Network Firewall

6 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

Firewall # GA

Firewall is the Schema for managing AWS Network Firewall firewalls.

kubectl get firewalls · example on GitHub

Example

# Firewall — Network Firewall
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/networkfirewall.html#firewall
apiVersion: aws.konfig.io/v1alpha1
kind: Firewall
metadata:
  name: example-firewall
  namespace: default
spec:
  deleteProtection: true
  description: Managed by konfig-konector
  firewallPolicyRef:
    name: example-firewallpolicy
  name: example-firewall
  providerRef:
    name: example-firewall
    region: us-east-1
  subnetRefs:
  - name: example-subnetrefs
  tags:
    environment: dev
    team: platform
  vpcRef:
    name: example-vpc

Spec

Field	Type	Required	Description
`deleteProtection`	boolean	—	DeleteProtection prevents deletion of the firewall while enabled.
`description`	string	—	Description of the firewall.
`firewallPolicyRef`	object	yes	FirewallPolicyRef references the firewall policy to use.
`firewallPolicyRef.arn`	string	—	ARN is a direct AWS firewall policy ARN.
`firewallPolicyRef.name`	string	—	Name of a FirewallPolicy CR in the same namespace.
`name`	string	yes	Name is the descriptive name of the firewall.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`subnetRefs`	array<object>	yes	SubnetRefs are the subnets to place firewall endpoints in.
`subnetRefs[].id`	string	—	ID is a direct AWS Subnet ID (e.g.
`subnetRefs[].name`	string	—	Name of a Subnet CR in the same namespace.
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`vpcRef`	object	yes	VPCRef references the VPC where the firewall is created.
`vpcRef.id`	string	—	ID is a direct AWS VPC ID (e.g.
`vpcRef.name`	string	—	Name of a VPC CR in the same namespace.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the firewall.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	ID is the unique identifier of the firewall.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`state`	string	—	State is the readiness state reported by AWS (PROVISIONING, READY, DELETING).

FirewallPolicy # GA

FirewallPolicy is the Schema for managing AWS Network Firewall policies.

kubectl get firewallpolicies · example on GitHub

Example

# FirewallPolicy — Network Firewall
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/networkfirewall.html#firewallpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: FirewallPolicy
metadata:
  name: example-firewallpolicy
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-firewallpolicy
  providerRef:
    name: example-firewallpolicy
    region: us-east-1
  statefulRuleGroupRefs:
  - name: example-statefulrulegrouprefs
  statelessDefaultActions:
  - example
  statelessFragmentDefaultActions:
  - example
  statelessRuleGroupRefs:
  - arn: arn:aws:iam::123456789012:role/example-role
    name: example-firewallpolicy
    priority: 1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`description`	string	—	Description of the firewall policy.
`name`	string	yes	Name is the descriptive name of the firewall policy.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`statefulRuleGroupRefs`	array<object>	—	StatefulRuleGroupRefs references the stateful rule groups in the policy.
`statefulRuleGroupRefs[].arn`	string	—	ARN is a direct AWS rule group ARN.
`statefulRuleGroupRefs[].name`	string	—	Name of a FirewallRuleGroup CR in the same namespace.
`statelessDefaultActions`	array<string>	yes	StatelessDefaultActions are the actions for packets that don't match any stateless rule (e.g.
`statelessFragmentDefaultActions`	array<string>	yes	StatelessFragmentDefaultActions are the actions for fragmented UDP packets that don't match any stateless rule.
`statelessRuleGroupRefs`	array<object>	—	StatelessRuleGroupRefs references the stateless rule groups in the policy.
`statelessRuleGroupRefs[].arn`	string	—	ARN is a direct AWS rule group ARN.
`statelessRuleGroupRefs[].name`	string	—	Name of a FirewallRuleGroup CR in the same namespace.
`statelessRuleGroupRefs[].priority`	integer	yes	Priority is the order in which to run this rule group.
`tags`	map<string>	—	Tags are AWS resource tags to apply.

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the firewall policy.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	ID is the unique identifier of the firewall policy.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`updateToken`	string	—	UpdateToken is the optimistic-locking token from the last read.

FirewallRuleGroup # GA

FirewallRuleGroup is the Schema for managing AWS Network Firewall rule groups.

kubectl get firewallrulegroups · example on GitHub

Example

# FirewallRuleGroup — Network Firewall
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/networkfirewall.html#firewallrulegroup
apiVersion: aws.konfig.io/v1alpha1
kind: FirewallRuleGroup
metadata:
  name: example-firewallrulegroup
  namespace: default
spec:
  capacity: 1
  description: Managed by konfig-konector
  name: example-firewallrulegroup
  providerRef:
    name: example-firewallrulegroup
    region: us-east-1
  rulesString: example
  tags:
    environment: dev
    team: platform
  type: STATELESS

Spec

Field	Type	Required	Description
`capacity`	integer	yes	Capacity is the maximum operating resources this rule group can use.
`description`	string	—	Description of the rule group.
`name`	string	yes	Name is the descriptive name of the rule group.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`rulesString`	string	—	RulesString contains the rule definitions in Suricata-compatible format (stateful) or as a rules source string (stateless).
`tags`	map<string>	—	Tags are AWS resource tags to apply.
`type`	enum	yes	Type indicates whether the rule group is stateless or stateful. Allowed: `STATELESS, STATEFUL`

Status

Field	Type	Required	Description
`arn`	string	—	ARN is the Amazon Resource Name of the rule group.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	ID is the unique identifier of the rule group.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`updateToken`	string	—	UpdateToken is the optimistic-locking token from the last read.

NetworkFirewallLoggingConfiguration # CLOUD CONTROL · AWS::NetworkFirewall::LoggingConfiguration

NetworkFirewallLoggingConfiguration manages AWS::NetworkFirewall::LoggingConfiguration through the AWS Cloud Control API.

kubectl get networkfirewallloggingconfigurations · example on GitHub

Example

# NetworkFirewallLoggingConfiguration — Network Firewall
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/networkfirewall.html#networkfirewallloggingconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: NetworkFirewallLoggingConfiguration
metadata:
  name: example-networkfirewallloggingconfiguration
  namespace: default
spec:
  enableMonitoringDashboard: true
  firewallArn: arn:aws:iam::123456789012:role/example-role
  firewallName: example-networkfirewallloggingconfiguration
  loggingConfiguration:
    logDestinationConfigs:
    - logDestination:
        key: value
      logDestinationType: S3
      logType: ALERT
  providerRef:
    name: example-networkfirewallloggingconfiguration
    region: us-east-1

Spec

Field	Type	Required	Description
`enableMonitoringDashboard`	boolean	—
`firewallArn`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`firewallName`	string	—	Create-only in AWS: changing it requires replacing the resource.
`loggingConfiguration`	object	yes	NetworkFirewallLoggingConfigurationLoggingConfiguration is a nested property type of AWS::NetworkFirewall::LoggingConfiguration.
`loggingConfiguration.logDestinationConfigs`	array<object>	yes
`loggingConfiguration.logDestinationConfigs[].logDestination`	map<string>	yes	A key-value pair to configure the logDestinations.
`loggingConfiguration.logDestinationConfigs[].logDestinationType`	enum	yes	Allowed: `S3, CloudWatchLogs, KinesisDataFirehose`
`loggingConfiguration.logDestinationConfigs[].logType`	enum	yes	Allowed: `ALERT, FLOW, TLS`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

NetworkFirewallTLSInspectionConfiguration # CLOUD CONTROL · AWS::NetworkFirewall::TLSInspectionConfiguration

NetworkFirewallTLSInspectionConfiguration manages AWS::NetworkFirewall::TLSInspectionConfiguration through the AWS Cloud Control API.

kubectl get networkfirewalltlsinspectionconfigurations · example on GitHub

Example

# NetworkFirewallTLSInspectionConfiguration — Network Firewall
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/networkfirewall.html#networkfirewalltlsinspectionconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: NetworkFirewallTLSInspectionConfiguration
metadata:
  name: example-networkfirewalltlsinspectionconfiguration
  namespace: default
spec:
  description: Managed by konfig-konector
  providerRef:
    name: example-networkfirewalltlsinspectionconfiguration
    region: us-east-1
  tags:
  - key: example
    value: example
  tlsInspectionConfiguration:
    serverCertificateConfigurations:
    - certificateAuthorityArn: arn:aws:iam::123456789012:role/example-role
      scopes:
      - destinationPorts:
        - fromPort: 1
          toPort: 1
        destinations:
        - addressDefinition: example
        protocols:
        - 1
        sourcePorts:
        - fromPort: 1
          toPort: 1
        sources:
        - addressDefinition: example
      serverCertificates:
      - resourceArn: arn:aws:iam::123456789012:role/example-role
  tlsInspectionConfigurationName: example-networkfirewalltlsinspectionconfiguration

Spec

Field	Type	Required	Description
`description`	string	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes
`tlsInspectionConfiguration`	object	yes	NetworkFirewallTLSInspectionConfigurationTLSInspectionConfiguration is a nested property type of AWS::NetworkFirewall::TLSInspectionConfiguration.
`tlsInspectionConfiguration.serverCertificateConfigurations`	array<object>	—
`tlsInspectionConfiguration.serverCertificateConfigurations[].certificateAuthorityArn`	string	—
`tlsInspectionConfiguration.serverCertificateConfigurations[].checkCertificateRevocationStatus`	object	—	NetworkFirewallTLSInspectionConfigurationServerCertificateConfigurationCheckCertificateRevocationStatus is a nested property type of AWS::NetworkFirewall::TLSInspectionConfiguration.
`tlsInspectionConfiguration.serverCertificateConfigurations[].checkCertificateRevocationStatus.revokedStatusAction`	enum	—	Allowed: `PASS, DROP, REJECT`
`tlsInspectionConfiguration.serverCertificateConfigurations[].checkCertificateRevocationStatus.unknownStatusAction`	enum	—	Allowed: `PASS, DROP, REJECT`
`tlsInspectionConfiguration.serverCertificateConfigurations[].scopes`	array<object>	—
`tlsInspectionConfiguration.serverCertificateConfigurations[].scopes[].destinationPorts`	array<object>	—
`tlsInspectionConfiguration.serverCertificateConfigurations[].scopes[].destinationPorts[].fromPort`	integer	yes
`tlsInspectionConfiguration.serverCertificateConfigurations[].scopes[].destinationPorts[].toPort`	integer	yes
`tlsInspectionConfiguration.serverCertificateConfigurations[].scopes[].destinations`	array<object>	—
`tlsInspectionConfiguration.serverCertificateConfigurations[].scopes[].destinations[].addressDefinition`	string	yes
`tlsInspectionConfiguration.serverCertificateConfigurations[].scopes[].protocols`	array<integer>	—
`tlsInspectionConfiguration.serverCertificateConfigurations[].scopes[].sourcePorts`	array<object>	—
`tlsInspectionConfiguration.serverCertificateConfigurations[].scopes[].sourcePorts[].fromPort`	integer	yes
`tlsInspectionConfiguration.serverCertificateConfigurations[].scopes[].sourcePorts[].toPort`	integer	yes
`tlsInspectionConfiguration.serverCertificateConfigurations[].scopes[].sources`	array<object>	—
`tlsInspectionConfiguration.serverCertificateConfigurations[].scopes[].sources[].addressDefinition`	string	yes
`tlsInspectionConfiguration.serverCertificateConfigurations[].serverCertificates`	array<object>	—
`tlsInspectionConfiguration.serverCertificateConfigurations[].serverCertificates[].resourceArn`	string	—
`tlsInspectionConfigurationName`	string	yes	Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`tlsInspectionConfigurationArn`	string	—	Read-only: reported by AWS after creation.
`tlsInspectionConfigurationId`	string	—	Read-only: reported by AWS after creation.

NetworkFirewallVpcEndpointAssociation # CLOUD CONTROL · AWS::NetworkFirewall::VpcEndpointAssociation

NetworkFirewallVpcEndpointAssociation manages AWS::NetworkFirewall::VpcEndpointAssociation through the AWS Cloud Control API.

kubectl get networkfirewallvpcendpointassociations · example on GitHub

Example

# NetworkFirewallVpcEndpointAssociation — Network Firewall
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/networkfirewall.html#networkfirewallvpcendpointassociation
apiVersion: aws.konfig.io/v1alpha1
kind: NetworkFirewallVpcEndpointAssociation
metadata:
  name: example-networkfirewallvpcendpointassociation
  namespace: default
spec:
  description: Managed by konfig-konector
  firewallArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-networkfirewallvpcendpointassociation
    region: us-east-1
  subnetMapping:
    ipAddressType: example
    subnetId: subnet-0abc12def3456789
  tags:
  - key: example
    value: example
  vpcId: vpc-0abc12def3456789

Spec

Field	Type	Required	Description
`description`	string	—	Create-only in AWS: changing it requires replacing the resource.
`firewallArn`	string	yes	Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`subnetMapping`	object	yes	Create-only in AWS: changing it requires replacing the resource.
`subnetMapping.ipAddressType`	string	—	A IPAddressType
`subnetMapping.subnetId`	string	yes	A SubnetId.
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes
`vpcId`	string	yes	Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`endpointId`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`vpcEndpointAssociationArn`	string	—	Read-only: reported by AWS after creation.
`vpcEndpointAssociationId`	string	—	Read-only: reported by AWS after creation.