Amazon EC2 Ec2 Vpc Encryption Control API

openapi: 3.2.0
info:
  title: Amazon Elastic Compute Cloud Vpc Encryption Control API
  version: '2016-11-15'
  description: Generated from AWS's published Smithy model for Amazon Elastic Compute Cloud. 4 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://ec2.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Vpc Encryption Control
paths:
  /?Action=CreateVpcEncryptionControl:
    post:
      operationId: CreateVpcEncryptionControl
      summary: Create Vpc Encryption Control
      description: Creates a VPC Encryption Control configuration for a specified VPC. VPC Encryption Control enables you to enforce encryption for all data in transit within and between VPCs to meet compliance requirements for standards like HIPAA, FedRAMP, and PCI DSS. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/CreateVpcEncryptionControlResult'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: CreateVpcEncryptionControl
                  Version:
                    type: string
                    const: '2016-11-15'
              - $ref: '#/components/schemas/CreateVpcEncryptionControlRequest'
      tags:
      - Vpc Encryption Control
  /?Action=DeleteVpcEncryptionControl:
    post:
      operationId: DeleteVpcEncryptionControl
      summary: Delete Vpc Encryption Control
      description: Deletes a VPC Encryption Control configuration. This removes the encryption policy enforcement from the specified VPC. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/DeleteVpcEncryptionControlResult'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: DeleteVpcEncryptionControl
                  Version:
                    type: string
                    const: '2016-11-15'
              - $ref: '#/components/schemas/DeleteVpcEncryptionControlRequest'
      tags:
      - Vpc Encryption Control
  /?Action=DescribeVpcEncryptionControls:
    post:
      operationId: DescribeVpcEncryptionControls
      summary: Describe Vpc Encryption Controls
      description: Describes one or more VPC Encryption Control configurations. VPC Encryption Control enables you to enforce encryption for all data in transit within and between VPCs to meet compliance requirements You can filter the results to return information about specific encryption controls or VPCs. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/DescribeVpcEncryptionControlsResult'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: DescribeVpcEncryptionControls
                  Version:
                    type: string
                    const: '2016-11-15'
              - $ref: '#/components/schemas/DescribeVpcEncryptionControlsRequest'
      tags:
      - Vpc Encryption Control
  /?Action=ModifyVpcEncryptionControl:
    post:
      operationId: ModifyVpcEncryptionControl
      summary: Modify Vpc Encryption Control
      description: Modifies the encryption control configuration for a VPC. You can update the encryption mode and exclusion settings for various gateway types and peering connections. For more information, see Enforce VPC encryption in transit in the Amazon VPC User Guide.
      responses:
        '200':
          description: Success
          content:
            text/xml:
              schema:
                $ref: '#/components/schemas/ModifyVpcEncryptionControlResult'
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              allOf:
              - type: object
                required:
                - Action
                - Version
                properties:
                  Action:
                    type: string
                    const: ModifyVpcEncryptionControl
                  Version:
                    type: string
                    const: '2016-11-15'
              - $ref: '#/components/schemas/ModifyVpcEncryptionControlRequest'
      tags:
      - Vpc Encryption Control
components:
  schemas:
    DescribeVpcEncryptionControlsResult:
      type: object
      properties:
        VpcEncryptionControls:
          type: array
          items:
            $ref: '#/components/schemas/VpcEncryptionControl'
          description: Information about the VPC Encryption Control configurations.
        NextToken:
          type: string
          description: The token to include in another request to get the next page of items. This value is null when there are no more items to return.
    Tag:
      type: object
      properties:
        Key:
          type: string
          description: 'The key of the tag. Constraints: Tag keys are case-sensitive and accept a maximum of 127 Unicode characters. May not begin with aws:.'
        Value:
          type: string
          description: 'The value of the tag. Constraints: Tag values are case-sensitive and accept a maximum of 256 Unicode characters.'
    ModifyVpcEncryptionControlResult:
      type: object
      properties:
        VpcEncryptionControl:
          $ref: '#/components/schemas/VpcEncryptionControl'
    DescribeVpcEncryptionControlsRequest:
      type: object
      properties:
        DryRun:
          type: boolean
          description: Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.
        Filters:
          type: array
          items:
            $ref: '#/components/schemas/Filter'
          description: The filters to apply to the request.
        VpcEncryptionControlIds:
          type: array
          items:
            type: string
          description: The IDs of the VPC Encryption Control configurations to describe.
        VpcIds:
          type: array
          items:
            type: string
          description: The IDs of the VPCs to describe encryption control configurations for.
        NextToken:
          type: string
          description: The token returned from a previous paginated request. Pagination continues from the end of the items returned by the previous request.
        MaxResults:
          type: integer
          description: The maximum number of items to return for this request. To get the next page of items, make another request with the token returned in the output. For more information, see Pagination.
    DeleteVpcEncryptionControlRequest:
      type: object
      properties:
        DryRun:
          type: boolean
          description: Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.
        VpcEncryptionControlId:
          type: string
          description: The ID of the VPC Encryption Control resource to delete.
      required:
      - VpcEncryptionControlId
    VpcEncryptionControl:
      type: object
      properties:
        VpcId:
          type: string
          description: The ID of the VPC associated with the encryption control configuration.
        VpcEncryptionControlId:
          type: string
          description: The ID of the VPC Encryption Control configuration.
        Mode:
          type: string
          enum:
          - monitor
          - enforce
          description: The encryption mode for the VPC Encryption Control configuration.
        State:
          type: string
          enum:
          - enforce-in-progress
          - monitor-in-progress
          - enforce-failed
          - monitor-failed
          - deleting
          - deleted
          - available
          - creating
          - delete-failed
          description: The current state of the VPC Encryption Control configuration.
        StateMessage:
          type: string
          description: A message providing additional information about the encryption control state.
        ResourceExclusions:
          $ref: '#/components/schemas/VpcEncryptionControlExclusions'
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: The tags assigned to the VPC Encryption Control configuration.
    CreateVpcEncryptionControlRequest:
      type: object
      properties:
        DryRun:
          type: boolean
          description: Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.
        VpcId:
          type: string
          description: The ID of the VPC for which to create the encryption control configuration.
        TagSpecifications:
          type: array
          items:
            $ref: '#/components/schemas/TagSpecification'
          description: The tags to apply to the VPC Encryption Control resource.
      required:
      - VpcId
    CreateVpcEncryptionControlResult:
      type: object
      properties:
        VpcEncryptionControl:
          $ref: '#/components/schemas/VpcEncryptionControl'
    VpcEncryptionControlExclusions:
      type: object
      properties:
        InternetGateway:
          $ref: '#/components/schemas/VpcEncryptionControlExclusion'
        EgressOnlyInternetGateway:
          $ref: '#/components/schemas/VpcEncryptionControlExclusion'
        NatGateway:
          $ref: '#/components/schemas/VpcEncryptionControlExclusion'
        VirtualPrivateGateway:
          $ref: '#/components/schemas/VpcEncryptionControlExclusion'
        VpcPeering:
          $ref: '#/components/schemas/VpcEncryptionControlExclusion'
        Lambda:
          $ref: '#/components/schemas/VpcEncryptionControlExclusion'
        VpcLattice:
          $ref: '#/components/schemas/VpcEncryptionControlExclusion'
        ElasticFileSystem:
          $ref: '#/components/schemas/VpcEncryptionControlExclusion'
    VpcEncryptionControlExclusion:
      type: object
      properties:
        State:
          type: string
          enum:
          - enabling
          - enabled
          - disabling
          - disabled
          description: The current state of the exclusion configuration.
        StateMessage:
          type: string
          description: A message providing additional information about the exclusion state.
    TagSpecification:
      type: object
      properties:
        ResourceType:
          type: string
          enum:
          - capacity-reservation
          - client-vpn-endpoint
          - customer-gateway
          - carrier-gateway
          - coip-pool
          - declarative-policies-report
          - dedicated-host
          - dhcp-options
          - egress-only-internet-gateway
          - elastic-ip
          - elastic-gpu
          - export-image-task
          - export-instance-task
          - fleet
          - fpga-image
          - host-reservation
          - image
          - image-usage-report
          - import-image-task
          - import-snapshot-task
          - instance
          - instance-event-window
          - internet-gateway
          - ipam
          - ipam-pool
          - ipam-scope
          - ipv4pool-ec2
          - ipv6pool-ec2
          - key-pair
          - launch-template
          - local-gateway
          - local-gateway-route-table
          - local-gateway-virtual-interface
          - local-gateway-virtual-interface-group
          - local-gateway-route-table-vpc-association
          - local-gateway-route-table-virtual-interface-group-association
          - natgateway
          - network-acl
          - network-interface
          - network-insights-analysis
          - network-insights-path
          - network-insights-access-scope
          - network-insights-access-scope-analysis
          - outpost-lag
          - placement-group
          - prefix-list
          - replace-root-volume-task
          - reserved-instances
          - route-table
          - security-group
          - security-group-rule
          - service-link-virtual-interface
          - snapshot
          - spot-fleet-request
          - spot-instances-request
          - subnet
          - subnet-cidr-reservation
          - traffic-mirror-filter
          - traffic-mirror-session
          - traffic-mirror-target
          - transit-gateway
          - transit-gateway-attachment
          - transit-gateway-connect-peer
          - transit-gateway-multicast-domain
          - transit-gateway-policy-table
          - transit-gateway-metering-policy
          - transit-gateway-route-table
          - transit-gateway-route-table-announcement
          - volume
          - vpc
          - vpc-endpoint
          - vpc-endpoint-connection
          - vpc-endpoint-service
          - vpc-endpoint-service-permission
          - vpc-peering-connection
          - vpn-connection
          - vpn-gateway
          - vpc-flow-log
          - capacity-reservation-fleet
          - traffic-mirror-filter-rule
          - vpc-endpoint-connection-device-type
          - verified-access-instance
          - verified-access-group
          - verified-access-endpoint
          - verified-access-policy
          - verified-access-trust-provider
          - vpn-connection-device-type
          - vpc-block-public-access-exclusion
          - vpc-encryption-control
          - route-server
          - route-server-endpoint
          - route-server-peer
          - ipam-resource-discovery
          - ipam-resource-discovery-association
          - instance-connect-endpoint
          - verified-access-endpoint-target
          - ipam-external-resource-verification-token
          - capacity-block
          - mac-modification-task
          - ipam-prefix-list-resolver
          - ipam-policy
          - ipam-prefix-list-resolver-target
          - ipam-internet-registry-association
          - secondary-interface
          - secondary-network
          - secondary-subnet
          - capacity-manager-data-export
          - vpn-concentrator
          - ipam-pool-allocation
          - capacity-reservation-cancellation-quote
          - application-status-check
          - capacity-reservation-modification-quote
          description: The type of resource to tag on creation.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: The tags to apply to the resource.
    ModifyVpcEncryptionControlRequest:
      type: object
      properties:
        DryRun:
          type: boolean
          description: Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.
        VpcEncryptionControlId:
          type: string
          description: The ID of the VPC Encryption Control resource to modify.
        Mode:
          type: string
          enum:
          - monitor
          - enforce
          description: The encryption mode for the VPC Encryption Control configuration.
        InternetGatewayExclusion:
          type: string
          enum:
          - enable
          - disable
          description: Specifies whether to exclude internet gateway traffic from encryption enforcement.
        EgressOnlyInternetGatewayExclusion:
          type: string
          enum:
          - enable
          - disable
          description: Specifies whether to exclude egress-only internet gateway traffic from encryption enforcement.
        NatGatewayExclusion:
          type: string
          enum:
          - enable
          - disable
          description: Specifies whether to exclude NAT gateway traffic from encryption enforcement.
        VirtualPrivateGatewayExclusion:
          type: string
          enum:
          - enable
          - disable
          description: Specifies whether to exclude virtual private gateway traffic from encryption enforcement.
        VpcPeeringExclusion:
          type: string
          enum:
          - enable
          - disable
          description: Specifies whether to exclude VPC peering connection traffic from encryption enforcement.
        LambdaExclusion:
          type: string
          enum:
          - enable
          - disable
          description: Specifies whether to exclude Lambda function traffic from encryption enforcement.
        VpcLatticeExclusion:
          type: string
          enum:
          - enable
          - disable
          description: Specifies whether to exclude VPC Lattice traffic from encryption enforcement.
        ElasticFileSystemExclusion:
          type: string
          enum:
          - enable
          - disable
          description: Specifies whether to exclude Elastic File System traffic from encryption enforcement.
      required:
      - VpcEncryptionControlId
    Filter:
      type: object
      properties:
        Name:
          type: string
          description: The name of the filter. Filter names are case-sensitive.
        Values:
          type: array
          items:
            type: string
          description: The filter values. Filter values are case-sensitive. If you specify multiple values for a filter, the values are joined with an OR, and the request returns all results that match any of the specified values.
    DeleteVpcEncryptionControlResult:
      type: object
      properties:
        VpcEncryptionControl:
          $ref: '#/components/schemas/VpcEncryptionControl'
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: ec2
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/ec2/service/2016-11-15/ec2-2016-11-15.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)