Creates a network connector that enables Lambda compute resources to route outbound traffic through your Amazon VPC. The network connector provisions elastic network interfaces (ENIs) in the subnets you specify, providing a managed network path to private resources such as databases, caches, and internal APIs.
This operation is asynchronous. The network connector starts in PENDING state while ENIs are provisioned in your VPC (provisioning typically takes up to 10 minutes). Use GetNetworkConnector to poll the connector state until it reaches ACTIVE. Once active, you can attach the connector to Lambda MicroVMs at run time using the egressNetworkConnectors parameter on RunMicroVm.
This operation is idempotent when you provide a ClientToken — if you retry a request that completed successfully using the same client token, the operation returns the existing connector without creating a duplicate.
Initiates deletion of a network connector. The connector transitions to DELETING state while elastic network interfaces are cleaned up asynchronously. After deletion completes, subsequent calls to GetNetworkConnector return ResourceNotFoundException.
This operation is idempotent — calling delete on a connector that is already deleting or has been deleted succeeds without error. You can delete connectors in ACTIVE or FAILED states. Before deleting a connector, ensure that no Lambda MicroVMs are using it, as they will lose VPC egress connectivity immediately.
Retrieves the current configuration, state, and metadata of a network connector. The Identifier parameter accepts the connector ID, name, or full ARN. Use this operation to poll connector state after creation or update, or to inspect the current VPC configuration and any failure reasons.
The response includes the full connector configuration, current state, and — if the connector has been updated — the LastUpdateStatus and LastUpdateStatusReasonCode fields that indicate whether the most recent update succeeded or failed.
Returns a paginated list of network connectors in your account for the current Region. You can optionally filter results by connector state. Use the Marker parameter from a previous response to retrieve the next page of results.
Each item in the response includes the connector ARN, name, ID, type, current state, and last modified timestamp. To retrieve full configuration details for a specific connector, use GetNetworkConnector.
Updates the VPC configuration or operator role of an existing network connector. You can modify the subnet IDs, security group IDs, network protocol, or operator role. The connector must be in ACTIVE state to accept updates.
This operation is asynchronous. The connector remains in ACTIVE state during the update — existing workloads that reference this connector are not disrupted. Use GetNetworkConnector to monitor the LastUpdateStatus field, which transitions through InProgress to Successful or Failed. If the update fails, the LastUpdateStatusReasonCode field provides a specific error code for troubleshooting. This operation is idempotent when you provide a ClientToken.
A unique name for the network connector within your account and Region. You can use the name to identify the connector in subsequent API calls.
" }, "Configuration":{ "shape":"NetworkConnectorConfiguration", "documentation":"The network configuration for the connector. Specify a VpcEgressConfiguration to enable outbound traffic routing through your VPC.
The ARN of the IAM role that Lambda assumes to manage elastic network interfaces in your VPC. This role must have permissions for ec2:CreateNetworkInterface, ec2:DeleteNetworkInterface, and related describe operations.
A unique, case-sensitive identifier that you provide to ensure the idempotency of the request. If you retry a request with the same client token, the API returns the existing connector without creating a duplicate.
", "idempotencyToken":true }, "Tags":{ "shape":"NetworkConnectorTags", "documentation":"A map of key-value pairs to associate with the network connector for organization, cost allocation, or access control.
" } } }, "CreateNetworkConnectorResponse":{ "type":"structure", "required":[ "Arn", "Name", "Id" ], "members":{ "Arn":{ "shape":"NetworkConnectorArn", "documentation":"The Amazon Resource Name (ARN) of the network connector.
" }, "Name":{ "shape":"NetworkConnectorName", "documentation":"The name of the network connector.
" }, "Id":{"shape":"NetworkConnectorId"}, "Configuration":{ "shape":"NetworkConnectorConfiguration", "documentation":"The network configuration of the connector, including VPC subnets and security groups.
" }, "OperatorRole":{ "shape":"NetworkConnectorRoleArn", "documentation":"The ARN of the IAM role that Lambda uses to manage the underlying ENI resources for this connector.
" }, "State":{ "shape":"NetworkConnectorState", "documentation":"The current state of the network connector.
" } } }, "DeleteNetworkConnectorRequest":{ "type":"structure", "required":["Identifier"], "members":{ "Identifier":{ "shape":"NetworkConnectorIdentifier", "location":"uri", "locationName":"Identifier" } } }, "DeleteNetworkConnectorResponse":{ "type":"structure", "required":[ "Arn", "Name", "Id" ], "members":{ "Arn":{ "shape":"NetworkConnectorArn", "documentation":"The Amazon Resource Name (ARN) of the network connector.
" }, "Name":{ "shape":"NetworkConnectorName", "documentation":"The name of the network connector.
" }, "Id":{"shape":"NetworkConnectorId"}, "Configuration":{ "shape":"NetworkConnectorConfiguration", "documentation":"The network configuration of the connector, including VPC subnets and security groups.
" }, "OperatorRole":{ "shape":"NetworkConnectorRoleArn", "documentation":"The ARN of the IAM role that Lambda uses to manage the underlying ENI resources for this connector.
" }, "State":{ "shape":"NetworkConnectorState", "documentation":"The current state of the network connector. The State field is typically DELETING after this call.
The Amazon Resource Name (ARN) of the network connector.
" }, "Name":{ "shape":"NetworkConnectorName", "documentation":"The name of the network connector.
" }, "Id":{"shape":"NetworkConnectorId"}, "Version":{ "shape":"NetworkConnectorVersion", "documentation":"The version number of the connector configuration, incremented on each update.
" }, "Configuration":{ "shape":"NetworkConnectorConfiguration", "documentation":"The network configuration of the connector, including VPC subnets and security groups.
" }, "OperatorRole":{ "shape":"NetworkConnectorRoleArn", "documentation":"The ARN of the IAM role that Lambda uses to manage the underlying ENI resources for this connector.
" }, "State":{ "shape":"NetworkConnectorState", "documentation":"The current state of the network connector.
" }, "StateReason":{ "shape":"String", "documentation":"A human-readable explanation of the current state, populated when the state is FAILED or DELETE_FAILED.
A machine-readable code indicating the reason for the current state. Use this for programmatic error handling.
" }, "LastUpdateStatus":{ "shape":"NetworkConnectorLastUpdateStatus", "documentation":"The status of the most recent update operation (Successful, Failed, or InProgress).
A human-readable explanation of the last update status.
" }, "LastUpdateStatusReasonCode":{ "shape":"NetworkConnectorLastUpdateStatusReasonCode", "documentation":"A machine-readable code indicating the reason for the last update status. Use this for programmatic error handling.
" }, "LastModified":{ "shape":"CoreTimestamp", "documentation":"The date and time when the connector configuration was last modified.
" } } }, "InvalidParameterValueException":{ "type":"structure", "members":{ "Type":{ "shape":"String", "documentation":"The exception type.
" }, "message":{"shape":"String"} }, "documentation":"One of the parameters in the request is not valid. Check the error message for details about which parameter failed validation.
", "error":{ "httpStatusCode":400, "senderFault":true }, "exception":true }, "ListNetworkConnectorsRequest":{ "type":"structure", "members":{ "State":{ "shape":"NetworkConnectorState", "documentation":"Optional filter to return only connectors in the specified state (for example, ACTIVE or FAILED).
The pagination token from a previous ListNetworkConnectors response. Use this value to retrieve the next page of results.
The maximum number of connectors to return per page. Valid range: 1 to 100.
", "location":"querystring", "locationName":"MaxItems" } } }, "ListNetworkConnectorsResponse":{ "type":"structure", "required":["NetworkConnectors"], "members":{ "NetworkConnectors":{ "shape":"NetworkConnectorsList", "documentation":"A list of network connector summaries for the current page of results.
" }, "NextMarker":{ "shape":"String", "documentation":"The pagination token to include in a subsequent request to retrieve the next page. This value is null when there are no more results.
" } } }, "MaxHundredListItems":{ "type":"integer", "box":true, "max":100, "min":1 }, "NetworkConnectorArn":{ "type":"string", "max":140, "min":1, "pattern":"(arn:aws[a-zA-Z-]*:lambda:(eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:\\d{12}:network-connector:[a-zA-Z0-9-_]+(:[1-9]|[1-9][0-9]+)?)" }, "NetworkConnectorConfiguration":{ "type":"structure", "members":{ "VpcEgressConfiguration":{ "shape":"NetworkConnectorVpcEgressConfiguration", "documentation":"Configuration for a VPC egress network connector. Specifies the subnets, security groups, and network protocol for routing outbound traffic through your VPC.
" } }, "documentation":"The network configuration for a network connector. Different connector types use different configuration shapes; specify the configuration that matches your connector type.
", "union":true }, "NetworkConnectorId":{ "type":"string", "documentation":"The unique identifier for a network connector, assigned by the service at creation time
", "max":140, "min":1 }, "NetworkConnectorIdentifier":{ "type":"string", "documentation":"A flexible identifier that accepts a network connector ID, name, or ARN
", "max":140, "min":1 }, "NetworkConnectorLastUpdateStatus":{ "type":"string", "enum":[ "Successful", "Failed", "InProgress" ] }, "NetworkConnectorLastUpdateStatusReason":{"type":"string"}, "NetworkConnectorLastUpdateStatusReasonCode":{ "type":"string", "enum":[ "DisallowedByVpcEncryptionControl", "Ec2RequestLimitExceeded", "InsufficientRolePermissions", "InternalError", "InvalidSecurityGroup", "InvalidSubnet", "SubnetOutOfIPAddresses" ] }, "NetworkConnectorLimitExceededException":{ "type":"structure", "members":{ "Type":{ "shape":"String", "documentation":"The exception type.
" }, "message":{ "shape":"String", "documentation":"A human-readable description of the error.
" } }, "documentation":"The account has reached the maximum number of network connectors allowed. Delete unused connectors or request a limit increase through Service Quotas.
", "error":{ "httpStatusCode":400, "senderFault":true }, "exception":true }, "NetworkConnectorName":{ "type":"string", "max":140, "min":1, "pattern":"(arn:aws[a-zA-Z-]*:lambda:(eusc-)?[a-z]{2}((-gov)|(-iso([a-z]?)))?-[a-z]+-\\d{1}:\\d{12}:network-connector:[a-zA-Z0-9-_]+(:[1-9]|[1-9][0-9]+)?)|[a-zA-Z0-9_-]{1,64}" }, "NetworkConnectorRoleArn":{ "type":"string", "max":10000, "min":0, "pattern":"arn:(aws[a-zA-Z-]*)?:iam::\\d{12}:role/?[a-zA-Z_0-9+=,.@\\-_/]+" }, "NetworkConnectorSecurityGroupId":{ "type":"string", "max":1024, "min":0, "pattern":"sg-[0-9a-zA-Z]*" }, "NetworkConnectorSecurityGroupIds":{ "type":"list", "member":{"shape":"NetworkConnectorSecurityGroupId"}, "max":5, "min":0 }, "NetworkConnectorState":{ "type":"string", "enum":[ "PENDING", "ACTIVE", "INACTIVE", "FAILED", "DELETING", "DELETE_FAILED" ] }, "NetworkConnectorStateReasonCode":{ "type":"string", "enum":[ "DisallowedByVpcEncryptionControl", "Ec2RequestLimitExceeded", "InsufficientRolePermissions", "InternalError", "InvalidSecurityGroup", "InvalidSubnet", "SubnetOutOfIPAddresses" ] }, "NetworkConnectorSubnetId":{ "type":"string", "max":1024, "min":0, "pattern":"subnet-[0-9a-z]*" }, "NetworkConnectorSubnetIds":{ "type":"list", "member":{"shape":"NetworkConnectorSubnetId"}, "max":16, "min":1 }, "NetworkConnectorSummary":{ "type":"structure", "required":[ "Arn", "Name", "Id", "Type" ], "members":{ "Arn":{ "shape":"NetworkConnectorArn", "documentation":"The ARN of the network connector.
" }, "Name":{ "shape":"NetworkConnectorName", "documentation":"The name of the network connector.
" }, "Id":{"shape":"NetworkConnectorId"}, "Type":{ "shape":"NetworkConnectorType", "documentation":"The type of the network connector (VPC_EGRESS).
The current state of the network connector.
" }, "LastModified":{ "shape":"CoreTimestamp", "documentation":"The date and time when the connector was last modified.
" } }, "documentation":"Summary information about a network connector returned by ListNetworkConnectors. Contains identifying fields and current state. To retrieve full configuration details, use GetNetworkConnector.
The IDs of the VPC subnets where Lambda provisions elastic network interfaces (ENIs). Specify 1 to 16 subnets. All subnets must be in the same VPC.
" }, "SecurityGroupIds":{ "shape":"NetworkConnectorSecurityGroupIds", "documentation":"The IDs of the VPC security groups to attach to the ENIs. Specify 0 to 5 security groups. All security groups must be in the same VPC as the subnets.
" }, "NetworkProtocol":{ "shape":"NetworkProtocol", "documentation":"The network protocol for the connector. Specify IPv4 for IPv4-only networking, or DualStack for both IPv4 and IPv6.
The types of Lambda compute resources that can use this connector. Currently, only MicroVm is supported.
Configuration for a VPC egress network connector. Specifies the VPC subnets, security groups, network protocol, and associated Lambda compute resource types.
" }, "NetworkConnectorsList":{ "type":"list", "member":{"shape":"NetworkConnectorSummary"}, "max":50, "min":0 }, "NetworkProtocol":{ "type":"string", "enum":[ "IPv4", "DualStack" ] }, "ResourceConflictException":{ "type":"structure", "members":{ "Type":{ "shape":"String", "documentation":"The exception type.
" }, "message":{"shape":"String"} }, "documentation":"The request could not be completed due to a conflict with the current state of the resource. For example, attempting to update a connector that is not in ACTIVE state.
The exception type.
" }, "Message":{"shape":"String"} }, "documentation":"The specified network connector does not exist. Verify the identifier (ID, name, or ARN) and Region.
", "error":{ "httpStatusCode":404, "senderFault":true }, "exception":true }, "ServiceException":{ "type":"structure", "members":{ "Type":{ "shape":"String", "documentation":"The exception type.
" }, "Message":{"shape":"String"} }, "documentation":"An internal service error occurred. Retry the request with exponential backoff.
", "error":{"httpStatusCode":500}, "exception":true, "fault":true }, "String":{"type":"string"}, "ThrottleReason":{ "type":"string", "enum":[ "ConcurrentInvocationLimitExceeded", "FunctionInvocationRateLimitExceeded", "ReservedFunctionConcurrentInvocationLimitExceeded", "ReservedFunctionInvocationRateLimitExceeded", "CallerRateLimitExceeded", "ConcurrentSnapshotCreateLimitExceeded" ] }, "TooManyRequestsException":{ "type":"structure", "members":{ "retryAfterSeconds":{ "shape":"String", "documentation":"The number of seconds to wait before retrying the request.
", "location":"header", "locationName":"Retry-After" }, "Type":{ "shape":"String", "documentation":"The exception type.
" }, "message":{"shape":"String"}, "Reason":{ "shape":"ThrottleReason", "documentation":"The reason for the throttling.
" } }, "documentation":"The request was throttled due to exceeding the allowed request rate. Retry the request after a brief wait using exponential backoff.
", "error":{ "httpStatusCode":429, "senderFault":true }, "exception":true }, "UpdateNetworkConnectorRequest":{ "type":"structure", "required":["Identifier"], "members":{ "Identifier":{ "shape":"NetworkConnectorIdentifier", "location":"uri", "locationName":"Identifier" }, "Configuration":{ "shape":"NetworkConnectorConfiguration", "documentation":"The updated network configuration for the connector. Provide the full VpcEgressConfiguration including all subnet IDs and security group IDs — this replaces the existing configuration.
The updated ARN of the IAM role that Lambda assumes to manage ENIs. Use this to change the operator role without recreating the connector.
" }, "ClientToken":{ "shape":"ClientTokenString", "documentation":"A unique, case-sensitive identifier to ensure idempotency of the update request.
", "idempotencyToken":true } } }, "UpdateNetworkConnectorResponse":{ "type":"structure", "required":[ "Arn", "Name", "Id" ], "members":{ "Arn":{ "shape":"NetworkConnectorArn", "documentation":"The Amazon Resource Name (ARN) of the network connector.
" }, "Name":{ "shape":"NetworkConnectorName", "documentation":"The name of the network connector.
" }, "Id":{"shape":"NetworkConnectorId"}, "OperatorRole":{ "shape":"NetworkConnectorRoleArn", "documentation":"The ARN of the IAM role that Lambda uses to manage the underlying ENI resources for this connector.
" }, "Configuration":{ "shape":"NetworkConnectorConfiguration", "documentation":"The network configuration of the connector, including VPC subnets and security groups.
" }, "State":{ "shape":"NetworkConnectorState", "documentation":"The current state of the network connector.
" }, "LastUpdateStatus":{ "shape":"NetworkConnectorLastUpdateStatus", "documentation":"The status of this update operation (typically InProgress immediately after the call).
A human-readable explanation of the update status.
" }, "LastModified":{ "shape":"CoreTimestamp", "documentation":"The timestamp of this update.
" } } } }, "documentation":"AWS Lambda Core is a set of APIs for managing shared infrastructure resources used by AWS Lambda. The Lambda Core API provides operations for creating and managing network connectors that enable Lambda MicroVMs to access resources in your Amazon Virtual Private Cloud (Amazon VPC).
Network connectors provision elastic network interfaces (ENIs) in your VPC subnets, providing a managed network path from Lambda compute environments to private resources such as Amazon RDS databases, Amazon ElastiCache clusters, and internal APIs. You create a network connector once and attach it to one or more Lambda MicroVMs at run time.
" }