---
title: "POST /servicenetworkvpcassociations"
method: POST
path: "/servicenetworkvpcassociations"
---

# POST /servicenetworkvpcassociations

`POST /servicenetworkvpcassociations`

Associates a VPC with a service network. When you associate a VPC with the service network, it enables all the resources within that VPC to be clients and communicate with other services in the service network. For more information, see [Manage VPC associations](https://docs.aws.amazon.com/vpc-lattice/latest/ug/service-network-associations.html#service-network-vpc-associations) in the _Amazon VPC Lattice User Guide_.

You can't use this operation if there is a disassociation in progress. If the association fails, retry by deleting the association and recreating it.

As a result of this operation, the association gets created in the service network account and the VPC owner account.

If you add a security group to the service network and VPC association, the association must continue to always have at least one security group. You can add or edit security groups at any time. However, to remove all security groups, you must first delete the association and recreate it without security groups.

## Request body

- object
  - `clientToken` string — A unique, case-sensitive identifier that you provide to ensure the idempotency of the request. If you retry a request that completed successfully using the same client token and parameters, the retry succeeds without performing any actions. If the parameters aren't identical, the retry fails.
  - `serviceNetworkIdentifier` string, required — The ID or ARN of the service network. You must use an ARN if the resources are in different accounts.
  - `vpcIdentifier` string, required — The ID of the VPC.
  - `privateDnsEnabled` boolean — Indicates if private DNS is enabled for the VPC association.
  - `securityGroupIds` SecurityGroupId[] — The IDs of the security groups. Security groups aren't added by default. You can add a security group to apply network level controls to control which resources in a VPC are allowed to access the service network and its services. For more information, see <a href="https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html">Control traffic to resources using security groups</a> in the <i>Amazon VPC User Guide</i>.
  - `tags` object — The tags for the association.
  - `dnsOptions` object — The DNS configuration options.
    - `privateDnsPreference` 'VERIFIED_DOMAINS_ONLY' | 'ALL_DOMAINS' | 'VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS' | 'SPECIFIED_DOMAINS_ONLY' — <p> The preference for which private domains have a private hosted zone created for and associated with the specified VPC. Only supported when private DNS is enabled and when the VPC endpoint type is ServiceNetwork or Resource. </p> <ul> <li> <p> <code>ALL_DOMAINS</code> - VPC Lattice provisions private hosted zones for all custom domain names.</p> </li> <li> <p> <code>VERIFIED_DOMAINS_ONLY</code> - VPC Lattice provisions a private hosted zone only if custom domain name has been verified by the provider.</p> </li> <li> <p> <code>VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS</code> - VPC Lattice provisions private hosted zones for all verified custom domain names and other domain names that the resource consumer specifies. The resource consumer specifies the domain names in the privateDnsSpecifiedDomains parameter.</p> </li> <li> <p> <code>SPECIFIED_DOMAINS_ONLY</code> - VPC Lattice provisions a private hosted zone for domain names specified by the resource consumer. The resource consumer specifies the domain names in the privateDnsSpecifiedDomains parameter.</p> </li> </ul>
    - `privateDnsSpecifiedDomains` PrivateDnsSpecifiedDomain[] — Indicates which of the private domains to create private hosted zones for and associate with the specified VPC. Only supported when private DNS is enabled and the private DNS preference is <code>VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS</code> or <code>SPECIFIED_DOMAINS_ONLY</code>.

## Response `200`

Success

- CreateServiceNetworkVpcAssociationResponse
  - `id` string — The ID of the association.
  - `status` 'CREATE_IN_PROGRESS' | 'ACTIVE' | 'UPDATE_IN_PROGRESS' | 'DELETE_IN_PROGRESS' | 'CREATE_FAILED' | 'DELETE_FAILED' | 'UPDATE_FAILED' — The association status.
  - `arn` string — The Amazon Resource Name (ARN) of the association.
  - `createdBy` string — The account that created the association.
  - `securityGroupIds` SecurityGroupId[] — The IDs of the security groups.
  - `privateDnsEnabled` boolean — Indicates if private DNS is enabled for the VPC association.
  - `dnsOptions` DnsOptions — The DNS configuration options.
    - `privateDnsPreference` 'VERIFIED_DOMAINS_ONLY' | 'ALL_DOMAINS' | 'VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS' | 'SPECIFIED_DOMAINS_ONLY' — <p> The preference for which private domains have a private hosted zone created for and associated with the specified VPC. Only supported when private DNS is enabled and when the VPC endpoint type is ServiceNetwork or Resource. </p> <ul> <li> <p> <code>ALL_DOMAINS</code> - VPC Lattice provisions private hosted zones for all custom domain names.</p> </li> <li> <p> <code>VERIFIED_DOMAINS_ONLY</code> - VPC Lattice provisions a private hosted zone only if custom domain name has been verified by the provider.</p> </li> <li> <p> <code>VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS</code> - VPC Lattice provisions private hosted zones for all verified custom domain names and other domain names that the resource consumer specifies. The resource consumer specifies the domain names in the privateDnsSpecifiedDomains parameter.</p> </li> <li> <p> <code>SPECIFIED_DOMAINS_ONLY</code> - VPC Lattice provisions a private hosted zone for domain names specified by the resource consumer. The resource consumer specifies the domain names in the privateDnsSpecifiedDomains parameter.</p> </li> </ul>
    - `privateDnsSpecifiedDomains` PrivateDnsSpecifiedDomain[] — Indicates which of the private domains to create private hosted zones for and associate with the specified VPC. Only supported when private DNS is enabled and the private DNS preference is <code>VERIFIED_DOMAINS_AND_SPECIFIED_DOMAINS</code> or <code>SPECIFIED_DOMAINS_ONLY</code>.

## Other responses

- `480` — ValidationException
- `481` — AccessDeniedException
- `482` — ConflictException
- `483` — ResourceNotFoundException
- `484` — ThrottlingException
- `485` — ServiceQuotaExceededException
- `486` — InternalServerException

---

[API](https://skmtc.net/aws/apis/vpc-lattice.md) · [All operations](https://skmtc.net/aws/apis/vpc-lattice/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/vpc-lattice/versions/bbec5439e0f7/schema)