Sign in

v1

latestOpenAPI 3.0.0Apache 2.0 License2026-07-171,1822,9897.4 MB

Creates a VPN connection between an existing virtual private gateway or transit gateway and a customer gateway. The supported connection type is ipsec.1.

The response includes information that you need to give to your network administrator to configure your customer gateway.

We strongly recommend that you use HTTPS when calling this operation because the response contains sensitive cryptographic information for configuring your customer gateway device.

If you decide to shut down your VPN connection for any reason and later create a new VPN connection, you must reconfigure your customer gateway with the new information returned from this call.

This is an idempotent operation. If you perform the operation more than once, Amazon EC2 doesn't return an error.

For more information, see Amazon Web Services Site-to-Site VPN in the Amazon Web Services Site-to-Site VPN User Guide.

get/#Action=CreateVpnConnection

Query parameters

CustomerGatewayIdstring required

The ID of the customer gateway.

Typestring required

The type of VPN connection (<code>ipsec.1</code>).

VpnGatewayIdstring

The ID of the virtual private gateway. If you specify a virtual private gateway, you cannot specify a transit gateway.

TransitGatewayIdstring

The ID of the transit gateway. If you specify a transit gateway, you cannot specify a virtual private gateway.

DryRunboolean

Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is <code>DryRunOperation</code>. Otherwise, it is <code>UnauthorizedOperation</code>.

EnableAccelerationboolean
<p>Indicate whether to enable acceleration for the VPN connection.</p> <p>Default: <code>false</code> </p>
StaticRoutesOnlyboolean
<p>Indicate whether the VPN connection uses static routes only. If you are creating a VPN connection for a device that does not support BGP, you must specify <code>true</code>. Use <a>CreateVpnConnectionRoute</a> to create a static route.</p> <p>Default: <code>false</code> </p>
TunnelInsideIpVersion'ipv4' | 'ipv6'
<p>Indicate whether the VPN tunnels process IPv4 or IPv6 traffic.</p> <p>Default: <code>ipv4</code> </p>
LocalIpv4NetworkCidrstring
<p>The IPv4 CIDR on the customer gateway (on-premises) side of the VPN connection.</p> <p>Default: <code>0.0.0.0/0</code> </p>
RemoteIpv4NetworkCidrstring
<p>The IPv4 CIDR on the Amazon Web Services side of the VPN connection.</p> <p>Default: <code>0.0.0.0/0</code> </p>
LocalIpv6NetworkCidrstring
<p>The IPv6 CIDR on the customer gateway (on-premises) side of the VPN connection.</p> <p>Default: <code>::/0</code> </p>
RemoteIpv6NetworkCidrstring
<p>The IPv6 CIDR on the Amazon Web Services side of the VPN connection.</p> <p>Default: <code>::/0</code> </p>
OutsideIpAddressTypestring
<p>The type of IPv4 address assigned to the outside interface of the customer gateway device.</p> <p>Valid values: <code>PrivateIpv4</code> | <code>PublicIpv4</code> </p> <p>Default: <code>PublicIpv4</code> </p>
TransportTransitGatewayAttachmentIdstring
<p>The transit gateway attachment ID to use for the VPN tunnel.</p> <p>Required if <code>OutsideIpAddressType</code> is set to <code>PrivateIpv4</code>.</p>

The options for the VPN connection.

ResourceType'capacity-reservation' | 'client-vpn-endpoint' | 'customer-gateway' | 'carrier-gateway' | 'coip-pool' | 'dedicated-host' | 'dhcp-options' | 'egress-only-internet-gateway' | 'elastic-ip' | 'elastic-gpu' | 'export-image-task' | 'export-instance-task' | 'fleet' | 'fpga-image' | 'host-reservation' | 'image' | 'import-image-task' | 'import-snapshot-task' | 'instance' | 'instance-event-window' | 'internet-gateway' | 'ipam' | 'ipam-pool' | 'ipam-scope' | 'ipv4pool-ec2' | 'ipv6pool-ec2' | 'key-pair' | 'launch-template' | 'local-gateway' | 'local-gateway-route-table' | 'local-gateway-virtual-interface' | 'local-gateway-virtual-interface-group' | 'local-gateway-route-table-vpc-association' | 'local-gateway-route-table-virtual-interface-group-association' | 'natgateway' | 'network-acl' | 'network-interface' | 'network-insights-analysis' | 'network-insights-path' | 'network-insights-access-scope' | 'network-insights-access-scope-analysis' | 'placement-group' | 'prefix-list' | 'replace-root-volume-task' | 'reserved-instances' | 'route-table' | 'security-group' | 'security-group-rule' | 'snapshot' | 'spot-fleet-request' | 'spot-instances-request' | 'subnet' | 'subnet-cidr-reservation' | 'traffic-mirror-filter' | 'traffic-mirror-session' | 'traffic-mirror-target' | 'transit-gateway' | 'transit-gateway-attachment' | 'transit-gateway-connect-peer' | 'transit-gateway-multicast-domain' | 'transit-gateway-policy-table' | 'transit-gateway-route-table' | 'transit-gateway-route-table-announcement' | 'volume' | 'vpc' | 'vpc-endpoint' | 'vpc-endpoint-connection' | 'vpc-endpoint-service' | 'vpc-endpoint-service-permission' | 'vpc-peering-connection' | 'vpn-connection' | 'vpn-gateway' | 'vpc-flow-log' | 'capacity-reservation-fleet' | 'traffic-mirror-filter-rule' | 'vpc-endpoint-connection-device-type' | 'verified-access-instance' | 'verified-access-group' | 'verified-access-endpoint' | 'verified-access-policy' | 'verified-access-trust-provider' | 'vpn-connection-device-type' | 'vpc-block-public-access-exclusion' | 'ipam-resource-discovery' | 'ipam-resource-discovery-association'

The type of resource to tag on creation.

The tags to apply to the VPN connection.

Action'CreateVpnConnection' required
Version'2016-11-15' required

Response

Success