ec2:CreateVpnConnectionRoute is a Write access-level action in the ec2 service. Grants permission to create a static route for a VPN connection between a virtual private gateway and a customer gateway
ARNs that ec2:CreateVpnConnectionRoute can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants ec2:CreateVpnConnectionRoute.
Filters access by a tag key and value pair that is allowed in the request
Filters access by a tag key and value pair of a resource
Filters access by a list of tag keys that are allowed in the request
Filters access by an attribute of a resource
Filters access by an attribute being set on a resource
Filters access by the authentication type for the VPN tunnel endpoints
Filters access by the duration after which DPD timeout occurs on a VPN tunnel
Filters access by the lifetime in seconds for phase 1 of the IKE negotiations for a VPN tunnel
Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 2 IKE negotiations
Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations
Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations
Filters access by the lifetime in seconds for phase 2 of the IKE negotiations for a VPN tunnel
Filters access by the gateway type for a VPN endpoint on the AWS side of a VPN connection
Filters access by the name of the AWS Region
Filters access by the internet key exchange (IKE) versions that are permitted for a VPN tunnel
Filters access by the percentage of increase of the rekey window (determined by the rekey margin time) within which the rekey time is randomly selected for a VPN tunnel
Filters access by the margin time before the phase 2 lifetime expires for a VPN tunnel
Filters access by the range of inside IP addresses for a VPN tunnel
Filters access by a range of inside IPv6 addresses for a VPN tunnel
Filters access by the number of packets in an IKE replay window
Filters access by a tag key and value pair of a resource
Filters access by the routing type for the VPN connection
Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 1 IKE negotiations
Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations
Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations
A minimal policy that allows ec2:CreateVpnConnectionRoute. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowEc2CreateVpnConnectionRoute",
"Effect": "Allow",
"Action": "ec2:CreateVpnConnectionRoute",
"Resource": "*"
}
]
}