Enables access logs to be sent to Amazon CloudWatch, Amazon S3, and Amazon Kinesis Data Firehose.

The service network owner can use the access logs to audit the services in the network. The service network owner can only see access logs from clients and services that are associated with their service network. Access log entries represent traffic originated from VPCs associated with that network. For more information, see [Access logs](https://docs.aws.amazon.com/vpc-lattice/latest/ug/monitoring-access-logs.html) in the *Amazon VPC Lattice User Guide* .

CfnAccessLogSubscription

The Amazon Resource Name (ARN) of the destination.

The supported destination types are CloudWatch Log groups, Kinesis Data Firehose delivery streams, and Amazon S3 buckets.

destinationArn

The ID or ARN of the service network or service.

resourceIdentifier

serviceNetworkLogType

The tags for the access log subscription.

CfnAuthPolicy

policy

The ID or ARN of the service network or service for which the policy is created.

A domain name verification is an entity that allows you to prove your ownership of a given domain.

When you create a domain verification using CloudFormation, use a waiter to make sure the domain verification is complete before you create a service network resource association, a VPC endpoint, or a service network VPC association with this domain.

CfnDomainVerification

domainName

The tags associated with the domain verification.

Creates a listener for a service.

Before you start using your Amazon VPC Lattice service, you must add one or more listeners. A listener is a process that checks for connection requests to your services. For more information, see [Listeners](https://docs.aws.amazon.com/vpc-lattice/latest/ug/listeners.html) in the *Amazon VPC Lattice User Guide* .

CfnListener

The action for the default rule.

Each listener has a default rule. The default rule is used if no other rules match.

defaultAction

protocol

The name of the listener.

A listener name must be unique within a service. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.

If you don't specify a name, CloudFormation generates one. However, if you specify a name, and later want to replace the resource, you must specify a new name.

name

The listener port.

You can specify a value from 1 to 65535. For HTTP, the default is 80. For HTTPS, the default is 443.

port

serviceIdentifier

Creates a resource configuration.

A resource configuration defines a specific resource. You can associate a resource configuration with a service network or a VPC endpoint.

CfnResourceConfiguration

The type of resource configuration. A resource configuration can be one of the following types:.

- *SINGLE* - A single resource.
- *GROUP* - A group of resources. You must create a group resource configuration before you create a child resource configuration.
- *CHILD* - A single resource that is part of a group resource configuration.
- *ARN* - An AWS resource.

resourceConfigurationType

Specifies whether the resource configuration can be associated with a sharable service network.

allowAssociationToSharableServiceNetwork

customDomainName

domainVerificationId

(GROUP) The group domain for a group resource configuration.

Any domains that you create for the child resource are subdomains of the group domain. Child resources inherit the verification status of the domain.

groupDomain

(SINGLE, GROUP, CHILD) The TCP port ranges that a consumer can use to access a resource configuration (for example: 1-65535).

You can separate port ranges using commas (for example: 1,2,22-30).

portRanges

(SINGLE, GROUP) The protocol accepted by the resource configuration.

protocolType

The auth type for the resource configuration.

resourceConfigurationAuthType

Identifies the resource configuration in one of the following ways:.

- *Amazon Resource Name (ARN)* - Supported resource-types that are provisioned by AWS services, such as RDS databases, can be identified by their ARN.
- *Domain name* - Any domain name that is publicly resolvable.
- *IP address* - For IPv4 and IPv6, only IP addresses in the VPC are supported.

resourceConfigurationDefinition

The ID of the group resource configuration.

resourceConfigurationGroupId

resourceGatewayId

A resource gateway is a point of ingress into the VPC where a resource resides.

It spans multiple Availability Zones. For your resource to be accessible from all Availability Zones, you should create your resource gateways to span as many Availability Zones as possible. A VPC can have multiple resource gateways.

CfnResourceGateway

The IDs of the VPC subnets for the resource gateway.

subnetIds

The ID of the VPC for the resource gateway.

vpcIdentifier

The type of IP address used by the resource gateway.

ipAddressType

The number of IPv4 addresses in each ENI for the resource gateway.

ipv4AddressesPerEni

The IDs of the security groups applied to the resource gateway.

securityGroupIds

Retrieves information about the specified resource policy.

The resource policy is an IAM policy created on behalf of the resource owner when they share a resource.

CfnResourcePolicy

The Amazon Resource Name (ARN) of the service network or service.

resourceArn

Creates a listener rule.

Each listener has a default rule for checking connection requests, but you can define additional rules. Each rule consists of a priority, one or more actions, and one or more conditions. For more information, see [Listener rules](https://docs.aws.amazon.com/vpc-lattice/latest/ug/listeners.html#listener-rules) in the *Amazon VPC Lattice User Guide* .

CfnRule

action

match

The priority assigned to the rule.

Each rule for a specific listener must have a unique priority. The lower the priority number the higher the priority.

priority

listenerIdentifier

The name of the rule.

The name must be unique within the listener. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.

If you don't specify a name, CloudFormation generates one. However, if you specify a name, and later want to replace the resource, you must specify a new name.

Creates a service.

A service is any software application that can run on instances containers, or serverless functions within an account or virtual private cloud (VPC).

For more information, see [Services](https://docs.aws.amazon.com/vpc-lattice/latest/ug/services.html) in the *Amazon VPC Lattice User Guide* .

CfnService

The type of IAM policy.

- `NONE` : The resource does not use an IAM policy. This is the default.
- `AWS_IAM` : The resource uses an IAM policy. When this type is used, auth is enabled and an auth policy is required.

authType

The Amazon Resource Name (ARN) of the certificate.

certificateArn

Describes the DNS information of the service.

This field is read-only.

dnsEntry

The name of the service.

The name must be unique within the account. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.

If you don't specify a name, CloudFormation generates one. However, if you specify a name, and later want to replace the resource, you must specify a new name.

Creates a service network.

A service network is a logical boundary for a collection of services. You can associate services and VPCs with a service network.

For more information, see [Service networks](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-networks.html) in the *Amazon VPC Lattice User Guide* .

CfnServiceNetwork

The name of the service network.

The name must be unique to the account. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.

If you don't specify a name, CloudFormation generates one. However, if you specify a name, and later want to replace the resource, you must specify a new name.

Specify if the service network should be enabled for sharing.

sharingConfig

Associates the specified service network with the specified resource configuration.

This allows the resource configuration to receive connections through the service network, including through a service network VPC endpoint.

CfnServiceNetworkResourceAssociation

Indicates if private DNS is enabled for the service network resource association.

privateDnsEnabled

The ID of the resource configuration associated with the service network.

resourceConfigurationId

The ID of the service network associated with the resource configuration.

serviceNetworkId

A key-value pair to associate with a resource.

Associates the specified service with the specified service network.

For more information, see [Manage service associations](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-network-associations.html#service-network-service-associations) in the *Amazon VPC Lattice User Guide* .

You can't use this operation if the service and service network are already associated or if there is a disassociation or deletion in progress. If the association fails, you can retry the operation by deleting the association and recreating it.

You cannot associate a service and service network that are shared with a caller. The caller must own either the service or the service network.

As a result of this operation, the association is created in the service network account and the association owner account.

CfnServiceNetworkServiceAssociation

The ID or ARN of the service network.

You must use an ARN if the resources are in different accounts.

serviceNetworkIdentifier

Associates a VPC with a service network.

When you associate a VPC with the service network, it enables all the resources within that VPC to be clients and communicate with other services in the service network. For more information, see [Manage VPC associations](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-network-associations.html#service-network-vpc-associations) in the *Amazon VPC Lattice User Guide* .

You can't use this operation if there is a disassociation in progress. If the association fails, retry by deleting the association and recreating it.

As a result of this operation, the association gets created in the service network account and the VPC owner account.

If you add a security group to the service network and VPC association, the association must continue to always have at least one security group. You can add or edit security groups at any time. However, to remove all security groups, you must first delete the association and recreate it without security groups.

CfnServiceNetworkVpcAssociation

The DNS options for the service network VPC association.

dnsOptions

Indicates if private DNS is enabled for the service network VPC association.

The IDs of the security groups.

Security groups aren't added by default. You can add a security group to apply network level controls to control which resources in a VPC are allowed to access the service network and its services. For more information, see [Control traffic to resources using security groups](https://docs.aws.amazon.com//vpc/latest/userguide/VPC_SecurityGroups.html) in the *Amazon VPC User Guide* .

Creates a target group.

A target group is a collection of targets, or compute resources, that run your application or service. A target group can only be used by a single service.

For more information, see [Target groups](https://docs.aws.amazon.com/vpc-lattice/latest/ug/target-groups.html) in the *Amazon VPC Lattice User Guide* .

CfnTargetGroup

type

config

The name of the target group.

The name must be unique within the account. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.

If you don't specify a name, CloudFormation generates one. However, if you specify a name, and later want to replace the resource, you must specify a new name.

AWS vpclattice

L1 Constructs14