2026/09/17 - Amazon VPC Lattice - 5 updated api methods
Changes Adding support for CIDR Resource Configuration
{'protocol': {'TCP_UDP'},
'resourceConfigurationDefinition': {'cidrResource': {'cidrRanges': ['string']}},
'type': {'CIDR'}}
Creates a resource configuration. A resource configuration defines a specific resource. You can associate a resource configuration with a service network or a VPC endpoint.
See also: AWS API Documentation
Request Syntax
client.create_resource_configuration(
name='string',
type='GROUP'|'CHILD'|'SINGLE'|'ARN'|'CIDR',
portRanges=[
'string',
],
protocol='TCP'|'TCP_UDP',
resourceGatewayIdentifier='string',
resourceConfigurationGroupIdentifier='string',
resourceConfigurationDefinition={
'dnsResource': {
'domainName': 'string',
'ipAddressType': 'IPV4'|'IPV6'|'DUALSTACK'
},
'ipResource': {
'ipAddress': 'string'
},
'arnResource': {
'arn': 'string'
},
'cidrResource': {
'cidrRanges': [
'string',
]
}
},
allowAssociationToShareableServiceNetwork=True|False,
customDomainName='string',
groupDomain='string',
domainVerificationIdentifier='string',
clientToken='string',
tags={
'string': 'string'
}
)
string
[REQUIRED]
The name of the resource configuration. The name must be unique within the account. The valid characters are a-z, 0-9, and hyphens (-). You can't use a hyphen as the first or last character, or immediately after another hyphen.
string
[REQUIRED]
The type of resource configuration. A resource configuration can be one of the following types:
SINGLE - A single resource.
GROUP - A group of resources. You must create a group resource configuration before you create a child resource configuration.
CHILD - A single resource that is part of a group resource configuration.
ARN - An Amazon Web Services resource.
CIDR - A network segment, expressed as a range of IP addresses (a CIDR block). Use this type to share a portion of your network rather than an individual resource. A consumer accesses the resources within the CIDR range through a Tunnel VPC endpoint. You can't add a CIDR resource configuration to a service network. A CIDR resource configuration must be associated with a resource gateway whose DNS resolution is set to IN_VPC.
list
(SINGLE, GROUP, CHILD, CIDR) The port ranges that a consumer can use to access a resource configuration (for example: 1-65535). You can separate port ranges using commas (for example: 1,2,22-30). To resolve DNS through a CIDR resource configuration, include port 53 in the port ranges.
(string) --
string
(SINGLE, GROUP, CIDR) The protocol accepted by the resource configuration. The default is TCP. TCP_UDP is supported only for CIDR resource configurations; specify it for a CIDR resource configuration to allow DNS resolution, which uses UDP.
string
(SINGLE, GROUP, ARN, CIDR) The ID or ARN of the resource gateway used to connect to the resource configuration. For a child resource configuration, this value is inherited from the parent resource configuration. For a CIDR resource configuration, the associated resource gateway must have its DNS resolution set to IN_VPC so that DNS queries resolve in the context of your VPC.
string
(CHILD) The ID or ARN of the parent resource configuration of type GROUP. This is used to associate a child resource configuration with a group resource configuration.
dict
Identifies the resource configuration in one of the following ways:
Amazon Resource Name (ARN) - Supported resource-types that are provisioned by Amazon Web Services services, such as RDS databases, can be identified by their ARN.
Domain name - Any domain name that is publicly resolvable.
IP address - For IPv4 and IPv6, only IP addresses in the VPC are supported.
CIDR range - For a resource configuration of type CIDR, specify a cidrResource with one or more cidrRanges (for example, 10.0.0.0/16) that cover the IP addresses of the resources you want to make accessible. You can specify up to 10 ranges, using IPv4, IPv6, or both, and each range must include a prefix length. To represent your entire network, specify 0.0.0.0/0 (IPv4) or ::/0 (IPv6) as the only range. You can't use reserved ranges such as 169.254.0.0/16, 100.64.0.0/10, 224.0.0.0/4, fe80::/10, or ff00::/8.
dnsResource (dict) --
The DNS name of the resource.
domainName (string) --
The domain name of the resource.
ipAddressType (string) --
The type of IP address. Dualstack is currently not supported.
ipResource (dict) --
The IP resource.
ipAddress (string) --
The IP address of the IP resource.
arnResource (dict) --
The Amazon Resource Name (ARN) of the resource.
arn (string) --
The Amazon Resource Name (ARN) of the resource.
cidrResource (dict) --
The network segment for a resource configuration of type CIDR, specified as one or more CIDR ranges ( cidrRanges). Resources whose IP addresses fall within these ranges are reachable through a Tunnel VPC endpoint.
cidrRanges (list) --
The CIDR ranges of the network segment, for example, 10.0.0.0/16.
(string) --
boolean
(SINGLE, GROUP, ARN) Specifies whether the resource configuration can be associated with a sharable service network. The default is false.
string
A custom domain name for your resource configuration. Additionally, provide a DomainVerificationID to prove your ownership of a domain.
string
(GROUP) The group domain for a group resource configuration. Any domains that you create for the child resource are subdomains of the group domain. Child resources inherit the verification status of the domain.
string
The domain verification ID of your verified custom domain name. If you don't provide an ID, you must configure the DNS settings yourself.
string
A unique, case-sensitive identifier that you provide to ensure the idempotency of the request. If you retry a request that completed successfully using the same client token and parameters, the retry succeeds without performing any actions. If the parameters aren't identical, the retry fails.
This field is autopopulated if not provided.
dict
The tags for the resource configuration.
(string) --
The key of the tag.
Constraints: Tag keys are case-sensitive and accept a maximum of 128 Unicode characters. Valid characters are Unicode letters, digits, white space, and any of the following symbols: _ . : / = + - @ May not begin with aws:.
(string) --
The value of the tag.
Constraints: Tag values are case-sensitive and accept a maximum of 256 Unicode characters. Valid characters are Unicode letters, digits, white space, and any of the following symbols: _ . : / = + - @
dict
Response Syntax
{
'id': 'string',
'name': 'string',
'arn': 'string',
'resourceGatewayId': 'string',
'resourceConfigurationGroupId': 'string',
'type': 'GROUP'|'CHILD'|'SINGLE'|'ARN'|'CIDR',
'portRanges': [
'string',
],
'protocol': 'TCP'|'TCP_UDP',
'status': 'ACTIVE'|'CREATE_IN_PROGRESS'|'UPDATE_IN_PROGRESS'|'DELETE_IN_PROGRESS'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETE_FAILED',
'resourceConfigurationDefinition': {
'dnsResource': {
'domainName': 'string',
'ipAddressType': 'IPV4'|'IPV6'|'DUALSTACK'
},
'ipResource': {
'ipAddress': 'string'
},
'arnResource': {
'arn': 'string'
},
'cidrResource': {
'cidrRanges': [
'string',
]
}
},
'allowAssociationToShareableServiceNetwork': True|False,
'createdAt': datetime(2015, 1, 1),
'failureReason': 'string',
'customDomainName': 'string',
'domainVerificationId': 'string',
'groupDomain': 'string',
'domainVerificationArn': 'string'
}
Response Structure
(dict) --
id (string) --
The ID of the resource configuration.
name (string) --
The name of the resource configuration.
arn (string) --
The Amazon Resource Name (ARN) of the resource configuration.
resourceGatewayId (string) --
The ID of the resource gateway associated with the resource configuration.
resourceConfigurationGroupId (string) --
The ID of the parent resource configuration of type GROUP.
type (string) --
The type of resource configuration. A resource configuration can be one of the following types:
SINGLE - A single resource.
GROUP - A group of resources. You must create a group resource configuration before you create a child resource configuration.
CHILD - A single resource that is part of a group resource configuration.
ARN - An Amazon Web Services resource.
CIDR - A network segment, expressed as a range of IP addresses (a CIDR block). A consumer accesses the resources within the CIDR range through a Tunnel VPC endpoint. A CIDR resource configuration must be associated with a resource gateway whose DNS resolution is set to IN_VPC.
portRanges (list) --
The port range.
(string) --
protocol (string) --
The protocol.
status (string) --
The current status of the resource configuration.
resourceConfigurationDefinition (dict) --
Identifies the resource configuration in one of the following ways:
Amazon Resource Name (ARN) - Supported resource-types that are provisioned by Amazon Web Services services, such as RDS databases, can be identified by their ARN.
Domain name - Any domain name that is publicly resolvable.
IP address - For IPv4 and IPv6, only IP addresses in the VPC are supported.
dnsResource (dict) --
The DNS name of the resource.
domainName (string) --
The domain name of the resource.
ipAddressType (string) --
The type of IP address. Dualstack is currently not supported.
ipResource (dict) --
The IP resource.
ipAddress (string) --
The IP address of the IP resource.
arnResource (dict) --
The Amazon Resource Name (ARN) of the resource.
arn (string) --
The Amazon Resource Name (ARN) of the resource.
cidrResource (dict) --
The network segment for a resource configuration of type CIDR, specified as one or more CIDR ranges ( cidrRanges). Resources whose IP addresses fall within these ranges are reachable through a Tunnel VPC endpoint.
cidrRanges (list) --
The CIDR ranges of the network segment, for example, 10.0.0.0/16.
(string) --
allowAssociationToShareableServiceNetwork (boolean) --
Specifies whether the resource configuration can be associated with a sharable service network.
createdAt (datetime) --
The date and time that the resource configuration was created, in ISO-8601 format.
failureReason (string) --
The reason that the request failed.
customDomainName (string) --
The custom domain name for your resource configuration.
domainVerificationId (string) --
The domain name verification ID.
groupDomain (string) --
(GROUP) The group domain for a group resource configuration. Any domains that you create for the child resource are subdomains of the group domain. Child resources inherit the verification status of the domain.
domainVerificationArn (string) --
The verification ID ARN
{'protocol': {'TCP_UDP'},
'resourceConfigurationDefinition': {'cidrResource': {'cidrRanges': ['string']}},
'type': {'CIDR'}}
Retrieves information about the specified resource configuration.
See also: AWS API Documentation
Request Syntax
client.get_resource_configuration(
resourceConfigurationIdentifier='string'
)
string
[REQUIRED]
The ID of the resource configuration.
dict
Response Syntax
{
'id': 'string',
'name': 'string',
'arn': 'string',
'resourceGatewayId': 'string',
'resourceConfigurationGroupId': 'string',
'type': 'GROUP'|'CHILD'|'SINGLE'|'ARN'|'CIDR',
'allowAssociationToShareableServiceNetwork': True|False,
'portRanges': [
'string',
],
'protocol': 'TCP'|'TCP_UDP',
'customDomainName': 'string',
'status': 'ACTIVE'|'CREATE_IN_PROGRESS'|'UPDATE_IN_PROGRESS'|'DELETE_IN_PROGRESS'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETE_FAILED',
'resourceConfigurationDefinition': {
'dnsResource': {
'domainName': 'string',
'ipAddressType': 'IPV4'|'IPV6'|'DUALSTACK'
},
'ipResource': {
'ipAddress': 'string'
},
'arnResource': {
'arn': 'string'
},
'cidrResource': {
'cidrRanges': [
'string',
]
}
},
'createdAt': datetime(2015, 1, 1),
'amazonManaged': True|False,
'failureReason': 'string',
'lastUpdatedAt': datetime(2015, 1, 1),
'domainVerificationId': 'string',
'domainVerificationArn': 'string',
'domainVerificationStatus': 'VERIFIED'|'PENDING'|'VERIFICATION_TIMED_OUT',
'groupDomain': 'string'
}
Response Structure
(dict) --
id (string) --
The ID of the resource configuration.
name (string) --
The name of the resource configuration.
arn (string) --
The Amazon Resource Name (ARN) of the resource configuration.
resourceGatewayId (string) --
The ID of the resource gateway used to connect to the resource configuration in a given VPC. You can specify the resource gateway identifier only for resource configurations with type SINGLE, GROUP, ARN, or CIDR.
resourceConfigurationGroupId (string) --
The ID of the group resource configuration.
type (string) --
The type of resource configuration.
SINGLE - A single resource.
GROUP - A group of resources.
CHILD - A single resource that is part of a group resource configuration.
ARN - An Amazon Web Services resource.
CIDR - A network segment (a range of IP addresses) accessed through a Tunnel VPC endpoint.
allowAssociationToShareableServiceNetwork (boolean) --
Specifies whether the resource configuration is associated with a sharable service network.
portRanges (list) --
The TCP port ranges that a consumer can use to access a resource configuration. You can separate port ranges with a comma. Example: 1-65535 or 1,2,22-30
(string) --
protocol (string) --
The TCP protocol accepted by the specified resource configuration.
customDomainName (string) --
The custom domain name of the resource configuration.
status (string) --
The status of the resource configuration.
resourceConfigurationDefinition (dict) --
The resource configuration.
dnsResource (dict) --
The DNS name of the resource.
domainName (string) --
The domain name of the resource.
ipAddressType (string) --
The type of IP address. Dualstack is currently not supported.
ipResource (dict) --
The IP resource.
ipAddress (string) --
The IP address of the IP resource.
arnResource (dict) --
The Amazon Resource Name (ARN) of the resource.
arn (string) --
The Amazon Resource Name (ARN) of the resource.
cidrResource (dict) --
The network segment for a resource configuration of type CIDR, specified as one or more CIDR ranges ( cidrRanges). Resources whose IP addresses fall within these ranges are reachable through a Tunnel VPC endpoint.
cidrRanges (list) --
The CIDR ranges of the network segment, for example, 10.0.0.0/16.
(string) --
createdAt (datetime) --
The date and time that the resource configuration was created, in ISO-8601 format.
amazonManaged (boolean) --
Indicates whether the resource configuration was created and is managed by Amazon.
failureReason (string) --
The reason the create-resource-configuration request failed.
lastUpdatedAt (datetime) --
The most recent date and time that the resource configuration was updated, in ISO-8601 format.
domainVerificationId (string) --
The domain verification ID.
domainVerificationArn (string) --
The ARN of the domain verification.
domainVerificationStatus (string) --
The domain verification status.
groupDomain (string) --
(GROUP) The group domain for a group resource configuration. Any domains that you create for the child resource are subdomains of the group domain. Child resources inherit the verification status of the domain.
{'items': {'type': {'CIDR'}}}
Lists the resource configurations owned by or shared with this account.
See also: AWS API Documentation
Request Syntax
client.list_resource_configurations(
resourceGatewayIdentifier='string',
resourceConfigurationGroupIdentifier='string',
domainVerificationIdentifier='string',
maxResults=123,
nextToken='string'
)
string
The ID of the resource gateway for the resource configuration.
string
The ID of the resource configuration of type Group.
string
The domain verification ID.
integer
The maximum page size.
string
A pagination token for the next page of results.
dict
Response Syntax
{
'items': [
{
'id': 'string',
'name': 'string',
'arn': 'string',
'resourceGatewayId': 'string',
'resourceConfigurationGroupId': 'string',
'type': 'GROUP'|'CHILD'|'SINGLE'|'ARN'|'CIDR',
'status': 'ACTIVE'|'CREATE_IN_PROGRESS'|'UPDATE_IN_PROGRESS'|'DELETE_IN_PROGRESS'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETE_FAILED',
'amazonManaged': True|False,
'createdAt': datetime(2015, 1, 1),
'lastUpdatedAt': datetime(2015, 1, 1),
'customDomainName': 'string',
'domainVerificationId': 'string',
'groupDomain': 'string'
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
items (list) --
Information about the resource configurations.
(dict) --
Summary information about a resource configuration.
id (string) --
The ID of the resource configuration.
name (string) --
The name of the resource configuration.
arn (string) --
The Amazon Resource Name (ARN) of the resource configuration.
resourceGatewayId (string) --
The ID of the resource gateway.
resourceConfigurationGroupId (string) --
The ID of the group resource configuration.
type (string) --
The type of resource configuration.
SINGLE - A single resource.
GROUP - A group of resources. You must create a group resource configuration before you create a child resource configuration.
CHILD - A single resource that is part of a group resource configuration.
ARN - An Amazon Web Services resource.
CIDR - A network segment (a range of IP addresses) accessed through a Tunnel VPC endpoint.
status (string) --
The status of the resource configuration.
amazonManaged (boolean) --
Indicates whether the resource configuration was created and is managed by Amazon.
createdAt (datetime) --
The date and time that the resource configuration was created, in ISO-8601 format.
lastUpdatedAt (datetime) --
The most recent date and time that the resource configuration was updated, in ISO-8601 format.
customDomainName (string) --
The custom domain name.
domainVerificationId (string) --
The domain verification ID.
groupDomain (string) --
(GROUP) The group domain for a group resource configuration. Any domains that you create for the child resource are subdomains of the group domain. Child resources inherit the verification status of the domain.
nextToken (string) --
If there are additional results, a pagination token for the next page of results.
{'items': {'payerResponsibility': [{'payerResponsibilityType': 'VpcEndpointAccount '
'| '
'ResourceGatewayAccount',
'scope': 'ResourceGatewayCharges'}]}}
Lists the associations for the specified VPC endpoint.
See also: AWS API Documentation
Request Syntax
client.list_resource_endpoint_associations(
resourceConfigurationIdentifier='string',
resourceEndpointAssociationIdentifier='string',
vpcEndpointId='string',
vpcEndpointOwner='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The ID for the resource configuration associated with the VPC endpoint.
string
The ID of the association.
string
The ID of the VPC endpoint in the association.
string
The owner of the VPC endpoint in the association.
integer
The maximum page size.
string
A pagination token for the next page of results.
dict
Response Syntax
{
'items': [
{
'id': 'string',
'arn': 'string',
'resourceConfigurationId': 'string',
'resourceConfigurationArn': 'string',
'resourceConfigurationName': 'string',
'vpcEndpointId': 'string',
'vpcEndpointOwner': 'string',
'createdBy': 'string',
'createdAt': datetime(2015, 1, 1),
'payerResponsibility': [
{
'scope': 'ResourceGatewayCharges',
'payerResponsibilityType': 'VpcEndpointAccount'|'ResourceGatewayAccount'
},
]
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
items (list) --
Information about the VPC endpoint associations.
(dict) --
Summary information about a VPC endpoint association.
id (string) --
The ID of the VPC endpoint association.
arn (string) --
The Amazon Resource Name (ARN) of the VPC endpoint association.
resourceConfigurationId (string) --
The ID of the resource configuration.
resourceConfigurationArn (string) --
The Amazon Resource Name (ARN) of the resource configuration.
resourceConfigurationName (string) --
The name of the resource configuration.
vpcEndpointId (string) --
The ID of the VPC endpoint.
vpcEndpointOwner (string) --
The owner of the VPC endpoint.
createdBy (string) --
The account that created the association.
createdAt (datetime) --
The date and time that the VPC endpoint association was created, in ISO-8601 format.
payerResponsibility (list) --
Who pays for each category of charges on the VPC endpoint association.
(dict) --
Specifies which account pays for a category of charges on a VPC endpoint association.
scope (string) --
The category of charges that this entry applies to. ResourceGatewayCharges covers the resource gateway's data processing charge.
payerResponsibilityType (string) --
The account that pays this category of charges. VpcEndpointAccount owns the VPC endpoint. ResourceGatewayAccount owns the resource gateway.
nextToken (string) --
If there are additional results, a pagination token for the next page of results.
{'resourceConfigurationDefinition': {'cidrResource': {'cidrRanges': ['string']}}}
Response {'protocol': {'TCP_UDP'},
'resourceConfigurationDefinition': {'cidrResource': {'cidrRanges': ['string']}},
'type': {'CIDR'}}
Updates the specified resource configuration.
See also: AWS API Documentation
Request Syntax
client.update_resource_configuration(
resourceConfigurationIdentifier='string',
resourceConfigurationDefinition={
'dnsResource': {
'domainName': 'string',
'ipAddressType': 'IPV4'|'IPV6'|'DUALSTACK'
},
'ipResource': {
'ipAddress': 'string'
},
'arnResource': {
'arn': 'string'
},
'cidrResource': {
'cidrRanges': [
'string',
]
}
},
allowAssociationToShareableServiceNetwork=True|False,
portRanges=[
'string',
]
)
string
[REQUIRED]
The ID of the resource configuration.
dict
Identifies the resource configuration in one of the following ways:
Amazon Resource Name (ARN) - Supported resource-types that are provisioned by Amazon Web Services services, such as RDS databases, can be identified by their ARN.
Domain name - Any domain name that is publicly resolvable.
IP address - For IPv4 and IPv6, only IP addresses in the VPC are supported.
dnsResource (dict) --
The DNS name of the resource.
domainName (string) --
The domain name of the resource.
ipAddressType (string) --
The type of IP address. Dualstack is currently not supported.
ipResource (dict) --
The IP resource.
ipAddress (string) --
The IP address of the IP resource.
arnResource (dict) --
The Amazon Resource Name (ARN) of the resource.
arn (string) --
The Amazon Resource Name (ARN) of the resource.
cidrResource (dict) --
The network segment for a resource configuration of type CIDR, specified as one or more CIDR ranges ( cidrRanges). Resources whose IP addresses fall within these ranges are reachable through a Tunnel VPC endpoint.
cidrRanges (list) --
The CIDR ranges of the network segment, for example, 10.0.0.0/16.
(string) --
boolean
Indicates whether to add the resource configuration to service networks that are shared with other accounts.
list
The TCP port ranges that a consumer can use to access a resource configuration. You can separate port ranges with a comma. Example: 1-65535 or 1,2,22-30
(string) --
dict
Response Syntax
{
'id': 'string',
'name': 'string',
'arn': 'string',
'resourceGatewayId': 'string',
'resourceConfigurationGroupId': 'string',
'type': 'GROUP'|'CHILD'|'SINGLE'|'ARN'|'CIDR',
'portRanges': [
'string',
],
'allowAssociationToShareableServiceNetwork': True|False,
'protocol': 'TCP'|'TCP_UDP',
'status': 'ACTIVE'|'CREATE_IN_PROGRESS'|'UPDATE_IN_PROGRESS'|'DELETE_IN_PROGRESS'|'CREATE_FAILED'|'UPDATE_FAILED'|'DELETE_FAILED',
'resourceConfigurationDefinition': {
'dnsResource': {
'domainName': 'string',
'ipAddressType': 'IPV4'|'IPV6'|'DUALSTACK'
},
'ipResource': {
'ipAddress': 'string'
},
'arnResource': {
'arn': 'string'
},
'cidrResource': {
'cidrRanges': [
'string',
]
}
}
}
Response Structure
(dict) --
id (string) --
The ID of the resource configuration.
name (string) --
The name of the resource configuration.
arn (string) --
The Amazon Resource Name (ARN) of the resource configuration.
resourceGatewayId (string) --
The ID of the resource gateway associated with the resource configuration.
resourceConfigurationGroupId (string) --
The ID of the group resource configuration.
type (string) --
The type of resource configuration.
SINGLE - A single resource.
GROUP - A group of resources.
CHILD - A single resource that is part of a group resource configuration.
ARN - An Amazon Web Services resource.
CIDR - A network segment (a range of IP addresses) accessed through a Tunnel VPC endpoint.
portRanges (list) --
The TCP port ranges that a consumer can use to access a resource configuration. You can separate port ranges with a comma. Example: 1-65535 or 1,2,22-30
(string) --
allowAssociationToShareableServiceNetwork (boolean) --
Indicates whether to add the resource configuration to service networks that are shared with other accounts.
protocol (string) --
The TCP protocol accepted by the specified resource configuration.
status (string) --
The status of the resource configuration.
resourceConfigurationDefinition (dict) --
The resource configuration.
dnsResource (dict) --
The DNS name of the resource.
domainName (string) --
The domain name of the resource.
ipAddressType (string) --
The type of IP address. Dualstack is currently not supported.
ipResource (dict) --
The IP resource.
ipAddress (string) --
The IP address of the IP resource.
arnResource (dict) --
The Amazon Resource Name (ARN) of the resource.
arn (string) --
The Amazon Resource Name (ARN) of the resource.
cidrResource (dict) --
The network segment for a resource configuration of type CIDR, specified as one or more CIDR ranges ( cidrRanges). Resources whose IP addresses fall within these ranges are reachable through a Tunnel VPC endpoint.
cidrRanges (list) --
The CIDR ranges of the network segment, for example, 10.0.0.0/16.
(string) --