AWS API Changes

2026/07/29 - Amazon Elastic Compute Cloud - 3 new2 updated api methods

Changes This release adds support for policy-based routing on AWS Transit Gateway, enabling you to route traffic based on 5-tuple matching (source IP, destination IP, source port, destination port, and protocol) using new policy table entry APIs that direct matching traffic to a target route table.

CreateTransitGatewayPolicyTableEntry (new)

Link ¶

Creates an entry in a transit gateway policy table to route matching traffic to a specified route table.

See also: AWS API Documentation

Request Syntax

client.create_transit_gateway_policy_table_entry(
    TransitGatewayPolicyTableId='string',
    PolicyRuleNumber='string',
    PolicyRule={
        'SourceCidrBlock': 'string',
        'SourcePortRange': 'string',
        'DestinationCidrBlock': 'string',
        'DestinationPortRange': 'string',
        'Protocol': 'string',
        'MetaData': {
            'MetaDataKey': 'string',
            'MetaDataValue': 'string'
        }
    },
    TargetRouteTableId='string',
    DryRun=True|False
)

type TransitGatewayPolicyTableId:

string

param TransitGatewayPolicyTableId:

[REQUIRED]

The ID of the transit gateway policy table.

type PolicyRuleNumber:

string

param PolicyRuleNumber:

[REQUIRED]

The rule number for the policy table entry. Lower rule numbers are evaluated first and take precedence.

type PolicyRule:

dict

param PolicyRule:

The matching criteria for the policy table entry.

SourceCidrBlock (string) --

The source CIDR block for the policy rule.
SourcePortRange (string) --

The source port or port range for the policy rule. You can specify a port range only when Protocol is 6 (TCP) or 17 (UDP); for all other protocols, this value must be *.
DestinationCidrBlock (string) --

The destination CIDR block for the policy rule.
DestinationPortRange (string) --

The destination port or port range for the policy rule. You can specify a port range only when Protocol is 6 (TCP) or 17 (UDP); for all other protocols, this value must be *.
Protocol (string) --

The protocol for the policy rule. Valid values are 1 (ICMP), 6 (TCP), 17 (UDP), 47 (GRE), or * for all protocols.
MetaData (dict) --

The metadata key-value pair for the policy rule.
- MetaDataKey (string) --
  
  The key of the metadata pair for the policy rule.
- MetaDataValue (string) --
  
  The value of the metadata pair for the policy rule.

type TargetRouteTableId:

string

param TargetRouteTableId:

[REQUIRED]

The ID of the transit gateway route table to use for traffic matching this rule.

type DryRun:

boolean

param DryRun:

Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.

rtype:

dict

returns:

Response Syntax

{
    'TransitGatewayPolicyTableEntry': {
        'PolicyRuleNumber': 'string',
        'PolicyRule': {
            'SourceCidrBlock': 'string',
            'SourcePortRange': 'string',
            'DestinationCidrBlock': 'string',
            'DestinationPortRange': 'string',
            'Protocol': 'string',
            'MetaData': {
                'MetaDataKey': 'string',
                'MetaDataValue': 'string'
            }
        },
        'TargetRouteTableId': 'string',
        'State': 'active'|'deleted'
    }
}

Response Structure

(dict) --
- TransitGatewayPolicyTableEntry (dict) --
  
  Describes a transit gateway policy table entry
  - PolicyRuleNumber (string) --
    
    The rule number for the transit gateway policy table entry.
  - PolicyRule (dict) --
    
    The policy rule associated with the transit gateway policy table.
    - SourceCidrBlock (string) --
      
      The source CIDR block for the transit gateway policy rule.
    - SourcePortRange (string) --
      
      The source port or port range for the transit gateway policy rule.
    - DestinationCidrBlock (string) --
      
      The destination CIDR block for the transit gateway policy rule.
    - DestinationPortRange (string) --
      
      The destination port or port range for the transit gateway policy rule.
    - Protocol (string) --
      
      The protocol used by the transit gateway policy rule.
    - MetaData (dict) --
      
      The meta data tags used for the transit gateway policy rule.
      - MetaDataKey (string) --
        
        The key name for the transit gateway policy rule meta data tag.
      - MetaDataValue (string) --
        
        The value of the key for the transit gateway policy rule meta data tag.
  - TargetRouteTableId (string) --
    
    The ID of the target route table.
  - State (string) --
    
    The state of the transit gateway policy table entry.

ModifyTransitGatewayPolicyTableEntry (new)

Link ¶

Modifies the specified transit gateway policy table entry.

See also: AWS API Documentation

Request Syntax

client.modify_transit_gateway_policy_table_entry(
    TransitGatewayPolicyTableId='string',
    PolicyRuleNumber='string',
    PolicyRule={
        'SourceCidrBlock': 'string',
        'SourcePortRange': 'string',
        'DestinationCidrBlock': 'string',
        'DestinationPortRange': 'string',
        'Protocol': 'string',
        'MetaData': {
            'MetaDataKey': 'string',
            'MetaDataValue': 'string'
        }
    },
    TargetRouteTableId='string',
    DryRun=True|False
)

type TransitGatewayPolicyTableId:

string

param TransitGatewayPolicyTableId:

[REQUIRED]

The ID of the transit gateway policy table.

type PolicyRuleNumber:

string

param PolicyRuleNumber:

[REQUIRED]

The rule number of the policy table entry to modify.

type PolicyRule:

dict

param PolicyRule:

The updated matching criteria for the policy table entry. Unspecified fields retain their current values.

SourceCidrBlock (string) --

The source CIDR block for the policy rule.
SourcePortRange (string) --

The source port or port range for the policy rule. You can specify a port range only when Protocol is 6 (TCP) or 17 (UDP); for all other protocols, this value must be *.
DestinationCidrBlock (string) --

The destination CIDR block for the policy rule.
DestinationPortRange (string) --

The destination port or port range for the policy rule. You can specify a port range only when Protocol is 6 (TCP) or 17 (UDP); for all other protocols, this value must be *.
Protocol (string) --

The protocol for the policy rule. Valid values are 1 (ICMP), 6 (TCP), 17 (UDP), 47 (GRE), or * for all protocols.
MetaData (dict) --

The metadata key-value pair for the policy rule.
- MetaDataKey (string) --
  
  The key of the metadata pair for the policy rule.
- MetaDataValue (string) --
  
  The value of the metadata pair for the policy rule.

type TargetRouteTableId:

string

param TargetRouteTableId:

The ID of the transit gateway route table to use for traffic matching this rule.

type DryRun:

boolean

param DryRun:

rtype:

dict

returns:

Response Syntax

{
    'TransitGatewayPolicyTableEntry': {
        'PolicyRuleNumber': 'string',
        'PolicyRule': {
            'SourceCidrBlock': 'string',
            'SourcePortRange': 'string',
            'DestinationCidrBlock': 'string',
            'DestinationPortRange': 'string',
            'Protocol': 'string',
            'MetaData': {
                'MetaDataKey': 'string',
                'MetaDataValue': 'string'
            }
        },
        'TargetRouteTableId': 'string',
        'State': 'active'|'deleted'
    }
}

Response Structure

(dict) --
- TransitGatewayPolicyTableEntry (dict) --
  
  Describes a transit gateway policy table entry
  - PolicyRuleNumber (string) --
    
    The rule number for the transit gateway policy table entry.
  - PolicyRule (dict) --
    
    The policy rule associated with the transit gateway policy table.
    - SourceCidrBlock (string) --
      
      The source CIDR block for the transit gateway policy rule.
    - SourcePortRange (string) --
      
      The source port or port range for the transit gateway policy rule.
    - DestinationCidrBlock (string) --
      
      The destination CIDR block for the transit gateway policy rule.
    - DestinationPortRange (string) --
      
      The destination port or port range for the transit gateway policy rule.
    - Protocol (string) --
      
      The protocol used by the transit gateway policy rule.
    - MetaData (dict) --
      
      The meta data tags used for the transit gateway policy rule.
      - MetaDataKey (string) --
        
        The key name for the transit gateway policy rule meta data tag.
      - MetaDataValue (string) --
        
        The value of the key for the transit gateway policy rule meta data tag.
  - TargetRouteTableId (string) --
    
    The ID of the target route table.
  - State (string) --
    
    The state of the transit gateway policy table entry.

DeleteTransitGatewayPolicyTableEntry (new)

Link ¶

Deletes the specified transit gateway policy table entry.

See also: AWS API Documentation

Request Syntax

client.delete_transit_gateway_policy_table_entry(
    TransitGatewayPolicyTableId='string',
    PolicyRuleNumber='string',
    DryRun=True|False
)

type TransitGatewayPolicyTableId:

string

param TransitGatewayPolicyTableId:

[REQUIRED]

The ID of the transit gateway policy table.

type PolicyRuleNumber:

string

param PolicyRuleNumber:

[REQUIRED]

The rule number of the policy table entry to delete.

type DryRun:

boolean

param DryRun:

rtype:

dict

returns:

Response Syntax

{
    'TransitGatewayPolicyTableEntry': {
        'PolicyRuleNumber': 'string',
        'PolicyRule': {
            'SourceCidrBlock': 'string',
            'SourcePortRange': 'string',
            'DestinationCidrBlock': 'string',
            'DestinationPortRange': 'string',
            'Protocol': 'string',
            'MetaData': {
                'MetaDataKey': 'string',
                'MetaDataValue': 'string'
            }
        },
        'TargetRouteTableId': 'string',
        'State': 'active'|'deleted'
    }
}

Response Structure

(dict) --
- TransitGatewayPolicyTableEntry (dict) --
  
  Describes a transit gateway policy table entry
  - PolicyRuleNumber (string) --
    
    The rule number for the transit gateway policy table entry.
  - PolicyRule (dict) --
    
    The policy rule associated with the transit gateway policy table.
    - SourceCidrBlock (string) --
      
      The source CIDR block for the transit gateway policy rule.
    - SourcePortRange (string) --
      
      The source port or port range for the transit gateway policy rule.
    - DestinationCidrBlock (string) --
      
      The destination CIDR block for the transit gateway policy rule.
    - DestinationPortRange (string) --
      
      The destination port or port range for the transit gateway policy rule.
    - Protocol (string) --
      
      The protocol used by the transit gateway policy rule.
    - MetaData (dict) --
      
      The meta data tags used for the transit gateway policy rule.
      - MetaDataKey (string) --
        
        The key name for the transit gateway policy rule meta data tag.
      - MetaDataValue (string) --
        
        The value of the key for the transit gateway policy rule meta data tag.
  - TargetRouteTableId (string) --
    
    The ID of the target route table.
  - State (string) --
    
    The state of the transit gateway policy table entry.

DescribeTransitGatewayAttachments (updated)

Link ¶
Changes (response)

{'TransitGatewayAttachments': {'Association': {'TransitGatewayPolicyTableId': 'string'}}}

Describes one or more attachments between resources and transit gateways. By default, all attachments are described. Alternatively, you can filter the results by attachment ID, attachment state, resource ID, or resource owner.

See also: AWS API Documentation

Request Syntax

client.describe_transit_gateway_attachments(
    TransitGatewayAttachmentIds=[
        'string',
    ],
    Filters=[
        {
            'Name': 'string',
            'Values': [
                'string',
            ]
        },
    ],
    MaxResults=123,
    NextToken='string',
    DryRun=True|False
)

type TransitGatewayAttachmentIds:

list

param TransitGatewayAttachmentIds:

The IDs of the attachments.

(string) --

type Filters:

list

param Filters:

One or more filters. The possible values are:

association.state - The state of the association ( associating | associated | disassociating).
association.transit-gateway-route-table-id - The ID of the route table for the transit gateway.
resource-id - The ID of the resource.
resource-owner-id - The ID of the Amazon Web Services account that owns the resource.
resource-type - The resource type. Valid values are vpc | vpn | direct-connect-gateway | peering | connect.
state - The state of the attachment. Valid values are available | deleted | deleting | failed | failing | initiatingRequest | modifying | pendingAcceptance | pending | rollingBack | rejected | rejecting.
transit-gateway-attachment-id - The ID of the attachment.
transit-gateway-id - The ID of the transit gateway.
transit-gateway-owner-id - The ID of the Amazon Web Services account that owns the transit gateway.

(dict) --

A filter name and value pair that is used to return a more specific list of results from a describe operation. Filters can be used to match a set of resources by specific criteria, such as tags, attributes, or IDs.

If you specify multiple filters, the filters are joined with an AND, and the request returns only results that match all of the specified filters.

For more information, see List and filter using the CLI and API in the Amazon EC2 User Guide.
- Name (string) --
  
  The name of the filter. Filter names are case-sensitive.
- Values (list) --
  
  The filter values. Filter values are case-sensitive. If you specify multiple values for a filter, the values are joined with an OR, and the request returns all results that match any of the specified values.
  - (string) --

type MaxResults:

integer

param MaxResults:

The maximum number of results to return with a single call. To retrieve the remaining results, make another call with the returned nextToken value.

type NextToken:

string

param NextToken:

The token for the next page of results.

type DryRun:

boolean

param DryRun:

rtype:

dict

returns:

Response Syntax

{
    'TransitGatewayAttachments': [
        {
            'TransitGatewayAttachmentId': 'string',
            'TransitGatewayId': 'string',
            'TransitGatewayOwnerId': 'string',
            'ResourceOwnerId': 'string',
            'ResourceType': 'vpc'|'vpn'|'vpn-concentrator'|'direct-connect-gateway'|'connect'|'peering'|'tgw-peering'|'network-function'|'client-vpn',
            'ResourceId': 'string',
            'State': 'initiating'|'initiatingRequest'|'pendingAcceptance'|'rollingBack'|'pending'|'available'|'modifying'|'deleting'|'deleted'|'failed'|'rejected'|'rejecting'|'failing',
            'Association': {
                'TransitGatewayRouteTableId': 'string',
                'TransitGatewayPolicyTableId': 'string',
                'State': 'associating'|'associated'|'disassociating'|'disassociated'
            },
            'CreationTime': datetime(2015, 1, 1),
            'Tags': [
                {
                    'Key': 'string',
                    'Value': 'string'
                },
            ]
        },
    ],
    'NextToken': 'string'
}

Response Structure

(dict) --
- TransitGatewayAttachments (list) --
  
  Information about the attachments.
  - (dict) --
    
    Describes an attachment between a resource and a transit gateway.
    - TransitGatewayAttachmentId (string) --
      
      The ID of the attachment.
    - TransitGatewayId (string) --
      
      The ID of the transit gateway.
    - TransitGatewayOwnerId (string) --
      
      The ID of the Amazon Web Services account that owns the transit gateway.
    - ResourceOwnerId (string) --
      
      The ID of the Amazon Web Services account that owns the resource.
    - ResourceType (string) --
      
      The resource type. Note that the tgw-peering resource type has been deprecated.
    - ResourceId (string) --
      
      The ID of the resource.
    - State (string) --
      
      The attachment state. Note that the initiating state has been deprecated.
    - Association (dict) --
      
      The association.
      - TransitGatewayRouteTableId (string) --
        
        The ID of the route table for the transit gateway.
      - TransitGatewayPolicyTableId (string) --
        
        The ID of the transit gateway policy table associated with the attachment.
      - State (string) --
        
        The state of the association.
    - CreationTime (datetime) --
      
      The creation time.
    - Tags (list) --
      
      The tags for the attachment.
      - (dict) --
        
        Describes a tag.
        
        Key (string) --
        
        The key of the tag.
        
        Constraints: Tag keys are case-sensitive and accept a maximum of 127 Unicode characters. May not begin with aws:.
        
        Value (string) --
        
        The value of the tag.
        
        Constraints: Tag values are case-sensitive and accept a maximum of 256 Unicode characters.
- NextToken (string) --
  
  The token to use to retrieve the next page of results. This value is null when there are no more results to return.

GetTransitGatewayPolicyTableEntries (updated)

Link ¶
Changes (response)

{'NextToken': 'string',
 'TransitGatewayPolicyTableEntries': {'State': 'active | deleted'}}

Returns a list of transit gateway policy table entries.

See also: AWS API Documentation

Request Syntax

client.get_transit_gateway_policy_table_entries(
    TransitGatewayPolicyTableId='string',
    Filters=[
        {
            'Name': 'string',
            'Values': [
                'string',
            ]
        },
    ],
    MaxResults=123,
    NextToken='string',
    DryRun=True|False
)

type TransitGatewayPolicyTableId:

string

param TransitGatewayPolicyTableId:

[REQUIRED]

The ID of the transit gateway policy table.

type Filters:

list

param Filters:

One or more filters. The possible values are:

policy-rule-number - The rule number for the transit gateway policy table entry.
target-route-table-id - The ID of the target route table.
policy-rule.source-ip - The source CIDR block for the policy rule.
policy-rule.destination-ip - The destination CIDR block for the policy rule.
policy-rule.source-port - The source port or port range for the policy rule.
policy-rule.destination-port - The destination port or port range for the policy rule.
policy-rule.protocol - The protocol for the policy rule.
policy-rule.meta-data.key - The metadata key for the policy rule.
policy-rule.meta-data.value - The metadata value for the policy rule.

(dict) --

A filter name and value pair that is used to return a more specific list of results from a describe operation. Filters can be used to match a set of resources by specific criteria, such as tags, attributes, or IDs.

If you specify multiple filters, the filters are joined with an AND, and the request returns only results that match all of the specified filters.

For more information, see List and filter using the CLI and API in the Amazon EC2 User Guide.
- Name (string) --
  
  The name of the filter. Filter names are case-sensitive.
- Values (list) --
  
  The filter values. Filter values are case-sensitive. If you specify multiple values for a filter, the values are joined with an OR, and the request returns all results that match any of the specified values.
  - (string) --

type MaxResults:

integer

param MaxResults:

The maximum number of results to return with a single call. To retrieve the remaining results, make another call with the returned nextToken value.

type NextToken:

string

param NextToken:

The token for the next page of results.

type DryRun:

boolean

param DryRun:

rtype:

dict

returns:

Response Syntax

{
    'TransitGatewayPolicyTableEntries': [
        {
            'PolicyRuleNumber': 'string',
            'PolicyRule': {
                'SourceCidrBlock': 'string',
                'SourcePortRange': 'string',
                'DestinationCidrBlock': 'string',
                'DestinationPortRange': 'string',
                'Protocol': 'string',
                'MetaData': {
                    'MetaDataKey': 'string',
                    'MetaDataValue': 'string'
                }
            },
            'TargetRouteTableId': 'string',
            'State': 'active'|'deleted'
        },
    ],
    'NextToken': 'string'
}

Response Structure

(dict) --
- TransitGatewayPolicyTableEntries (list) --
  
  The entries for the transit gateway policy table.
  - (dict) --
    
    Describes a transit gateway policy table entry
    - PolicyRuleNumber (string) --
      
      The rule number for the transit gateway policy table entry.
    - PolicyRule (dict) --
      
      The policy rule associated with the transit gateway policy table.
      - SourceCidrBlock (string) --
        
        The source CIDR block for the transit gateway policy rule.
      - SourcePortRange (string) --
        
        The source port or port range for the transit gateway policy rule.
      - DestinationCidrBlock (string) --
        
        The destination CIDR block for the transit gateway policy rule.
      - DestinationPortRange (string) --
        
        The destination port or port range for the transit gateway policy rule.
      - Protocol (string) --
        
        The protocol used by the transit gateway policy rule.
      - MetaData (dict) --
        
        The meta data tags used for the transit gateway policy rule.
        
        MetaDataKey (string) --
        
        The key name for the transit gateway policy rule meta data tag.
        
        MetaDataValue (string) --
        
        The value of the key for the transit gateway policy rule meta data tag.
    - TargetRouteTableId (string) --
      
      The ID of the target route table.
    - State (string) --
      
      The state of the transit gateway policy table entry.
- NextToken (string) --
  
  The token to use to retrieve the next page of results. This value is null when there are no more results to return.