTarget.instance`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].loadBalancerTarget.instance.arn`	string	—
`forwardPathComponents[].explanations[].loadBalancerTarget.instance.id`	string	—
`forwardPathComponents[].explanations[].loadBalancerTarget.port`	integer	—
`forwardPathComponents[].explanations[].loadBalancerTargetGroup`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].loadBalancerTargetGroup.arn`	string	—
`forwardPathComponents[].explanations[].loadBalancerTargetGroup.id`	string	—
`forwardPathComponents[].explanations[].loadBalancerTargetGroups`	array<object>	—
`forwardPathComponents[].explanations[].loadBalancerTargetGroups[].arn`	string	—
`forwardPathComponents[].explanations[].loadBalancerTargetGroups[].id`	string	—
`forwardPathComponents[].explanations[].loadBalancerTargetPort`	integer	—
`forwardPathComponents[].explanations[].missingComponent`	string	—
`forwardPathComponents[].explanations[].natGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].natGateway.arn`	string	—
`forwardPathComponents[].explanations[].natGateway.id`	string	—
`forwardPathComponents[].explanations[].networkInterface`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].networkInterface.arn`	string	—
`forwardPathComponents[].explanations[].networkInterface.id`	string	—
`forwardPathComponents[].explanations[].packetField`	string	—
`forwardPathComponents[].explanations[].port`	integer	—
`forwardPathComponents[].explanations[].portRanges`	array<object>	—
`forwardPathComponents[].explanations[].portRanges[].from`	integer	—
`forwardPathComponents[].explanations[].portRanges[].to`	integer	—
`forwardPathComponents[].explanations[].prefixList`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].prefixList.arn`	string	—
`forwardPathComponents[].explanations[].prefixList.id`	string	—
`forwardPathComponents[].explanations[].protocols`	array<string>	—
`forwardPathComponents[].explanations[].routeTable`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].routeTable.arn`	string	—
`forwardPathComponents[].explanations[].routeTable.id`	string	—
`forwardPathComponents[].explanations[].routeTableRoute`	object	—	EC2NetworkInsightsAnalysisAnalysisRouteTableRoute is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].routeTableRoute.destinationCidr`	string	—
`forwardPathComponents[].explanations[].routeTableRoute.destinationPrefixListId`	string	—
`forwardPathComponents[].explanations[].routeTableRoute.egressOnlyInternetGatewayId`	string	—
`forwardPathComponents[].explanations[].routeTableRoute.gatewayId`	string	—
`forwardPathComponents[].explanations[].routeTableRoute.instanceId`	string	—
`forwardPathComponents[].explanations[].routeTableRoute.natGatewayId`	string	—
`forwardPathComponents[].explanations[].routeTableRoute.networkInterfaceId`	string	—
`forwardPathComponents[].explanations[].routeTableRoute.origin`	string	—
`forwardPathComponents[].explanations[].routeTableRoute.state`	string	—
`forwardPathComponents[].explanations[].routeTableRoute.transitGatewayId`	string	—
`forwardPathComponents[].explanations[].routeTableRoute.vpcPeeringConnectionId`	string	—
`forwardPathComponents[].explanations[].securityGroup`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].securityGroup.arn`	string	—
`forwardPathComponents[].explanations[].securityGroup.id`	string	—
`forwardPathComponents[].explanations[].securityGroupRule`	object	—	EC2NetworkInsightsAnalysisAnalysisSecurityGroupRule is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].securityGroupRule.cidr`	string	—
`forwardPathComponents[].explanations[].securityGroupRule.direction`	string	—
`forwardPathComponents[].explanations[].securityGroupRule.portRange`	object	—	EC2NetworkInsightsAnalysisPortRange is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].securityGroupRule.portRange.from`	integer	—
`forwardPathComponents[].explanations[].securityGroupRule.portRange.to`	integer	—
`forwardPathComponents[].explanations[].securityGroupRule.prefixListId`	string	—
`forwardPathComponents[].explanations[].securityGroupRule.protocol`	string	—
`forwardPathComponents[].explanations[].securityGroupRule.securityGroupId`	string	—
`forwardPathComponents[].explanations[].securityGroups`	array<object>	—
`forwardPathComponents[].explanations[].securityGroups[].arn`	string	—
`forwardPathComponents[].explanations[].securityGroups[].id`	string	—
`forwardPathComponents[].explanations[].sourceVpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].sourceVpc.arn`	string	—
`forwardPathComponents[].explanations[].sourceVpc.id`	string	—
`forwardPathComponents[].explanations[].state`	string	—
`forwardPathComponents[].explanations[].subnet`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].subnet.arn`	string	—
`forwardPathComponents[].explanations[].subnet.id`	string	—
`forwardPathComponents[].explanations[].subnetRouteTable`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].subnetRouteTable.arn`	string	—
`forwardPathComponents[].explanations[].subnetRouteTable.id`	string	—
`forwardPathComponents[].explanations[].transitGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].transitGateway.arn`	string	—
`forwardPathComponents[].explanations[].transitGateway.id`	string	—
`forwardPathComponents[].explanations[].transitGatewayAttachment`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].transitGatewayAttachment.arn`	string	—
`forwardPathComponents[].explanations[].transitGatewayAttachment.id`	string	—
`forwardPathComponents[].explanations[].transitGatewayRouteTable`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].transitGatewayRouteTable.arn`	string	—
`forwardPathComponents[].explanations[].transitGatewayRouteTable.id`	string	—
`forwardPathComponents[].explanations[].transitGatewayRouteTableRoute`	object	—	EC2NetworkInsightsAnalysisTransitGatewayRouteTableRoute is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].transitGatewayRouteTableRoute.attachmentId`	string	—
`forwardPathComponents[].explanations[].transitGatewayRouteTableRoute.destinationCidr`	string	—
`forwardPathComponents[].explanations[].transitGatewayRouteTableRoute.prefixListId`	string	—
`forwardPathComponents[].explanations[].transitGatewayRouteTableRoute.resourceId`	string	—
`forwardPathComponents[].explanations[].transitGatewayRouteTableRoute.resourceType`	string	—
`forwardPathComponents[].explanations[].transitGatewayRouteTableRoute.routeOrigin`	string	—
`forwardPathComponents[].explanations[].transitGatewayRouteTableRoute.state`	string	—
`forwardPathComponents[].explanations[].vpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].vpc.arn`	string	—
`forwardPathComponents[].explanations[].vpc.id`	string	—
`forwardPathComponents[].explanations[].vpcEndpoint`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].vpcEndpoint.arn`	string	—
`forwardPathComponents[].explanations[].vpcEndpoint.id`	string	—
`forwardPathComponents[].explanations[].vpcPeeringConnection`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].vpcPeeringConnection.arn`	string	—
`forwardPathComponents[].explanations[].vpcPeeringConnection.id`	string	—
`forwardPathComponents[].explanations[].vpnConnection`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].vpnConnection.arn`	string	—
`forwardPathComponents[].explanations[].vpnConnection.id`	string	—
`forwardPathComponents[].explanations[].vpnGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].explanations[].vpnGateway.arn`	string	—
`forwardPathComponents[].explanations[].vpnGateway.id`	string	—
`forwardPathComponents[].inboundHeader`	object	—	EC2NetworkInsightsAnalysisAnalysisPacketHeader is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].inboundHeader.destinationAddresses`	array<string>	—
`forwardPathComponents[].inboundHeader.destinationPortRanges`	array<object>	—
`forwardPathComponents[].inboundHeader.destinationPortRanges[].from`	integer	—
`forwardPathComponents[].inboundHeader.destinationPortRanges[].to`	integer	—
`forwardPathComponents[].inboundHeader.protocol`	string	—
`forwardPathComponents[].inboundHeader.sourceAddresses`	array<string>	—
`forwardPathComponents[].inboundHeader.sourcePortRanges`	array<object>	—
`forwardPathComponents[].inboundHeader.sourcePortRanges[].from`	integer	—
`forwardPathComponents[].inboundHeader.sourcePortRanges[].to`	integer	—
`forwardPathComponents[].outboundHeader`	object	—	EC2NetworkInsightsAnalysisAnalysisPacketHeader is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].outboundHeader.destinationAddresses`	array<string>	—
`forwardPathComponents[].outboundHeader.destinationPortRanges`	array<object>	—
`forwardPathComponents[].outboundHeader.destinationPortRanges[].from`	integer	—
`forwardPathComponents[].outboundHeader.destinationPortRanges[].to`	integer	—
`forwardPathComponents[].outboundHeader.protocol`	string	—
`forwardPathComponents[].outboundHeader.sourceAddresses`	array<string>	—
`forwardPathComponents[].outboundHeader.sourcePortRanges`	array<object>	—
`forwardPathComponents[].outboundHeader.sourcePortRanges[].from`	integer	—
`forwardPathComponents[].outboundHeader.sourcePortRanges[].to`	integer	—
`forwardPathComponents[].routeTableRoute`	object	—	EC2NetworkInsightsAnalysisAnalysisRouteTableRoute is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].routeTableRoute.destinationCidr`	string	—
`forwardPathComponents[].routeTableRoute.destinationPrefixListId`	string	—
`forwardPathComponents[].routeTableRoute.egressOnlyInternetGatewayId`	string	—
`forwardPathComponents[].routeTableRoute.gatewayId`	string	—
`forwardPathComponents[].routeTableRoute.instanceId`	string	—
`forwardPathComponents[].routeTableRoute.natGatewayId`	string	—
`forwardPathComponents[].routeTableRoute.networkInterfaceId`	string	—
`forwardPathComponents[].routeTableRoute.origin`	string	—
`forwardPathComponents[].routeTableRoute.state`	string	—
`forwardPathComponents[].routeTableRoute.transitGatewayId`	string	—
`forwardPathComponents[].routeTableRoute.vpcPeeringConnectionId`	string	—
`forwardPathComponents[].securityGroupRule`	object	—	EC2NetworkInsightsAnalysisAnalysisSecurityGroupRule is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].securityGroupRule.cidr`	string	—
`forwardPathComponents[].securityGroupRule.direction`	string	—
`forwardPathComponents[].securityGroupRule.portRange`	object	—	EC2NetworkInsightsAnalysisPortRange is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].securityGroupRule.portRange.from`	integer	—
`forwardPathComponents[].securityGroupRule.portRange.to`	integer	—
`forwardPathComponents[].securityGroupRule.prefixListId`	string	—
`forwardPathComponents[].securityGroupRule.protocol`	string	—
`forwardPathComponents[].securityGroupRule.securityGroupId`	string	—
`forwardPathComponents[].sequenceNumber`	integer	—
`forwardPathComponents[].serviceName`	string	—
`forwardPathComponents[].sourceVpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].sourceVpc.arn`	string	—
`forwardPathComponents[].sourceVpc.id`	string	—
`forwardPathComponents[].subnet`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].subnet.arn`	string	—
`forwardPathComponents[].subnet.id`	string	—
`forwardPathComponents[].transitGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].transitGateway.arn`	string	—
`forwardPathComponents[].transitGateway.id`	string	—
`forwardPathComponents[].transitGatewayRouteTableRoute`	object	—	EC2NetworkInsightsAnalysisTransitGatewayRouteTableRoute is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].transitGatewayRouteTableRoute.attachmentId`	string	—
`forwardPathComponents[].transitGatewayRouteTableRoute.destinationCidr`	string	—
`forwardPathComponents[].transitGatewayRouteTableRoute.prefixListId`	string	—
`forwardPathComponents[].transitGatewayRouteTableRoute.resourceId`	string	—
`forwardPathComponents[].transitGatewayRouteTableRoute.resourceType`	string	—
`forwardPathComponents[].transitGatewayRouteTableRoute.routeOrigin`	string	—
`forwardPathComponents[].transitGatewayRouteTableRoute.state`	string	—
`forwardPathComponents[].vpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`forwardPathComponents[].vpc.arn`	string	—
`forwardPathComponents[].vpc.id`	string	—
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`networkInsightsAnalysisArn`	string	—	Read-only: reported by AWS after creation.
`networkInsightsAnalysisId`	string	—	Read-only: reported by AWS after creation.
`networkPathFound`	boolean	—	Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`returnPathComponents`	array<object>	—	Read-only: reported by AWS after creation.
`returnPathComponents[].aclRule`	object	—	EC2NetworkInsightsAnalysisAnalysisAclRule is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].aclRule.cidr`	string	—
`returnPathComponents[].aclRule.egress`	boolean	—
`returnPathComponents[].aclRule.portRange`	object	—	EC2NetworkInsightsAnalysisPortRange is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].aclRule.portRange.from`	integer	—
`returnPathComponents[].aclRule.portRange.to`	integer	—
`returnPathComponents[].aclRule.protocol`	string	—
`returnPathComponents[].aclRule.ruleAction`	string	—
`returnPathComponents[].aclRule.ruleNumber`	integer	—
`returnPathComponents[].additionalDetails`	array<object>	—
`returnPathComponents[].additionalDetails[].additionalDetailType`	string	—
`returnPathComponents[].additionalDetails[].component`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].additionalDetails[].component.arn`	string	—
`returnPathComponents[].additionalDetails[].component.id`	string	—
`returnPathComponents[].additionalDetails[].loadBalancers`	array<object>	—
`returnPathComponents[].additionalDetails[].loadBalancers[].arn`	string	—
`returnPathComponents[].additionalDetails[].loadBalancers[].id`	string	—
`returnPathComponents[].additionalDetails[].serviceName`	string	—
`returnPathComponents[].component`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].component.arn`	string	—
`returnPathComponents[].component.id`	string	—
`returnPathComponents[].destinationVpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].destinationVpc.arn`	string	—
`returnPathComponents[].destinationVpc.id`	string	—
`returnPathComponents[].elasticLoadBalancerListener`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].elasticLoadBalancerListener.arn`	string	—
`returnPathComponents[].elasticLoadBalancerListener.id`	string	—
`returnPathComponents[].explanations`	array<object>	—
`returnPathComponents[].explanations[].acl`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].acl.arn`	string	—
`returnPathComponents[].explanations[].acl.id`	string	—
`returnPathComponents[].explanations[].aclRule`	object	—	EC2NetworkInsightsAnalysisAnalysisAclRule is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].aclRule.cidr`	string	—
`returnPathComponents[].explanations[].aclRule.egress`	boolean	—
`returnPathComponents[].explanations[].aclRule.portRange`	object	—	EC2NetworkInsightsAnalysisPortRange is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].aclRule.portRange.from`	integer	—
`returnPathComponents[].explanations[].aclRule.portRange.to`	integer	—
`returnPathComponents[].explanations[].aclRule.protocol`	string	—
`returnPathComponents[].explanations[].aclRule.ruleAction`	string	—
`returnPathComponents[].explanations[].aclRule.ruleNumber`	integer	—
`returnPathComponents[].explanations[].address`	string	—
`returnPathComponents[].explanations[].addresses`	array<string>	—
`returnPathComponents[].explanations[].attachedTo`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].attachedTo.arn`	string	—
`returnPathComponents[].explanations[].attachedTo.id`	string	—
`returnPathComponents[].explanations[].availabilityZones`	array<string>	—
`returnPathComponents[].explanations[].cidrs`	array<string>	—
`returnPathComponents[].explanations[].classicLoadBalancerListener`	object	—	EC2NetworkInsightsAnalysisAnalysisLoadBalancerListener is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].classicLoadBalancerListener.instancePort`	integer	—
`returnPathComponents[].explanations[].classicLoadBalancerListener.loadBalancerPort`	integer	—
`returnPathComponents[].explanations[].component`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].component.arn`	string	—
`returnPathComponents[].explanations[].component.id`	string	—
`returnPathComponents[].explanations[].componentAccount`	string	—
`returnPathComponents[].explanations[].componentRegion`	string	—
`returnPathComponents[].explanations[].customerGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].customerGateway.arn`	string	—
`returnPathComponents[].explanations[].customerGateway.id`	string	—
`returnPathComponents[].explanations[].destination`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].destination.arn`	string	—
`returnPathComponents[].explanations[].destination.id`	string	—
`returnPathComponents[].explanations[].destinationVpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].destinationVpc.arn`	string	—
`returnPathComponents[].explanations[].destinationVpc.id`	string	—
`returnPathComponents[].explanations[].direction`	string	—
`returnPathComponents[].explanations[].elasticLoadBalancerListener`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].elasticLoadBalancerListener.arn`	string	—
`returnPathComponents[].explanations[].elasticLoadBalancerListener.id`	string	—
`returnPathComponents[].explanations[].explanationCode`	string	—
`returnPathComponents[].explanations[].ingressRouteTable`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].ingressRouteTable.arn`	string	—
`returnPathComponents[].explanations[].ingressRouteTable.id`	string	—
`returnPathComponents[].explanations[].internetGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].internetGateway.arn`	string	—
`returnPathComponents[].explanations[].internetGateway.id`	string	—
`returnPathComponents[].explanations[].loadBalancerArn`	string	—
`returnPathComponents[].explanations[].loadBalancerListenerPort`	integer	—
`returnPathComponents[].explanations[].loadBalancerTarget`	object	—	EC2NetworkInsightsAnalysisAnalysisLoadBalancerTarget is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].loadBalancerTarget.address`	string	—
`returnPathComponents[].explanations[].loadBalancerTarget.availabilityZone`	string	—
`returnPathComponents[].explanations[].loadBalancerTarget.instance`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].loadBalancerTarget.instance.arn`	string	—
`returnPathComponents[].explanations[].loadBalancerTarget.instance.id`	string	—
`returnPathComponents[].explanations[].loadBalancerTarget.port`	integer	—
`returnPathComponents[].explanations[].loadBalancerTargetGroup`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].loadBalancerTargetGroup.arn`	string	—
`returnPathComponents[].explanations[].loadBalancerTargetGroup.id`	string	—
`returnPathComponents[].explanations[].loadBalancerTargetGroups`	array<object>	—
`returnPathComponents[].explanations[].loadBalancerTargetGroups[].arn`	string	—
`returnPathComponents[].explanations[].loadBalancerTargetGroups[].id`	string	—
`returnPathComponents[].explanations[].loadBalancerTargetPort`	integer	—
`returnPathComponents[].explanations[].missingComponent`	string	—
`returnPathComponents[].explanations[].natGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].natGateway.arn`	string	—
`returnPathComponents[].explanations[].natGateway.id`	string	—
`returnPathComponents[].explanations[].networkInterface`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].networkInterface.arn`	string	—
`returnPathComponents[].explanations[].networkInterface.id`	string	—
`returnPathComponents[].explanations[].packetField`	string	—
`returnPathComponents[].explanations[].port`	integer	—
`returnPathComponents[].explanations[].portRanges`	array<object>	—
`returnPathComponents[].explanations[].portRanges[].from`	integer	—
`returnPathComponents[].explanations[].portRanges[].to`	integer	—
`returnPathComponents[].explanations[].prefixList`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].prefixList.arn`	string	—
`returnPathComponents[].explanations[].prefixList.id`	string	—
`returnPathComponents[].explanations[].protocols`	array<string>	—
`returnPathComponents[].explanations[].routeTable`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].routeTable.arn`	string	—
`returnPathComponents[].explanations[].routeTable.id`	string	—
`returnPathComponents[].explanations[].routeTableRoute`	object	—	EC2NetworkInsightsAnalysisAnalysisRouteTableRoute is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].routeTableRoute.destinationCidr`	string	—
`returnPathComponents[].explanations[].routeTableRoute.destinationPrefixListId`	string	—
`returnPathComponents[].explanations[].routeTableRoute.egressOnlyInternetGatewayId`	string	—
`returnPathComponents[].explanations[].routeTableRoute.gatewayId`	string	—
`returnPathComponents[].explanations[].routeTableRoute.instanceId`	string	—
`returnPathComponents[].explanations[].routeTableRoute.natGatewayId`	string	—
`returnPathComponents[].explanations[].routeTableRoute.networkInterfaceId`	string	—
`returnPathComponents[].explanations[].routeTableRoute.origin`	string	—
`returnPathComponents[].explanations[].routeTableRoute.state`	string	—
`returnPathComponents[].explanations[].routeTableRoute.transitGatewayId`	string	—
`returnPathComponents[].explanations[].routeTableRoute.vpcPeeringConnectionId`	string	—
`returnPathComponents[].explanations[].securityGroup`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].securityGroup.arn`	string	—
`returnPathComponents[].explanations[].securityGroup.id`	string	—
`returnPathComponents[].explanations[].securityGroupRule`	object	—	EC2NetworkInsightsAnalysisAnalysisSecurityGroupRule is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].securityGroupRule.cidr`	string	—
`returnPathComponents[].explanations[].securityGroupRule.direction`	string	—
`returnPathComponents[].explanations[].securityGroupRule.portRange`	object	—	EC2NetworkInsightsAnalysisPortRange is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].securityGroupRule.portRange.from`	integer	—
`returnPathComponents[].explanations[].securityGroupRule.portRange.to`	integer	—
`returnPathComponents[].explanations[].securityGroupRule.prefixListId`	string	—
`returnPathComponents[].explanations[].securityGroupRule.protocol`	string	—
`returnPathComponents[].explanations[].securityGroupRule.securityGroupId`	string	—
`returnPathComponents[].explanations[].securityGroups`	array<object>	—
`returnPathComponents[].explanations[].securityGroups[].arn`	string	—
`returnPathComponents[].explanations[].securityGroups[].id`	string	—
`returnPathComponents[].explanations[].sourceVpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].sourceVpc.arn`	string	—
`returnPathComponents[].explanations[].sourceVpc.id`	string	—
`returnPathComponents[].explanations[].state`	string	—
`returnPathComponents[].explanations[].subnet`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].subnet.arn`	string	—
`returnPathComponents[].explanations[].subnet.id`	string	—
`returnPathComponents[].explanations[].subnetRouteTable`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].subnetRouteTable.arn`	string	—
`returnPathComponents[].explanations[].subnetRouteTable.id`	string	—
`returnPathComponents[].explanations[].transitGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].transitGateway.arn`	string	—
`returnPathComponents[].explanations[].transitGateway.id`	string	—
`returnPathComponents[].explanations[].transitGatewayAttachment`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].transitGatewayAttachment.arn`	string	—
`returnPathComponents[].explanations[].transitGatewayAttachment.id`	string	—
`returnPathComponents[].explanations[].transitGatewayRouteTable`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].transitGatewayRouteTable.arn`	string	—
`returnPathComponents[].explanations[].transitGatewayRouteTable.id`	string	—
`returnPathComponents[].explanations[].transitGatewayRouteTableRoute`	object	—	EC2NetworkInsightsAnalysisTransitGatewayRouteTableRoute is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].transitGatewayRouteTableRoute.attachmentId`	string	—
`returnPathComponents[].explanations[].transitGatewayRouteTableRoute.destinationCidr`	string	—
`returnPathComponents[].explanations[].transitGatewayRouteTableRoute.prefixListId`	string	—
`returnPathComponents[].explanations[].transitGatewayRouteTableRoute.resourceId`	string	—
`returnPathComponents[].explanations[].transitGatewayRouteTableRoute.resourceType`	string	—
`returnPathComponents[].explanations[].transitGatewayRouteTableRoute.routeOrigin`	string	—
`returnPathComponents[].explanations[].transitGatewayRouteTableRoute.state`	string	—
`returnPathComponents[].explanations[].vpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].vpc.arn`	string	—
`returnPathComponents[].explanations[].vpc.id`	string	—
`returnPathComponents[].explanations[].vpcEndpoint`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].vpcEndpoint.arn`	string	—
`returnPathComponents[].explanations[].vpcEndpoint.id`	string	—
`returnPathComponents[].explanations[].vpcPeeringConnection`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].vpcPeeringConnection.arn`	string	—
`returnPathComponents[].explanations[].vpcPeeringConnection.id`	string	—
`returnPathComponents[].explanations[].vpnConnection`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].vpnConnection.arn`	string	—
`returnPathComponents[].explanations[].vpnConnection.id`	string	—
`returnPathComponents[].explanations[].vpnGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].explanations[].vpnGateway.arn`	string	—
`returnPathComponents[].explanations[].vpnGateway.id`	string	—
`returnPathComponents[].inboundHeader`	object	—	EC2NetworkInsightsAnalysisAnalysisPacketHeader is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].inboundHeader.destinationAddresses`	array<string>	—
`returnPathComponents[].inboundHeader.destinationPortRanges`	array<object>	—
`returnPathComponents[].inboundHeader.destinationPortRanges[].from`	integer	—
`returnPathComponents[].inboundHeader.destinationPortRanges[].to`	integer	—
`returnPathComponents[].inboundHeader.protocol`	string	—
`returnPathComponents[].inboundHeader.sourceAddresses`	array<string>	—
`returnPathComponents[].inboundHeader.sourcePortRanges`	array<object>	—
`returnPathComponents[].inboundHeader.sourcePortRanges[].from`	integer	—
`returnPathComponents[].inboundHeader.sourcePortRanges[].to`	integer	—
`returnPathComponents[].outboundHeader`	object	—	EC2NetworkInsightsAnalysisAnalysisPacketHeader is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].outboundHeader.destinationAddresses`	array<string>	—
`returnPathComponents[].outboundHeader.destinationPortRanges`	array<object>	—
`returnPathComponents[].outboundHeader.destinationPortRanges[].from`	integer	—
`returnPathComponents[].outboundHeader.destinationPortRanges[].to`	integer	—
`returnPathComponents[].outboundHeader.protocol`	string	—
`returnPathComponents[].outboundHeader.sourceAddresses`	array<string>	—
`returnPathComponents[].outboundHeader.sourcePortRanges`	array<object>	—
`returnPathComponents[].outboundHeader.sourcePortRanges[].from`	integer	—
`returnPathComponents[].outboundHeader.sourcePortRanges[].to`	integer	—
`returnPathComponents[].routeTableRoute`	object	—	EC2NetworkInsightsAnalysisAnalysisRouteTableRoute is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].routeTableRoute.destinationCidr`	string	—
`returnPathComponents[].routeTableRoute.destinationPrefixListId`	string	—
`returnPathComponents[].routeTableRoute.egressOnlyInternetGatewayId`	string	—
`returnPathComponents[].routeTableRoute.gatewayId`	string	—
`returnPathComponents[].routeTableRoute.instanceId`	string	—
`returnPathComponents[].routeTableRoute.natGatewayId`	string	—
`returnPathComponents[].routeTableRoute.networkInterfaceId`	string	—
`returnPathComponents[].routeTableRoute.origin`	string	—
`returnPathComponents[].routeTableRoute.state`	string	—
`returnPathComponents[].routeTableRoute.transitGatewayId`	string	—
`returnPathComponents[].routeTableRoute.vpcPeeringConnectionId`	string	—
`returnPathComponents[].securityGroupRule`	object	—	EC2NetworkInsightsAnalysisAnalysisSecurityGroupRule is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].securityGroupRule.cidr`	string	—
`returnPathComponents[].securityGroupRule.direction`	string	—
`returnPathComponents[].securityGroupRule.portRange`	object	—	EC2NetworkInsightsAnalysisPortRange is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].securityGroupRule.portRange.from`	integer	—
`returnPathComponents[].securityGroupRule.portRange.to`	integer	—
`returnPathComponents[].securityGroupRule.prefixListId`	string	—
`returnPathComponents[].securityGroupRule.protocol`	string	—
`returnPathComponents[].securityGroupRule.securityGroupId`	string	—
`returnPathComponents[].sequenceNumber`	integer	—
`returnPathComponents[].serviceName`	string	—
`returnPathComponents[].sourceVpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].sourceVpc.arn`	string	—
`returnPathComponents[].sourceVpc.id`	string	—
`returnPathComponents[].subnet`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].subnet.arn`	string	—
`returnPathComponents[].subnet.id`	string	—
`returnPathComponents[].transitGateway`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].transitGateway.arn`	string	—
`returnPathComponents[].transitGateway.id`	string	—
`returnPathComponents[].transitGatewayRouteTableRoute`	object	—	EC2NetworkInsightsAnalysisTransitGatewayRouteTableRoute is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].transitGatewayRouteTableRoute.attachmentId`	string	—
`returnPathComponents[].transitGatewayRouteTableRoute.destinationCidr`	string	—
`returnPathComponents[].transitGatewayRouteTableRoute.prefixListId`	string	—
`returnPathComponents[].transitGatewayRouteTableRoute.resourceId`	string	—
`returnPathComponents[].transitGatewayRouteTableRoute.resourceType`	string	—
`returnPathComponents[].transitGatewayRouteTableRoute.routeOrigin`	string	—
`returnPathComponents[].transitGatewayRouteTableRoute.state`	string	—
`returnPathComponents[].vpc`	object	—	EC2NetworkInsightsAnalysisAnalysisComponent is a nested property type of AWS::EC2::NetworkInsightsAnalysis.
`returnPathComponents[].vpc.arn`	string	—
`returnPathComponents[].vpc.id`	string	—
`startDate`	string	—	Read-only: reported by AWS after creation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `running, failed, succeeded`
`statusMessage`	string	—	Read-only: reported by AWS after creation.
`suggestedAccounts`	array<string>	—	Read-only: reported by AWS after creation.

EC2NetworkInsightsPath # CLOUD CONTROL · AWS::EC2::NetworkInsightsPath

EC2NetworkInsightsPath manages AWS::EC2::NetworkInsightsPath through the AWS Cloud Control API.

kubectl get ec2networkinsightspaths · example on GitHub

Example

# EC2NetworkInsightsPath — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2networkinsightspath
apiVersion: aws.konfig.io/v1alpha1
kind: EC2NetworkInsightsPath
metadata:
  name: example-ec2networkinsightspath
  namespace: default
spec:
  destination: example
  destinationIp: example
  destinationPort: 443
  filterAtDestination:
    destinationAddress: example
    destinationPortRange:
      fromPort: 443
      toPort: 443
    sourceAddress: example
    sourcePortRange:
      fromPort: 443
      toPort: 443
  filterAtSource:
    destinationAddress: example
    destinationPortRange:
      fromPort: 443
      toPort: 443
    sourceAddress: example
    sourcePortRange:
      fromPort: 443
      toPort: 443
  protocol: tcp
  providerRef:
    name: example-ec2networkinsightspath
    region: us-east-1
  source: example
  sourceIp: example
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`destination`	string	—	Create-only in AWS: changing it requires replacing the resource.
`destinationIp`	string	—	Create-only in AWS: changing it requires replacing the resource.
`destinationPort`	integer	—	Create-only in AWS: changing it requires replacing the resource.
`filterAtDestination`	object	—	Create-only in AWS: changing it requires replacing the resource.
`filterAtDestination.destinationAddress`	string	—
`filterAtDestination.destinationPortRange`	object	—	EC2NetworkInsightsPathFilterPortRange is a nested property type of AWS::EC2::NetworkInsightsPath.
`filterAtDestination.destinationPortRange.fromPort`	integer	—
`filterAtDestination.destinationPortRange.toPort`	integer	—
`filterAtDestination.sourceAddress`	string	—
`filterAtDestination.sourcePortRange`	object	—	EC2NetworkInsightsPathFilterPortRange is a nested property type of AWS::EC2::NetworkInsightsPath.
`filterAtDestination.sourcePortRange.fromPort`	integer	—
`filterAtDestination.sourcePortRange.toPort`	integer	—
`filterAtSource`	object	—	Create-only in AWS: changing it requires replacing the resource.
`filterAtSource.destinationAddress`	string	—
`filterAtSource.destinationPortRange`	object	—	EC2NetworkInsightsPathFilterPortRange is a nested property type of AWS::EC2::NetworkInsightsPath.
`filterAtSource.destinationPortRange.fromPort`	integer	—
`filterAtSource.destinationPortRange.toPort`	integer	—
`filterAtSource.sourceAddress`	string	—
`filterAtSource.sourcePortRange`	object	—	EC2NetworkInsightsPathFilterPortRange is a nested property type of AWS::EC2::NetworkInsightsPath.
`filterAtSource.sourcePortRange.fromPort`	integer	—
`filterAtSource.sourcePortRange.toPort`	integer	—
`protocol`	enum	yes	Create-only in AWS: changing it requires replacing the resource. Allowed: `tcp, udp`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`source`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`sourceIp`	string	—	Create-only in AWS: changing it requires replacing the resource.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdDate`	string	—	Read-only: reported by AWS after creation.
`destinationArn`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`networkInsightsPathArn`	string	—	Read-only: reported by AWS after creation.
`networkInsightsPathId`	string	—	Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`sourceArn`	string	—	Read-only: reported by AWS after creation.

EC2NetworkInterface # CLOUD CONTROL · AWS::EC2::NetworkInterface

EC2NetworkInterface manages AWS::EC2::NetworkInterface through the AWS Cloud Control API.

kubectl get ec2networkinterfaces · example on GitHub

Example

# EC2NetworkInterface — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2networkinterface
apiVersion: aws.konfig.io/v1alpha1
kind: EC2NetworkInterface
metadata:
  name: example-ec2networkinterface
  namespace: default
spec:
  connectionTrackingSpecification:
    tcpEstablishedTimeout: 300
    udpStreamTimeout: 300
    udpTimeout: 300
  description: Managed by konfig-konector
  enablePrimaryIpv6: true
  groupSet:
  - example
  interfaceType: example
  ipv4PrefixCount: 2
  ipv4Prefixes:
  - ipv4Prefix: example
  ipv6AddressCount: 2
  ipv6Addresses:
  - ipv6Address: example
  ipv6PrefixCount: 2
  ipv6Prefixes:
  - ipv6Prefix: example
  privateIpAddress: example
  privateIpAddresses:
  - primary: false
    privateIpAddress: example
  providerRef:
    name: example-ec2networkinterface
    region: us-east-1
  publicIpDnsHostnameTypeSpecification: public-dual-stack-dns-name
  secondaryPrivateIpAddressCount: 2
  sourceDestCheck: false
  subnetId: subnet-0abc12def3456789
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`connectionTrackingSpecification`	object	—	EC2NetworkInterfaceConnectionTrackingSpecification is a nested property type of AWS::EC2::NetworkInterface.
`connectionTrackingSpecification.tcpEstablishedTimeout`	integer	—
`connectionTrackingSpecification.udpStreamTimeout`	integer	—
`connectionTrackingSpecification.udpTimeout`	integer	—
`description`	string	—	A description for the network interface.
`enablePrimaryIpv6`	boolean	—	If you have instances or ENIs that rely on the IPv6 address not changing, to avoid disrupting traffic to instances or ENIs, you can enable a primary IPv6 address.
`groupSet`	array<string>	—	A list of security group IDs associated with this network interface.
`interfaceType`	string	—	Indicates the type of network interface.
`ipv4PrefixCount`	integer	—	The number of IPv4 prefixes to assign to a network interface.
`ipv4Prefixes`	array<object>	—	Assigns a list of IPv4 prefixes to the network interface.
`ipv4Prefixes[].ipv4Prefix`	string	yes
`ipv6AddressCount`	integer	—	The number of IPv6 addresses to assign to a network interface.
`ipv6Addresses`	array<object>	—	One or more specific IPv6 addresses from the IPv6 CIDR block range of your subnet to associate with the network interface.
`ipv6Addresses[].ipv6Address`	string	yes
`ipv6PrefixCount`	integer	—	The number of IPv6 prefixes to assign to a network interface.
`ipv6Prefixes`	array<object>	—	Assigns a list of IPv6 prefixes to the network interface.
`ipv6Prefixes[].ipv6Prefix`	string	yes
`privateIpAddress`	string	—	Assigns a single private IP address to the network interface, which is used as the primary private IP address.
`privateIpAddresses`	array<object>	—	Assigns a list of private IP addresses to the network interface.
`privateIpAddresses[].primary`	boolean	yes
`privateIpAddresses[].privateIpAddress`	string	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`publicIpDnsHostnameTypeSpecification`	enum	—	Public IP DNS hostname type Allowed: `public-dual-stack-dns-name, public-ipv4-dns-name, public-ipv6-dns-name`
`secondaryPrivateIpAddressCount`	integer	—	The number of secondary private IPv4 addresses to assign to a network interface.
`sourceDestCheck`	boolean	—	Indicates whether traffic to or from the instance is validated.
`subnetId`	string	yes	The ID of the subnet to associate with the network interface.
`tags`	array<object>	—	An arbitrary set of tags (key-value pairs) for this network interface.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Network interface id.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`primaryIpv6Address`	string	—	The primary IPv6 address Read-only: reported by AWS after creation.
`primaryPrivateIpAddress`	string	—	Returns the primary private IP address of the network interface.
`publicIpDnsNameOptions`	object	—	Read-only: reported by AWS after creation.
`publicIpDnsNameOptions.dnsHostnameType`	string	—
`publicIpDnsNameOptions.publicDualStackDnsName`	string	—
`publicIpDnsNameOptions.publicIpv4DnsName`	string	—
`publicIpDnsNameOptions.publicIpv6DnsName`	string	—
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`secondaryPrivateIpAddresses`	array<string>	—	Returns the secondary private IP addresses of the network interface.
`vpcId`	string	—	The ID of the VPC Read-only: reported by AWS after creation.

EC2NetworkInterfaceAttachment # CLOUD CONTROL · AWS::EC2::NetworkInterfaceAttachment

EC2NetworkInterfaceAttachment manages AWS::EC2::NetworkInterfaceAttachment through the AWS Cloud Control API.

kubectl get ec2networkinterfaceattachments · example on GitHub

Example

# EC2NetworkInterfaceAttachment — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2networkinterfaceattachment
apiVersion: aws.konfig.io/v1alpha1
kind: EC2NetworkInterfaceAttachment
metadata:
  name: example-ec2networkinterfaceattachment
  namespace: default
spec:
  deleteOnTermination: false
  deviceIndex: example
  enaQueueCount: 2
  enaSrdSpecification:
    enaSrdEnabled: true
    enaSrdUdpSpecification:
      enaSrdUdpEnabled: true
  instanceId: i-0abc1234def567890
  networkInterfaceId: example-id
  providerRef:
    name: example-ec2networkinterfaceattachment
    region: us-east-1

Spec

Field	Type	Required	Description
`deleteOnTermination`	boolean	—	Whether to delete the network interface when the instance terminates.
`deviceIndex`	string	yes	The network interface's position in the attachment order.
`enaQueueCount`	integer	—	The number of ENA queues created with the instance.
`enaSrdSpecification`	object	—	Configures ENA Express for the network interface that this action attaches to the instance.
`enaSrdSpecification.enaSrdEnabled`	boolean	—	Indicates whether ENA Express is enabled for the network interface.
`enaSrdSpecification.enaSrdUdpSpecification`	object	—	Configures ENA Express for UDP network traffic.
`enaSrdSpecification.enaSrdUdpSpecification.enaSrdUdpEnabled`	boolean	—
`instanceId`	string	yes	The ID of the instance to which you will attach the ENI.
`networkInterfaceId`	string	yes	The ID of the ENI that you want to attach.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attachmentId`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2NetworkPerformanceMetricSubscription # CLOUD CONTROL · AWS::EC2::NetworkPerformanceMetricSubscription

EC2NetworkPerformanceMetricSubscription manages AWS::EC2::NetworkPerformanceMetricSubscription through the AWS Cloud Control API.

kubectl get ec2networkperformancemetricsubscriptions · example on GitHub

Example

# EC2NetworkPerformanceMetricSubscription — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2networkperformancemetricsubscription
apiVersion: aws.konfig.io/v1alpha1
kind: EC2NetworkPerformanceMetricSubscription
metadata:
  name: example-ec2networkperformancemetricsubscription
  namespace: default
spec:
  destination: example
  metric: example
  providerRef:
    name: example-ec2networkperformancemetricsubscription
    region: us-east-1
  source: example
  statistic: example

Spec

Field	Type	Required	Description
`destination`	string	yes	The target Region or Availability Zone for the metric to subscribe to.
`metric`	string	yes	The metric type to subscribe to.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`source`	string	yes	The starting Region or Availability Zone for metric to subscribe to.
`statistic`	string	yes	The statistic to subscribe to.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2Route # CLOUD CONTROL · AWS::EC2::Route

EC2Route manages AWS::EC2::Route through the AWS Cloud Control API.

kubectl get ec2routes · example on GitHub

Example

# EC2Route — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2route
apiVersion: aws.konfig.io/v1alpha1
kind: EC2Route
metadata:
  name: example-ec2route
  namespace: default
spec:
  coreNetworkArn: arn:aws:iam::123456789012:role/example-role
  destinationCidrBlock: 10.0.0.0/16
  destinationIpv6CidrBlock: 2001:db8::/56
  odbNetworkArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-ec2route
    region: us-east-1
  routeTableId: example-id

Spec

Field	Type	Required	Description
`carrierGatewayId`	string	—	The ID of the carrier gateway.
`coreNetworkArn`	string	—	The Amazon Resource Name (ARN) of the core network.
`destinationCidrBlock`	string	—	The IPv4 CIDR address block used for the destination match.
`destinationIpv6CidrBlock`	string	—	The IPv6 CIDR block used for the destination match.
`destinationPrefixListId`	string	—	The ID of a prefix list used for the destination match.
`egressOnlyInternetGatewayId`	string	—	[IPv6 traffic only] The ID of an egress-only internet gateway.
`gatewayId`	string	—	The ID of an internet gateway or virtual private gateway attached to your VPC.
`instanceId`	string	—	The ID of a NAT instance in your VPC.
`localGatewayId`	string	—	The ID of the local gateway.
`natGatewayId`	string	—	[IPv4 traffic only] The ID of a NAT gateway.
`networkInterfaceId`	string	—	The ID of a network interface.
`odbNetworkArn`	string	—	The Amazon Resource Name (ARN) of the ODB network.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`routeTableId`	string	yes	The ID of the route table for the route.
`transitGatewayId`	string	—	The ID of a transit gateway.
`vpcEndpointId`	string	—	The ID of a VPC endpoint.
`vpcPeeringConnectionId`	string	—	The ID of a VPC peering connection.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`cidrBlock`	string	—	Read-only: reported by AWS after creation.
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2RouteServer # CLOUD CONTROL · AWS::EC2::RouteServer

EC2RouteServer manages AWS::EC2::RouteServer through the AWS Cloud Control API.

kubectl get ec2routeservers · example on GitHub

Example

# EC2RouteServer — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2routeserver
apiVersion: aws.konfig.io/v1alpha1
kind: EC2RouteServer
metadata:
  name: example-ec2routeserver
  namespace: default
spec:
  amazonSideAsn: 1
  persistRoutes: enable
  persistRoutesDuration: 1
  providerRef:
    name: example-ec2routeserver
    region: us-east-1
  snsNotificationsEnabled: true
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`amazonSideAsn`	integer	yes	The Amazon-side ASN of the Route Server.
`persistRoutes`	enum	—	Whether to enable persistent routes Allowed: `enable, disable`
`persistRoutesDuration`	integer	—	The duration of persistent routes in minutes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`snsNotificationsEnabled`	boolean	—	Whether to enable SNS notifications
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the Route Server.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	The ID of the Route Server.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2RouteServerAssociation # CLOUD CONTROL · AWS::EC2::RouteServerAssociation

EC2RouteServerAssociation manages AWS::EC2::RouteServerAssociation through the AWS Cloud Control API.

kubectl get ec2routeserverassociations · example on GitHub

Example

# EC2RouteServerAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2routeserverassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2RouteServerAssociation
metadata:
  name: example-ec2routeserverassociation
  namespace: default
spec:
  providerRef:
    name: example-ec2routeserverassociation
    region: us-east-1
  routeServerId: example-id
  vpcId: vpc-0abc12def3456789

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`routeServerId`	string	yes	Route Server ID Create-only in AWS: changing it requires replacing the resource.
`vpcId`	string	yes	VPC ID Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2RouteServerEndpoint # CLOUD CONTROL · AWS::EC2::RouteServerEndpoint

EC2RouteServerEndpoint manages AWS::EC2::RouteServerEndpoint through the AWS Cloud Control API.

kubectl get ec2routeserverendpoints · example on GitHub

Example

# EC2RouteServerEndpoint — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2routeserverendpoint
apiVersion: aws.konfig.io/v1alpha1
kind: EC2RouteServerEndpoint
metadata:
  name: example-ec2routeserverendpoint
  namespace: default
spec:
  providerRef:
    name: example-ec2routeserverendpoint
    region: us-east-1
  routeServerId: example-id
  subnetId: subnet-0abc12def3456789
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`routeServerId`	string	yes	Route Server ID Create-only in AWS: changing it requires replacing the resource.
`subnetId`	string	yes	Subnet ID Create-only in AWS: changing it requires replacing the resource.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the Route Server Endpoint.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`eniAddress`	string	—	Elastic Network Interface IP address owned by the Route Server Endpoint Read-only: reported by AWS after creation.
`eniId`	string	—	Elastic Network Interface ID owned by the Route Server Endpoint Read-only: reported by AWS after creation.
`id`	string	—	The ID of the Route Server Endpoint.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`vpcId`	string	—	VPC ID Read-only: reported by AWS after creation.

EC2RouteServerPeer # CLOUD CONTROL · AWS::EC2::RouteServerPeer

EC2RouteServerPeer manages AWS::EC2::RouteServerPeer through the AWS Cloud Control API.

kubectl get ec2routeserverpeers · example on GitHub

Example

# EC2RouteServerPeer — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2routeserverpeer
apiVersion: aws.konfig.io/v1alpha1
kind: EC2RouteServerPeer
metadata:
  name: example-ec2routeserverpeer
  namespace: default
spec:
  bgpOptions:
    peerAsn: 1
    peerLivenessDetection: bfd
  peerAddress: example
  providerRef:
    name: example-ec2routeserverpeer
    region: us-east-1
  routeServerEndpointId: example-id
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`bgpOptions`	object	yes	Create-only in AWS: changing it requires replacing the resource.
`bgpOptions.peerAsn`	integer	—	BGP ASN of the Route Server Peer
`bgpOptions.peerLivenessDetection`	enum	—	BGP Liveness Detection Allowed: `bfd, bgp-keepalive`
`peerAddress`	string	yes	IP address of the Route Server Peer Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`routeServerEndpointId`	string	yes	Route Server Endpoint ID Create-only in AWS: changing it requires replacing the resource.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the Route Server Peer.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`endpointEniAddress`	string	—	Elastic Network Interface IP address owned by the Route Server Endpoint Read-only: reported by AWS after creation.
`endpointEniId`	string	—	Elastic Network Interface ID owned by the Route Server Endpoint Read-only: reported by AWS after creation.
`id`	string	—	The ID of the Route Server Peer.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`routeServerId`	string	—	Route Server ID Read-only: reported by AWS after creation.
`subnetId`	string	—	Subnet ID Read-only: reported by AWS after creation.
`vpcId`	string	—	VPC ID Read-only: reported by AWS after creation.

EC2RouteServerPropagation # CLOUD CONTROL · AWS::EC2::RouteServerPropagation

EC2RouteServerPropagation manages AWS::EC2::RouteServerPropagation through the AWS Cloud Control API.

kubectl get ec2routeserverpropagations · example on GitHub

Example

# EC2RouteServerPropagation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2routeserverpropagation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2RouteServerPropagation
metadata:
  name: example-ec2routeserverpropagation
  namespace: default
spec:
  providerRef:
    name: example-ec2routeserverpropagation
    region: us-east-1
  routeServerId: example-id
  routeTableId: example-id

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`routeServerId`	string	yes	Route Server ID Create-only in AWS: changing it requires replacing the resource.
`routeTableId`	string	yes	Route Table ID Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2SecurityGroupEgress # CLOUD CONTROL · AWS::EC2::SecurityGroupEgress

EC2SecurityGroupEgress manages AWS::EC2::SecurityGroupEgress through the AWS Cloud Control API.

kubectl get ec2securitygroupegresses · example on GitHub

Example

# EC2SecurityGroupEgress — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2securitygroupegress
apiVersion: aws.konfig.io/v1alpha1
kind: EC2SecurityGroupEgress
metadata:
  name: example-ec2securitygroupegress
  namespace: default
spec:
  cidrIp: 10.0.0.0/16
  cidrIpv6: 10.0.0.0/16
  description: Managed by konfig-konector
  fromPort: 443
  groupId: example-id
  ipProtocol: example
  providerRef:
    name: example-ec2securitygroupegress
    region: us-east-1
  toPort: 443

Spec

Field	Type	Required	Description
`cidrIp`	string	—	The IPv4 address range, in CIDR format.
`cidrIpv6`	string	—	The IPv6 address range, in CIDR format.
`description`	string	—	The description of an egress (outbound) security group rule.
`destinationPrefixListId`	string	—	The prefix list IDs for an AWS service.
`destinationSecurityGroupId`	string	—	The ID of the security group.
`fromPort`	integer	—	If the protocol is TCP or UDP, this is the start of the port range.
`groupId`	string	yes	The ID of the security group.
`ipProtocol`	string	yes	The IP protocol name (``tcp``, ``udp``, ``icmp``, ``icmpv6``) or number (see [Protocol Numbers](https://docs.aws.amazon.com/http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)).
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`toPort`	integer	—	If the protocol is TCP or UDP, this is the end of the port range.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2SecurityGroupIngress # CLOUD CONTROL · AWS::EC2::SecurityGroupIngress

EC2SecurityGroupIngress manages AWS::EC2::SecurityGroupIngress through the AWS Cloud Control API.

kubectl get ec2securitygroupingresses · example on GitHub

Example

# EC2SecurityGroupIngress — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2securitygroupingress
apiVersion: aws.konfig.io/v1alpha1
kind: EC2SecurityGroupIngress
metadata:
  name: example-ec2securitygroupingress
  namespace: default
spec:
  cidrIp: 10.0.0.0/16
  cidrIpv6: 10.0.0.0/16
  description: Managed by konfig-konector
  fromPort: 443
  groupName: example-ec2securitygroupingress
  ipProtocol: example
  providerRef:
    name: example-ec2securitygroupingress
    region: us-east-1
  sourceSecurityGroupName: example-ec2securitygroupingress
  toPort: 443

Spec

Field	Type	Required	Description
`cidrIp`	string	—	The IPv4 ranges Create-only in AWS: changing it requires replacing the resource.
`cidrIpv6`	string	—	[VPC only] The IPv6 ranges Create-only in AWS: changing it requires replacing the resource.
`description`	string	—	Updates the description of an ingress (inbound) security group rule.
`fromPort`	integer	—	The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number.
`groupId`	string	—	The ID of the security group.
`groupName`	string	—	The name of the security group.
`ipProtocol`	string	yes	The IP protocol name (tcp, udp, icmp, icmpv6) or number (see Protocol Numbers).
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`sourcePrefixListId`	string	—	[EC2-VPC only] The ID of a prefix list.
`sourceSecurityGroupId`	string	—	The ID of the security group.
`sourceSecurityGroupName`	string	—	[EC2-Classic, default VPC] The name of the source security group.
`sourceSecurityGroupOwnerId`	string	—	[nondefault VPC] The AWS account ID that owns the source security group.
`toPort`	integer	—	The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	The Security Group Rule Id Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2SecurityGroupVpcAssociation # CLOUD CONTROL · AWS::EC2::SecurityGroupVpcAssociation

EC2SecurityGroupVpcAssociation manages AWS::EC2::SecurityGroupVpcAssociation through the AWS Cloud Control API.

kubectl get ec2securitygroupvpcassociations · example on GitHub

Example

# EC2SecurityGroupVpcAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2securitygroupvpcassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2SecurityGroupVpcAssociation
metadata:
  name: example-ec2securitygroupvpcassociation
  namespace: default
spec:
  groupId: example-id
  providerRef:
    name: example-ec2securitygroupvpcassociation
    region: us-east-1
  vpcId: vpc-0abc12def3456789

Spec

Field	Type	Required	Description
`groupId`	string	yes	The group ID of the specified security group.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`vpcId`	string	yes	The ID of the VPC in the security group vpc association.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	enum	—	The state of the security group vpc association. Allowed: `associating, associated, association-failed, disassociating, disassociated, disassociation-failed`
`stateReason`	string	—	The reason for the state of the security group vpc association.
`vpcOwnerId`	string	—	The owner of the VPC in the security group vpc association.

EC2SnapshotBlockPublicAccess # CLOUD CONTROL · AWS::EC2::SnapshotBlockPublicAccess ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: account-wide EBS snapshot public access setting. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. EC2SnapshotBlockPublicAccess manages AWS::EC2::SnapshotBlockPublicAccess through the AWS Cloud Control API.

kubectl get ec2snapshotblockpublicaccesses · example on GitHub

Example

# EC2SnapshotBlockPublicAccess — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2snapshotblockpublicaccess
apiVersion: aws.konfig.io/v1alpha1
kind: EC2SnapshotBlockPublicAccess
metadata:
  name: example-ec2snapshotblockpublicaccess
  namespace: default
spec:
  providerRef:
    name: example-ec2snapshotblockpublicaccess
    region: us-east-1
  state: block-all-sharing

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`state`	enum	yes	The state of EBS Snapshot Block Public Access. Allowed: `block-all-sharing, block-new-sharing`

Status

Field	Type	Required	Description
`accountId`	string	—	The identifier for the specified AWS account.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2SqlHaStandbyDetectedInstance # CLOUD CONTROL · AWS::EC2::SqlHaStandbyDetectedInstance

EC2SqlHaStandbyDetectedInstance manages AWS::EC2::SqlHaStandbyDetectedInstance through the AWS Cloud Control API.

kubectl get ec2sqlhastandbydetectedinstances · example on GitHub

Example

# EC2SqlHaStandbyDetectedInstance — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2sqlhastandbydetectedinstance
apiVersion: aws.konfig.io/v1alpha1
kind: EC2SqlHaStandbyDetectedInstance
metadata:
  name: example-ec2sqlhastandbydetectedinstance
  namespace: default
spec:
  instanceId: i-0abc1234def567890
  providerRef:
    name: example-ec2sqlhastandbydetectedinstance
    region: us-east-1
  sqlServerCredentials: example

Spec

Field	Type	Required	Description
`instanceId`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`sqlServerCredentials`	string	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`haStatus`	enum	—	Read-only: reported by AWS after creation. Allowed: `processing, active, standby, invalid`
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedTime`	string	—	Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`sqlServerLicenseUsage`	enum	—	Read-only: reported by AWS after creation. Allowed: `full, waived`

EC2SubnetCidrBlock # CLOUD CONTROL · AWS::EC2::SubnetCidrBlock

EC2SubnetCidrBlock manages AWS::EC2::SubnetCidrBlock through the AWS Cloud Control API.

kubectl get ec2subnetcidrblocks · example on GitHub

Example

# EC2SubnetCidrBlock — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2subnetcidrblock
apiVersion: aws.konfig.io/v1alpha1
kind: EC2SubnetCidrBlock
metadata:
  name: example-ec2subnetcidrblock
  namespace: default
spec:
  ipv6CidrBlock: 2001:db8::/56
  ipv6NetmaskLength: 1
  providerRef:
    name: example-ec2subnetcidrblock
    region: us-east-1
  subnetId: subnet-0abc12def3456789

Spec

Field	Type	Required	Description
`ipv6CidrBlock`	string	—	The IPv6 network range for the subnet, in CIDR notation.
`ipv6IpamPoolId`	string	—	The ID of an IPv6 Amazon VPC IP Address Manager (IPAM) pool from which to allocate, to get the subnet's CIDR Create-only in AWS: changing it requires replacing the resource.
`ipv6NetmaskLength`	integer	—	The netmask length of the IPv6 CIDR to allocate to the subnet from an IPAM pool Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`subnetId`	string	yes	The ID of the subnet Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Information about the IPv6 association.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`ipSource`	string	—	The IP Source of an IPv6 Subnet CIDR Block.
`ipv6AddressAttribute`	string	—	The value denoting whether an IPv6 Subnet CIDR Block is public or private.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2SubnetNetworkAclAssociation # CLOUD CONTROL · AWS::EC2::SubnetNetworkAclAssociation

EC2SubnetNetworkAclAssociation manages AWS::EC2::SubnetNetworkAclAssociation through the AWS Cloud Control API.

kubectl get ec2subnetnetworkaclassociations · example on GitHub

Example

# EC2SubnetNetworkAclAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2subnetnetworkaclassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2SubnetNetworkAclAssociation
metadata:
  name: example-ec2subnetnetworkaclassociation
  namespace: default
spec:
  networkAclId: example-id
  providerRef:
    name: example-ec2subnetnetworkaclassociation
    region: us-east-1
  subnetId: subnet-0abc12def3456789

Spec

Field	Type	Required	Description
`networkAclId`	string	yes	The ID of the network ACL Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`subnetId`	string	yes	The ID of the subnet Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`associationId`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2SubnetRouteTableAssociation # CLOUD CONTROL · AWS::EC2::SubnetRouteTableAssociation

EC2SubnetRouteTableAssociation manages AWS::EC2::SubnetRouteTableAssociation through the AWS Cloud Control API.

kubectl get ec2subnetroutetableassociations · example on GitHub

Example

# EC2SubnetRouteTableAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2subnetroutetableassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2SubnetRouteTableAssociation
metadata:
  name: example-ec2subnetroutetableassociation
  namespace: default
spec:
  providerRef:
    name: example-ec2subnetroutetableassociation
    region: us-east-1
  routeTableId: example-id
  subnetId: subnet-0abc12def3456789

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`routeTableId`	string	yes	The ID of the route table.
`subnetId`	string	yes	The ID of the subnet.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2TrafficMirrorFilter # CLOUD CONTROL · AWS::EC2::TrafficMirrorFilter

EC2TrafficMirrorFilter manages AWS::EC2::TrafficMirrorFilter through the AWS Cloud Control API.

kubectl get ec2trafficmirrorfilters · example on GitHub

Example

# EC2TrafficMirrorFilter — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2trafficmirrorfilter
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TrafficMirrorFilter
metadata:
  name: example-ec2trafficmirrorfilter
  namespace: default
spec:
  description: Managed by konfig-konector
  networkServices:
  - example
  providerRef:
    name: example-ec2trafficmirrorfilter
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`description`	string	—	The description of a traffic mirror filter.
`networkServices`	array<string>	—	The network service that is associated with the traffic mirror filter.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for a traffic mirror filter.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	The ID of a traffic mirror filter.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2TrafficMirrorFilterRule # CLOUD CONTROL · AWS::EC2::TrafficMirrorFilterRule

EC2TrafficMirrorFilterRule manages AWS::EC2::TrafficMirrorFilterRule through the AWS Cloud Control API.

kubectl get ec2trafficmirrorfilterrules · example on GitHub

Example

# EC2TrafficMirrorFilterRule — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2trafficmirrorfilterrule
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TrafficMirrorFilterRule
metadata:
  name: example-ec2trafficmirrorfilterrule
  namespace: default
spec:
  description: Managed by konfig-konector
  destinationCidrBlock: 10.0.0.0/16
  destinationPortRange:
    fromPort: 443
    toPort: 443
  protocol: 1
  providerRef:
    name: example-ec2trafficmirrorfilterrule
    region: us-east-1
  ruleAction: example
  ruleNumber: 1
  sourceCidrBlock: 10.0.0.0/16
  sourcePortRange:
    fromPort: 443
    toPort: 443
  tags:
  - key: example
    value: example
  trafficDirection: example
  trafficMirrorFilterId: example-id

Spec

Field	Type	Required	Description
`description`	string	—	The description of the Traffic Mirror Filter rule.
`destinationCidrBlock`	string	yes	The destination CIDR block to assign to the Traffic Mirror rule.
`destinationPortRange`	object	—	The destination port range.
`destinationPortRange.fromPort`	integer	yes	The first port in the Traffic Mirror port range.
`destinationPortRange.toPort`	integer	yes	The last port in the Traffic Mirror port range.
`protocol`	integer	—	The number of protocol, for example 17 (UDP), to assign to the Traffic Mirror rule.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`ruleAction`	string	yes	The action to take on the filtered traffic (accept/reject).
`ruleNumber`	integer	yes	The number of the Traffic Mirror rule.
`sourceCidrBlock`	string	yes	The source CIDR block to assign to the Traffic Mirror Filter rule.
`sourcePortRange`	object	—	The source port range.
`sourcePortRange.fromPort`	integer	yes	The first port in the Traffic Mirror port range.
`sourcePortRange.toPort`	integer	yes	The last port in the Traffic Mirror port range.
`tags`	array<object>	—	Any tags assigned to the Traffic Mirror Filter rule.
`tags[].key`	string	yes
`tags[].value`	string	yes
`trafficDirection`	string	yes	The direction of traffic (ingress/egress).
`trafficMirrorFilterId`	string	yes	The ID of the filter that this rule is associated with.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`trafficMirrorFilterRuleId`	string	—	The ID of the Traffic Mirror Filter rule.

EC2TrafficMirrorSession # CLOUD CONTROL · AWS::EC2::TrafficMirrorSession

EC2TrafficMirrorSession manages AWS::EC2::TrafficMirrorSession through the AWS Cloud Control API.

kubectl get ec2trafficmirrorsessions · example on GitHub

Example

# EC2TrafficMirrorSession — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2trafficmirrorsession
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TrafficMirrorSession
metadata:
  name: example-ec2trafficmirrorsession
  namespace: default
spec:
  description: Managed by konfig-konector
  networkInterfaceId: example-id
  packetLength: 1
  providerRef:
    name: example-ec2trafficmirrorsession
    region: us-east-1
  sessionNumber: 1
  tags:
  - key: example
    value: example
  trafficMirrorFilterId: example-id
  trafficMirrorTargetId: example-id
  virtualNetworkId: 1

Spec

Field	Type	Required	Description
`description`	string	—	The description of the Traffic Mirror session.
`networkInterfaceId`	string	yes	The ID of the source network interface.
`ownerId`	string	—	The ID of the account that owns the Traffic Mirror session.
`packetLength`	integer	—	The number of bytes in each packet to mirror.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`sessionNumber`	integer	yes	The session number determines the order in which sessions are evaluated when an interface is used by multiple sessions.
`tags`	array<object>	—	The tags assigned to the Traffic Mirror session.
`tags[].key`	string	yes
`tags[].value`	string	yes
`trafficMirrorFilterId`	string	yes	The ID of a Traffic Mirror filter.
`trafficMirrorTargetId`	string	yes	The ID of a Traffic Mirror target.
`virtualNetworkId`	integer	—	The VXLAN ID for the Traffic Mirror session.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	The ID of a Traffic Mirror session.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2TrafficMirrorTarget # CLOUD CONTROL · AWS::EC2::TrafficMirrorTarget

EC2TrafficMirrorTarget manages AWS::EC2::TrafficMirrorTarget through the AWS Cloud Control API.

kubectl get ec2trafficmirrortargets · example on GitHub

Example

# EC2TrafficMirrorTarget — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2trafficmirrortarget
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TrafficMirrorTarget
metadata:
  name: example-ec2trafficmirrortarget
  namespace: default
spec:
  description: Managed by konfig-konector
  networkLoadBalancerArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-ec2trafficmirrortarget
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`description`	string	—	The description of the Traffic Mirror target.
`gatewayLoadBalancerEndpointId`	string	—	The ID of the Gateway Load Balancer endpoint.
`networkInterfaceId`	string	—	The network interface ID that is associated with the target.
`networkLoadBalancerArn`	string	—	The Amazon Resource Name (ARN) of the Network Load Balancer that is associated with the target.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags to assign to the Traffic Mirror target.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2TransitGatewayConnect # CLOUD CONTROL · AWS::EC2::TransitGatewayConnect

EC2TransitGatewayConnect manages AWS::EC2::TransitGatewayConnect through the AWS Cloud Control API.

kubectl get ec2transitgatewayconnects · example on GitHub

Example

# EC2TransitGatewayConnect — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewayconnect
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayConnect
metadata:
  name: example-ec2transitgatewayconnect
  namespace: default
spec:
  options:
    protocol: example
  providerRef:
    name: example-ec2transitgatewayconnect
    region: us-east-1
  tags:
  - key: example
    value: example
  transportTransitGatewayAttachmentId: example-id

Spec

Field	Type	Required	Description
`options`	object	yes	The Connect attachment options.
`options.protocol`	string	—	The tunnel protocol.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the attachment.
`tags[].key`	string	yes
`tags[].value`	string	yes
`transportTransitGatewayAttachmentId`	string	yes	The ID of the attachment from which the Connect attachment was created.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	The creation time.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	The state of the attachment.
`transitGatewayAttachmentId`	string	—	The ID of the Connect attachment.
`transitGatewayId`	string	—	The ID of the transit gateway.

EC2TransitGatewayConnectPeer # CLOUD CONTROL · AWS::EC2::TransitGatewayConnectPeer

EC2TransitGatewayConnectPeer manages AWS::EC2::TransitGatewayConnectPeer through the AWS Cloud Control API.

kubectl get ec2transitgatewayconnectpeers · example on GitHub

Example

# EC2TransitGatewayConnectPeer — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewayconnectpeer
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayConnectPeer
metadata:
  name: example-ec2transitgatewayconnectpeer
  namespace: default
spec:
  connectPeerConfiguration:
    bgpConfigurations:
    - bgpStatus: example
      peerAddress: example
      peerAsn: 1
      transitGatewayAddress: example
      transitGatewayAsn: 1
    insideCidrBlocks:
    - 10.0.0.0/16
    peerAddress: example
    protocol: example
    transitGatewayAddress: example
  providerRef:
    name: example-ec2transitgatewayconnectpeer
    region: us-east-1
  tags:
  - key: example
    value: example
  transitGatewayAttachmentId: example-id

Spec

Field	Type	Required	Description
`connectPeerConfiguration`	object	yes	The Connect peer details.
`connectPeerConfiguration.bgpConfigurations`	array<object>	—	The BGP configuration details.
`connectPeerConfiguration.bgpConfigurations[].bgpStatus`	string	—	The BGP status.
`connectPeerConfiguration.bgpConfigurations[].peerAddress`	string	—	The interior BGP peer IP address for the appliance.
`connectPeerConfiguration.bgpConfigurations[].peerAsn`	number	—	The peer Autonomous System Number (ASN).
`connectPeerConfiguration.bgpConfigurations[].transitGatewayAddress`	string	—	The interior BGP peer IP address for the transit gateway.
`connectPeerConfiguration.bgpConfigurations[].transitGatewayAsn`	number	—	The transit gateway Autonomous System Number (ASN).
`connectPeerConfiguration.insideCidrBlocks`	array<string>	yes	The range of interior BGP peer IP addresses.
`connectPeerConfiguration.peerAddress`	string	yes	The peer IP address (GRE outer IP address) on the appliance side of the Connect peer.
`connectPeerConfiguration.protocol`	string	—	The tunnel protocol.
`connectPeerConfiguration.transitGatewayAddress`	string	—	The Connect peer IP address on the transit gateway side of the tunnel.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the Connect Peer.
`tags[].key`	string	yes
`tags[].value`	string	yes
`transitGatewayAttachmentId`	string	yes	The ID of the Connect attachment.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	The creation time.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	The state of the Connect peer.
`transitGatewayConnectPeerId`	string	—	The ID of the Connect peer.

EC2TransitGatewayMeteringPolicy # CLOUD CONTROL · AWS::EC2::TransitGatewayMeteringPolicy

EC2TransitGatewayMeteringPolicy manages AWS::EC2::TransitGatewayMeteringPolicy through the AWS Cloud Control API.

kubectl get ec2transitgatewaymeteringpolicies · example on GitHub

Example

# EC2TransitGatewayMeteringPolicy — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewaymeteringpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayMeteringPolicy
metadata:
  name: example-ec2transitgatewaymeteringpolicy
  namespace: default
spec:
  middleboxAttachmentIds:
  - example
  providerRef:
    name: example-ec2transitgatewaymeteringpolicy
    region: us-east-1
  tags:
  - key: example
    value: example
  transitGatewayId: example-id

Spec

Field	Type	Required	Description
`middleboxAttachmentIds`	array<string>	—	Middle box attachment Ids
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes
`transitGatewayId`	string	yes	The Id of transit gateway Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	State of the transit gateway metering policy Read-only: reported by AWS after creation.
`transitGatewayMeteringPolicyId`	string	—	The Id of the transit gateway metering policy Read-only: reported by AWS after creation.
`updateEffectiveAt`	string	—	The timestamp at which the latest action performed on the metering policy will become effective Read-only: reported by AWS after creation.

EC2TransitGatewayMeteringPolicyEntry # CLOUD CONTROL · AWS::EC2::TransitGatewayMeteringPolicyEntry

EC2TransitGatewayMeteringPolicyEntry manages AWS::EC2::TransitGatewayMeteringPolicyEntry through the AWS Cloud Control API.

kubectl get ec2transitgatewaymeteringpolicyentries · example on GitHub

Example

# EC2TransitGatewayMeteringPolicyEntry — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewaymeteringpolicyentry
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayMeteringPolicyEntry
metadata:
  name: example-ec2transitgatewaymeteringpolicyentry
  namespace: default
spec:
  destinationCidrBlock: 10.0.0.0/16
  destinationPortRange: example
  destinationTransitGatewayAttachmentType: vpc
  meteredAccount: source-attachment-owner
  policyRuleNumber: 1
  protocol: example
  providerRef:
    name: example-ec2transitgatewaymeteringpolicyentry
    region: us-east-1
  sourceCidrBlock: 10.0.0.0/16
  sourcePortRange: example
  sourceTransitGatewayAttachmentType: vpc
  transitGatewayMeteringPolicyId: example-id

Spec

Field	Type	Required	Description
`destinationCidrBlock`	string	—	The list of IP addresses of the instances receiving traffic from the transit gateway Create-only in AWS: changing it requires replacing the resource.
`destinationPortRange`	string	—	The list of ports on destination instances receiving traffic from the transit gateway Create-only in AWS: changing it requires replacing the resource.
`destinationTransitGatewayAttachmentId`	string	—	The ID of the source attachment through which traffic leaves a transit gateway Create-only in AWS: changing it requires replacing the resource.
`destinationTransitGatewayAttachmentType`	enum	—	The type of the attachment through which traffic leaves a transit gateway Create-only in AWS: changing it requires replacing the resource. Allowed: `vpc, vpn, direct-connect-gateway, peering, network-function, vpn-concentrator, client-vpn`
`meteredAccount`	enum	yes	The resource owner information responsible for paying default billable charges for the traffic flow Create-only in AWS: changing it requires replacing the resource. Allowed: `source-attachment-owner, destination-attachment-owner, transit-gateway-owner`
`policyRuleNumber`	integer	yes	The rule number of the metering policy entry Create-only in AWS: changing it requires replacing the resource.
`protocol`	string	—	The protocol of the traffic Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`sourceCidrBlock`	string	—	The list of IP addresses of the instances sending traffic to the transit gateway for which the metering policy entry is applicable Create-only in AWS: changing it requires replacing the resource.
`sourcePortRange`	string	—	The list of ports on source instances sending traffic to the transit gateway Create-only in AWS: changing it requires replacing the resource.
`sourceTransitGatewayAttachmentId`	string	—	The ID of the source attachment through which traffic enters a transit gateway Create-only in AWS: changing it requires replacing the resource.
`sourceTransitGatewayAttachmentType`	enum	—	The type of the attachment through which traffic enters a transit gateway Create-only in AWS: changing it requires replacing the resource. Allowed: `vpc, vpn, direct-connect-gateway, peering, network-function, vpn-concentrator, client-vpn`
`transitGatewayMeteringPolicyId`	string	yes	The ID of the transit gateway metering policy for which the entry is being created Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	State of the transit gateway metering policy Read-only: reported by AWS after creation.
`updateEffectiveAt`	string	—	The timestamp at which the latest action performed on the metering policy entry will become effective Read-only: reported by AWS after creation.

EC2TransitGatewayMulticastDomain # CLOUD CONTROL · AWS::EC2::TransitGatewayMulticastDomain

EC2TransitGatewayMulticastDomain manages AWS::EC2::TransitGatewayMulticastDomain through the AWS Cloud Control API.

kubectl get ec2transitgatewaymulticastdomains · example on GitHub

Example

# EC2TransitGatewayMulticastDomain — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewaymulticastdomain
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayMulticastDomain
metadata:
  name: example-ec2transitgatewaymulticastdomain
  namespace: default
spec:
  options:
    autoAcceptSharedAssociations: example
    igmpv2Support: example
    staticSourcesSupport: example
  providerRef:
    name: example-ec2transitgatewaymulticastdomain
    region: us-east-1
  tags:
  - key: example
    value: example
  transitGatewayId: example-id

Spec

Field	Type	Required	Description
`options`	object	—	The options for the transit gateway multicast domain.
`options.autoAcceptSharedAssociations`	string	—	Indicates whether to automatically cross-account subnet associations that are associated with the transit gateway multicast domain.
`options.igmpv2Support`	string	—	Indicates whether Internet Group Management Protocol (IGMP) version 2 is turned on for the transit gateway multicast domain.
`options.staticSourcesSupport`	string	—	Indicates whether support for statically configuring transit gateway multicast group sources is turned on.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the transit gateway multicast domain.
`tags[].key`	string	yes
`tags[].value`	string	yes
`transitGatewayId`	string	yes	The ID of the transit gateway.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	The time the transit gateway multicast domain was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	The state of the transit gateway multicast domain.
`transitGatewayMulticastDomainArn`	string	—	The Amazon Resource Name (ARN) of the transit gateway multicast domain.
`transitGatewayMulticastDomainId`	string	—	The ID of the transit gateway multicast domain.

EC2TransitGatewayMulticastDomainAssociation # CLOUD CONTROL · AWS::EC2::TransitGatewayMulticastDomainAssociation

EC2TransitGatewayMulticastDomainAssociation manages AWS::EC2::TransitGatewayMulticastDomainAssociation through the AWS Cloud Control API.

kubectl get ec2transitgatewaymulticastdomainassociations · example on GitHub

Example

# EC2TransitGatewayMulticastDomainAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewaymulticastdomainassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayMulticastDomainAssociation
metadata:
  name: example-ec2transitgatewaymulticastdomainassociation
  namespace: default
spec:
  providerRef:
    name: example-ec2transitgatewaymulticastdomainassociation
    region: us-east-1
  subnetId: subnet-0abc12def3456789
  transitGatewayAttachmentId: example-id
  transitGatewayMulticastDomainId: example-id

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`subnetId`	string	yes	The IDs of the subnets to associate with the transit gateway multicast domain.
`transitGatewayAttachmentId`	string	yes	The ID of the transit gateway attachment.
`transitGatewayMulticastDomainId`	string	yes	The ID of the transit gateway multicast domain.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`resourceId`	string	—	The ID of the resource.
`resourceType`	string	—	The type of resource, for example a VPC attachment.
`state`	string	—	The state of the subnet association.

EC2TransitGatewayMulticastGroupMember # CLOUD CONTROL · AWS::EC2::TransitGatewayMulticastGroupMember

EC2TransitGatewayMulticastGroupMember manages AWS::EC2::TransitGatewayMulticastGroupMember through the AWS Cloud Control API.

kubectl get ec2transitgatewaymulticastgroupmembers · example on GitHub

Example

# EC2TransitGatewayMulticastGroupMember — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewaymulticastgroupmember
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayMulticastGroupMember
metadata:
  name: example-ec2transitgatewaymulticastgroupmember
  namespace: default
spec:
  groupIpAddress: example
  networkInterfaceId: example-id
  providerRef:
    name: example-ec2transitgatewaymulticastgroupmember
    region: us-east-1
  transitGatewayMulticastDomainId: example-id

Spec

Field	Type	Required	Description
`groupIpAddress`	string	yes	The IP address assigned to the transit gateway multicast group.
`networkInterfaceId`	string	yes	The ID of the transit gateway attachment.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`transitGatewayMulticastDomainId`	string	yes	The ID of the transit gateway multicast domain.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`groupMember`	boolean	—	Indicates that the resource is a transit gateway multicast group member.
`groupSource`	boolean	—	Indicates that the resource is a transit gateway multicast group member.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`memberType`	string	—	The member type (for example, static).
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`resourceId`	string	—	The ID of the resource.
`resourceType`	string	—	The type of resource, for example a VPC attachment.
`subnetId`	string	—	The ID of the subnet.
`transitGatewayAttachmentId`	string	—	The ID of the transit gateway attachment.

EC2TransitGatewayMulticastGroupSource # CLOUD CONTROL · AWS::EC2::TransitGatewayMulticastGroupSource

EC2TransitGatewayMulticastGroupSource manages AWS::EC2::TransitGatewayMulticastGroupSource through the AWS Cloud Control API.

kubectl get ec2transitgatewaymulticastgroupsources · example on GitHub

Example

# EC2TransitGatewayMulticastGroupSource — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewaymulticastgroupsource
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayMulticastGroupSource
metadata:
  name: example-ec2transitgatewaymulticastgroupsource
  namespace: default
spec:
  groupIpAddress: example
  networkInterfaceId: example-id
  providerRef:
    name: example-ec2transitgatewaymulticastgroupsource
    region: us-east-1
  transitGatewayMulticastDomainId: example-id

Spec

Field	Type	Required	Description
`groupIpAddress`	string	yes	The IP address assigned to the transit gateway multicast group.
`networkInterfaceId`	string	yes	The ID of the transit gateway attachment.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`transitGatewayMulticastDomainId`	string	yes	The ID of the transit gateway multicast domain.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`groupMember`	boolean	—	Indicates that the resource is a transit gateway multicast group member.
`groupSource`	boolean	—	Indicates that the resource is a transit gateway multicast group member.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`resourceId`	string	—	The ID of the resource.
`resourceType`	string	—	The type of resource, for example a VPC attachment.
`sourceType`	string	—	The source type.
`subnetId`	string	—	The ID of the subnet.
`transitGatewayAttachmentId`	string	—	The ID of the transit gateway attachment.

EC2TransitGatewayPeeringAttachment # CLOUD CONTROL · AWS::EC2::TransitGatewayPeeringAttachment

EC2TransitGatewayPeeringAttachment manages AWS::EC2::TransitGatewayPeeringAttachment through the AWS Cloud Control API.

kubectl get ec2transitgatewaypeeringattachments · example on GitHub

Example

# EC2TransitGatewayPeeringAttachment — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewaypeeringattachment
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayPeeringAttachment
metadata:
  name: example-ec2transitgatewaypeeringattachment
  namespace: default
spec:
  peerAccountId: '123456789012'
  peerRegion: example
  peerTransitGatewayId: example-id
  providerRef:
    name: example-ec2transitgatewaypeeringattachment
    region: us-east-1
  tags:
  - key: example
    value: example
  transitGatewayId: example-id

Spec

Field	Type	Required	Description
`peerAccountId`	string	yes	The ID of the peer account Create-only in AWS: changing it requires replacing the resource.
`peerRegion`	string	yes	Peer Region Create-only in AWS: changing it requires replacing the resource.
`peerTransitGatewayId`	string	yes	The ID of the peer transit gateway.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags for the transit gateway peering attachment.
`tags[].key`	string	yes
`tags[].value`	string	yes
`transitGatewayId`	string	yes	The ID of the transit gateway.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	The time the transit gateway peering attachment was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	The state of the transit gateway peering attachment.
`status`	object	—	The status of the transit gateway peering attachment.
`status.code`	string	—	The status code.
`status.message`	string	—	The status message, if applicable.
`transitGatewayAttachmentId`	string	—	The ID of the transit gateway peering attachment.

EC2TransitGatewayPolicyTable # CLOUD CONTROL · AWS::EC2::TransitGatewayPolicyTable

EC2TransitGatewayPolicyTable manages AWS::EC2::TransitGatewayPolicyTable through the AWS Cloud Control API.

kubectl get ec2transitgatewaypolicytables · example on GitHub

Example

# EC2TransitGatewayPolicyTable — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewaypolicytable
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayPolicyTable
metadata:
  name: example-ec2transitgatewaypolicytable
  namespace: default
spec:
  providerRef:
    name: example-ec2transitgatewaypolicytable
    region: us-east-1
  tags:
  - key: example
    value: example
  transitGatewayId: example-id

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes
`transitGatewayId`	string	yes	The Id of transit gateway Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	Creation time of the transit gateway policy table Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	State of the transit gateway policy table Read-only: reported by AWS after creation.
`transitGatewayPolicyTableId`	string	—	The Id of transit gateway policy table.

EC2TransitGatewayPolicyTableAssociation # CLOUD CONTROL · AWS::EC2::TransitGatewayPolicyTableAssociation

EC2TransitGatewayPolicyTableAssociation manages AWS::EC2::TransitGatewayPolicyTableAssociation through the AWS Cloud Control API.

kubectl get ec2transitgatewaypolicytableassociations · example on GitHub

Example

# EC2TransitGatewayPolicyTableAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewaypolicytableassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayPolicyTableAssociation
metadata:
  name: example-ec2transitgatewaypolicytableassociation
  namespace: default
spec:
  providerRef:
    name: example-ec2transitgatewaypolicytableassociation
    region: us-east-1
  transitGatewayAttachmentId: example-id
  transitGatewayPolicyTableId: example-id

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`transitGatewayAttachmentId`	string	yes	The ID of transit gateway attachment.
`transitGatewayPolicyTableId`	string	yes	The ID of transit gateway policy table.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	The state of the transit gateway policy table association.

EC2TransitGatewayPolicyTableEntry # CLOUD CONTROL · AWS::EC2::TransitGatewayPolicyTableEntry

EC2TransitGatewayPolicyTableEntry manages AWS::EC2::TransitGatewayPolicyTableEntry through the AWS Cloud Control API.

kubectl get ec2transitgatewaypolicytableentries · example on GitHub

Example

# EC2TransitGatewayPolicyTableEntry — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewaypolicytableentry
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayPolicyTableEntry
metadata:
  name: example-ec2transitgatewaypolicytableentry
  namespace: default
spec:
  policyRule:
    destinationCidrBlock: 10.0.0.0/16
    destinationPortRange: example
    protocol: example
    sourceCidrBlock: 10.0.0.0/16
    sourcePortRange: example
  policyRuleNumber: example
  providerRef:
    name: example-ec2transitgatewaypolicytableentry
    region: us-east-1
  targetRouteTableId: example-id
  transitGatewayPolicyTableId: example-id

Spec

Field	Type	Required	Description
`policyRule`	object	yes	The policy rule associated with the entry.
`policyRule.destinationCidrBlock`	string	—	The destination CIDR block for the transit gateway policy rule.
`policyRule.destinationPortRange`	string	—	The destination port range for the transit gateway policy rule.
`policyRule.protocol`	string	—	The protocol for the transit gateway policy rule.
`policyRule.sourceCidrBlock`	string	—	The source CIDR block for the transit gateway policy rule.
`policyRule.sourcePortRange`	string	—	The source port range for the transit gateway policy rule.
`policyRuleNumber`	string	yes	The rule number for the policy table entry.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`targetRouteTableId`	string	yes	The ID of the target route table.
`transitGatewayPolicyTableId`	string	yes	The ID of the transit gateway policy table.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`state`	string	—	The state of the policy table entry.

EC2TransitGatewayRoute # CLOUD CONTROL · AWS::EC2::TransitGatewayRoute

EC2TransitGatewayRoute manages AWS::EC2::TransitGatewayRoute through the AWS Cloud Control API.

kubectl get ec2transitgatewayroutes · example on GitHub

Example

# EC2TransitGatewayRoute — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewayroute
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayRoute
metadata:
  name: example-ec2transitgatewayroute
  namespace: default
spec:
  blackhole: false
  destinationCidrBlock: 10.0.0.0/16
  providerRef:
    name: example-ec2transitgatewayroute
    region: us-east-1
  transitGatewayRouteTableId: example-id

Spec

Field	Type	Required	Description
`blackhole`	boolean	—	Indicates whether to drop traffic that matches this route.
`destinationCidrBlock`	string	yes	The CIDR range used for destination matches.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`transitGatewayAttachmentId`	string	—	The ID of transit gateway attachment.
`transitGatewayRouteTableId`	string	yes	The ID of transit gateway route table.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2TransitGatewayRouteTable # CLOUD CONTROL · AWS::EC2::TransitGatewayRouteTable

EC2TransitGatewayRouteTable manages AWS::EC2::TransitGatewayRouteTable through the AWS Cloud Control API.

kubectl get ec2transitgatewayroutetables · example on GitHub

Example

# EC2TransitGatewayRouteTable — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewayroutetable
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayRouteTable
metadata:
  name: example-ec2transitgatewayroutetable
  namespace: default
spec:
  providerRef:
    name: example-ec2transitgatewayroutetable
    region: us-east-1
  tags:
  - key: example
    value: example
  transitGatewayId: example-id

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Tags are composed of a Key/Value pair.
`tags[].key`	string	yes
`tags[].value`	string	yes
`transitGatewayId`	string	yes	The ID of the transit gateway.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`transitGatewayRouteTableId`	string	—	Transit Gateway Route Table primary identifier Read-only: reported by AWS after creation.

EC2TransitGatewayRouteTableAssociation # CLOUD CONTROL · AWS::EC2::TransitGatewayRouteTableAssociation

EC2TransitGatewayRouteTableAssociation manages AWS::EC2::TransitGatewayRouteTableAssociation through the AWS Cloud Control API.

kubectl get ec2transitgatewayroutetableassociations · example on GitHub

Example

# EC2TransitGatewayRouteTableAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewayroutetableassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayRouteTableAssociation
metadata:
  name: example-ec2transitgatewayroutetableassociation
  namespace: default
spec:
  providerRef:
    name: example-ec2transitgatewayroutetableassociation
    region: us-east-1
  transitGatewayAttachmentId: example-id
  transitGatewayRouteTableId: example-id

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`transitGatewayAttachmentId`	string	yes	The ID of transit gateway attachment.
`transitGatewayRouteTableId`	string	yes	The ID of transit gateway route table.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2TransitGatewayRouteTablePropagation # CLOUD CONTROL · AWS::EC2::TransitGatewayRouteTablePropagation

EC2TransitGatewayRouteTablePropagation manages AWS::EC2::TransitGatewayRouteTablePropagation through the AWS Cloud Control API.

kubectl get ec2transitgatewayroutetablepropagations · example on GitHub

Example

# EC2TransitGatewayRouteTablePropagation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2transitgatewayroutetablepropagation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2TransitGatewayRouteTablePropagation
metadata:
  name: example-ec2transitgatewayroutetablepropagation
  namespace: default
spec:
  providerRef:
    name: example-ec2transitgatewayroutetablepropagation
    region: us-east-1
  transitGatewayAttachmentId: example-id
  transitGatewayRouteTableId: example-id

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`transitGatewayAttachmentId`	string	yes	The ID of transit gateway attachment.
`transitGatewayRouteTableId`	string	yes	The ID of transit gateway route table.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2VPCBlockPublicAccessExclusion # CLOUD CONTROL · AWS::EC2::VPCBlockPublicAccessExclusion ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: modifies the account-wide VPC public access posture. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. EC2VPCBlockPublicAccessExclusion manages AWS::EC2::VPCBlockPublicAccessExclusion through the AWS Cloud Control API.

kubectl get ec2vpcblockpublicaccessexclusions · example on GitHub

Example

# EC2VPCBlockPublicAccessExclusion — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2vpcblockpublicaccessexclusion
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VPCBlockPublicAccessExclusion
metadata:
  name: example-ec2vpcblockpublicaccessexclusion
  namespace: default
spec:
  internetGatewayExclusionMode: allow-bidirectional
  providerRef:
    name: example-ec2vpcblockpublicaccessexclusion
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`internetGatewayExclusionMode`	enum	yes	The desired Block Public Access Exclusion Mode for a specific VPC/Subnet. Allowed: `allow-bidirectional, allow-egress`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`subnetId`	string	—	The ID of the subnet.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes
`vpcId`	string	—	The ID of the vpc.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`exclusionId`	string	—	The ID of the exclusion Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2VPCBlockPublicAccessOptions # CLOUD CONTROL · AWS::EC2::VPCBlockPublicAccessOptions ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: account-wide VPC public access setting; can cut internet access for every VPC. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. EC2VPCBlockPublicAccessOptions manages AWS::EC2::VPCBlockPublicAccessOptions through the AWS Cloud Control API.

kubectl get ec2vpcblockpublicaccessoptions · example on GitHub

Example

# EC2VPCBlockPublicAccessOptions — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2vpcblockpublicaccessoptions
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VPCBlockPublicAccessOptions
metadata:
  name: example-ec2vpcblockpublicaccessoptions
  namespace: default
spec:
  internetGatewayBlockMode: block-bidirectional
  providerRef:
    name: example-ec2vpcblockpublicaccessoptions
    region: us-east-1

Spec

Field	Type	Required	Description
`internetGatewayBlockMode`	enum	yes	The desired Block Public Access mode for Internet Gateways in your account. Allowed: `block-bidirectional, block-ingress`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`accountId`	string	—	The identifier for the specified AWS account.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`exclusionsAllowed`	string	—	Determines if exclusions are allowed.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2VPCCidrBlock # CLOUD CONTROL · AWS::EC2::VPCCidrBlock

EC2VPCCidrBlock manages AWS::EC2::VPCCidrBlock through the AWS Cloud Control API.

kubectl get ec2vpccidrblocks · example on GitHub

Example

# EC2VPCCidrBlock — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2vpccidrblock
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VPCCidrBlock
metadata:
  name: example-ec2vpccidrblock
  namespace: default
spec:
  amazonProvidedIpv6CidrBlock: false
  cidrBlock: 10.0.0.0/16
  ipv4NetmaskLength: 1
  ipv6CidrBlock: 2001:db8::/56
  ipv6CidrBlockNetworkBorderGroup: 10.0.0.0/16
  ipv6NetmaskLength: 1
  ipv6Pool: example
  providerRef:
    name: example-ec2vpccidrblock
    region: us-east-1
  vpcId: vpc-0abc12def3456789

Spec

Field	Type	Required	Description
`amazonProvidedIpv6CidrBlock`	boolean	—	Requests an Amazon-provided IPv6 CIDR block with a /56 prefix length for the VPC.
`cidrBlock`	string	—	An IPv4 CIDR block to associate with the VPC.
`ipv4IpamPoolId`	string	—	The ID of the IPv4 IPAM pool to Associate a CIDR from to a VPC.
`ipv4NetmaskLength`	integer	—	The netmask length of the IPv4 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool.
`ipv6CidrBlock`	string	—	An IPv6 CIDR block from the IPv6 address pool.
`ipv6CidrBlockNetworkBorderGroup`	string	—	The name of the location from which we advertise the IPV6 CIDR block.
`ipv6IpamPoolId`	string	—	The ID of the IPv6 IPAM pool to Associate a CIDR from to a VPC.
`ipv6NetmaskLength`	integer	—	The netmask length of the IPv6 CIDR you would like to associate from an Amazon VPC IP Address Manager (IPAM) pool.
`ipv6Pool`	string	—	The ID of an IPv6 address pool from which to allocate the IPv6 CIDR block.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`vpcId`	string	yes	The ID of the VPC.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	The Id of the VPC associated CIDR Block.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`ipSource`	string	—	The IP Source of an IPv6 VPC CIDR Block.
`ipv6AddressAttribute`	string	—	The value denoting whether an IPv6 VPC CIDR Block is public or private.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2VPCDHCPOptionsAssociation # CLOUD CONTROL · AWS::EC2::VPCDHCPOptionsAssociation

EC2VPCDHCPOptionsAssociation manages AWS::EC2::VPCDHCPOptionsAssociation through the AWS Cloud Control API.

kubectl get ec2vpcdhcpoptionsassociations · example on GitHub

Example

# EC2VPCDHCPOptionsAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2vpcdhcpoptionsassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VPCDHCPOptionsAssociation
metadata:
  name: example-ec2vpcdhcpoptionsassociation
  namespace: default
spec:
  dhcpOptionsId: example-id
  providerRef:
    name: example-ec2vpcdhcpoptionsassociation
    region: us-east-1
  vpcId: vpc-0abc12def3456789

Spec

Field	Type	Required	Description
`dhcpOptionsId`	string	yes	The ID of the DHCP options set, or default to associate no DHCP options with the VPC.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`vpcId`	string	yes	The ID of the VPC.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2VPCEncryptionControl # CLOUD CONTROL · AWS::EC2::VPCEncryptionControl

EC2VPCEncryptionControl manages AWS::EC2::VPCEncryptionControl through the AWS Cloud Control API.

kubectl get ec2vpcencryptioncontrols · example on GitHub

Example

# EC2VPCEncryptionControl — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2vpcencryptioncontrol
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VPCEncryptionControl
metadata:
  name: example-ec2vpcencryptioncontrol
  namespace: default
spec:
  egressOnlyInternetGatewayExclusionInput: enable
  elasticFileSystemExclusionInput: enable
  internetGatewayExclusionInput: enable
  lambdaExclusionInput: enable
  mode: monitor
  natGatewayExclusionInput: enable
  providerRef:
    name: example-ec2vpcencryptioncontrol
    region: us-east-1
  tags:
  - key: example
    value: example
  virtualPrivateGatewayExclusionInput: enable
  vpcLatticeExclusionInput: enable
  vpcPeeringExclusionInput: enable

Spec

Field	Type	Required	Description
`egressOnlyInternetGatewayExclusionInput`	enum	—	Used to enable or disable EIGW exclusion Allowed: `enable, disable`
`elasticFileSystemExclusionInput`	enum	—	Used to enable or disable EFS exclusion Allowed: `enable, disable`
`internetGatewayExclusionInput`	enum	—	Used to enable or disable IGW exclusion Allowed: `enable, disable`
`lambdaExclusionInput`	enum	—	Used to enable or disable Lambda exclusion Allowed: `enable, disable`
`mode`	enum	—	The VPC encryption control mode, either monitor or enforce. Allowed: `monitor, enforce`
`natGatewayExclusionInput`	enum	—	Used to enable or disable Nat gateway exclusion Allowed: `enable, disable`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags to assign to the VPC encryption control.
`tags[].key`	string	yes
`tags[].value`	string	yes
`virtualPrivateGatewayExclusionInput`	enum	—	Used to enable or disable VGW exclusion Allowed: `enable, disable`
`vpcId`	string	—	The VPC on which this VPC encryption control is applied.
`vpcLatticeExclusionInput`	enum	—	Used to enable or disable Vpc Lattice exclusion Allowed: `enable, disable`
`vpcPeeringExclusionInput`	enum	—	Used to enable or disable VPC peering exclusion Allowed: `enable, disable`

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`resourceExclusions`	object	—	Enumerates the states of all the VPC encryption control resource exclusions Read-only: reported by AWS after creation.
`resourceExclusions.egressOnlyInternetGateway`	object	—	EC2VPCEncryptionControlVpcEncryptionControlExclusion is a nested property type of AWS::EC2::VPCEncryptionControl.
`resourceExclusions.egressOnlyInternetGateway.state`	string	—
`resourceExclusions.egressOnlyInternetGateway.stateMessage`	string	—
`resourceExclusions.elasticFileSystem`	object	—	EC2VPCEncryptionControlVpcEncryptionControlExclusion is a nested property type of AWS::EC2::VPCEncryptionControl.
`resourceExclusions.elasticFileSystem.state`	string	—
`resourceExclusions.elasticFileSystem.stateMessage`	string	—
`resourceExclusions.internetGateway`	object	—	EC2VPCEncryptionControlVpcEncryptionControlExclusion is a nested property type of AWS::EC2::VPCEncryptionControl.
`resourceExclusions.internetGateway.state`	string	—
`resourceExclusions.internetGateway.stateMessage`	string	—
`resourceExclusions.lambda`	object	—	EC2VPCEncryptionControlVpcEncryptionControlExclusion is a nested property type of AWS::EC2::VPCEncryptionControl.
`resourceExclusions.lambda.state`	string	—
`resourceExclusions.lambda.stateMessage`	string	—
`resourceExclusions.natGateway`	object	—	EC2VPCEncryptionControlVpcEncryptionControlExclusion is a nested property type of AWS::EC2::VPCEncryptionControl.
`resourceExclusions.natGateway.state`	string	—
`resourceExclusions.natGateway.stateMessage`	string	—
`resourceExclusions.virtualPrivateGateway`	object	—	EC2VPCEncryptionControlVpcEncryptionControlExclusion is a nested property type of AWS::EC2::VPCEncryptionControl.
`resourceExclusions.virtualPrivateGateway.state`	string	—
`resourceExclusions.virtualPrivateGateway.stateMessage`	string	—
`resourceExclusions.vpcLattice`	object	—	EC2VPCEncryptionControlVpcEncryptionControlExclusion is a nested property type of AWS::EC2::VPCEncryptionControl.
`resourceExclusions.vpcLattice.state`	string	—
`resourceExclusions.vpcLattice.stateMessage`	string	—
`resourceExclusions.vpcPeering`	object	—	EC2VPCEncryptionControlVpcEncryptionControlExclusion is a nested property type of AWS::EC2::VPCEncryptionControl.
`resourceExclusions.vpcPeering.state`	string	—
`resourceExclusions.vpcPeering.stateMessage`	string	—
`state`	enum	—	The current state of the VPC encryption control. Allowed: `creating, available, monitor-in-progress, enforce-in-progress, monitor-failed, enforce-failed, deleting, deleted…`
`stateMessage`	string	—	Provides additional context on the state of the VPC encryption control.
`vpcEncryptionControlId`	string	—	The VPC encryption control resource id.

EC2VPCEndpointConnectionNotification # CLOUD CONTROL · AWS::EC2::VPCEndpointConnectionNotification

EC2VPCEndpointConnectionNotification manages AWS::EC2::VPCEndpointConnectionNotification through the AWS Cloud Control API.

kubectl get ec2vpcendpointconnectionnotifications · example on GitHub

Example

# EC2VPCEndpointConnectionNotification — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2vpcendpointconnectionnotification
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VPCEndpointConnectionNotification
metadata:
  name: example-ec2vpcendpointconnectionnotification
  namespace: default
spec:
  connectionEvents:
  - example
  connectionNotificationArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-ec2vpcendpointconnectionnotification
    region: us-east-1

Spec

Field	Type	Required	Description
`connectionEvents`	array<string>	yes	The endpoint events for which to receive notifications.
`connectionNotificationArn`	string	yes	The ARN of the SNS topic for the notifications.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`serviceId`	string	—	The ID of the endpoint service.
`vpcEndpointId`	string	—	The ID of the endpoint.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`vpcEndpointConnectionNotificationId`	string	—	VPC Endpoint Connection ID generated by service Read-only: reported by AWS after creation.

EC2VPCEndpointServicePermissions # CLOUD CONTROL · AWS::EC2::VPCEndpointServicePermissions

EC2VPCEndpointServicePermissions manages AWS::EC2::VPCEndpointServicePermissions through the AWS Cloud Control API.

kubectl get ec2vpcendpointservicepermissions · example on GitHub

Example

# EC2VPCEndpointServicePermissions — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2vpcendpointservicepermissions
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VPCEndpointServicePermissions
metadata:
  name: example-ec2vpcendpointservicepermissions
  namespace: default
spec:
  allowedPrincipals:
  - example
  providerRef:
    name: example-ec2vpcendpointservicepermissions
    region: us-east-1
  serviceId: example-id

Spec

Field	Type	Required	Description
`allowedPrincipals`	array<string>	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`serviceId`	string	yes	Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2VPCGatewayAttachment # CLOUD CONTROL · AWS::EC2::VPCGatewayAttachment

EC2VPCGatewayAttachment manages AWS::EC2::VPCGatewayAttachment through the AWS Cloud Control API.

kubectl get ec2vpcgatewayattachments · example on GitHub

Example

# EC2VPCGatewayAttachment — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2vpcgatewayattachment
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VPCGatewayAttachment
metadata:
  name: example-ec2vpcgatewayattachment
  namespace: default
spec:
  providerRef:
    name: example-ec2vpcgatewayattachment
    region: us-east-1
  vpcId: vpc-0abc12def3456789

Spec

Field	Type	Required	Description
`internetGatewayId`	string	—	The ID of the internet gateway.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`vpcId`	string	yes	The ID of the VPC.
`vpnGatewayId`	string	—	The ID of the virtual private gateway.

Status

Field	Type	Required	Description
`attachmentType`	string	—	Used to identify if this resource is an Internet Gateway or Vpn Gateway Attachment Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EC2VPNConcentrator # CLOUD CONTROL · AWS::EC2::VPNConcentrator

EC2VPNConcentrator manages AWS::EC2::VPNConcentrator through the AWS Cloud Control API.

kubectl get ec2vpnconcentrators · example on GitHub

Example

# EC2VPNConcentrator — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2vpnconcentrator
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VPNConcentrator
metadata:
  name: example-ec2vpnconcentrator
  namespace: default
spec:
  providerRef:
    name: example-ec2vpnconcentrator
    region: us-east-1
  tags:
  - key: example
    value: example
  transitGatewayId: example-id
  type: example

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Any tags assigned to the VPN concentrator.
`tags[].key`	string	yes
`tags[].value`	string	yes
`transitGatewayId`	string	yes	The ID of the transit gateway associated with the VPN concentrator.
`type`	string	yes	The type of VPN concentrator.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`transitGatewayAttachmentId`	string	—	Read-only: reported by AWS after creation.
`vpnConcentratorId`	string	—	Read-only: reported by AWS after creation.

EC2VerifiedAccessEndpoint # CLOUD CONTROL · AWS::EC2::VerifiedAccessEndpoint

EC2VerifiedAccessEndpoint manages AWS::EC2::VerifiedAccessEndpoint through the AWS Cloud Control API.

kubectl get ec2verifiedaccessendpoints · example on GitHub

Example

# EC2VerifiedAccessEndpoint — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2verifiedaccessendpoint
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VerifiedAccessEndpoint
metadata:
  name: example-ec2verifiedaccessendpoint
  namespace: default
spec:
  applicationDomain: example
  attachmentType: example
  cidrOptions:
    cidr: 10.0.0.0/16
    portRanges:
    - fromPort: 1
      toPort: 1
    protocol: example
    subnetIds:
    - example
  description: Managed by konfig-konector
  domainCertificateArn: arn:aws:iam::123456789012:role/example-role
  endpointDomainPrefix: example
  endpointType: example
  loadBalancerOptions:
    loadBalancerArn: arn:aws:iam::123456789012:role/example-role
    port: 1
    portRanges:
    - fromPort: 1
      toPort: 1
    protocol: example
    subnetIds:
    - example
  networkInterfaceOptions:
    port: 1
    portRanges:
    - fromPort: 1
      toPort: 1
    protocol: example
  policyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
    "Resource": "*"}]}'
  policyEnabled: true
  providerRef:
    name: example-ec2verifiedaccessendpoint
    region: us-east-1
  rdsOptions:
    port: 1
    protocol: example
    rdsDbClusterArn: arn:aws:iam::123456789012:role/example-role
    rdsDbInstanceArn: arn:aws:iam::123456789012:role/example-role
    rdsDbProxyArn: arn:aws:iam::123456789012:role/example-role
    rdsEndpoint: example
    subnetIds:
    - example
  securityGroupIds:
  - example
  sseSpecification:
    customerManagedKeyEnabled: true
    kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  tags:
  - key: example
    value: example
  verifiedAccessGroupId: example-id

Spec

Field	Type	Required	Description
`applicationDomain`	string	—	The DNS name for users to reach your application.
`attachmentType`	string	yes	The type of attachment used to provide connectivity between the AWS Verified Access endpoint and the application.
`cidrOptions`	object	—	The options for cidr type endpoint.
`cidrOptions.cidr`	string	—	The IP address range, in CIDR notation.
`cidrOptions.portRanges`	array<object>	—	The list of port range.
`cidrOptions.portRanges[].fromPort`	integer	—	The first port in the range.
`cidrOptions.portRanges[].toPort`	integer	—	The last port in the range.
`cidrOptions.protocol`	string	—	The IP protocol.
`cidrOptions.subnetIds`	array<string>	—	The IDs of the subnets.
`description`	string	—	A description for the AWS Verified Access endpoint.
`domainCertificateArn`	string	—	The ARN of a public TLS/SSL certificate imported into or created with ACM.
`endpointDomainPrefix`	string	—	A custom identifier that gets prepended to a DNS name that is generated for the endpoint.
`endpointType`	string	yes	The type of AWS Verified Access endpoint.
`loadBalancerOptions`	object	—	The load balancer details if creating the AWS Verified Access endpoint as load-balancer type.
`loadBalancerOptions.loadBalancerArn`	string	—	The ARN of the load balancer.
`loadBalancerOptions.port`	integer	—	The IP port number.
`loadBalancerOptions.portRanges`	array<object>	—	The list of port range.
`loadBalancerOptions.portRanges[].fromPort`	integer	—	The first port in the range.
`loadBalancerOptions.portRanges[].toPort`	integer	—	The last port in the range.
`loadBalancerOptions.protocol`	string	—	The IP protocol.
`loadBalancerOptions.subnetIds`	array<string>	—	The IDs of the subnets.
`networkInterfaceOptions`	object	—	The options for network-interface type endpoint.
`networkInterfaceOptions.networkInterfaceId`	string	—	The ID of the network interface.
`networkInterfaceOptions.port`	integer	—	The IP port number.
`networkInterfaceOptions.portRanges`	array<object>	—	The list of port ranges.
`networkInterfaceOptions.portRanges[].fromPort`	integer	—	The first port in the range.
`networkInterfaceOptions.portRanges[].toPort`	integer	—	The last port in the range.
`networkInterfaceOptions.protocol`	string	—	The IP protocol.
`policyDocument`	string	—	The AWS Verified Access policy document.
`policyEnabled`	boolean	—	The status of the Verified Access policy.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`rdsOptions`	object	—	The options for rds type endpoint.
`rdsOptions.port`	integer	—	The IP port number.
`rdsOptions.protocol`	string	—	The IP protocol.
`rdsOptions.rdsDbClusterArn`	string	—	The ARN of the RDS DB cluster.
`rdsOptions.rdsDbInstanceArn`	string	—	The ARN of the RDS DB instance.
`rdsOptions.rdsDbProxyArn`	string	—	The ARN of the RDS DB proxy.
`rdsOptions.rdsEndpoint`	string	—	The RDS endpoint.
`rdsOptions.subnetIds`	array<string>	—	The IDs of the subnets.
`securityGroupIds`	array<string>	—	The IDs of the security groups for the endpoint.
`sseSpecification`	object	—	The configuration options for customer provided KMS encryption.
`sseSpecification.customerManagedKeyEnabled`	boolean	—	Whether to encrypt the policy with the provided key or disable encryption
`sseSpecification.kmsKeyArn`	string	—	KMS Key Arn used to encrypt the group policy
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes
`verifiedAccessGroupId`	string	yes	The ID of the AWS Verified Access group.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	The creation time.
`deviceValidationDomain`	string	—	Returned if endpoint has a device trust provider attached.
`endpointDomain`	string	—	A DNS name that is generated for the endpoint.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedTime`	string	—	The last updated time.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	string	—	The endpoint status.
`verifiedAccessEndpointId`	string	—	The ID of the AWS Verified Access endpoint.
`verifiedAccessInstanceId`	string	—	The ID of the AWS Verified Access instance.

EC2VerifiedAccessGroup # CLOUD CONTROL · AWS::EC2::VerifiedAccessGroup

EC2VerifiedAccessGroup manages AWS::EC2::VerifiedAccessGroup through the AWS Cloud Control API.

kubectl get ec2verifiedaccessgroups · example on GitHub

Example

# EC2VerifiedAccessGroup — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2verifiedaccessgroup
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VerifiedAccessGroup
metadata:
  name: example-ec2verifiedaccessgroup
  namespace: default
spec:
  description: Managed by konfig-konector
  policyDocument: '{"Version": "2012-10-17", "Statement": [{"Effect": "Allow", "Action": ["s3:GetObject"],
    "Resource": "*"}]}'
  policyEnabled: true
  providerRef:
    name: example-ec2verifiedaccessgroup
    region: us-east-1
  sseSpecification:
    customerManagedKeyEnabled: true
    kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  tags:
  - key: example
    value: example
  verifiedAccessInstanceId: i-0abc1234def567890

Spec

Field	Type	Required	Description
`description`	string	—	A description for the AWS Verified Access group.
`policyDocument`	string	—	The AWS Verified Access policy document.
`policyEnabled`	boolean	—	The status of the Verified Access policy.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`sseSpecification`	object	—	The configuration options for customer provided KMS encryption.
`sseSpecification.customerManagedKeyEnabled`	boolean	—	Whether to encrypt the policy with the provided key or disable encryption
`sseSpecification.kmsKeyArn`	string	—	KMS Key Arn used to encrypt the group policy
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes
`verifiedAccessInstanceId`	string	yes	The ID of the AWS Verified Access instance.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	Time this Verified Access Group was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedTime`	string	—	Time this Verified Access Group was last updated.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`owner`	string	—	The AWS account number that owns the group.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`verifiedAccessGroupArn`	string	—	The ARN of the Verified Access group.
`verifiedAccessGroupId`	string	—	The ID of the AWS Verified Access group.

EC2VerifiedAccessInstance # CLOUD CONTROL · AWS::EC2::VerifiedAccessInstance

EC2VerifiedAccessInstance manages AWS::EC2::VerifiedAccessInstance through the AWS Cloud Control API.

kubectl get ec2verifiedaccessinstances · example on GitHub

Example

# EC2VerifiedAccessInstance — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2verifiedaccessinstance
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VerifiedAccessInstance
metadata:
  name: example-ec2verifiedaccessinstance
  namespace: default
spec:
  cidrEndpointsCustomSubDomain: 10.0.0.0/16
  description: Managed by konfig-konector
  fipsEnabled: true
  loggingConfigurations:
    cloudWatchLogs:
      enabled: true
      logGroup: example
    includeTrustContext: false
    kinesisDataFirehose:
      deliveryStream: example
      enabled: true
    logVersion: '1.0'
    s3:
      bucketName: example-ec2verifiedaccessinstance
      bucketOwner: example
      enabled: true
      prefix: example
  providerRef:
    name: example-ec2verifiedaccessinstance
    region: us-east-1
  tags:
  - key: example
    value: example
  verifiedAccessTrustProviderIds:
  - example
  verifiedAccessTrustProviders:
  - description: Managed by konfig-konector
    deviceTrustProviderType: example
    trustProviderType: example
    userTrustProviderType: example

Spec

Field	Type	Required	Description
`cidrEndpointsCustomSubDomain`	string	—	Introduce CidrEndpointsCustomSubDomain property to represent the domain (say, ava.my-company.com)
`description`	string	—	A description for the AWS Verified Access instance.
`fipsEnabled`	boolean	—	Indicates whether FIPS is enabled
`loggingConfigurations`	object	—	The configuration options for AWS Verified Access instances.
`loggingConfigurations.cloudWatchLogs`	object	—	Sends Verified Access logs to CloudWatch Logs.
`loggingConfigurations.cloudWatchLogs.enabled`	boolean	—	Indicates whether logging is enabled.
`loggingConfigurations.cloudWatchLogs.logGroup`	string	—	The ID of the CloudWatch Logs log group.
`loggingConfigurations.includeTrustContext`	boolean	—	Include claims from trust providers in Verified Access logs.
`loggingConfigurations.kinesisDataFirehose`	object	—	Sends Verified Access logs to Kinesis.
`loggingConfigurations.kinesisDataFirehose.deliveryStream`	string	—	The ID of the delivery stream.
`loggingConfigurations.kinesisDataFirehose.enabled`	boolean	—	Indicates whether logging is enabled.
`loggingConfigurations.logVersion`	string	—	Select log version for Verified Access logs.
`loggingConfigurations.s3`	object	—	Sends Verified Access logs to Amazon S3.
`loggingConfigurations.s3.bucketName`	string	—	The bucket name.
`loggingConfigurations.s3.bucketOwner`	string	—	The ID of the AWS account that owns the Amazon S3 bucket.
`loggingConfigurations.s3.enabled`	boolean	—	Indicates whether logging is enabled.
`loggingConfigurations.s3.prefix`	string	—	The bucket prefix.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes
`verifiedAccessTrustProviderIds`	array<string>	—	The IDs of the AWS Verified Access trust providers.
`verifiedAccessTrustProviders`	array<object>	—	AWS Verified Access trust providers.
`verifiedAccessTrustProviders[].description`	string	—	The description of trust provider.
`verifiedAccessTrustProviders[].deviceTrustProviderType`	string	—	The type of device-based trust provider.
`verifiedAccessTrustProviders[].trustProviderType`	string	—	The type of trust provider (user- or device-based).
`verifiedAccessTrustProviders[].userTrustProviderType`	string	—	The type of user-based trust provider.
`verifiedAccessTrustProviders[].verifiedAccessTrustProviderId`	string	—	The ID of the trust provider.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`cidrEndpointsCustomSubDomainNameServers`	array<string>	—	Property to represent the name servers assoicated with the domain that AVA manages (say, ['ns1.amazonaws.com', 'ns2.amazonaws.com', 'ns3.amazonaws.com', 'ns4.amazonaws.com']).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	Time this Verified Access Instance was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedTime`	string	—	Time this Verified Access Instance was last updated.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`verifiedAccessInstanceId`	string	—	The ID of the AWS Verified Access instance.

EC2VerifiedAccessTrustProvider # CLOUD CONTROL · AWS::EC2::VerifiedAccessTrustProvider

EC2VerifiedAccessTrustProvider manages AWS::EC2::VerifiedAccessTrustProvider through the AWS Cloud Control API.

kubectl get ec2verifiedaccesstrustproviders · example on GitHub

Example

# EC2VerifiedAccessTrustProvider — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2verifiedaccesstrustprovider
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VerifiedAccessTrustProvider
metadata:
  name: example-ec2verifiedaccesstrustprovider
  namespace: default
spec:
  description: Managed by konfig-konector
  deviceOptions:
    publicSigningKeyUrl: example
  deviceTrustProviderType: example
  nativeApplicationOidcOptions:
    authorizationEndpoint: example
    clientSecret: example
    issuer: example
    publicSigningKeyEndpoint: example
    scope: example
    tokenEndpoint: example
    userInfoEndpoint: example
  oidcOptions:
    authorizationEndpoint: example
    clientSecret: example
    issuer: example
    scope: example
    tokenEndpoint: example
    userInfoEndpoint: example
  policyReferenceName: example-ec2verifiedaccesstrustprovider
  providerRef:
    name: example-ec2verifiedaccesstrustprovider
    region: us-east-1
  sseSpecification:
    customerManagedKeyEnabled: true
    kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  tags:
  - key: example
    value: example
  trustProviderType: example
  userTrustProviderType: example

Spec

Field	Type	Required	Description
`description`	string	—	A description for the Amazon Web Services Verified Access trust provider.
`deviceOptions`	object	—	Create-only in AWS: changing it requires replacing the resource.
`deviceOptions.publicSigningKeyUrl`	string	—	URL Verified Access will use to verify authenticity of the device tokens.
`deviceOptions.tenantId`	string	—	The ID of the tenant application with the device-identity provider.
`deviceTrustProviderType`	string	—	The type of device-based trust provider.
`nativeApplicationOidcOptions`	object	—	EC2VerifiedAccessTrustProviderNativeApplicationOidcOptions is a nested property type of AWS::EC2::VerifiedAccessTrustProvider.
`nativeApplicationOidcOptions.authorizationEndpoint`	string	—	The OIDC authorization endpoint.
`nativeApplicationOidcOptions.clientId`	string	—	The client identifier.
`nativeApplicationOidcOptions.clientSecret`	string	—	The client secret.
`nativeApplicationOidcOptions.issuer`	string	—	The OIDC issuer.
`nativeApplicationOidcOptions.publicSigningKeyEndpoint`	string	—	The public signing key for endpoint
`nativeApplicationOidcOptions.scope`	string	—	OpenID Connect (OIDC) scopes are used by an application during authentication to authorize access to details of a user.
`nativeApplicationOidcOptions.tokenEndpoint`	string	—	The OIDC token endpoint.
`nativeApplicationOidcOptions.userInfoEndpoint`	string	—	The OIDC user info endpoint.
`oidcOptions`	object	—	EC2VerifiedAccessTrustProviderOidcOptions is a nested property type of AWS::EC2::VerifiedAccessTrustProvider.
`oidcOptions.authorizationEndpoint`	string	—	The OIDC authorization endpoint.
`oidcOptions.clientId`	string	—	The client identifier.
`oidcOptions.clientSecret`	string	—	The client secret.
`oidcOptions.issuer`	string	—	The OIDC issuer.
`oidcOptions.scope`	string	—	OpenID Connect (OIDC) scopes are used by an application during authentication to authorize access to details of a user.
`oidcOptions.tokenEndpoint`	string	—	The OIDC token endpoint.
`oidcOptions.userInfoEndpoint`	string	—	The OIDC user info endpoint.
`policyReferenceName`	string	yes	The identifier to be used when working with policy rules.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`sseSpecification`	object	—	The configuration options for customer provided KMS encryption.
`sseSpecification.customerManagedKeyEnabled`	boolean	—	Whether to encrypt the policy with the provided key or disable encryption
`sseSpecification.kmsKeyArn`	string	—	KMS Key Arn used to encrypt the group policy
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes
`trustProviderType`	string	yes	Type of trust provider.
`userTrustProviderType`	string	—	The type of device-based trust provider.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	string	—	The creation time.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedTime`	string	—	The last updated time.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`verifiedAccessTrustProviderId`	string	—	The ID of the Amazon Web Services Verified Access trust provider.

EC2VolumeAttachment # CLOUD CONTROL · AWS::EC2::VolumeAttachment

EC2VolumeAttachment manages AWS::EC2::VolumeAttachment through the AWS Cloud Control API.

kubectl get ec2volumeattachments · example on GitHub

Example

# EC2VolumeAttachment — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#ec2volumeattachment
apiVersion: aws.konfig.io/v1alpha1
kind: EC2VolumeAttachment
metadata:
  name: example-ec2volumeattachment
  namespace: default
spec:
  device: example
  ebsCardIndex: 1
  instanceId: i-0abc1234def567890
  providerRef:
    name: example-ec2volumeattachment
    region: us-east-1
  volumeId: example-id

Spec

Field	Type	Required	Description
`device`	string	—	The device name (for example, ``/dev/sdh`` or ``xvdh``).
`ebsCardIndex`	integer	—	The index of the EBS card.
`instanceId`	string	yes	The ID of the instance to which the volume attaches.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`volumeId`	string	yes	The ID of the Amazon EBS volume.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

EIPAssociation # GA

EIPAssociation is the Schema for managing EC2 Elastic IP associations.

kubectl get eipassociations · example on GitHub

Example

# EIPAssociation — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#eipassociation
apiVersion: aws.konfig.io/v1alpha1
kind: EIPAssociation
metadata:
  name: example-eipassociation
  namespace: default
spec:
  allowReassociation: false
  elasticIpRef:
    name: example-eipassociation
  instanceRef:
    name: example-instance
  privateIpAddress: example
  providerRef:
    name: example-eipassociation
    region: us-east-1

Spec

Field	Type	Required	Description
`allowReassociation`	boolean	—	AllowReassociation allows the EIP to be reassociated if already associated.
`elasticIpRef`	object	yes	ElasticIPRef references the ElasticIP to associate.
`elasticIpRef.allocationId`	string	—	AllocationID is a direct AWS EIP allocation ID (e.g.
`elasticIpRef.name`	string	—	Name of an ElasticIP CR in the same namespace.
`instanceId`	string	—	InstanceID is a direct EC2 instance ID.
`instanceRef`	object	—	InstanceRef references the EC2 instance to associate with.
`instanceRef.name`	string	—	Name of the resource in the same namespace.
`instanceRef.namespace`	string	—	Namespace of the resource.
`networkInterfaceId`	string	—	NetworkInterfaceID is the network interface ID to associate the EIP with.
`privateIpAddress`	string	—	PrivateIPAddress is the private IP address to associate the EIP with.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`associationId`	string	—	AssociationID is the AWS association ID.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

EgressOnlyIGW # GA

EgressOnlyIGW is the Schema for managing Egress-Only Internet Gateways.

kubectl get egressonlyigws · example on GitHub

Example

# EgressOnlyIGW — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#egressonlyigw
apiVersion: aws.konfig.io/v1alpha1
kind: EgressOnlyIGW
metadata:
  name: example-egressonlyigw
  namespace: default
spec:
  providerRef:
    name: example-egressonlyigw
    region: us-east-1
  tags:
    environment: dev
    team: platform
  vpcRef:
    name: example-vpc

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`vpcRef`	object	yes	VPCRef is the VPC to attach the egress-only IGW to.
`vpcRef.id`	string	—	ID is a direct AWS VPC ID (e.g.
`vpcRef.name`	string	—	Name of a VPC CR in the same namespace.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`egressOnlyIgwId`	string	—	EgressOnlyIGWID is the ID of the egress-only internet gateway.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

ElasticIP # GA

ElasticIP is the Schema for managing AWS Elastic IP addresses.

kubectl get elasticips · example on GitHub

Example

# ElasticIP — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#elasticip
apiVersion: aws.konfig.io/v1alpha1
kind: ElasticIP
metadata:
  name: example-elasticip
  namespace: default
spec:
  domain: vpc
  providerRef:
    name: example-elasticip
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`domain`	enum	—	Domain is the domain for the Elastic IP. Allowed: `vpc`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`allocationId`	string	—	AllocationID is the AWS allocation ID of the Elastic IP.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`publicIp`	string	—	PublicIP is the public IP address.

FlowLog # GA

FlowLog is the Schema for managing VPC Flow Logs.

kubectl get flowlogs · example on GitHub

Example

# FlowLog — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#flowlog
apiVersion: aws.konfig.io/v1alpha1
kind: FlowLog
metadata:
  name: example-flowlog
  namespace: default
spec:
  deliverLogsPermissionArn: arn:aws:iam::123456789012:role/example-role
  logDestination: example
  logDestinationType: cloud-watch-logs
  logFormat: example
  logGroupName: example-flowlog
  maxAggregationInterval: 1
  providerRef:
    name: example-flowlog
    region: us-east-1
  resourceId: example-id
  resourceType: VPC
  tags:
    environment: dev
    team: platform
  trafficType: ACCEPT

Spec

Field	Type	Required	Description
`deliverLogsPermissionArn`	string	—	DeliverLogsPermissionARN is the IAM role ARN for delivering logs to CloudWatch.
`logDestination`	string	—	LogDestination is the ARN of the destination (CloudWatch log group, S3 bucket, or Firehose).
`logDestinationType`	enum	—	LogDestinationType is the destination type for flow log data. Allowed: `cloud-watch-logs, s3, kinesis-data-firehose`
`logFormat`	string	—	LogFormat is a custom format string for flow log records.
`logGroupName`	string	—	LogGroupName is the CloudWatch log group name (used when LogDestinationType is cloud-watch-logs).
`maxAggregationInterval`	integer	—	MaxAggregationInterval is the maximum interval in seconds to aggregate records (60 or 600).
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceId`	string	yes	ResourceID is the ID of the VPC, subnet, or network interface to capture traffic for.
`resourceType`	enum	yes	ResourceType is the type of resource to log traffic for. Allowed: `VPC, Subnet, NetworkInterface`
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`trafficType`	enum	—	TrafficType specifies which traffic to capture. Allowed: `ACCEPT, REJECT, ALL`

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`flowLogId`	string	—	FlowLogID is the ID of the flow log.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

InternetGateway # GA

InternetGateway is the Schema for managing AWS Internet Gateways.

kubectl get internetgateways · example on GitHub

Example

# InternetGateway — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#internetgateway
apiVersion: aws.konfig.io/v1alpha1
kind: InternetGateway
metadata:
  name: example-internetgateway
  namespace: default
spec:
  providerRef:
    name: example-internetgateway
    region: us-east-1
  tags:
    environment: dev
    team: platform
  vpcRef:
    name: example-vpc

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`vpcRef`	object	yes	VPCRef references the VPC to attach this internet gateway to.
`vpcRef.id`	string	—	ID is a direct AWS VPC ID (e.g.
`vpcRef.name`	string	—	Name of a VPC CR in the same namespace.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`internetGatewayId`	string	—	InternetGatewayID is the AWS Internet Gateway identifier.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

KeyPair # GA

KeyPair is the Schema for managing EC2 Key Pairs.

kubectl get keypairs · example on GitHub

Example

# KeyPair — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#keypair
apiVersion: aws.konfig.io/v1alpha1
kind: KeyPair
metadata:
  name: example-keypair
  namespace: default
spec:
  keyName: example-keypair
  keyType: rsa
  providerRef:
    name: example-keypair
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`keyName`	string	yes	KeyName is the name of the key pair.
`keyType`	enum	—	KeyType is the cryptographic algorithm: rsa or ed25519. Allowed: `rsa, ed25519`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`keyPairId`	string	—	KeyPairID is the AWS Key Pair identifier.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

LaunchTemplate # GA

LaunchTemplate is the Schema for managing EC2 Launch Templates.

kubectl get launchtemplates · example on GitHub

Example

# LaunchTemplate — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#launchtemplate
apiVersion: aws.konfig.io/v1alpha1
kind: LaunchTemplate
metadata:
  name: example-launchtemplate
  namespace: default
spec:
  blockDeviceMappings:
  - deviceName: example-launchtemplate
    encrypted: true
    volumeSize: 2
    volumeType: example
  iamInstanceProfile: example
  imageId: ami-0abc1234def567890
  instanceType: example
  keyName: example-launchtemplate
  launchTemplateName: example-launchtemplate
  providerRef:
    name: example-launchtemplate
    region: us-east-1
  securityGroupRefs:
  - name: example-securitygrouprefs
  tags:
    environment: dev
    team: platform
  userData: example

Spec

Field	Type	Required	Description
`blockDeviceMappings`	array<object>	—	BlockDeviceMappings is the list of block device mappings.
`blockDeviceMappings[].deviceName`	string	yes	DeviceName is the device name (e.g.
`blockDeviceMappings[].encrypted`	boolean	—	Encrypted enables EBS encryption.
`blockDeviceMappings[].volumeSize`	integer	—	VolumeSize is the size of the EBS volume in GiB.
`blockDeviceMappings[].volumeType`	string	—	VolumeType is the EBS volume type (gp2, gp3, io1, etc.).
`iamInstanceProfile`	string	—	IAMInstanceProfile is the name or ARN of an IAM instance profile.
`imageId`	string	yes	ImageID is the AMI ID.
`instanceType`	string	—	InstanceType is the EC2 instance type (e.g.
`keyName`	string	—	KeyName is the name of the EC2 key pair.
`launchTemplateName`	string	yes	LaunchTemplateName is the name of the launch template.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`securityGroupRefs`	array<object>	—	SecurityGroupRefs is the list of security group references.
`securityGroupRefs[].id`	string	—	ID is a direct AWS Security Group ID (e.g.
`securityGroupRefs[].name`	string	—	Name of a SecurityGroup CR in the same namespace.
`tags`	map<string>	—	Tags are AWS resource tags to apply to the launch template resource.
`userData`	string	—	UserData is base64-encoded user data to pass to the instances.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`latestVersionNumber`	integer	—	LatestVersionNumber is the most recently created version number.
`launchTemplateId`	string	—	LaunchTemplateID is the AWS Launch Template identifier.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

ManagedPrefixList # GA

ManagedPrefixList is the Schema for managing EC2 managed prefix lists.

kubectl get managedprefixlists · example on GitHub

Example

# ManagedPrefixList — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#managedprefixlist
apiVersion: aws.konfig.io/v1alpha1
kind: ManagedPrefixList
metadata:
  name: example-managedprefixlist
  namespace: default
spec:
  addressFamily: IPv4
  entries:
  - cidr: 10.0.0.0/16
    description: Managed by konfig-konector
  maxEntries: 1
  name: example-managedprefixlist
  providerRef:
    name: example-managedprefixlist
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`addressFamily`	enum	yes	AddressFamily of the entries. Allowed: `IPv4, IPv6`
`entries`	array<object>	—	Entries are the CIDR entries of the prefix list.
`entries[].cidr`	string	yes	CIDR block for the entry.
`entries[].description`	string	—	Description of the entry.
`maxEntries`	integer	yes	MaxEntries is the maximum number of entries the prefix list can hold.
`name`	string	yes	Name of the prefix list.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the prefix list.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`prefixListId`	string	—	PrefixListID is the AWS prefix list identifier.
`state`	string	—	State is the lifecycle state reported by AWS.
`version`	integer	—	Version is the current version number of the prefix list.

NatGateway # GA

NatGateway is the Schema for managing AWS NAT Gateways.

kubectl get natgateways · example on GitHub

Example

# NatGateway — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#natgateway
apiVersion: aws.konfig.io/v1alpha1
kind: NatGateway
metadata:
  name: example-natgateway
  namespace: default
spec:
  connectivityType: public
  providerRef:
    name: example-natgateway
    region: us-east-1
  subnetRef:
    name: example-subnet
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`connectivityType`	enum	—	ConnectivityType is "public" or "private". Allowed: `public, private`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`subnetRef`	object	yes	SubnetRef references the subnet in which to create the NAT gateway.
`subnetRef.id`	string	—	ID is a direct AWS Subnet ID (e.g.
`subnetRef.name`	string	—	Name of a Subnet CR in the same namespace.
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`elasticIpAllocationId`	string	—	ElasticIPAllocationID is the allocation ID of the Elastic IP (public NAT only).
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`natGatewayId`	string	—	NatGatewayID is the AWS NAT Gateway identifier.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the current NAT Gateway state (pending \| available \| deleting \| deleted).

NetworkACL # GA

NetworkACL is the Schema for managing EC2 Network ACLs.

kubectl get networkacls · example on GitHub

Example

# NetworkACL — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#networkacl
apiVersion: aws.konfig.io/v1alpha1
kind: NetworkACL
metadata:
  name: example-networkacl
  namespace: default
spec:
  entries:
  - cidrBlock: 10.0.0.0/16
    egress: false
    icmpTypeCode:
      code: 1
      type: 1
    ipv6CidrBlock: 2001:db8::/56
    portRange:
      from: 1
      to: 1
    protocol: example
    ruleAction: allow
    ruleNumber: 1
  providerRef:
    name: example-networkacl
    region: us-east-1
  tags:
    environment: dev
    team: platform
  vpcRef:
    name: example-vpc

Spec

Field	Type	Required	Description
`entries`	array<object>	—	Entries are the NACL rules.
`entries[].cidrBlock`	string	—	CIDRBlock is the IPv4 CIDR range.
`entries[].egress`	boolean	yes	Egress indicates whether this is an egress rule (true) or ingress rule (false).
`entries[].icmpTypeCode`	object	—	ICMPTypeCode defines ICMP type and code.
`entries[].icmpTypeCode.code`	integer	yes	Code is the ICMP code (-1 for all).
`entries[].icmpTypeCode.type`	integer	yes	Type is the ICMP type (-1 for all).
`entries[].ipv6CidrBlock`	string	—	IPv6CIDRBlock is the IPv6 CIDR range.
`entries[].portRange`	object	—	PortRange defines the allowed port range.
`entries[].portRange.from`	integer	yes	From is the start of the port range.
`entries[].portRange.to`	integer	yes	To is the end of the port range.
`entries[].protocol`	string	yes	Protocol is the IP protocol number (-1 for all, 6 for TCP, 17 for UDP, 1 for ICMP).
`entries[].ruleAction`	enum	yes	RuleAction is "allow" or "deny". Allowed: `allow, deny`
`entries[].ruleNumber`	integer	yes	RuleNumber is the rule priority (1-32766).
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`vpcRef`	object	yes	VPCRef references the VPC in which to create the NACL.
`vpcRef.id`	string	—	ID is a direct AWS VPC ID (e.g.
`vpcRef.name`	string	—	Name of a VPC CR in the same namespace.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`networkAclId`	string	—	NetworkACLID is the AWS NACL ID.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

PlacementGroup # GA

PlacementGroup is the Schema for managing EC2 Placement Groups.

kubectl get placementgroups · example on GitHub

Example

# PlacementGroup — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#placementgroup
apiVersion: aws.konfig.io/v1alpha1
kind: PlacementGroup
metadata:
  name: example-placementgroup
  namespace: default
spec:
  groupName: example-placementgroup
  partitionCount: 1
  providerRef:
    name: example-placementgroup
    region: us-east-1
  spreadLevel: host
  strategy: cluster
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`groupName`	string	yes	GroupName is the name of the placement group.
`partitionCount`	integer	—	PartitionCount is the number of partitions (for partition strategy only).
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`spreadLevel`	enum	—	SpreadLevel is the spread level (for spread strategy). Allowed: `host, rack`
`strategy`	enum	yes	Strategy is the placement strategy. Allowed: `cluster, partition, spread`
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`groupId`	string	—	GroupID is the AWS placement group ID.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the current state of the placement group.

RouteTable # GA

RouteTable is the Schema for managing AWS Route Tables.

kubectl get routetables · example on GitHub

Example

# RouteTable — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#routetable
apiVersion: aws.konfig.io/v1alpha1
kind: RouteTable
metadata:
  name: example-routetable
  namespace: default
spec:
  providerRef:
    name: example-routetable
    region: us-east-1
  routes:
  - destinationCidr: 10.0.0.0/16
    natGatewayRef: example
  subnetAssociations:
  - example
  tags:
    environment: dev
    team: platform
  vpcRef:
    name: example-vpc

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`routes`	array<object>	—	Routes is the list of routes to manage in this table.
`routes[].destinationCidr`	string	yes	DestinationCIDR is the destination CIDR block (e.g.
`routes[].gatewayId`	string	—	GatewayID is a direct gateway ID (e.g.
`routes[].natGatewayRef`	string	—	NatGatewayRef is the name of a NatGateway CR in the same namespace.
`subnetAssociations`	array<string>	—	SubnetAssociations is a list of Subnet CR names (same namespace) to associate.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`vpcRef`	object	yes	VPCRef references the VPC this route table belongs to.
`vpcRef.id`	string	—	ID is a direct AWS VPC ID (e.g.
`vpcRef.name`	string	—	Name of a VPC CR in the same namespace.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`routeTableId`	string	—	RouteTableID is the AWS Route Table identifier.

SecurityGroup # GA

SecurityGroup is the Schema for managing AWS Security Groups.

kubectl get securitygroups · example on GitHub

Example

# SecurityGroup — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#securitygroup
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityGroup
metadata:
  name: example-securitygroup
  namespace: default
spec:
  description: Managed by konfig-konector
  egressRules:
  - cidrIpv4: 10.0.0.0/16
    cidrIpv6: 10.0.0.0/16
    description: Managed by konfig-konector
    fromPort: 443
    protocol: example
    sourceGroupRef: example
    toPort: 443
  groupName: example-securitygroup
  ingressRules:
  - cidrIpv4: 10.0.0.0/16
    cidrIpv6: 10.0.0.0/16
    description: Managed by konfig-konector
    fromPort: 443
    protocol: example
    sourceGroupRef: example
    toPort: 443
  providerRef:
    name: example-securitygroup
    region: us-east-1
  tags:
    environment: dev
    team: platform
  vpcRef:
    name: example-vpc

Spec

Field	Type	Required	Description
`description`	string	yes	Description is the description for the security group.
`egressRules`	array<object>	—	EgressRules defines the allowed outbound traffic.
`egressRules[].cidrIpv4`	string	—	CIDRIPv4 is the source/destination IPv4 CIDR range.
`egressRules[].cidrIpv6`	string	—	CIDRIPv6 is the source/destination IPv6 CIDR range.
`egressRules[].description`	string	—	Description is a description for the rule.
`egressRules[].fromPort`	integer	—	FromPort is the start of the port range.
`egressRules[].prefixListId`	string	—	PrefixListID is the ID of a managed prefix list to use as source/destination.
`egressRules[].protocol`	string	yes	Protocol is the IP protocol (tcp, udp, icmp, or -1 for all).
`egressRules[].sourceGroupRef`	string	—	SourceGroupRef is the name of a SecurityGroup CR in the same namespace to use as the source/destination (instead of a CIDR).
`egressRules[].toPort`	integer	—	ToPort is the end of the port range.
`groupName`	string	yes	GroupName is the name of the security group.
`ingressRules`	array<object>	—	IngressRules defines the allowed inbound traffic.
`ingressRules[].cidrIpv4`	string	—	CIDRIPv4 is the source/destination IPv4 CIDR range.
`ingressRules[].cidrIpv6`	string	—	CIDRIPv6 is the source/destination IPv6 CIDR range.
`ingressRules[].description`	string	—	Description is a description for the rule.
`ingressRules[].fromPort`	integer	—	FromPort is the start of the port range.
`ingressRules[].prefixListId`	string	—	PrefixListID is the ID of a managed prefix list to use as source/destination.
`ingressRules[].protocol`	string	yes	Protocol is the IP protocol (tcp, udp, icmp, or -1 for all).
`ingressRules[].sourceGroupRef`	string	—	SourceGroupRef is the name of a SecurityGroup CR in the same namespace to use as the source/destination (instead of a CIDR).
`ingressRules[].toPort`	integer	—	ToPort is the end of the port range.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`vpcRef`	object	yes	VPCRef references the VPC this security group belongs to.
`vpcRef.id`	string	—	ID is a direct AWS VPC ID (e.g.
`vpcRef.name`	string	—	Name of a VPC CR in the same namespace.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`groupId`	string	—	GroupID is the AWS Security Group identifier.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.

SpotFleet # GA

SpotFleet is the Schema for managing EC2 Spot Fleet requests.

kubectl get spotfleets · example on GitHub

Example

# SpotFleet — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#spotfleet
apiVersion: aws.konfig.io/v1alpha1
kind: SpotFleet
metadata:
  name: example-spotfleet
  namespace: default
spec:
  allocationStrategy: lowestPrice
  iamFleetRole: example
  launchSpecs:
  - imageId: ami-0abc1234def567890
    instanceType: example
    keyName: example-spotfleet
    securityGroupIds:
    - example
    spotPrice: example
    weightedCapacity: 2
  providerRef:
    name: example-spotfleet
    region: us-east-1
  spotPrice: example
  tags:
    environment: dev
    team: platform
  targetCapacity: 1
  terminateInstancesWithExpiration: false
  validUntil: '2026-01-01T00:00:00Z'

Spec

Field	Type	Required	Description
`allocationStrategy`	enum	—	AllocationStrategy controls how Spot Fleet selects instances. Allowed: `lowestPrice, diversified, capacityOptimized, priceCapacityOptimized`
`iamFleetRole`	string	yes	IAMFleetRole is the ARN of the IAM role for the Spot Fleet.
`launchSpecs`	array<object>	yes	LaunchSpecs defines the launch specifications.
`launchSpecs[].imageId`	string	yes	ImageID is the AMI ID for instances in this spec.
`launchSpecs[].instanceType`	string	yes	InstanceType is the EC2 instance type.
`launchSpecs[].keyName`	string	—	KeyName is the EC2 key pair name.
`launchSpecs[].securityGroupIds`	array<string>	—	SecurityGroupIDs are the security groups to attach.
`launchSpecs[].spotPrice`	string	—	SpotPrice is the maximum spot price for this spec.
`launchSpecs[].subnetId`	string	—	SubnetID is the subnet to launch instances in.
`launchSpecs[].weightedCapacity`	number	—	WeightedCapacity is the number of capacity units this spec provides.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`spotPrice`	string	—	SpotPrice is the global maximum spot price bid.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`targetCapacity`	integer	yes	TargetCapacity is the number of units to request.
`terminateInstancesWithExpiration`	boolean	—	TerminateInstancesWithExpiration terminates all instances when the request expires.
`validUntil`	string	—	ValidUntil is an optional expiry time for the request (RFC3339).

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`requestState`	string	—	RequestState is the current state of the Spot Fleet request.
`spotFleetRequestId`	string	—	SpotFleetRequestID is the ID of the Spot Fleet request.

Subnet # GA

Subnet is the Schema for managing AWS Subnets.

kubectl get subnets · example on GitHub

Example

# Subnet — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#subnet
apiVersion: aws.konfig.io/v1alpha1
kind: Subnet
metadata:
  name: example-subnet
  namespace: default
spec:
  availabilityZone: us-east-1a
  cidrBlock: 10.0.0.0/16
  mapPublicIpOnLaunch: false
  providerRef:
    name: example-subnet
    region: us-east-1
  tags:
    environment: dev
    team: platform
  vpcRef:
    name: example-vpc

Spec

Field	Type	Required	Description
`availabilityZone`	string	—	AvailabilityZone is the AZ in which to create the subnet (e.g.
`cidrBlock`	string	yes	CIDRBlock is the IPv4 CIDR for the subnet (e.g.
`mapPublicIpOnLaunch`	boolean	—	MapPublicIPOnLaunch automatically assigns a public IP to instances launched in this subnet.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`vpcRef`	object	yes	VPCRef references the VPC this subnet belongs to.
`vpcRef.id`	string	—	ID is a direct AWS VPC ID (e.g.
`vpcRef.name`	string	—	Name of a VPC CR in the same namespace.

Status

Field	Type	Required	Description
`availableIpAddressCount`	integer	—	AvailableIPAddressCount is the number of available IP addresses.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`subnetId`	string	—	SubnetID is the AWS Subnet identifier.

TransitGateway # GA

TransitGateway is the Schema for managing AWS Transit Gateways.

kubectl get transitgateways · example on GitHub

Example

# TransitGateway — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#transitgateway
apiVersion: aws.konfig.io/v1alpha1
kind: TransitGateway
metadata:
  name: example-transitgateway
  namespace: default
spec:
  amazonSideAsn: 64512
  autoAcceptSharedAttachments: false
  defaultRouteTableAssociation: false
  defaultRouteTablePropagation: false
  description: Managed by konfig-konector
  dnsSupport: false
  providerRef:
    name: example-transitgateway
    region: us-east-1
  tags:
    environment: dev
    team: platform
  vpnEcmpSupport: false

Spec

Field	Type	Required	Description
`amazonSideAsn`	integer	—	AmazonSideASN is the private ASN for the Amazon side of a BGP session.
`autoAcceptSharedAttachments`	boolean	—	AutoAcceptSharedAttachments enables automatic acceptance of cross-account attachments.
`defaultRouteTableAssociation`	boolean	—	DefaultRouteTableAssociation enables automatic association with the default route table.
`defaultRouteTablePropagation`	boolean	—	DefaultRouteTablePropagation enables automatic propagation to the default route table.
`description`	string	—	Description is a human-readable description for the transit gateway.
`dnsSupport`	boolean	—	DNSSupport enables DNS resolution for the transit gateway.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`vpnEcmpSupport`	boolean	—	VPNECMPSupport enables equal-cost multipath routing for VPN attachments.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the ARN of the transit gateway.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the current state of the transit gateway.
`transitGatewayId`	string	—	TransitGatewayID is the AWS Transit Gateway ID.

TransitGatewayVpcAttachment # GA WIP · CROSS-ACCOUNT

STATUS: WIP.

kubectl get transitgatewayvpcattachments · example on GitHub

Example

# TransitGatewayVpcAttachment — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#transitgatewayvpcattachment
apiVersion: aws.konfig.io/v1alpha1
kind: TransitGatewayVpcAttachment
metadata:
  name: example-transitgatewayvpcattachment
  namespace: default
spec:
  accepterProviderRef:
    name: example-transitgatewayvpcattachment
    region: us-east-1
  applianceModeSupport: false
  dnsSupport: false
  ipv6Support: false
  providerRef:
    name: example-transitgatewayvpcattachment
    region: us-east-1
  subnetRefs:
  - name: example-subnetrefs
  tags:
    environment: dev
    team: platform
  transitGatewayRef:
    name: example-transitgatewayvpcattachment
  vpcRef:
    name: example-vpc

Spec

Field	Type	Required	Description
`accepterProviderRef`	object	—	AccepterProviderRef names the AWSProvider of the account that owns the Transit Gateway when it is shared into this account via RAM.
`accepterProviderRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`accepterProviderRef.region`	string	—	Region overrides the provider's region for this resource only.
`applianceModeSupport`	boolean	—	ApplianceModeSupport enables appliance mode for the attachment.
`dnsSupport`	boolean	—	DNSSupport enables DNS resolution for the attachment.
`ipv6Support`	boolean	—	IPv6Support enables IPv6 for the attachment.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`subnetRefs`	array<object>	yes	SubnetRefs are the subnets in each availability zone to attach.
`subnetRefs[].id`	string	—	ID is a direct AWS Subnet ID (e.g.
`subnetRefs[].name`	string	—	Name of a Subnet CR in the same namespace.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`transitGatewayRef`	object	yes	TransitGatewayRef references the Transit Gateway to attach to.
`transitGatewayRef.name`	string	—	Name of a TransitGateway CR in the same namespace.
`transitGatewayRef.transitGatewayId`	string	—	TransitGatewayID is a direct AWS Transit Gateway ID.
`vpcRef`	object	yes	VPCRef references the VPC to attach.
`vpcRef.id`	string	—	ID is a direct AWS VPC ID (e.g.
`vpcRef.name`	string	—	Name of a VPC CR in the same namespace.

Status

Field	Type	Required	Description
`attachmentId`	string	—	AttachmentID is the AWS TGW VPC attachment ID.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the current state of the attachment.

VPC # GA

VPC is the Schema for managing AWS VPCs.

kubectl get vpcs · example on GitHub

Example

# VPC — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#vpc
apiVersion: aws.konfig.io/v1alpha1
kind: VPC
metadata:
  name: example-vpc
  namespace: default
spec:
  assignIpv6CidrBlock: false
  cidrBlock: 10.0.0.0/16
  enableDnsHostnames: true
  enableDnsSupport: true
  instanceTenancy: default
  providerRef:
    name: example-vpc
    region: us-east-1
  secondaryIPv4CIDRs:
  - 10.0.0.0/16
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`assignIpv6CidrBlock`	boolean	—	AssignIpv6CidrBlock requests an Amazon-provided IPv6 CIDR block for the VPC.
`cidrBlock`	string	yes	CIDRBlock is the IPv4 CIDR for the VPC (e.g.
`enableDnsHostnames`	boolean	—	EnableDNSHostnames enables DNS hostnames for instances in the VPC.
`enableDnsSupport`	boolean	—	EnableDNSSupport enables DNS resolution within the VPC.
`instanceTenancy`	enum	—	InstanceTenancy is the tenancy of instances launched into the VPC. Allowed: `default, dedicated, host`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`secondaryIPv4CIDRs`	array<string>	—	SecondaryIPv4CIDRs is a list of additional IPv4 CIDR blocks to associate with the VPC.
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`ipv6CidrBlock`	string	—	Ipv6CidrBlock is the Amazon-provided IPv6 CIDR block assigned to the VPC.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the current VPC state (pending \| available).
`vpcId`	string	—	VPCID is the AWS VPC identifier.

VPCEndpoint # GA

VPCEndpoint is the Schema for managing AWS VPC Endpoints.

kubectl get vpcendpoints · example on GitHub

Example

# VPCEndpoint — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#vpcendpoint
apiVersion: aws.konfig.io/v1alpha1
kind: VPCEndpoint
metadata:
  name: example-vpcendpoint
  namespace: default
spec:
  endpointType: Interface
  providerRef:
    name: example-vpcendpoint
    region: us-east-1
  routeTableRefs:
  - example
  securityGroupRefs:
  - name: example-securitygrouprefs
  serviceName: example-vpcendpoint
  subnetRefs:
  - name: example-subnetrefs
  tags:
    environment: dev
    team: platform
  vpcRef:
    name: example-vpc

Spec

Field	Type	Required	Description
`endpointType`	enum	yes	EndpointType is the type of endpoint: "Interface" or "Gateway". Allowed: `Interface, Gateway`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`routeTableRefs`	array<string>	—	RouteTableRefs is the list of RouteTable CR names (same namespace) for Gateway endpoints.
`securityGroupRefs`	array<object>	—	SecurityGroupRefs is the list of security group references for Interface endpoints.
`securityGroupRefs[].id`	string	—	ID is a direct AWS Security Group ID (e.g.
`securityGroupRefs[].name`	string	—	Name of a SecurityGroup CR in the same namespace.
`serviceName`	string	yes	ServiceName is the AWS service endpoint name (e.g.
`subnetRefs`	array<object>	—	SubnetRefs is the list of subnet references for Interface endpoints.
`subnetRefs[].id`	string	—	ID is a direct AWS Subnet ID (e.g.
`subnetRefs[].name`	string	—	Name of a Subnet CR in the same namespace.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`vpcRef`	object	yes	VPCRef references the VPC for this endpoint.
`vpcRef.id`	string	—	ID is a direct AWS VPC ID (e.g.
`vpcRef.name`	string	—	Name of a VPC CR in the same namespace.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`endpointId`	string	—	EndpointID is the AWS VPC Endpoint identifier.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the current endpoint state.

VPCEndpointService # GA WIP · CROSS-ACCOUNT

STATUS: WIP.

kubectl get vpcendpointservices · example on GitHub

Example

# VPCEndpointService — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#vpcendpointservice
apiVersion: aws.konfig.io/v1alpha1
kind: VPCEndpointService
metadata:
  name: example-vpcendpointservice
  namespace: default
spec:
  acceptanceRequired: false
  allowedPrincipals:
  - example
  autoAcceptConnections: false
  gatewayLoadBalancerArns:
  - example
  networkLoadBalancerRefs:
  - name: example-networkloadbalancerrefs
  privateDnsName: example-vpcendpointservice
  providerRef:
    name: example-vpcendpointservice
    region: us-east-1
  supportedIpAddressTypes:
  - example
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`acceptanceRequired`	boolean	—	AcceptanceRequired makes consumer connections wait for acceptance.
`allowedPrincipals`	array<string>	—	AllowedPrincipals are IAM ARNs (accounts, roles, users, "*") permitted to discover and connect to the service.
`autoAcceptConnections`	boolean	—	AutoAcceptConnections accepts every pendingAcceptance connection from an allowed principal on each reconcile.
`gatewayLoadBalancerArns`	array<string>	—	GatewayLoadBalancerArns front the service instead of NLBs.
`networkLoadBalancerRefs`	array<object>	—	NetworkLoadBalancerRefs front the service (LoadBalancer CRs or ARNs).
`networkLoadBalancerRefs[].arn`	string	—	ARN is a direct AWS load balancer ARN.
`networkLoadBalancerRefs[].name`	string	—	Name of a LoadBalancer CR in the same namespace.
`privateDnsName`	string	—	PrivateDNSName is an optional private DNS name for the service.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`supportedIpAddressTypes`	array<string>	—	SupportedIPAddressTypes: ipv4, ipv6.
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`availabilityZones`	array<string>	—	AvailabilityZones the service is reachable in.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`pendingConnections`	integer	—	PendingConnections counts consumer endpoints awaiting acceptance.
`privateDnsNameVerificationState`	string	—	PrivateDNSNameVerificationState for the private DNS name, if set.
`privateDnsVerificationRecord`	string	—	PrivateDNSVerificationRecord is the TXT record (name/value) proving DNS ownership.
`serviceId`	string	—	ServiceID is the endpoint service configuration ID (vpce-svc-...).
`serviceName`	string	—	ServiceName is what consumers put in VPCEndpoint.spec.serviceName.
`state`	string	—	State of the service configuration.

VPCPeeringConnection # GA WIP · CROSS-ACCOUNT

STATUS: WIP.

kubectl get vpcpeeringconnections · example on GitHub

Example

# VPCPeeringConnection — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#vpcpeeringconnection
apiVersion: aws.konfig.io/v1alpha1
kind: VPCPeeringConnection
metadata:
  name: example-vpcpeeringconnection
  namespace: default
spec:
  accepterProviderRef:
    name: example-vpcpeeringconnection
    region: us-east-1
  autoAccept: false
  peerRegion: example
  peerVpcId: vpc-0abc12def3456789
  providerRef:
    name: example-vpcpeeringconnection
    region: us-east-1
  tags:
    environment: dev
    team: platform
  vpcRef:
    name: example-vpc

Spec

Field	Type	Required	Description
`accepterProviderRef`	object	—	AccepterProviderRef names the AWSProvider for the accepter VPC's account.
`accepterProviderRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`accepterProviderRef.region`	string	—	Region overrides the provider's region for this resource only.
`autoAccept`	boolean	—	AutoAccept makes the controller accept the peering request itself.
`peerOwnerId`	string	—	PeerOwnerID is the AWS account ID of the accepter VPC owner.
`peerRegion`	string	—	PeerRegion is the region of the accepter VPC.
`peerVpcId`	string	yes	PeerVPCID is the accepter VPC ID.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`vpcRef`	object	yes	VPCRef is the requester VPC (local).
`vpcRef.id`	string	—	ID is a direct AWS VPC ID (e.g.
`vpcRef.name`	string	—	Name of a VPC CR in the same namespace.

Status

Field	Type	Required	Description
`accepterAccountId`	string	—	AccepterAccountID is the account that owns the accepter VPC.
`accepterVpcId`	string	—
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`peeringId`	string	—	PeeringID is the VPC peering connection ID.
`requesterVpcId`	string	—	RequesterVPCID and AccepterVPCID are the two VPCs as reported by AWS.
`status`	string	—	Status is the current state of the peering connection.

VPNConnection # GA

VPNConnection is the Schema for managing EC2 VPN connections.

kubectl get vpnconnections · example on GitHub

Example

# VPNConnection — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#vpnconnection
apiVersion: aws.konfig.io/v1alpha1
kind: VPNConnection
metadata:
  name: example-vpnconnection
  namespace: default
spec:
  customerGatewayRef:
    name: example-customergateway
  providerRef:
    name: example-vpnconnection
    region: us-east-1
  staticRoutesOnly: false
  tags:
    environment: dev
    team: platform
  transitGatewayRef:
    name: example-vpnconnection
  tunnelOptions:
  - insideCidr: 10.0.0.0/16
    presharedKeyRef:
      key: example
      name: example-vpnconnection
  type: ipsec.1
  vpnGatewayRef:
    name: example-vpngateway

Spec

Field	Type	Required	Description
`customerGatewayRef`	object	yes	CustomerGatewayRef references the customer gateway.
`customerGatewayRef.id`	string	—	ID is a direct AWS customer gateway ID (cgw-...).
`customerGatewayRef.name`	string	—	Name of a CustomerGateway CR in the same namespace.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`staticRoutesOnly`	boolean	—	StaticRoutesOnly indicates the VPN connection uses static routes only (required when the customer gateway device does not support BGP).
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`transitGatewayRef`	object	—	TransitGatewayRef references the transit gateway.
`transitGatewayRef.name`	string	—	Name of a TransitGateway CR in the same namespace.
`transitGatewayRef.transitGatewayId`	string	—	TransitGatewayID is a direct AWS Transit Gateway ID.
`tunnelOptions`	array<object>	—	TunnelOptions configures the VPN tunnels (up to 2).
`tunnelOptions[].insideCidr`	string	—	InsideCIDR is the range of inside IP addresses for the tunnel (a /30 CIDR block from the 169.254.0.0/16 range).
`tunnelOptions[].presharedKeyRef`	object	—	PreSharedKeyRef references a Kubernetes Secret holding the tunnel's pre-shared key.
`tunnelOptions[].presharedKeyRef.key`	string	yes	Key is the key within the Secret whose value to use.
`tunnelOptions[].presharedKeyRef.name`	string	yes	Name of the Kubernetes Secret.
`type`	enum	—	Type of VPN connection. Allowed: `ipsec.1`
`vpnGatewayRef`	object	—	VPNGatewayRef references the virtual private gateway.
`vpnGatewayRef.id`	string	—	ID is a direct AWS virtual private gateway ID (vgw-...).
`vpnGatewayRef.name`	string	—	Name of a VPNGateway CR in the same namespace.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the lifecycle state reported by AWS (pending, available, deleting, deleted).
`vpnConnectionId`	string	—	VPNConnectionID is the AWS VPN connection identifier.

VPNConnectionRoute # GA

VPNConnectionRoute is the Schema for managing static routes on EC2 VPN connections.

kubectl get vpnconnectionroutes · example on GitHub

Example

# VPNConnectionRoute — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#vpnconnectionroute
apiVersion: aws.konfig.io/v1alpha1
kind: VPNConnectionRoute
metadata:
  name: example-vpnconnectionroute
  namespace: default
spec:
  destinationCidrBlock: 10.0.0.0/16
  providerRef:
    name: example-vpnconnectionroute
    region: us-east-1
  vpnConnectionRef:
    name: example-vpnconnection

Spec

Field	Type	Required	Description
`destinationCidrBlock`	string	yes	DestinationCIDRBlock is the CIDR block associated with the local subnet of the customer network.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`vpnConnectionRef`	object	yes	VPNConnectionRef references the VPN connection to add the route to.
`vpnConnectionRef.id`	string	—	ID is a direct AWS VPN connection ID (vpn-...).
`vpnConnectionRef.name`	string	—	Name of a VPNConnection CR in the same namespace.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`vpnConnectionId`	string	—	VPNConnectionID is the resolved VPN connection the route was created on.

VPNGateway # GA

VPNGateway is the Schema for managing EC2 virtual private gateways.

kubectl get vpngateways · example on GitHub

Example

# VPNGateway — EC2 & VPC
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ec2.html#vpngateway
apiVersion: aws.konfig.io/v1alpha1
kind: VPNGateway
metadata:
  name: example-vpngateway
  namespace: default
spec:
  amazonSideAsn: 1
  providerRef:
    name: example-vpngateway
    region: us-east-1
  tags:
    environment: dev
    team: platform
  type: ipsec.1
  vpcRef:
    name: example-vpc

Spec

Field	Type	Required	Description
`amazonSideAsn`	integer	—	AmazonSideASN is the private Autonomous System Number for the Amazon side of a BGP session.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`type`	enum	—	Type of VPN connection the virtual private gateway supports. Allowed: `ipsec.1`
`vpcRef`	object	—	VPCRef references the VPC to attach the gateway to.
`vpcRef.id`	string	—	ID is a direct AWS VPC ID (e.g.
`vpcRef.name`	string	—	Name of a VPC CR in the same namespace.

Status

Field	Type	Required	Description
`attachedVpcId`	string	—	AttachedVPCID is the VPC the gateway is currently attached to.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the lifecycle state reported by AWS.
`vpnGatewayId`	string	—	VPNGatewayID is the AWS virtual private gateway identifier.