ec2:CreateVpnConnection

Write

ec2:CreateVpnConnection is a Write access-level action in the ec2 service. Grants permission to create a VPN connection between a virtual private gateway or transit gateway and a customer gateway

Resource types

ARNs that ec2:CreateVpnConnection can be scoped to in an IAM policy.

arn:${Partition}:ec2:${Region}:${Account}:customer-gateway/${CustomerGatewayId} required
customer-gateway
arn:${Partition}:ec2:${Region}:${Account}:transit-gateway/${TransitGatewayId}
transit-gateway
arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-attachment/${TransitGatewayAttachmentId}
transit-gateway-attachment
arn:${Partition}:ec2:${Region}:${Account}:vpn-concentrator/${VpnConcentratorId}
vpn-concentrator
arn:${Partition}:ec2:${Region}:${Account}:vpn-connection/${VpnConnectionId} required
vpn-connection
arn:${Partition}:ec2:${Region}:${Account}:vpn-gateway/${VpnGatewayId}
vpn-gateway

Condition keys

Keys you can use in the Condition block of a policy that grants ec2:CreateVpnConnection.

ec2:Region String

Filters access by the name of the AWS Region

aws:ResourceTag/${TagKey} String

Filters access by a tag key and value pair of a resource

ec2:ResourceTag/${TagKey} String

Filters access by a tag key and value pair of a resource

ec2:transitGatewayId String

Filters access by the ID of a transit gateway

ec2:transitGatewayAttachmentId String

Filters access by the ID of a transit gateway attachment

aws:RequestTag/${TagKey} String

Filters access by a tag key and value pair that is allowed in the request

aws:TagKeys ArrayOfString

Filters access by a list of tag keys that are allowed in the request

ec2:AuthenticationType String

Filters access by the authentication type for the VPN tunnel endpoints

ec2:DPDTimeoutSeconds Numeric

Filters access by the duration after which DPD timeout occurs on a VPN tunnel

ec2:GatewayType String

Filters access by the gateway type for a VPN endpoint on the AWS side of a VPN connection

ec2:IKEVersions ArrayOfString

Filters access by the internet key exchange (IKE) versions that are permitted for a VPN tunnel

ec2:InsideTunnelCidr String

Filters access by the range of inside IP addresses for a VPN tunnel

ec2:InsideTunnelIpv6Cidr String

Filters access by a range of inside IPv6 addresses for a VPN tunnel

ec2:Phase1DHGroup ArrayOfString

Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 1 IKE negotiations

ec2:Phase1EncryptionAlgorithms ArrayOfString

Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations

ec2:Phase1IntegrityAlgorithms ArrayOfString

Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations

ec2:Phase1LifetimeSeconds Numeric

Filters access by the lifetime in seconds for phase 1 of the IKE negotiations for a VPN tunnel

ec2:Phase2DHGroup ArrayOfString

Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 2 IKE negotiations

ec2:Phase2EncryptionAlgorithms ArrayOfString

Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations

ec2:Phase2IntegrityAlgorithms ArrayOfString

Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations

ec2:Phase2LifetimeSeconds Numeric

Filters access by the lifetime in seconds for phase 2 of the IKE negotiations for a VPN tunnel

ec2:RekeyFuzzPercentage Numeric

Filters access by the percentage of increase of the rekey window (determined by the rekey margin time) within which the rekey time is randomly selected for a VPN tunnel

ec2:RekeyMarginTimeSeconds Numeric

Filters access by the margin time before the phase 2 lifetime expires for a VPN tunnel

ec2:ReplayWindowSizePackets String

Filters access by the number of packets in an IKE replay window

ec2:RoutingType String

Filters access by the routing type for the VPN connection

Example IAM policy

A minimal policy that allows ec2:CreateVpnConnection. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowEc2CreateVpnConnection",
      "Effect": "Allow",
      "Action": "ec2:CreateVpnConnection",
      "Resource": "*"
    }
  ]
}

Related actions in ec2

ec2:AcceptAddressTransfer Write ec2:AcceptCapacityReservationBillingOwnership Write ec2:AcceptReservedInstancesExchangeQuote Write ec2:AcceptTransitGatewayClientVpnAttachment Write ec2:AcceptTransitGatewayMulticastDomainAssociations Write ec2:AcceptTransitGatewayPeeringAttachment Write ec2:AcceptTransitGatewayVpcAttachment Write ec2:AcceptVpcEndpointConnections Write ec2:AcceptVpcPeeringConnection Write ec2:AdvertiseByoipCidr Write ec2:AllocateAddress Write ec2:AllocateHosts Write

View all ec2 actions →