View a markdown version of this page

AWS::Serverless::NetworkConnector - Amazon Serverless Application Model
SyntaxPropertiesReturn ValuesExamples
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

AWS::Serverless::NetworkConnector

Creates a Amazon Lambda Network Connector that defines network connectivity for Lambda compute resources. A network connector specifies how compute resources connect to networks, for example by routing egress traffic through a customer VPC using elastic network interfaces (ENIs) that the service provisions in specified subnets and security groups. Each connector serves one compute type, either MicroVMs or Web Functions. To use a connector with an AWS::Serverless::WebFunction, set ComputeTypes to WebFunction and pass the connector's LatestVersionArn to the function's EgressNetworkConnectorArn property.

Note

When you deploy to Amazon CloudFormation, Amazon SAM transforms your Amazon SAM resources into Amazon CloudFormation resources. For more information, see Generated Amazon CloudFormation resources for Amazon SAM.

Syntax

To declare this entity in your Amazon Serverless Application Model (Amazon SAM) template, use the following syntax.

YAML

Type: AWS::Serverless::NetworkConnector
Properties:
  ComputeTypes: List
  Name: String
  OperatorRole: String
  PropagateTags: Boolean
  Tags: Map
  VpcConfig: VpcConfig

Properties

ComputeTypes

The type of Lambda compute resource that can use this network connector. Specify exactly one of the following values:

  • MicroVm: The connector is used by MicroVM compute resources.

  • WebFunction: The connector is used by AWS::Serverless::WebFunction resources through their EgressNetworkConnectorArn property.

Type: List

Required: No

Default: [MicroVm]

Amazon CloudFormation compatibility: This property is passed directly to the Configuration.VpcEgressConfiguration.AssociatedComputeResourceTypes property of an AWS::Lambda::NetworkConnector resource.

Name

The name of the network connector. The name must be unique within your account and Region.

Type: String

Required: No

Amazon CloudFormation compatibility: This property is passed directly to the Name property of an AWS::Lambda::NetworkConnector resource.

OperatorRole

The ARN of the IAM role that the network connector service assumes to create and manage elastic network interfaces (ENIs).

Type: String

Required: No

Amazon CloudFormation compatibility: This property is similar to the OperatorRole property of an AWS::Lambda::NetworkConnector resource. This is required in Amazon CloudFormation but not in Amazon SAM. If you don't specify a role, Amazon SAM creates one with a logical ID of <resource-logical-id>OperatorRole.

PropagateTags

Specifies whether to pass tags from the Tags property to generated resources, such as the auto-generated operator role.

Type: Boolean

Required: No

Default: False

Amazon CloudFormation compatibility: This property is unique to Amazon SAM and doesn't have an Amazon CloudFormation equivalent.

Tags

A map of key-value pairs that specifies the tags added to this network connector.

Type: Map

Required: No

Amazon CloudFormation compatibility: This property is similar to the Tags property of an AWS::Lambda::NetworkConnector resource. The Tags property in Amazon SAM consists of key-value pairs (whereas in Amazon CloudFormation this property consists of a list of Tag objects). Also, Amazon SAM automatically adds a lambda:createdBy:SAM tag to this network connector, and to the default roles that are generated for it.

VpcConfig

The VPC egress configuration for the network connector. Specifies the subnets, security groups, and network protocol for routing outbound traffic through your VPC.

Type: VpcConfig

Required: Yes

Amazon CloudFormation compatibility: This property is transformed to the Configuration.VpcEgressConfiguration property of an AWS::Lambda::NetworkConnector resource. Amazon SAM sets AssociatedComputeResourceTypes from the ComputeTypes property.

Return Values

Ref

When the logical ID of this resource is provided to the Ref intrinsic function, it returns the ARN of the network connector.

For more information about using the Ref function, see Ref in the Amazon CloudFormation User Guide.

Fn::GetAtt

Fn::GetAtt returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using Fn::GetAtt, see Fn::GetAtt in the Amazon CloudFormation User Guide.

Arn

The Amazon Resource Name (ARN) of the network connector.

LatestVersionArn

The version-qualified ARN of the latest version of the network connector, for example arn:aws:lambda:us-east-1:123456789012:network-connector:my-connector:1. Use this value for the EgressNetworkConnectorArn property of an AWS::Serverless::WebFunction.

State

The current state of the network connector. Valid values are PENDING, ACTIVE, INACTIVE, FAILED, DELETING, and DELETE_FAILED.

Examples

Basic network connector with auto-generated role

The following example creates a VPC egress network connector. Amazon SAM automatically generates the operator role.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  MyVpcConnector:
    Type: AWS::Serverless::NetworkConnector
    Properties:
      Name: my-vpc-connector
      VpcConfig:
        SubnetIds:
          - subnet-0abc123def4567890
          - subnet-0def456abc7890123
        SecurityGroupIds:
          - sg-0abc1234abcde0001
        NetworkProtocol: IPv4
      Tags:
        Environment: Production

Network connector for a Web Function

The following example creates a network connector for Web Functions and uses it for a Web Function's outbound traffic.

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
  MyWebFunctionConnector:
    Type: AWS::Serverless::NetworkConnector
    Properties:
      ComputeTypes:
        - WebFunction
      VpcConfig:
        SubnetIds:
          - subnet-0abc123def4567890
        SecurityGroupIds:
          - sg-0abc1234abcde0001
        NetworkProtocol: IPv4

  MyWebFunction:
    Type: AWS::Serverless::WebFunction
    Properties:
      Runtime: nodejs24.x
      AuthType: IamAuth
      CodeUri: s3://amzn-s3-demo-bucket/webfn.zip
      EgressNetworkConnectorArn: !GetAtt MyWebFunctionConnector.LatestVersionArn