Your AWS NAT Gateway Cost Audit Report

Opportunity #1 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# VPC
        vpc = ec2.Vpc(
            self,
            "Ingress",
            cidr="10.1.0.0/16",
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="Private-Subnet", subnet_type=ec2.SubnetType.PRIVATE_ISOLATED,

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #2 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# Create a VPC for our infrastructure
        vpc = ec2.Vpc(self, "VPC")

        # Read and prepare user data script for EC2 instances
        data = open("./httpd.sh", "rb").read()
        httpd=ec2.UserData.for_linux()
        httpd.add_commands(str(data,'utf-8'))

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #3 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueueArm64")

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #4 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #5 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #6 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super().__init__(app, id, **kwargs)

        vpc = ec2.Vpc(self, "VPC")

        asg = autoscaling.AutoScalingGroup(
            self, "ASG",
            vpc=vpc,
            instance_type=ec2.InstanceType.of(
                ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #7 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #8 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #9 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

from aws_cdk import CfnOutput, Stack
from aws_cdk.aws_ec2 import Vpc, NatProvider, SubnetConfiguration, SubnetType
from constructs import Construct

class NetworkStack(Stack):

    def __init__(self, scope: Construct, id: str, props, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #10 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

#    region=region)
        
        vpc = ec2.Vpc(
            self,"LabVpc",
            cidr="10.10.0.0/24"
        )

        #Instance
        instance = ec2.Instance(self,

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #11 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC)]
            )

        # AMI
        amzn_linux = ec2.MachineImage.latest_amazon_linux(
            generation=ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #12 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

night_max = nightschedule[2]["max"]

        vpc = ec2.Vpc(self, "ecsVpc", max_azs=2)

        ecs_cluster = ecs.Cluster(
            self,
            id="ecscluster",
            vpc=vpc,
            container_insights=True,

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #13 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super().__init__(scope, construct_id, **kwargs)
        # Creating a shared VPC with public subnets and private subnets with NAT Gateways
        vpc = ec2.Vpc(self, "ServiceConnectVPC",
                    ip_addresses=ec2.IpAddresses.cidr("10.0.0.0/16"),
                    create_internet_gateway=True,
                    max_azs=2,
                    nat_gateways=2,
                    enable_dns_hostnames=True,
                    enable_dns_support=True,

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #14 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        asg = autoscaling.AutoScalingGroup(
            self, "MyFleet",

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #15 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #16 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# Create VPC with 2 Availability Zones
vpc = ec2.Vpc(
    stack, "MyVpc",
    max_azs=2
)

# Create ECS cluster in the VPC
cluster = ecs.Cluster(

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #17 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "awsvpc-ecs-demo-cluster",

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #18 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "EcsCluster",

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #19 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #20 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# Create a cluster
        vpc = ec2.Vpc(
            self, "Vpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'fargate-service-autoscaling',

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #21 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

VOLUME_NAME = 'cdk-ecs-sample-efs-volume'

        vpc = ec2.Vpc(
            self, PREFIX + 'Vpc',
            max_azs=2
        )

        ecs_cluster = ecs.Cluster(
            self, PREFIX + 'Cluster',

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #22 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

self,
            "vpc",
            nat_gateways=0,
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="public", subnet_type=ec2.SubnetType.PUBLIC
                )
            ],
        )

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #23 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# VPC in which the MSK cluster and client are located
        vpc = ec2.Vpc(self, "MskVpc",
            cidr="10.0.0.0/16",
            nat_gateways=1,
            max_azs=2,
            subnet_configuration = subnets)

        # MSK cluster and an EC2 Instance used to create the topics

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #24 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# The code that defines your stack goes here

        self.vpc = ec2.Vpc(self, "VPC",
                           max_azs=2,
                           cidr="10.10.0.0/16",
                           # configuration will create 3 groups in 2 AZs = 6 subnets.
                           subnet_configuration=[ec2.SubnetConfiguration(
                               subnet_type=ec2.SubnetType.PUBLIC,
                               name="Public",

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #25 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "SvlCTCWLVpc")
        es_sec_grp = ec2.SecurityGroup(
            self,
            "SvlCTCWLOpenSearchSecGrp",
            vpc=vpc,
            allow_all_outbound=True,
            security_group_name="SvlCTCWLSecGrp",

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #26 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "OpenSearch VPC", max_azs=3)

        ################################################################################
        # Amazon OpenSearch Service domain
        es_sec_grp = ec2.SecurityGroup(
            self,
            "OpenSearchSecGrp",

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #27 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "IcePlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #28 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "LavaPlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #29 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #30 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super().__init__(scope, construct_id, **kwargs)

        vpc = ec2.Vpc(self, "ecsVpc")

        s3_bucket = s3.Bucket(
            self,
            "bucket",
            access_control=s3.BucketAccessControl.PRIVATE,
            encryption=s3.BucketEncryption.S3_MANAGED,

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #31 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC,cidr_mask=24)],
        )

        # Instance Role and SSM Managed Policy
        role = iam.Role(self, "ec2Role", assumed_by=iam.ServicePrincipal("ec2.amazonaws.com"))

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #32 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

def create_VPC(self):
        vpc = ec2.Vpc(
            self,
            "Vpc",
            ip_addresses = ec2.IpAddresses.cidr(VPC_CIDR),
            subnet_configuration = [
                ec2.SubnetConfiguration(
                    name = 'Public-Subent',

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #33 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

this.vpc = new ec2.Vpc(this, 'nested-stack-vpc', {
      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
      natGateways: 0,
      maxAzs: 3,
      subnetConfiguration: [
        {
          name: 'public-subnet-1',
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 24,

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #34 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #35 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

this.vpc = new Vpc(this, 'vpc', {
        maxAzs: 3,
        natGateways: 1,
        enableDnsHostnames: true,
        enableDnsSupport: true,
        ipAddresses: IpAddresses.cidr('10.0.0.0/16'),
        subnetConfiguration: [
        {
            cidrMask: 24,

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #36 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      maxAzs: 2,
      natGateways: 0,
    });

    // Create the required IAM role which allows the SFTP server
    // to log to CloudWatch.
    const cloudWatchLoggingRole = new iam.Role(this, 'CloudWatchLoggingRole', {
      assumedBy: new iam.ServicePrincipal('transfer.amazonaws.com'),

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #37 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// VPC for Batch compute environment
    const vpc = new ec2.Vpc(this, 'OpenMPVPC', {
      maxAzs: 2,
      natGateways: 1,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'Public',

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #38 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super(scope, id, props);

        this.vpc = new ec2.Vpc(this, 'Vpc', {
            natGateways: 1,
        });

    }
}

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #39 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #40 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// Create ECS resources
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with a cluster and a local image that gets
    // uploaded to an S3 staging bucket prior to being uploaded to ECR.
    // A new repository is created in ECR and the Fargate service is created
    // with the image from ECR.

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #41 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// Creates VPC for the ECS Cluster
    const clusterVpc = new ec2.Vpc(this, "ClusterVpc", {
      ipAddresses: ec2.IpAddresses.cidr("10.50.0.0/16"),
    });

    // Deploys the cluster VPC after the initial image build triggers
    clusterVpc.node.addDependency(triggerLambda);

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #42 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

const stack = new Stack(app, 'integ-testing-eicendpoint', { env });

    const vpc = new ec2.Vpc(stack, 'Vpc', { subnetConfiguration: [{ cidrMask: 24, name: 'rds', subnetType: ec2.SubnetType.PRIVATE_ISOLATED }] });

    const instance = new ec2.Instance(stack, 'instance', {
      vpc,
      vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PRIVATE_ISOLATED }),
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.LARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023(),

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #43 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// Create a VPC with public subnets in 2 AZs
    this.vpc = new Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'ServerPublic',
          subnetType: SubnetType.PUBLIC,
          mapPublicIpOnLaunch: true,

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #44 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'Vpc', {
      ipAddresses: ec2.IpAddresses.cidr(VPC_CIDR),
      subnetConfiguration: [
        {
          cidrMask: SUBNET_SIZE,
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #45 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const asg = new autoscaling.AutoScalingGroup(this, 'MyFleet', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.XLARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64
      }),

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #46 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super(scope, id, props);

    this.vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    this.cluster = new ecs.Cluster(this, 'Cluster', {
      vpc: this.vpc
    });
  }
}

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #47 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// deploy, but VPC creation is slow so we'll only have to do that once
    // and can iterate quickly on consuming stacks. Not doing that for now.
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

    // Instantiate ECS Service with just cluster and image

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #48 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #49 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #50 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// Create the cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'awsvpc-ecs-demo-cluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #51 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3_AMD, ec2.InstanceSize.MICRO)
});

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #52 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// Create VPC and Fargate Cluster
    // NOTE: Limit AZs to avoid reaching resource quotas
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with just cluster and image
    new ecs_patterns.ApplicationLoadBalancedFargateService(this, "FargateService", {
      cluster,
      taskImageOptions: {

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #53 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// Create a cluster
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'fargate-service-autoscaling', { vpc });

    // Create Fargate Service
    const fargateService = new ecs_patterns.NetworkLoadBalancedFargateService(this, 'sample-app', {
      cluster,
      taskImageOptions: {

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #54 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'DefaultVpc', { maxAzs: 2});
    const ecsCluster = new ecs.Cluster(this, 'DefaultEcsCluster', {vpc: vpc});

    const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', {
      vpc: vpc,
      encrypted: true,
      lifecyclePolicy: efs.LifecyclePolicy.AFTER_14_DAYS,

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #55 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// NOTE: Limit AZs to avoid reaching resource quotas
//       NAT needed to pull from ECR and to push cloudwatch logs
const vpc = new ec2.Vpc(stack, 'MyVpc', { maxAzs: 2, natGateways: 1 });
const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });

// Instantiate Fargate Service with a cluster and a local image that gets
// uploaded to an S3 staging bucket prior to being uploaded to ECR.
// A new repository is created in ECR and the Fargate service is created
// with the image from ECR.

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #56 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });

    // create a task definition with CloudWatch Logs
    const logging = new ecs.AwsLogDriver({
      streamPrefix: "myapp",
    })

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #57 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// Create a new VPC for our cluster
    const vpc = new ec2.Vpc(this, "EKSVpc");

    // Create Cluster with no default capacity (node group will be added later)
    const eksCluster = new eks.Cluster(this, "EKSCluster", {
      vpc: vpc,
      defaultCapacity: 0,
      version: kubernetesVersion,

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #58 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC', {});

    const privateSubnets = vpc.privateSubnets.slice(0,2).map(x => x.subnetId)

    const templatedSecret = new sm.Secret(this, adDnsDomainName + '_credentials', {
      generateSecretString: {
        secretStringTemplate: JSON.stringify({ username: 'admin' }),

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #59 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

cidr: "10.192.0.0/16",
      maxAzs: 2,
      natGateways: 0,
      enableDnsHostnames: true,
      enableDnsSupport: true,
      /**
       * Each entry in this list configures a Subnet Group
       *
       * ISOLATED: Isolated Subnets do not route traffic to the Internet (in this VPC).

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #60 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// VPC
    const vpc = new ec2.Vpc(this, "Vpc", {
      vpcName: `${Aws.STACK_NAME}-vpc`,
    });
    this.vpc = vpc;

    // Create Cognito User Pool
    const userPool = new cognito.UserPool(this, 'CognitoUserPool', {

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #61 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

// Create a VPC for our application
    const vpc = new ec2.Vpc(this, 'PostgresLambdaVpc', {
      maxAzs: 2,
      natGateways: 1,
    });

    // Create a PostgreSQL Aurora Serverless v2 cluster
    const dbCluster = new rds.DatabaseCluster(this, 'PostgresCluster', {

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #62 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super(scope, id);
    // @see https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Vpc.html
    this.vpc = new ec2.Vpc(this, "R53ResolverTestVPC", {
      ipAddresses: ec2.IpAddresses.cidr("10.24.34.0/23"),
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #63 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

bucketResource.addPropertyDeletionOverride('CorsConfiguration.Bar');

        const vpc = new ec2.Vpc(this, 'VPC', { maxAzs: 1 });
        const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
            instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.XLARGE),
            machineImage: new ec2.AmazonLinuxImage(),
            vpc
        });

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #64 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

super(scope, id, props);

        const vpc = new ec2.Vpc(this, 'Vpc', {
            ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16')
        });

        const logGroup = new logs.LogGroup(
            this,
            'DNSFirewallLogGroup',

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #65 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

const clusterId = "redis-demo-cluster";

    const vpc = new ec2.Vpc(this, "Vpc", {
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        }

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #66 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [{
        cidrMask: 24,
        name: 'public',
        subnetType: ec2.SubnetType.PUBLIC,
      }]
    });

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #67 — VPC with NAT Gateway is missing an S3 Gateway VPC Endpoint $800/mo

const vpc = new ec2.Vpc(this, 'SSMDocumentTestVpc', {
      maxAzs: 1,
      natGateways: 0,
      subnetConfiguration: [
        {
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,
        }
      ]

# Terraform — add an S3 Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html

Opportunity #68 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# VPC
        vpc = ec2.Vpc(
            self,
            "Ingress",
            cidr="10.1.0.0/16",
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="Private-Subnet", subnet_type=ec2.SubnetType.PRIVATE_ISOLATED,

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #69 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# VPC
        vpc = ec2.Vpc(
            self,
            "Ingress",
            cidr="10.1.0.0/16",
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="Private-Subnet", subnet_type=ec2.SubnetType.PRIVATE_ISOLATED,

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #70 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# Create a VPC for our infrastructure
        vpc = ec2.Vpc(self, "VPC")

        # Read and prepare user data script for EC2 instances
        data = open("./httpd.sh", "rb").read()
        httpd=ec2.UserData.for_linux()
        httpd.add_commands(str(data,'utf-8'))

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #71 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# Create a VPC for our infrastructure
        vpc = ec2.Vpc(self, "VPC")

        # Read and prepare user data script for EC2 instances
        data = open("./httpd.sh", "rb").read()
        httpd=ec2.UserData.for_linux()
        httpd.add_commands(str(data,'utf-8'))

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #72 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueueArm64")

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #73 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueueArm64")

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #74 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #75 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #76 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #77 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #78 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super().__init__(app, id, **kwargs)

        vpc = ec2.Vpc(self, "VPC")

        asg = autoscaling.AutoScalingGroup(
            self, "ASG",
            vpc=vpc,
            instance_type=ec2.InstanceType.of(
                ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #79 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super().__init__(app, id, **kwargs)

        vpc = ec2.Vpc(self, "VPC")

        asg = autoscaling.AutoScalingGroup(
            self, "ASG",
            vpc=vpc,
            instance_type=ec2.InstanceType.of(
                ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #80 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #81 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #82 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #83 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #84 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

from aws_cdk import CfnOutput, Stack
from aws_cdk.aws_ec2 import Vpc, NatProvider, SubnetConfiguration, SubnetType
from constructs import Construct

class NetworkStack(Stack):

    def __init__(self, scope: Construct, id: str, props, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #85 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

from aws_cdk import CfnOutput, Stack
from aws_cdk.aws_ec2 import Vpc, NatProvider, SubnetConfiguration, SubnetType
from constructs import Construct

class NetworkStack(Stack):

    def __init__(self, scope: Construct, id: str, props, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #86 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

#    region=region)
        
        vpc = ec2.Vpc(
            self,"LabVpc",
            cidr="10.10.0.0/24"
        )

        #Instance
        instance = ec2.Instance(self,

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #87 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

#    region=region)
        
        vpc = ec2.Vpc(
            self,"LabVpc",
            cidr="10.10.0.0/24"
        )

        #Instance
        instance = ec2.Instance(self,

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #88 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC)]
            )

        # AMI
        amzn_linux = ec2.MachineImage.latest_amazon_linux(
            generation=ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #89 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC)]
            )

        # AMI
        amzn_linux = ec2.MachineImage.latest_amazon_linux(
            generation=ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #90 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

night_max = nightschedule[2]["max"]

        vpc = ec2.Vpc(self, "ecsVpc", max_azs=2)

        ecs_cluster = ecs.Cluster(
            self,
            id="ecscluster",
            vpc=vpc,
            container_insights=True,

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #91 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

night_max = nightschedule[2]["max"]

        vpc = ec2.Vpc(self, "ecsVpc", max_azs=2)

        ecs_cluster = ecs.Cluster(
            self,
            id="ecscluster",
            vpc=vpc,
            container_insights=True,

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #92 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super().__init__(scope, construct_id, **kwargs)
        # Creating a shared VPC with public subnets and private subnets with NAT Gateways
        vpc = ec2.Vpc(self, "ServiceConnectVPC",
                    ip_addresses=ec2.IpAddresses.cidr("10.0.0.0/16"),
                    create_internet_gateway=True,
                    max_azs=2,
                    nat_gateways=2,
                    enable_dns_hostnames=True,
                    enable_dns_support=True,

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #93 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super().__init__(scope, construct_id, **kwargs)
        # Creating a shared VPC with public subnets and private subnets with NAT Gateways
        vpc = ec2.Vpc(self, "ServiceConnectVPC",
                    ip_addresses=ec2.IpAddresses.cidr("10.0.0.0/16"),
                    create_internet_gateway=True,
                    max_azs=2,
                    nat_gateways=2,
                    enable_dns_hostnames=True,
                    enable_dns_support=True,

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #94 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        asg = autoscaling.AutoScalingGroup(
            self, "MyFleet",

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #95 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        asg = autoscaling.AutoScalingGroup(
            self, "MyFleet",

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #96 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #97 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #98 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# Create VPC with 2 Availability Zones
vpc = ec2.Vpc(
    stack, "MyVpc",
    max_azs=2
)

# Create ECS cluster in the VPC
cluster = ecs.Cluster(

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #99 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# Create VPC with 2 Availability Zones
vpc = ec2.Vpc(
    stack, "MyVpc",
    max_azs=2
)

# Create ECS cluster in the VPC
cluster = ecs.Cluster(

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #100 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "awsvpc-ecs-demo-cluster",

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #101 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "awsvpc-ecs-demo-cluster",

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #102 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "EcsCluster",

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #103 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "EcsCluster",

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #104 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #105 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #106 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# Create a cluster
        vpc = ec2.Vpc(
            self, "Vpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'fargate-service-autoscaling',

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #107 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# Create a cluster
        vpc = ec2.Vpc(
            self, "Vpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'fargate-service-autoscaling',

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #108 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

VOLUME_NAME = 'cdk-ecs-sample-efs-volume'

        vpc = ec2.Vpc(
            self, PREFIX + 'Vpc',
            max_azs=2
        )

        ecs_cluster = ecs.Cluster(
            self, PREFIX + 'Cluster',

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #109 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

VOLUME_NAME = 'cdk-ecs-sample-efs-volume'

        vpc = ec2.Vpc(
            self, PREFIX + 'Vpc',
            max_azs=2
        )

        ecs_cluster = ecs.Cluster(
            self, PREFIX + 'Cluster',

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #110 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

self,
            "vpc",
            nat_gateways=0,
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="public", subnet_type=ec2.SubnetType.PUBLIC
                )
            ],
        )

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #111 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

self,
            "vpc",
            nat_gateways=0,
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="public", subnet_type=ec2.SubnetType.PUBLIC
                )
            ],
        )

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #112 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# VPC in which the MSK cluster and client are located
        vpc = ec2.Vpc(self, "MskVpc",
            cidr="10.0.0.0/16",
            nat_gateways=1,
            max_azs=2,
            subnet_configuration = subnets)

        # MSK cluster and an EC2 Instance used to create the topics

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #113 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# VPC in which the MSK cluster and client are located
        vpc = ec2.Vpc(self, "MskVpc",
            cidr="10.0.0.0/16",
            nat_gateways=1,
            max_azs=2,
            subnet_configuration = subnets)

        # MSK cluster and an EC2 Instance used to create the topics

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #114 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# The code that defines your stack goes here

        self.vpc = ec2.Vpc(self, "VPC",
                           max_azs=2,
                           cidr="10.10.0.0/16",
                           # configuration will create 3 groups in 2 AZs = 6 subnets.
                           subnet_configuration=[ec2.SubnetConfiguration(
                               subnet_type=ec2.SubnetType.PUBLIC,
                               name="Public",

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #115 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# The code that defines your stack goes here

        self.vpc = ec2.Vpc(self, "VPC",
                           max_azs=2,
                           cidr="10.10.0.0/16",
                           # configuration will create 3 groups in 2 AZs = 6 subnets.
                           subnet_configuration=[ec2.SubnetConfiguration(
                               subnet_type=ec2.SubnetType.PUBLIC,
                               name="Public",

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #116 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "SvlCTCWLVpc")
        es_sec_grp = ec2.SecurityGroup(
            self,
            "SvlCTCWLOpenSearchSecGrp",
            vpc=vpc,
            allow_all_outbound=True,
            security_group_name="SvlCTCWLSecGrp",

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #117 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "SvlCTCWLVpc")
        es_sec_grp = ec2.SecurityGroup(
            self,
            "SvlCTCWLOpenSearchSecGrp",
            vpc=vpc,
            allow_all_outbound=True,
            security_group_name="SvlCTCWLSecGrp",

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #118 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "OpenSearch VPC", max_azs=3)

        ################################################################################
        # Amazon OpenSearch Service domain
        es_sec_grp = ec2.SecurityGroup(
            self,
            "OpenSearchSecGrp",

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #119 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "OpenSearch VPC", max_azs=3)

        ################################################################################
        # Amazon OpenSearch Service domain
        es_sec_grp = ec2.SecurityGroup(
            self,
            "OpenSearchSecGrp",

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #120 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "IcePlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #121 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "IcePlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #122 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "LavaPlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #123 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "LavaPlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #124 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #125 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #126 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super().__init__(scope, construct_id, **kwargs)

        vpc = ec2.Vpc(self, "ecsVpc")

        s3_bucket = s3.Bucket(
            self,
            "bucket",
            access_control=s3.BucketAccessControl.PRIVATE,
            encryption=s3.BucketEncryption.S3_MANAGED,

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #127 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super().__init__(scope, construct_id, **kwargs)

        vpc = ec2.Vpc(self, "ecsVpc")

        s3_bucket = s3.Bucket(
            self,
            "bucket",
            access_control=s3.BucketAccessControl.PRIVATE,
            encryption=s3.BucketEncryption.S3_MANAGED,

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #128 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC,cidr_mask=24)],
        )

        # Instance Role and SSM Managed Policy
        role = iam.Role(self, "ec2Role", assumed_by=iam.ServicePrincipal("ec2.amazonaws.com"))

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #129 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC,cidr_mask=24)],
        )

        # Instance Role and SSM Managed Policy
        role = iam.Role(self, "ec2Role", assumed_by=iam.ServicePrincipal("ec2.amazonaws.com"))

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #130 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

)

        vpc = ec2.Vpc(self, "infrastructure_vpc",
            vpc_name="emr_cdk_vpc",
            nat_gateways=1,
            cidr= '10.0.0.0/16',
            gateway_endpoints=
                {
                    "S3":

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #131 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

)

        vpc = ec2.Vpc(self, "infrastructure_vpc",
            vpc_name="emr_cdk_vpc",
            nat_gateways=1,
            cidr= '10.0.0.0/16',
            gateway_endpoints=
                {
                    "S3":

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #132 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

def create_VPC(self):
        vpc = ec2.Vpc(
            self,
            "Vpc",
            ip_addresses = ec2.IpAddresses.cidr(VPC_CIDR),
            subnet_configuration = [
                ec2.SubnetConfiguration(
                    name = 'Public-Subent',

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #133 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

def create_VPC(self):
        vpc = ec2.Vpc(
            self,
            "Vpc",
            ip_addresses = ec2.IpAddresses.cidr(VPC_CIDR),
            subnet_configuration = [
                ec2.SubnetConfiguration(
                    name = 'Public-Subent',

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #134 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

this.vpc = new ec2.Vpc(this, 'nested-stack-vpc', {
      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
      natGateways: 0,
      maxAzs: 3,
      subnetConfiguration: [
        {
          name: 'public-subnet-1',
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 24,

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #135 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

this.vpc = new ec2.Vpc(this, 'nested-stack-vpc', {
      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
      natGateways: 0,
      maxAzs: 3,
      subnetConfiguration: [
        {
          name: 'public-subnet-1',
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 24,

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #136 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #137 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #138 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

this.vpc = new Vpc(this, 'vpc', {
        maxAzs: 3,
        natGateways: 1,
        enableDnsHostnames: true,
        enableDnsSupport: true,
        ipAddresses: IpAddresses.cidr('10.0.0.0/16'),
        subnetConfiguration: [
        {
            cidrMask: 24,

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #139 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

this.vpc = new Vpc(this, 'vpc', {
        maxAzs: 3,
        natGateways: 1,
        enableDnsHostnames: true,
        enableDnsSupport: true,
        ipAddresses: IpAddresses.cidr('10.0.0.0/16'),
        subnetConfiguration: [
        {
            cidrMask: 24,

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #140 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      maxAzs: 2,
      natGateways: 0,
    });

    // Create the required IAM role which allows the SFTP server
    // to log to CloudWatch.
    const cloudWatchLoggingRole = new iam.Role(this, 'CloudWatchLoggingRole', {
      assumedBy: new iam.ServicePrincipal('transfer.amazonaws.com'),

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #141 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      maxAzs: 2,
      natGateways: 0,
    });

    // Create the required IAM role which allows the SFTP server
    // to log to CloudWatch.
    const cloudWatchLoggingRole = new iam.Role(this, 'CloudWatchLoggingRole', {
      assumedBy: new iam.ServicePrincipal('transfer.amazonaws.com'),

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #142 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// VPC for Batch compute environment
    const vpc = new ec2.Vpc(this, 'OpenMPVPC', {
      maxAzs: 2,
      natGateways: 1,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'Public',

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #143 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// VPC for Batch compute environment
    const vpc = new ec2.Vpc(this, 'OpenMPVPC', {
      maxAzs: 2,
      natGateways: 1,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'Public',

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #144 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super(scope, id, props);

        this.vpc = new ec2.Vpc(this, 'Vpc', {
            natGateways: 1,
        });

    }
}

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #145 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super(scope, id, props);

        this.vpc = new ec2.Vpc(this, 'Vpc', {
            natGateways: 1,
        });

    }
}

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #146 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #147 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #148 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// Create ECS resources
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with a cluster and a local image that gets
    // uploaded to an S3 staging bucket prior to being uploaded to ECR.
    // A new repository is created in ECR and the Fargate service is created
    // with the image from ECR.

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #149 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// Create ECS resources
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with a cluster and a local image that gets
    // uploaded to an S3 staging bucket prior to being uploaded to ECR.
    // A new repository is created in ECR and the Fargate service is created
    // with the image from ECR.

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #150 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// Creates VPC for the ECS Cluster
    const clusterVpc = new ec2.Vpc(this, "ClusterVpc", {
      ipAddresses: ec2.IpAddresses.cidr("10.50.0.0/16"),
    });

    // Deploys the cluster VPC after the initial image build triggers
    clusterVpc.node.addDependency(triggerLambda);

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #151 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// Creates VPC for the ECS Cluster
    const clusterVpc = new ec2.Vpc(this, "ClusterVpc", {
      ipAddresses: ec2.IpAddresses.cidr("10.50.0.0/16"),
    });

    // Deploys the cluster VPC after the initial image build triggers
    clusterVpc.node.addDependency(triggerLambda);

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #152 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

const stack = new Stack(app, 'integ-testing-eicendpoint', { env });

    const vpc = new ec2.Vpc(stack, 'Vpc', { subnetConfiguration: [{ cidrMask: 24, name: 'rds', subnetType: ec2.SubnetType.PRIVATE_ISOLATED }] });

    const instance = new ec2.Instance(stack, 'instance', {
      vpc,
      vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PRIVATE_ISOLATED }),
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.LARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023(),

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #153 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

const stack = new Stack(app, 'integ-testing-eicendpoint', { env });

    const vpc = new ec2.Vpc(stack, 'Vpc', { subnetConfiguration: [{ cidrMask: 24, name: 'rds', subnetType: ec2.SubnetType.PRIVATE_ISOLATED }] });

    const instance = new ec2.Instance(stack, 'instance', {
      vpc,
      vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PRIVATE_ISOLATED }),
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.LARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023(),

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #154 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// Create a VPC with public subnets in 2 AZs
    this.vpc = new Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'ServerPublic',
          subnetType: SubnetType.PUBLIC,
          mapPublicIpOnLaunch: true,

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #155 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// Create a VPC with public subnets in 2 AZs
    this.vpc = new Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'ServerPublic',
          subnetType: SubnetType.PUBLIC,
          mapPublicIpOnLaunch: true,

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #156 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'Vpc', {
      ipAddresses: ec2.IpAddresses.cidr(VPC_CIDR),
      subnetConfiguration: [
        {
          cidrMask: SUBNET_SIZE,
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #157 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'Vpc', {
      ipAddresses: ec2.IpAddresses.cidr(VPC_CIDR),
      subnetConfiguration: [
        {
          cidrMask: SUBNET_SIZE,
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #158 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const asg = new autoscaling.AutoScalingGroup(this, 'MyFleet', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.XLARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64
      }),

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #159 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const asg = new autoscaling.AutoScalingGroup(this, 'MyFleet', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.XLARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64
      }),

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #160 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super(scope, id, props);

    this.vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    this.cluster = new ecs.Cluster(this, 'Cluster', {
      vpc: this.vpc
    });
  }
}

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #161 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super(scope, id, props);

    this.vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    this.cluster = new ecs.Cluster(this, 'Cluster', {
      vpc: this.vpc
    });
  }
}

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #162 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// deploy, but VPC creation is slow so we'll only have to do that once
    // and can iterate quickly on consuming stacks. Not doing that for now.
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

    // Instantiate ECS Service with just cluster and image

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #163 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// deploy, but VPC creation is slow so we'll only have to do that once
    // and can iterate quickly on consuming stacks. Not doing that for now.
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

    // Instantiate ECS Service with just cluster and image

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #164 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #165 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #166 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #167 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #168 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// Create the cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'awsvpc-ecs-demo-cluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #169 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// Create the cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'awsvpc-ecs-demo-cluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #170 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3_AMD, ec2.InstanceSize.MICRO)
});

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #171 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3_AMD, ec2.InstanceSize.MICRO)
});

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #172 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// Create VPC and Fargate Cluster
    // NOTE: Limit AZs to avoid reaching resource quotas
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with just cluster and image
    new ecs_patterns.ApplicationLoadBalancedFargateService(this, "FargateService", {
      cluster,
      taskImageOptions: {

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #173 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// Create VPC and Fargate Cluster
    // NOTE: Limit AZs to avoid reaching resource quotas
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with just cluster and image
    new ecs_patterns.ApplicationLoadBalancedFargateService(this, "FargateService", {
      cluster,
      taskImageOptions: {

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #174 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// Create a cluster
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'fargate-service-autoscaling', { vpc });

    // Create Fargate Service
    const fargateService = new ecs_patterns.NetworkLoadBalancedFargateService(this, 'sample-app', {
      cluster,
      taskImageOptions: {

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #175 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// Create a cluster
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'fargate-service-autoscaling', { vpc });

    // Create Fargate Service
    const fargateService = new ecs_patterns.NetworkLoadBalancedFargateService(this, 'sample-app', {
      cluster,
      taskImageOptions: {

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #176 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'DefaultVpc', { maxAzs: 2});
    const ecsCluster = new ecs.Cluster(this, 'DefaultEcsCluster', {vpc: vpc});

    const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', {
      vpc: vpc,
      encrypted: true,
      lifecyclePolicy: efs.LifecyclePolicy.AFTER_14_DAYS,

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #177 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'DefaultVpc', { maxAzs: 2});
    const ecsCluster = new ecs.Cluster(this, 'DefaultEcsCluster', {vpc: vpc});

    const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', {
      vpc: vpc,
      encrypted: true,
      lifecyclePolicy: efs.LifecyclePolicy.AFTER_14_DAYS,

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #178 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// NOTE: Limit AZs to avoid reaching resource quotas
//       NAT needed to pull from ECR and to push cloudwatch logs
const vpc = new ec2.Vpc(stack, 'MyVpc', { maxAzs: 2, natGateways: 1 });
const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });

// Instantiate Fargate Service with a cluster and a local image that gets
// uploaded to an S3 staging bucket prior to being uploaded to ECR.
// A new repository is created in ECR and the Fargate service is created
// with the image from ECR.

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #179 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// NOTE: Limit AZs to avoid reaching resource quotas
//       NAT needed to pull from ECR and to push cloudwatch logs
const vpc = new ec2.Vpc(stack, 'MyVpc', { maxAzs: 2, natGateways: 1 });
const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });

// Instantiate Fargate Service with a cluster and a local image that gets
// uploaded to an S3 staging bucket prior to being uploaded to ECR.
// A new repository is created in ECR and the Fargate service is created
// with the image from ECR.

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #180 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });

    // create a task definition with CloudWatch Logs
    const logging = new ecs.AwsLogDriver({
      streamPrefix: "myapp",
    })

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #181 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });

    // create a task definition with CloudWatch Logs
    const logging = new ecs.AwsLogDriver({
      streamPrefix: "myapp",
    })

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #182 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// Create a new VPC for our cluster
    const vpc = new ec2.Vpc(this, "EKSVpc");

    // Create Cluster with no default capacity (node group will be added later)
    const eksCluster = new eks.Cluster(this, "EKSCluster", {
      vpc: vpc,
      defaultCapacity: 0,
      version: kubernetesVersion,

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #183 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// Create a new VPC for our cluster
    const vpc = new ec2.Vpc(this, "EKSVpc");

    // Create Cluster with no default capacity (node group will be added later)
    const eksCluster = new eks.Cluster(this, "EKSCluster", {
      vpc: vpc,
      defaultCapacity: 0,
      version: kubernetesVersion,

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #184 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC', {});

    const privateSubnets = vpc.privateSubnets.slice(0,2).map(x => x.subnetId)

    const templatedSecret = new sm.Secret(this, adDnsDomainName + '_credentials', {
      generateSecretString: {
        secretStringTemplate: JSON.stringify({ username: 'admin' }),

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #185 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC', {});

    const privateSubnets = vpc.privateSubnets.slice(0,2).map(x => x.subnetId)

    const templatedSecret = new sm.Secret(this, adDnsDomainName + '_credentials', {
      generateSecretString: {
        secretStringTemplate: JSON.stringify({ username: 'admin' }),

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #186 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

cidr: "10.192.0.0/16",
      maxAzs: 2,
      natGateways: 0,
      enableDnsHostnames: true,
      enableDnsSupport: true,
      /**
       * Each entry in this list configures a Subnet Group
       *
       * ISOLATED: Isolated Subnets do not route traffic to the Internet (in this VPC).

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #187 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

cidr: "10.192.0.0/16",
      maxAzs: 2,
      natGateways: 0,
      enableDnsHostnames: true,
      enableDnsSupport: true,
      /**
       * Each entry in this list configures a Subnet Group
       *
       * ISOLATED: Isolated Subnets do not route traffic to the Internet (in this VPC).

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #188 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// VPC
    const vpc = new ec2.Vpc(this, "Vpc", {
      vpcName: `${Aws.STACK_NAME}-vpc`,
    });
    this.vpc = vpc;

    // Create Cognito User Pool
    const userPool = new cognito.UserPool(this, 'CognitoUserPool', {

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #189 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// VPC
    const vpc = new ec2.Vpc(this, "Vpc", {
      vpcName: `${Aws.STACK_NAME}-vpc`,
    });
    this.vpc = vpc;

    // Create Cognito User Pool
    const userPool = new cognito.UserPool(this, 'CognitoUserPool', {

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #190 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

// Create a VPC for our application
    const vpc = new ec2.Vpc(this, 'PostgresLambdaVpc', {
      maxAzs: 2,
      natGateways: 1,
    });

    // Create a PostgreSQL Aurora Serverless v2 cluster
    const dbCluster = new rds.DatabaseCluster(this, 'PostgresCluster', {

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #191 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

// Create a VPC for our application
    const vpc = new ec2.Vpc(this, 'PostgresLambdaVpc', {
      maxAzs: 2,
      natGateways: 1,
    });

    // Create a PostgreSQL Aurora Serverless v2 cluster
    const dbCluster = new rds.DatabaseCluster(this, 'PostgresCluster', {

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #192 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super(scope, id);
    // @see https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Vpc.html
    this.vpc = new ec2.Vpc(this, "R53ResolverTestVPC", {
      ipAddresses: ec2.IpAddresses.cidr("10.24.34.0/23"),
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #193 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super(scope, id);
    // @see https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Vpc.html
    this.vpc = new ec2.Vpc(this, "R53ResolverTestVPC", {
      ipAddresses: ec2.IpAddresses.cidr("10.24.34.0/23"),
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #194 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

bucketResource.addPropertyDeletionOverride('CorsConfiguration.Bar');

        const vpc = new ec2.Vpc(this, 'VPC', { maxAzs: 1 });
        const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
            instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.XLARGE),
            machineImage: new ec2.AmazonLinuxImage(),
            vpc
        });

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #195 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

bucketResource.addPropertyDeletionOverride('CorsConfiguration.Bar');

        const vpc = new ec2.Vpc(this, 'VPC', { maxAzs: 1 });
        const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
            instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.XLARGE),
            machineImage: new ec2.AmazonLinuxImage(),
            vpc
        });

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #196 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

super(scope, id, props);

        const vpc = new ec2.Vpc(this, 'Vpc', {
            ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16')
        });

        const logGroup = new logs.LogGroup(
            this,
            'DNSFirewallLogGroup',

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #197 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

super(scope, id, props);

        const vpc = new ec2.Vpc(this, 'Vpc', {
            ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16')
        });

        const logGroup = new logs.LogGroup(
            this,
            'DNSFirewallLogGroup',

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #198 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

const clusterId = "redis-demo-cluster";

    const vpc = new ec2.Vpc(this, "Vpc", {
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        }

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #199 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

const clusterId = "redis-demo-cluster";

    const vpc = new ec2.Vpc(this, "Vpc", {
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        }

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #200 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [{
        cidrMask: 24,
        name: 'public',
        subnetType: ec2.SubnetType.PUBLIC,
      }]
    });

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #201 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [{
        cidrMask: 24,
        name: 'public',
        subnetType: ec2.SubnetType.PUBLIC,
      }]
    });

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #202 — VPC with NAT Gateway is missing the ECR API Interface VPC Endpoint $400/mo

const vpc = new ec2.Vpc(this, 'SSMDocumentTestVpc', {
      maxAzs: 1,
      natGateways: 0,
      subnetConfiguration: [
        {
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,
        }
      ]

# Terraform — add ECR API Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# IMPORTANT: also add aws_vpc_endpoint.ecr_dkr (ECR pulls need BOTH).
# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #203 — VPC with NAT Gateway is missing the ECR Docker Interface VPC Endpoint $400/mo

const vpc = new ec2.Vpc(this, 'SSMDocumentTestVpc', {
      maxAzs: 1,
      natGateways: 0,
      subnetConfiguration: [
        {
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,
        }
      ]

# Terraform — add ECR Docker Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/AmazonECR/latest/userguide/vpc-endpoints.html

Opportunity #204 — EKS resource (cdk_ts_eks_line_30) in NAT-backed VPC missing: ecr.api, ecr.dkr, logs, sts $400/mo

// Create Cluster with no default capacity (node group will be added later)
    const eksCluster = new eks.Cluster(this, "EKSCluster", {
      vpc: vpc,
      defaultCapacity: 0,
      version: kubernetesVersion,
      kubectlLayer: new KubectlLayer(this, "kubectl"),
      ipFamily: eks.IpFamily.IP_V4,
      clusterLogging: clusterLogging,

# Terraform — add the full private-EKS endpoint set:
locals {
  eks_interface_endpoints = [
    "ecr.api",
    "ecr.dkr",
    "logs",
    "sts",
    "ec2",
    "elasticloadbalancing",
  ]
}

resource "aws_vpc_endpoint" "eks_set" {
  for_each            = toset(local.eks_interface_endpoints)
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.${each.value}"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# Plus a free S3 Gateway endpoint (EKS uses it for image-layer storage):
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/eks/latest/userguide/private-clusters.html

Opportunity #205 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# Create a VPC for our infrastructure
        vpc = ec2.Vpc(self, "VPC")

        # Read and prepare user data script for EC2 instances
        data = open("./httpd.sh", "rb").read()
        httpd=ec2.UserData.for_linux()
        httpd.add_commands(str(data,'utf-8'))

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #206 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueueArm64")

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #207 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #208 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #209 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super().__init__(app, id, **kwargs)

        vpc = ec2.Vpc(self, "VPC")

        asg = autoscaling.AutoScalingGroup(
            self, "ASG",
            vpc=vpc,
            instance_type=ec2.InstanceType.of(
                ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #210 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #211 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #212 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

from aws_cdk import CfnOutput, Stack
from aws_cdk.aws_ec2 import Vpc, NatProvider, SubnetConfiguration, SubnetType
from constructs import Construct

class NetworkStack(Stack):

    def __init__(self, scope: Construct, id: str, props, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #213 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

#    region=region)
        
        vpc = ec2.Vpc(
            self,"LabVpc",
            cidr="10.10.0.0/24"
        )

        #Instance
        instance = ec2.Instance(self,

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #214 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC)]
            )

        # AMI
        amzn_linux = ec2.MachineImage.latest_amazon_linux(
            generation=ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #215 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

night_max = nightschedule[2]["max"]

        vpc = ec2.Vpc(self, "ecsVpc", max_azs=2)

        ecs_cluster = ecs.Cluster(
            self,
            id="ecscluster",
            vpc=vpc,
            container_insights=True,

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #216 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super().__init__(scope, construct_id, **kwargs)
        # Creating a shared VPC with public subnets and private subnets with NAT Gateways
        vpc = ec2.Vpc(self, "ServiceConnectVPC",
                    ip_addresses=ec2.IpAddresses.cidr("10.0.0.0/16"),
                    create_internet_gateway=True,
                    max_azs=2,
                    nat_gateways=2,
                    enable_dns_hostnames=True,
                    enable_dns_support=True,

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #217 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        asg = autoscaling.AutoScalingGroup(
            self, "MyFleet",

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #218 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #219 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# Create VPC with 2 Availability Zones
vpc = ec2.Vpc(
    stack, "MyVpc",
    max_azs=2
)

# Create ECS cluster in the VPC
cluster = ecs.Cluster(

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #220 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "awsvpc-ecs-demo-cluster",

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #221 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "EcsCluster",

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #222 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #223 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# Create a cluster
        vpc = ec2.Vpc(
            self, "Vpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'fargate-service-autoscaling',

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #224 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

VOLUME_NAME = 'cdk-ecs-sample-efs-volume'

        vpc = ec2.Vpc(
            self, PREFIX + 'Vpc',
            max_azs=2
        )

        ecs_cluster = ecs.Cluster(
            self, PREFIX + 'Cluster',

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #225 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

self,
            "vpc",
            nat_gateways=0,
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="public", subnet_type=ec2.SubnetType.PUBLIC
                )
            ],
        )

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #226 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# VPC in which the MSK cluster and client are located
        vpc = ec2.Vpc(self, "MskVpc",
            cidr="10.0.0.0/16",
            nat_gateways=1,
            max_azs=2,
            subnet_configuration = subnets)

        # MSK cluster and an EC2 Instance used to create the topics

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #227 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# The code that defines your stack goes here

        self.vpc = ec2.Vpc(self, "VPC",
                           max_azs=2,
                           cidr="10.10.0.0/16",
                           # configuration will create 3 groups in 2 AZs = 6 subnets.
                           subnet_configuration=[ec2.SubnetConfiguration(
                               subnet_type=ec2.SubnetType.PUBLIC,
                               name="Public",

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #228 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "SvlCTCWLVpc")
        es_sec_grp = ec2.SecurityGroup(
            self,
            "SvlCTCWLOpenSearchSecGrp",
            vpc=vpc,
            allow_all_outbound=True,
            security_group_name="SvlCTCWLSecGrp",

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #229 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "OpenSearch VPC", max_azs=3)

        ################################################################################
        # Amazon OpenSearch Service domain
        es_sec_grp = ec2.SecurityGroup(
            self,
            "OpenSearchSecGrp",

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #230 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "IcePlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #231 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "LavaPlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #232 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #233 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super().__init__(scope, construct_id, **kwargs)

        vpc = ec2.Vpc(self, "ecsVpc")

        s3_bucket = s3.Bucket(
            self,
            "bucket",
            access_control=s3.BucketAccessControl.PRIVATE,
            encryption=s3.BucketEncryption.S3_MANAGED,

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #234 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC,cidr_mask=24)],
        )

        # Instance Role and SSM Managed Policy
        role = iam.Role(self, "ec2Role", assumed_by=iam.ServicePrincipal("ec2.amazonaws.com"))

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #235 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

)

        vpc = ec2.Vpc(self, "infrastructure_vpc",
            vpc_name="emr_cdk_vpc",
            nat_gateways=1,
            cidr= '10.0.0.0/16',
            gateway_endpoints=
                {
                    "S3":

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #236 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

def create_VPC(self):
        vpc = ec2.Vpc(
            self,
            "Vpc",
            ip_addresses = ec2.IpAddresses.cidr(VPC_CIDR),
            subnet_configuration = [
                ec2.SubnetConfiguration(
                    name = 'Public-Subent',

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #237 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

this.vpc = new ec2.Vpc(this, 'nested-stack-vpc', {
      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
      natGateways: 0,
      maxAzs: 3,
      subnetConfiguration: [
        {
          name: 'public-subnet-1',
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 24,

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #238 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #239 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

this.vpc = new Vpc(this, 'vpc', {
        maxAzs: 3,
        natGateways: 1,
        enableDnsHostnames: true,
        enableDnsSupport: true,
        ipAddresses: IpAddresses.cidr('10.0.0.0/16'),
        subnetConfiguration: [
        {
            cidrMask: 24,

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #240 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      maxAzs: 2,
      natGateways: 0,
    });

    // Create the required IAM role which allows the SFTP server
    // to log to CloudWatch.
    const cloudWatchLoggingRole = new iam.Role(this, 'CloudWatchLoggingRole', {
      assumedBy: new iam.ServicePrincipal('transfer.amazonaws.com'),

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #241 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// VPC for Batch compute environment
    const vpc = new ec2.Vpc(this, 'OpenMPVPC', {
      maxAzs: 2,
      natGateways: 1,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'Public',

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #242 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super(scope, id, props);

        this.vpc = new ec2.Vpc(this, 'Vpc', {
            natGateways: 1,
        });

    }
}

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #243 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #244 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// Create ECS resources
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with a cluster and a local image that gets
    // uploaded to an S3 staging bucket prior to being uploaded to ECR.
    // A new repository is created in ECR and the Fargate service is created
    // with the image from ECR.

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #245 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// Creates VPC for the ECS Cluster
    const clusterVpc = new ec2.Vpc(this, "ClusterVpc", {
      ipAddresses: ec2.IpAddresses.cidr("10.50.0.0/16"),
    });

    // Deploys the cluster VPC after the initial image build triggers
    clusterVpc.node.addDependency(triggerLambda);

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #246 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

const stack = new Stack(app, 'integ-testing-eicendpoint', { env });

    const vpc = new ec2.Vpc(stack, 'Vpc', { subnetConfiguration: [{ cidrMask: 24, name: 'rds', subnetType: ec2.SubnetType.PRIVATE_ISOLATED }] });

    const instance = new ec2.Instance(stack, 'instance', {
      vpc,
      vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PRIVATE_ISOLATED }),
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.LARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023(),

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #247 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// Create a VPC with public subnets in 2 AZs
    this.vpc = new Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'ServerPublic',
          subnetType: SubnetType.PUBLIC,
          mapPublicIpOnLaunch: true,

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #248 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'Vpc', {
      ipAddresses: ec2.IpAddresses.cidr(VPC_CIDR),
      subnetConfiguration: [
        {
          cidrMask: SUBNET_SIZE,
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #249 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const asg = new autoscaling.AutoScalingGroup(this, 'MyFleet', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.XLARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64
      }),

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #250 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super(scope, id, props);

    this.vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    this.cluster = new ecs.Cluster(this, 'Cluster', {
      vpc: this.vpc
    });
  }
}

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #251 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// deploy, but VPC creation is slow so we'll only have to do that once
    // and can iterate quickly on consuming stacks. Not doing that for now.
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

    // Instantiate ECS Service with just cluster and image

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #252 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #253 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #254 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// Create the cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'awsvpc-ecs-demo-cluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #255 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3_AMD, ec2.InstanceSize.MICRO)
});

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #256 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// Create VPC and Fargate Cluster
    // NOTE: Limit AZs to avoid reaching resource quotas
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with just cluster and image
    new ecs_patterns.ApplicationLoadBalancedFargateService(this, "FargateService", {
      cluster,
      taskImageOptions: {

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #257 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// Create a cluster
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'fargate-service-autoscaling', { vpc });

    // Create Fargate Service
    const fargateService = new ecs_patterns.NetworkLoadBalancedFargateService(this, 'sample-app', {
      cluster,
      taskImageOptions: {

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #258 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'DefaultVpc', { maxAzs: 2});
    const ecsCluster = new ecs.Cluster(this, 'DefaultEcsCluster', {vpc: vpc});

    const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', {
      vpc: vpc,
      encrypted: true,
      lifecyclePolicy: efs.LifecyclePolicy.AFTER_14_DAYS,

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #259 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// NOTE: Limit AZs to avoid reaching resource quotas
//       NAT needed to pull from ECR and to push cloudwatch logs
const vpc = new ec2.Vpc(stack, 'MyVpc', { maxAzs: 2, natGateways: 1 });
const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });

// Instantiate Fargate Service with a cluster and a local image that gets
// uploaded to an S3 staging bucket prior to being uploaded to ECR.
// A new repository is created in ECR and the Fargate service is created
// with the image from ECR.

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #260 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });

    // create a task definition with CloudWatch Logs
    const logging = new ecs.AwsLogDriver({
      streamPrefix: "myapp",
    })

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #261 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// Create a new VPC for our cluster
    const vpc = new ec2.Vpc(this, "EKSVpc");

    // Create Cluster with no default capacity (node group will be added later)
    const eksCluster = new eks.Cluster(this, "EKSCluster", {
      vpc: vpc,
      defaultCapacity: 0,
      version: kubernetesVersion,

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #262 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC', {});

    const privateSubnets = vpc.privateSubnets.slice(0,2).map(x => x.subnetId)

    const templatedSecret = new sm.Secret(this, adDnsDomainName + '_credentials', {
      generateSecretString: {
        secretStringTemplate: JSON.stringify({ username: 'admin' }),

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #263 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

cidr: "10.192.0.0/16",
      maxAzs: 2,
      natGateways: 0,
      enableDnsHostnames: true,
      enableDnsSupport: true,
      /**
       * Each entry in this list configures a Subnet Group
       *
       * ISOLATED: Isolated Subnets do not route traffic to the Internet (in this VPC).

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #264 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// VPC
    const vpc = new ec2.Vpc(this, "Vpc", {
      vpcName: `${Aws.STACK_NAME}-vpc`,
    });
    this.vpc = vpc;

    // Create Cognito User Pool
    const userPool = new cognito.UserPool(this, 'CognitoUserPool', {

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #265 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

// Create a VPC for our application
    const vpc = new ec2.Vpc(this, 'PostgresLambdaVpc', {
      maxAzs: 2,
      natGateways: 1,
    });

    // Create a PostgreSQL Aurora Serverless v2 cluster
    const dbCluster = new rds.DatabaseCluster(this, 'PostgresCluster', {

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #266 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super(scope, id);
    // @see https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Vpc.html
    this.vpc = new ec2.Vpc(this, "R53ResolverTestVPC", {
      ipAddresses: ec2.IpAddresses.cidr("10.24.34.0/23"),
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #267 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

bucketResource.addPropertyDeletionOverride('CorsConfiguration.Bar');

        const vpc = new ec2.Vpc(this, 'VPC', { maxAzs: 1 });
        const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
            instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.XLARGE),
            machineImage: new ec2.AmazonLinuxImage(),
            vpc
        });

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #268 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

super(scope, id, props);

        const vpc = new ec2.Vpc(this, 'Vpc', {
            ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16')
        });

        const logGroup = new logs.LogGroup(
            this,
            'DNSFirewallLogGroup',

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #269 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

const clusterId = "redis-demo-cluster";

    const vpc = new ec2.Vpc(this, "Vpc", {
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        }

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #270 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [{
        cidrMask: 24,
        name: 'public',
        subnetType: ec2.SubnetType.PUBLIC,
      }]
    });

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #271 — VPC with NAT Gateway is missing a DynamoDB Gateway VPC Endpoint $300/mo

const vpc = new ec2.Vpc(this, 'SSMDocumentTestVpc', {
      maxAzs: 1,
      natGateways: 0,
      subnetConfiguration: [
        {
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,
        }
      ]

# Terraform — add a DynamoDB Gateway VPC Endpoint (FREE):
resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.dynamodb"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-ddb.html

Opportunity #272 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# VPC
        vpc = ec2.Vpc(
            self,
            "Ingress",
            cidr="10.1.0.0/16",
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="Private-Subnet", subnet_type=ec2.SubnetType.PRIVATE_ISOLATED,

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #273 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# Create a VPC for our infrastructure
        vpc = ec2.Vpc(self, "VPC")

        # Read and prepare user data script for EC2 instances
        data = open("./httpd.sh", "rb").read()
        httpd=ec2.UserData.for_linux()
        httpd.add_commands(str(data,'utf-8'))

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #274 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueueArm64")

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #275 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #276 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #277 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super().__init__(app, id, **kwargs)

        vpc = ec2.Vpc(self, "VPC")

        asg = autoscaling.AutoScalingGroup(
            self, "ASG",
            vpc=vpc,
            instance_type=ec2.InstanceType.of(
                ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #278 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #279 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #280 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

from aws_cdk import CfnOutput, Stack
from aws_cdk.aws_ec2 import Vpc, NatProvider, SubnetConfiguration, SubnetType
from constructs import Construct

class NetworkStack(Stack):

    def __init__(self, scope: Construct, id: str, props, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #281 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

#    region=region)
        
        vpc = ec2.Vpc(
            self,"LabVpc",
            cidr="10.10.0.0/24"
        )

        #Instance
        instance = ec2.Instance(self,

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #282 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC)]
            )

        # AMI
        amzn_linux = ec2.MachineImage.latest_amazon_linux(
            generation=ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #283 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

night_max = nightschedule[2]["max"]

        vpc = ec2.Vpc(self, "ecsVpc", max_azs=2)

        ecs_cluster = ecs.Cluster(
            self,
            id="ecscluster",
            vpc=vpc,
            container_insights=True,

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #284 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super().__init__(scope, construct_id, **kwargs)
        # Creating a shared VPC with public subnets and private subnets with NAT Gateways
        vpc = ec2.Vpc(self, "ServiceConnectVPC",
                    ip_addresses=ec2.IpAddresses.cidr("10.0.0.0/16"),
                    create_internet_gateway=True,
                    max_azs=2,
                    nat_gateways=2,
                    enable_dns_hostnames=True,
                    enable_dns_support=True,

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #285 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        asg = autoscaling.AutoScalingGroup(
            self, "MyFleet",

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #286 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #287 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# Create VPC with 2 Availability Zones
vpc = ec2.Vpc(
    stack, "MyVpc",
    max_azs=2
)

# Create ECS cluster in the VPC
cluster = ecs.Cluster(

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #288 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "awsvpc-ecs-demo-cluster",

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #289 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "EcsCluster",

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #290 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #291 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# Create a cluster
        vpc = ec2.Vpc(
            self, "Vpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'fargate-service-autoscaling',

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #292 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

VOLUME_NAME = 'cdk-ecs-sample-efs-volume'

        vpc = ec2.Vpc(
            self, PREFIX + 'Vpc',
            max_azs=2
        )

        ecs_cluster = ecs.Cluster(
            self, PREFIX + 'Cluster',

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #293 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

self,
            "vpc",
            nat_gateways=0,
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="public", subnet_type=ec2.SubnetType.PUBLIC
                )
            ],
        )

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #294 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# VPC in which the MSK cluster and client are located
        vpc = ec2.Vpc(self, "MskVpc",
            cidr="10.0.0.0/16",
            nat_gateways=1,
            max_azs=2,
            subnet_configuration = subnets)

        # MSK cluster and an EC2 Instance used to create the topics

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #295 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# The code that defines your stack goes here

        self.vpc = ec2.Vpc(self, "VPC",
                           max_azs=2,
                           cidr="10.10.0.0/16",
                           # configuration will create 3 groups in 2 AZs = 6 subnets.
                           subnet_configuration=[ec2.SubnetConfiguration(
                               subnet_type=ec2.SubnetType.PUBLIC,
                               name="Public",

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #296 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "SvlCTCWLVpc")
        es_sec_grp = ec2.SecurityGroup(
            self,
            "SvlCTCWLOpenSearchSecGrp",
            vpc=vpc,
            allow_all_outbound=True,
            security_group_name="SvlCTCWLSecGrp",

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #297 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "OpenSearch VPC", max_azs=3)

        ################################################################################
        # Amazon OpenSearch Service domain
        es_sec_grp = ec2.SecurityGroup(
            self,
            "OpenSearchSecGrp",

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #298 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "IcePlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #299 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "LavaPlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #300 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #301 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super().__init__(scope, construct_id, **kwargs)

        vpc = ec2.Vpc(self, "ecsVpc")

        s3_bucket = s3.Bucket(
            self,
            "bucket",
            access_control=s3.BucketAccessControl.PRIVATE,
            encryption=s3.BucketEncryption.S3_MANAGED,

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #302 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC,cidr_mask=24)],
        )

        # Instance Role and SSM Managed Policy
        role = iam.Role(self, "ec2Role", assumed_by=iam.ServicePrincipal("ec2.amazonaws.com"))

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #303 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

)

        vpc = ec2.Vpc(self, "infrastructure_vpc",
            vpc_name="emr_cdk_vpc",
            nat_gateways=1,
            cidr= '10.0.0.0/16',
            gateway_endpoints=
                {
                    "S3":

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #304 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

def create_VPC(self):
        vpc = ec2.Vpc(
            self,
            "Vpc",
            ip_addresses = ec2.IpAddresses.cidr(VPC_CIDR),
            subnet_configuration = [
                ec2.SubnetConfiguration(
                    name = 'Public-Subent',

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #305 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

this.vpc = new ec2.Vpc(this, 'nested-stack-vpc', {
      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
      natGateways: 0,
      maxAzs: 3,
      subnetConfiguration: [
        {
          name: 'public-subnet-1',
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 24,

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #306 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #307 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

this.vpc = new Vpc(this, 'vpc', {
        maxAzs: 3,
        natGateways: 1,
        enableDnsHostnames: true,
        enableDnsSupport: true,
        ipAddresses: IpAddresses.cidr('10.0.0.0/16'),
        subnetConfiguration: [
        {
            cidrMask: 24,

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #308 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      maxAzs: 2,
      natGateways: 0,
    });

    // Create the required IAM role which allows the SFTP server
    // to log to CloudWatch.
    const cloudWatchLoggingRole = new iam.Role(this, 'CloudWatchLoggingRole', {
      assumedBy: new iam.ServicePrincipal('transfer.amazonaws.com'),

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #309 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// VPC for Batch compute environment
    const vpc = new ec2.Vpc(this, 'OpenMPVPC', {
      maxAzs: 2,
      natGateways: 1,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'Public',

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #310 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super(scope, id, props);

        this.vpc = new ec2.Vpc(this, 'Vpc', {
            natGateways: 1,
        });

    }
}

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #311 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #312 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// Create ECS resources
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with a cluster and a local image that gets
    // uploaded to an S3 staging bucket prior to being uploaded to ECR.
    // A new repository is created in ECR and the Fargate service is created
    // with the image from ECR.

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #313 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// Creates VPC for the ECS Cluster
    const clusterVpc = new ec2.Vpc(this, "ClusterVpc", {
      ipAddresses: ec2.IpAddresses.cidr("10.50.0.0/16"),
    });

    // Deploys the cluster VPC after the initial image build triggers
    clusterVpc.node.addDependency(triggerLambda);

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #314 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

const stack = new Stack(app, 'integ-testing-eicendpoint', { env });

    const vpc = new ec2.Vpc(stack, 'Vpc', { subnetConfiguration: [{ cidrMask: 24, name: 'rds', subnetType: ec2.SubnetType.PRIVATE_ISOLATED }] });

    const instance = new ec2.Instance(stack, 'instance', {
      vpc,
      vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PRIVATE_ISOLATED }),
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.LARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023(),

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #315 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// Create a VPC with public subnets in 2 AZs
    this.vpc = new Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'ServerPublic',
          subnetType: SubnetType.PUBLIC,
          mapPublicIpOnLaunch: true,

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #316 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'Vpc', {
      ipAddresses: ec2.IpAddresses.cidr(VPC_CIDR),
      subnetConfiguration: [
        {
          cidrMask: SUBNET_SIZE,
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #317 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const asg = new autoscaling.AutoScalingGroup(this, 'MyFleet', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.XLARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64
      }),

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #318 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super(scope, id, props);

    this.vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    this.cluster = new ecs.Cluster(this, 'Cluster', {
      vpc: this.vpc
    });
  }
}

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #319 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// deploy, but VPC creation is slow so we'll only have to do that once
    // and can iterate quickly on consuming stacks. Not doing that for now.
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

    // Instantiate ECS Service with just cluster and image

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #320 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #321 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #322 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// Create the cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'awsvpc-ecs-demo-cluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #323 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3_AMD, ec2.InstanceSize.MICRO)
});

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #324 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// Create VPC and Fargate Cluster
    // NOTE: Limit AZs to avoid reaching resource quotas
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with just cluster and image
    new ecs_patterns.ApplicationLoadBalancedFargateService(this, "FargateService", {
      cluster,
      taskImageOptions: {

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #325 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// Create a cluster
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'fargate-service-autoscaling', { vpc });

    // Create Fargate Service
    const fargateService = new ecs_patterns.NetworkLoadBalancedFargateService(this, 'sample-app', {
      cluster,
      taskImageOptions: {

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #326 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'DefaultVpc', { maxAzs: 2});
    const ecsCluster = new ecs.Cluster(this, 'DefaultEcsCluster', {vpc: vpc});

    const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', {
      vpc: vpc,
      encrypted: true,
      lifecyclePolicy: efs.LifecyclePolicy.AFTER_14_DAYS,

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #327 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// NOTE: Limit AZs to avoid reaching resource quotas
//       NAT needed to pull from ECR and to push cloudwatch logs
const vpc = new ec2.Vpc(stack, 'MyVpc', { maxAzs: 2, natGateways: 1 });
const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });

// Instantiate Fargate Service with a cluster and a local image that gets
// uploaded to an S3 staging bucket prior to being uploaded to ECR.
// A new repository is created in ECR and the Fargate service is created
// with the image from ECR.

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #328 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });

    // create a task definition with CloudWatch Logs
    const logging = new ecs.AwsLogDriver({
      streamPrefix: "myapp",
    })

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #329 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// Create a new VPC for our cluster
    const vpc = new ec2.Vpc(this, "EKSVpc");

    // Create Cluster with no default capacity (node group will be added later)
    const eksCluster = new eks.Cluster(this, "EKSCluster", {
      vpc: vpc,
      defaultCapacity: 0,
      version: kubernetesVersion,

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #330 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC', {});

    const privateSubnets = vpc.privateSubnets.slice(0,2).map(x => x.subnetId)

    const templatedSecret = new sm.Secret(this, adDnsDomainName + '_credentials', {
      generateSecretString: {
        secretStringTemplate: JSON.stringify({ username: 'admin' }),

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #331 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

cidr: "10.192.0.0/16",
      maxAzs: 2,
      natGateways: 0,
      enableDnsHostnames: true,
      enableDnsSupport: true,
      /**
       * Each entry in this list configures a Subnet Group
       *
       * ISOLATED: Isolated Subnets do not route traffic to the Internet (in this VPC).

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #332 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// VPC
    const vpc = new ec2.Vpc(this, "Vpc", {
      vpcName: `${Aws.STACK_NAME}-vpc`,
    });
    this.vpc = vpc;

    // Create Cognito User Pool
    const userPool = new cognito.UserPool(this, 'CognitoUserPool', {

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #333 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

// Create a VPC for our application
    const vpc = new ec2.Vpc(this, 'PostgresLambdaVpc', {
      maxAzs: 2,
      natGateways: 1,
    });

    // Create a PostgreSQL Aurora Serverless v2 cluster
    const dbCluster = new rds.DatabaseCluster(this, 'PostgresCluster', {

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #334 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super(scope, id);
    // @see https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Vpc.html
    this.vpc = new ec2.Vpc(this, "R53ResolverTestVPC", {
      ipAddresses: ec2.IpAddresses.cidr("10.24.34.0/23"),
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #335 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

bucketResource.addPropertyDeletionOverride('CorsConfiguration.Bar');

        const vpc = new ec2.Vpc(this, 'VPC', { maxAzs: 1 });
        const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
            instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.XLARGE),
            machineImage: new ec2.AmazonLinuxImage(),
            vpc
        });

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #336 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

super(scope, id, props);

        const vpc = new ec2.Vpc(this, 'Vpc', {
            ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16')
        });

        const logGroup = new logs.LogGroup(
            this,
            'DNSFirewallLogGroup',

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #337 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

const clusterId = "redis-demo-cluster";

    const vpc = new ec2.Vpc(this, "Vpc", {
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        }

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #338 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [{
        cidrMask: 24,
        name: 'public',
        subnetType: ec2.SubnetType.PUBLIC,
      }]
    });

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #339 — VPC with NAT Gateway is missing the CloudWatch Logs Interface VPC Endpoint $250/mo

const vpc = new ec2.Vpc(this, 'SSMDocumentTestVpc', {
      maxAzs: 1,
      natGateways: 0,
      subnetConfiguration: [
        {
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,
        }
      ]

# Terraform — add CloudWatch Logs Interface VPC Endpoint:
resource "aws_vpc_endpoint" "logs" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.logs"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #340 — Lambda function in VPC (cdk_lambda_line_71) but VPC missing S3 Gateway endpoint(s) $200/mo

# Create the Lambda function to receive the request
        api_hanlder = lambda_.Function(
            self,
            "ApiHandler",
            function_name="apigw_handler",
            runtime=lambda_.Runtime.PYTHON_3_9,
            code=lambda_.Code.from_asset("lambda/apigw-handler"),
            handler="index.handler",

# Add the missing Gateway VPC Endpoint(s) for any AWS service your Lambda uses:
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}
# Repeat for dynamodb if your Lambda uses it.

# AWS docs: https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html

Opportunity #341 — Lambda function in VPC (cdk_lambda_line_107) but VPC missing S3 Gateway + DynamoDB Gateway endpoint(s) $200/mo

###################################################################
        # Lambda for subscription filter
        subscription_filter_lambda = lambda_.Function(
            self,
            "StreamCTCWLtoOSSLambda",
            function_name="bulk_ingest_handler",
            runtime=lambda_.Runtime.PYTHON_3_9,
            handler="index.handler",
            vpc=vpc,

# Add the missing Gateway VPC Endpoint(s) for any AWS service your Lambda uses:
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}
# Repeat for dynamodb if your Lambda uses it.

# AWS docs: https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html

Opportunity #342 — Lambda function in VPC (cdk_ts_lambda_line_17) but VPC missing S3 Gateway + DynamoDB Gateway endpoint(s) $200/mo

const { vpc: vpcLambda } = new VpcNestedStack(this, 'nested-stack-lambda');

    const lambdaFunction1 = new lambda.Function(this, 'lambda-function-1', {
      runtime: lambda.Runtime.NODEJS_18_X,
      vpc: vpcLambda,
      vpcSubnets: {
        subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
      },
      memorySize: 128,

# Add the missing Gateway VPC Endpoint(s) for any AWS service your Lambda uses:
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
}
# Repeat for dynamodb if your Lambda uses it.

# AWS docs: https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html

Opportunity #343 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# VPC
        vpc = ec2.Vpc(
            self,
            "Ingress",
            cidr="10.1.0.0/16",
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="Private-Subnet", subnet_type=ec2.SubnetType.PRIVATE_ISOLATED,

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #344 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# Create a VPC for our infrastructure
        vpc = ec2.Vpc(self, "VPC")

        # Read and prepare user data script for EC2 instances
        data = open("./httpd.sh", "rb").read()
        httpd=ec2.UserData.for_linux()
        httpd.add_commands(str(data,'utf-8'))

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #345 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueueArm64")

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #346 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #347 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #348 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super().__init__(app, id, **kwargs)

        vpc = ec2.Vpc(self, "VPC")

        asg = autoscaling.AutoScalingGroup(
            self, "ASG",
            vpc=vpc,
            instance_type=ec2.InstanceType.of(
                ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #349 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #350 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #351 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

from aws_cdk import CfnOutput, Stack
from aws_cdk.aws_ec2 import Vpc, NatProvider, SubnetConfiguration, SubnetType
from constructs import Construct

class NetworkStack(Stack):

    def __init__(self, scope: Construct, id: str, props, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #352 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

#    region=region)
        
        vpc = ec2.Vpc(
            self,"LabVpc",
            cidr="10.10.0.0/24"
        )

        #Instance
        instance = ec2.Instance(self,

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #353 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC)]
            )

        # AMI
        amzn_linux = ec2.MachineImage.latest_amazon_linux(
            generation=ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #354 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

night_max = nightschedule[2]["max"]

        vpc = ec2.Vpc(self, "ecsVpc", max_azs=2)

        ecs_cluster = ecs.Cluster(
            self,
            id="ecscluster",
            vpc=vpc,
            container_insights=True,

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #355 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super().__init__(scope, construct_id, **kwargs)
        # Creating a shared VPC with public subnets and private subnets with NAT Gateways
        vpc = ec2.Vpc(self, "ServiceConnectVPC",
                    ip_addresses=ec2.IpAddresses.cidr("10.0.0.0/16"),
                    create_internet_gateway=True,
                    max_azs=2,
                    nat_gateways=2,
                    enable_dns_hostnames=True,
                    enable_dns_support=True,

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #356 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        asg = autoscaling.AutoScalingGroup(
            self, "MyFleet",

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #357 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #358 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# Create VPC with 2 Availability Zones
vpc = ec2.Vpc(
    stack, "MyVpc",
    max_azs=2
)

# Create ECS cluster in the VPC
cluster = ecs.Cluster(

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #359 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "awsvpc-ecs-demo-cluster",

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #360 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "EcsCluster",

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #361 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #362 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# Create a cluster
        vpc = ec2.Vpc(
            self, "Vpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'fargate-service-autoscaling',

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #363 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

VOLUME_NAME = 'cdk-ecs-sample-efs-volume'

        vpc = ec2.Vpc(
            self, PREFIX + 'Vpc',
            max_azs=2
        )

        ecs_cluster = ecs.Cluster(
            self, PREFIX + 'Cluster',

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #364 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

self,
            "vpc",
            nat_gateways=0,
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="public", subnet_type=ec2.SubnetType.PUBLIC
                )
            ],
        )

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #365 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# VPC in which the MSK cluster and client are located
        vpc = ec2.Vpc(self, "MskVpc",
            cidr="10.0.0.0/16",
            nat_gateways=1,
            max_azs=2,
            subnet_configuration = subnets)

        # MSK cluster and an EC2 Instance used to create the topics

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #366 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# The code that defines your stack goes here

        self.vpc = ec2.Vpc(self, "VPC",
                           max_azs=2,
                           cidr="10.10.0.0/16",
                           # configuration will create 3 groups in 2 AZs = 6 subnets.
                           subnet_configuration=[ec2.SubnetConfiguration(
                               subnet_type=ec2.SubnetType.PUBLIC,
                               name="Public",

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #367 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "SvlCTCWLVpc")
        es_sec_grp = ec2.SecurityGroup(
            self,
            "SvlCTCWLOpenSearchSecGrp",
            vpc=vpc,
            allow_all_outbound=True,
            security_group_name="SvlCTCWLSecGrp",

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #368 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "OpenSearch VPC", max_azs=3)

        ################################################################################
        # Amazon OpenSearch Service domain
        es_sec_grp = ec2.SecurityGroup(
            self,
            "OpenSearchSecGrp",

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #369 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "IcePlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #370 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "LavaPlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #371 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #372 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super().__init__(scope, construct_id, **kwargs)

        vpc = ec2.Vpc(self, "ecsVpc")

        s3_bucket = s3.Bucket(
            self,
            "bucket",
            access_control=s3.BucketAccessControl.PRIVATE,
            encryption=s3.BucketEncryption.S3_MANAGED,

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #373 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC,cidr_mask=24)],
        )

        # Instance Role and SSM Managed Policy
        role = iam.Role(self, "ec2Role", assumed_by=iam.ServicePrincipal("ec2.amazonaws.com"))

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #374 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

)

        vpc = ec2.Vpc(self, "infrastructure_vpc",
            vpc_name="emr_cdk_vpc",
            nat_gateways=1,
            cidr= '10.0.0.0/16',
            gateway_endpoints=
                {
                    "S3":

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #375 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

def create_VPC(self):
        vpc = ec2.Vpc(
            self,
            "Vpc",
            ip_addresses = ec2.IpAddresses.cidr(VPC_CIDR),
            subnet_configuration = [
                ec2.SubnetConfiguration(
                    name = 'Public-Subent',

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #376 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

this.vpc = new ec2.Vpc(this, 'nested-stack-vpc', {
      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
      natGateways: 0,
      maxAzs: 3,
      subnetConfiguration: [
        {
          name: 'public-subnet-1',
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 24,

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #377 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #378 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

this.vpc = new Vpc(this, 'vpc', {
        maxAzs: 3,
        natGateways: 1,
        enableDnsHostnames: true,
        enableDnsSupport: true,
        ipAddresses: IpAddresses.cidr('10.0.0.0/16'),
        subnetConfiguration: [
        {
            cidrMask: 24,

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #379 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      maxAzs: 2,
      natGateways: 0,
    });

    // Create the required IAM role which allows the SFTP server
    // to log to CloudWatch.
    const cloudWatchLoggingRole = new iam.Role(this, 'CloudWatchLoggingRole', {
      assumedBy: new iam.ServicePrincipal('transfer.amazonaws.com'),

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #380 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// VPC for Batch compute environment
    const vpc = new ec2.Vpc(this, 'OpenMPVPC', {
      maxAzs: 2,
      natGateways: 1,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'Public',

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #381 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super(scope, id, props);

        this.vpc = new ec2.Vpc(this, 'Vpc', {
            natGateways: 1,
        });

    }
}

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #382 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #383 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// Create ECS resources
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with a cluster and a local image that gets
    // uploaded to an S3 staging bucket prior to being uploaded to ECR.
    // A new repository is created in ECR and the Fargate service is created
    // with the image from ECR.

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #384 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// Creates VPC for the ECS Cluster
    const clusterVpc = new ec2.Vpc(this, "ClusterVpc", {
      ipAddresses: ec2.IpAddresses.cidr("10.50.0.0/16"),
    });

    // Deploys the cluster VPC after the initial image build triggers
    clusterVpc.node.addDependency(triggerLambda);

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #385 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

const stack = new Stack(app, 'integ-testing-eicendpoint', { env });

    const vpc = new ec2.Vpc(stack, 'Vpc', { subnetConfiguration: [{ cidrMask: 24, name: 'rds', subnetType: ec2.SubnetType.PRIVATE_ISOLATED }] });

    const instance = new ec2.Instance(stack, 'instance', {
      vpc,
      vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PRIVATE_ISOLATED }),
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.LARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023(),

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #386 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// Create a VPC with public subnets in 2 AZs
    this.vpc = new Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'ServerPublic',
          subnetType: SubnetType.PUBLIC,
          mapPublicIpOnLaunch: true,

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #387 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'Vpc', {
      ipAddresses: ec2.IpAddresses.cidr(VPC_CIDR),
      subnetConfiguration: [
        {
          cidrMask: SUBNET_SIZE,
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #388 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const asg = new autoscaling.AutoScalingGroup(this, 'MyFleet', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.XLARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64
      }),

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #389 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super(scope, id, props);

    this.vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    this.cluster = new ecs.Cluster(this, 'Cluster', {
      vpc: this.vpc
    });
  }
}

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #390 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// deploy, but VPC creation is slow so we'll only have to do that once
    // and can iterate quickly on consuming stacks. Not doing that for now.
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

    // Instantiate ECS Service with just cluster and image

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #391 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #392 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #393 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// Create the cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'awsvpc-ecs-demo-cluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #394 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3_AMD, ec2.InstanceSize.MICRO)
});

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #395 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// Create VPC and Fargate Cluster
    // NOTE: Limit AZs to avoid reaching resource quotas
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with just cluster and image
    new ecs_patterns.ApplicationLoadBalancedFargateService(this, "FargateService", {
      cluster,
      taskImageOptions: {

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #396 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// Create a cluster
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'fargate-service-autoscaling', { vpc });

    // Create Fargate Service
    const fargateService = new ecs_patterns.NetworkLoadBalancedFargateService(this, 'sample-app', {
      cluster,
      taskImageOptions: {

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #397 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'DefaultVpc', { maxAzs: 2});
    const ecsCluster = new ecs.Cluster(this, 'DefaultEcsCluster', {vpc: vpc});

    const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', {
      vpc: vpc,
      encrypted: true,
      lifecyclePolicy: efs.LifecyclePolicy.AFTER_14_DAYS,

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #398 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// NOTE: Limit AZs to avoid reaching resource quotas
//       NAT needed to pull from ECR and to push cloudwatch logs
const vpc = new ec2.Vpc(stack, 'MyVpc', { maxAzs: 2, natGateways: 1 });
const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });

// Instantiate Fargate Service with a cluster and a local image that gets
// uploaded to an S3 staging bucket prior to being uploaded to ECR.
// A new repository is created in ECR and the Fargate service is created
// with the image from ECR.

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #399 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });

    // create a task definition with CloudWatch Logs
    const logging = new ecs.AwsLogDriver({
      streamPrefix: "myapp",
    })

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #400 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// Create a new VPC for our cluster
    const vpc = new ec2.Vpc(this, "EKSVpc");

    // Create Cluster with no default capacity (node group will be added later)
    const eksCluster = new eks.Cluster(this, "EKSCluster", {
      vpc: vpc,
      defaultCapacity: 0,
      version: kubernetesVersion,

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #401 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC', {});

    const privateSubnets = vpc.privateSubnets.slice(0,2).map(x => x.subnetId)

    const templatedSecret = new sm.Secret(this, adDnsDomainName + '_credentials', {
      generateSecretString: {
        secretStringTemplate: JSON.stringify({ username: 'admin' }),

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #402 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

cidr: "10.192.0.0/16",
      maxAzs: 2,
      natGateways: 0,
      enableDnsHostnames: true,
      enableDnsSupport: true,
      /**
       * Each entry in this list configures a Subnet Group
       *
       * ISOLATED: Isolated Subnets do not route traffic to the Internet (in this VPC).

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #403 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// VPC
    const vpc = new ec2.Vpc(this, "Vpc", {
      vpcName: `${Aws.STACK_NAME}-vpc`,
    });
    this.vpc = vpc;

    // Create Cognito User Pool
    const userPool = new cognito.UserPool(this, 'CognitoUserPool', {

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #404 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

// Create a VPC for our application
    const vpc = new ec2.Vpc(this, 'PostgresLambdaVpc', {
      maxAzs: 2,
      natGateways: 1,
    });

    // Create a PostgreSQL Aurora Serverless v2 cluster
    const dbCluster = new rds.DatabaseCluster(this, 'PostgresCluster', {

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #405 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super(scope, id);
    // @see https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Vpc.html
    this.vpc = new ec2.Vpc(this, "R53ResolverTestVPC", {
      ipAddresses: ec2.IpAddresses.cidr("10.24.34.0/23"),
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #406 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

bucketResource.addPropertyDeletionOverride('CorsConfiguration.Bar');

        const vpc = new ec2.Vpc(this, 'VPC', { maxAzs: 1 });
        const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
            instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.XLARGE),
            machineImage: new ec2.AmazonLinuxImage(),
            vpc
        });

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #407 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

super(scope, id, props);

        const vpc = new ec2.Vpc(this, 'Vpc', {
            ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16')
        });

        const logGroup = new logs.LogGroup(
            this,
            'DNSFirewallLogGroup',

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #408 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

const clusterId = "redis-demo-cluster";

    const vpc = new ec2.Vpc(this, "Vpc", {
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        }

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #409 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [{
        cidrMask: 24,
        name: 'public',
        subnetType: ec2.SubnetType.PUBLIC,
      }]
    });

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #410 — VPC with NAT Gateway is missing the STS Interface VPC Endpoint $150/mo

const vpc = new ec2.Vpc(this, 'SSMDocumentTestVpc', {
      maxAzs: 1,
      natGateways: 0,
      subnetConfiguration: [
        {
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,
        }
      ]

# Terraform — add STS Interface VPC Endpoint:
resource "aws_vpc_endpoint" "sts" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.sts"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #411 — 3 NAT Gateways without HA justification (2 extra over single-AZ) $270/mo

enable_dns_support=True,
                  max_azs=2,
                  nat_gateway_provider=NatProvider.gateway(),
                  nat_gateways=1,
                  subnet_configuration=[subnet1, subnet2]
                  )

        # This will export the VPC's ID in CloudFormation under the key
        # 'vpcid'

# Option A — single NAT Gateway (best for most workloads):
resource "aws_nat_gateway" "single" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public[0].id
  # Document tradeoff: cross-AZ data charges apply if the AZ goes down.
}

# Option B — keep multi-AZ NAT with documented justification:
resource "aws_nat_gateway" "per_az" {
  # HA-required: customer contract mandates RPO=0 even during AZ outage.
  count         = length(aws_subnet.public)
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
}

Opportunity #412 — 3 NAT Gateways without HA justification (2 extra over single-AZ) $270/mo

)
                           ],
                           # nat_gateway_provider=ec2.NatProvider.gateway(),
                           nat_gateways=2,
                           )
        CfnOutput(self, "Output",
                       value=self.vpc.vpc_id)

# Option A — single NAT Gateway (best for most workloads):
resource "aws_nat_gateway" "single" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public[0].id
  # Document tradeoff: cross-AZ data charges apply if the AZ goes down.
}

# Option B — keep multi-AZ NAT with documented justification:
resource "aws_nat_gateway" "per_az" {
  # HA-required: customer contract mandates RPO=0 even during AZ outage.
  count         = length(aws_subnet.public)
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
}

Opportunity #413 — 2 NAT Gateways without HA justification (1 extra over single-AZ) $135/mo

create_internet_gateway=True,
                    max_azs=2,
                    nat_gateways=2,
                    enable_dns_hostnames=True,
                    enable_dns_support=True,
                    vpc_name="App-Mesh-VPC",
                    subnet_configuration=[
                        ec2.SubnetConfiguration(
                            subnet_type=ec2.SubnetType.PUBLIC,

# Option A — single NAT Gateway (best for most workloads):
resource "aws_nat_gateway" "single" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public[0].id
  # Document tradeoff: cross-AZ data charges apply if the AZ goes down.
}

# Option B — keep multi-AZ NAT with documented justification:
resource "aws_nat_gateway" "per_az" {
  # HA-required: customer contract mandates RPO=0 even during AZ outage.
  count         = length(aws_subnet.public)
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
}

Opportunity #414 — 2 NAT Gateways without HA justification (1 extra over single-AZ) $135/mo

vpc = ec2.Vpc(self, "MskVpc",
            cidr="10.0.0.0/16",
            nat_gateways=1,
            max_azs=2,
            subnet_configuration = subnets)

        # MSK cluster and an EC2 Instance used to create the topics
        msk_cluster = MskBroker(self, 'MSKBroker', 
            vpc=vpc,

# Option A — single NAT Gateway (best for most workloads):
resource "aws_nat_gateway" "single" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public[0].id
  # Document tradeoff: cross-AZ data charges apply if the AZ goes down.
}

# Option B — keep multi-AZ NAT with documented justification:
resource "aws_nat_gateway" "per_az" {
  # HA-required: customer contract mandates RPO=0 even during AZ outage.
  count         = length(aws_subnet.public)
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
}

Opportunity #415 — 2 NAT Gateways without HA justification (1 extra over single-AZ) $135/mo

vpc = ec2.Vpc(self, "infrastructure_vpc",
            vpc_name="emr_cdk_vpc",
            nat_gateways=1,
            cidr= '10.0.0.0/16',
            gateway_endpoints=
                {
                    "S3": 
                        ec2.GatewayVpcEndpointOptions(service=ec2.GatewayVpcEndpointAwsService.S3)
                },

# Option A — single NAT Gateway (best for most workloads):
resource "aws_nat_gateway" "single" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public[0].id
  # Document tradeoff: cross-AZ data charges apply if the AZ goes down.
}

# Option B — keep multi-AZ NAT with documented justification:
resource "aws_nat_gateway" "per_az" {
  # HA-required: customer contract mandates RPO=0 even during AZ outage.
  count         = length(aws_subnet.public)
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
}

Opportunity #416 — 2 NAT Gateways without HA justification (1 extra over single-AZ) $135/mo

const vpc = new ec2.Vpc(this, 'OpenMPVPC', {
      maxAzs: 2,
      natGateways: 1,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'Public',
          subnetType: ec2.SubnetType.PUBLIC,
        },

# Option A — single NAT Gateway (best for most workloads):
resource "aws_nat_gateway" "single" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public[0].id
  # Document tradeoff: cross-AZ data charges apply if the AZ goes down.
}

# Option B — keep multi-AZ NAT with documented justification:
resource "aws_nat_gateway" "per_az" {
  # HA-required: customer contract mandates RPO=0 even during AZ outage.
  count         = length(aws_subnet.public)
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
}

Opportunity #417 — 2 NAT Gateways without HA justification (1 extra over single-AZ) $135/mo

this.vpc = new ec2.Vpc(this, 'Vpc', {
            natGateways: 1,
        });

    }
}

# Option A — single NAT Gateway (best for most workloads):
resource "aws_nat_gateway" "single" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public[0].id
  # Document tradeoff: cross-AZ data charges apply if the AZ goes down.
}

# Option B — keep multi-AZ NAT with documented justification:
resource "aws_nat_gateway" "per_az" {
  # HA-required: customer contract mandates RPO=0 even during AZ outage.
  count         = length(aws_subnet.public)
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
}

Opportunity #418 — 2 NAT Gateways without HA justification (1 extra over single-AZ) $135/mo

// NOTE: Limit AZs to avoid reaching resource quotas
//       NAT needed to pull from ECR and to push cloudwatch logs
const vpc = new ec2.Vpc(stack, 'MyVpc', { maxAzs: 2, natGateways: 1 });
const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });

// Instantiate Fargate Service with a cluster and a local image that gets
// uploaded to an S3 staging bucket prior to being uploaded to ECR.
// A new repository is created in ECR and the Fargate service is created
// with the image from ECR.

# Option A — single NAT Gateway (best for most workloads):
resource "aws_nat_gateway" "single" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public[0].id
  # Document tradeoff: cross-AZ data charges apply if the AZ goes down.
}

# Option B — keep multi-AZ NAT with documented justification:
resource "aws_nat_gateway" "per_az" {
  # HA-required: customer contract mandates RPO=0 even during AZ outage.
  count         = length(aws_subnet.public)
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
}

Opportunity #419 — 2 NAT Gateways without HA justification (1 extra over single-AZ) $135/mo

const vpc = new ec2.Vpc(this, 'PostgresLambdaVpc', {
      maxAzs: 2,
      natGateways: 1,
    });

    // Create a PostgreSQL Aurora Serverless v2 cluster
    const dbCluster = new rds.DatabaseCluster(this, 'PostgresCluster', {
      engine: rds.DatabaseClusterEngine.auroraPostgres({
        version: rds.AuroraPostgresEngineVersion.VER_17_4,

# Option A — single NAT Gateway (best for most workloads):
resource "aws_nat_gateway" "single" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.public[0].id
  # Document tradeoff: cross-AZ data charges apply if the AZ goes down.
}

# Option B — keep multi-AZ NAT with documented justification:
resource "aws_nat_gateway" "per_az" {
  # HA-required: customer contract mandates RPO=0 even during AZ outage.
  count         = length(aws_subnet.public)
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
}

Opportunity #420 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# VPC
        vpc = ec2.Vpc(
            self,
            "Ingress",
            cidr="10.1.0.0/16",
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="Private-Subnet", subnet_type=ec2.SubnetType.PRIVATE_ISOLATED,

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #421 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# Create a VPC for our infrastructure
        vpc = ec2.Vpc(self, "VPC")

        # Read and prepare user data script for EC2 instances
        data = open("./httpd.sh", "rb").read()
        httpd=ec2.UserData.for_linux()
        httpd.add_commands(str(data,'utf-8'))

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #422 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueueArm64")

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #423 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #424 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# This resource alone will create a private/public subnet in each AZ as well as nat/internet gateway(s)
        vpc = ec2.Vpc(self, "VPC")

        # To create number of Batch Compute Environment
        count = 3

        # Create AWS Batch Job Queue
        self.batch_queue = batch.JobQueue(self, "JobQueue")

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #425 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super().__init__(app, id, **kwargs)

        vpc = ec2.Vpc(self, "VPC")

        asg = autoscaling.AutoScalingGroup(
            self, "ASG",
            vpc=vpc,
            instance_type=ec2.InstanceType.of(
                ec2.InstanceClass.BURSTABLE2, ec2.InstanceSize.MICRO

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #426 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #427 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# Creates VPC for the ECS Cluster
        cluster_vpc = ec2.Vpc(
            self, "ClusterVpc",
            ip_addresses=ec2.IpAddresses.cidr(cidr_block="10.75.0.0/16")
        )

        # Deploys the cluster VPC after the initial image build triggers
        cluster_vpc.node.add_dependency(trigger_lambda)

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #428 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

from aws_cdk import CfnOutput, Stack
from aws_cdk.aws_ec2 import Vpc, NatProvider, SubnetConfiguration, SubnetType
from constructs import Construct

class NetworkStack(Stack):

    def __init__(self, scope: Construct, id: str, props, **kwargs) -> None:
        super().__init__(scope, id, **kwargs)

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #429 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

#    region=region)
        
        vpc = ec2.Vpc(
            self,"LabVpc",
            cidr="10.10.0.0/24"
        )

        #Instance
        instance = ec2.Instance(self,

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #430 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC)]
            )

        # AMI
        amzn_linux = ec2.MachineImage.latest_amazon_linux(
            generation=ec2.AmazonLinuxGeneration.AMAZON_LINUX_2,

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #431 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

night_max = nightschedule[2]["max"]

        vpc = ec2.Vpc(self, "ecsVpc", max_azs=2)

        ecs_cluster = ecs.Cluster(
            self,
            id="ecscluster",
            vpc=vpc,
            container_insights=True,

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #432 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super().__init__(scope, construct_id, **kwargs)
        # Creating a shared VPC with public subnets and private subnets with NAT Gateways
        vpc = ec2.Vpc(self, "ServiceConnectVPC",
                    ip_addresses=ec2.IpAddresses.cidr("10.0.0.0/16"),
                    create_internet_gateway=True,
                    max_azs=2,
                    nat_gateways=2,
                    enable_dns_hostnames=True,
                    enable_dns_support=True,

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #433 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        asg = autoscaling.AutoScalingGroup(
            self, "MyFleet",

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #434 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super().__init__(scope, id, *kwargs)

        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #435 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# Create VPC with 2 Availability Zones
vpc = ec2.Vpc(
    stack, "MyVpc",
    max_azs=2
)

# Create ECS cluster in the VPC
cluster = ecs.Cluster(

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #436 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "awsvpc-ecs-demo-cluster",

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #437 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# Create a cluster
vpc = ec2.Vpc(
    stack, "Vpc",
    max_azs=2
)

cluster = ecs.Cluster(
    stack, "EcsCluster",

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #438 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #439 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# Create a cluster
        vpc = ec2.Vpc(
            self, "Vpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'fargate-service-autoscaling',

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #440 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

VOLUME_NAME = 'cdk-ecs-sample-efs-volume'

        vpc = ec2.Vpc(
            self, PREFIX + 'Vpc',
            max_azs=2
        )

        ecs_cluster = ecs.Cluster(
            self, PREFIX + 'Cluster',

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #441 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

self,
            "vpc",
            nat_gateways=0,
            subnet_configuration=[
                ec2.SubnetConfiguration(
                    name="public", subnet_type=ec2.SubnetType.PUBLIC
                )
            ],
        )

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #442 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# VPC in which the MSK cluster and client are located
        vpc = ec2.Vpc(self, "MskVpc",
            cidr="10.0.0.0/16",
            nat_gateways=1,
            max_azs=2,
            subnet_configuration = subnets)

        # MSK cluster and an EC2 Instance used to create the topics

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #443 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# The code that defines your stack goes here

        self.vpc = ec2.Vpc(self, "VPC",
                           max_azs=2,
                           cidr="10.10.0.0/16",
                           # configuration will create 3 groups in 2 AZs = 6 subnets.
                           subnet_configuration=[ec2.SubnetConfiguration(
                               subnet_type=ec2.SubnetType.PUBLIC,
                               name="Public",

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #444 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "SvlCTCWLVpc")
        es_sec_grp = ec2.SecurityGroup(
            self,
            "SvlCTCWLOpenSearchSecGrp",
            vpc=vpc,
            allow_all_outbound=True,
            security_group_name="SvlCTCWLSecGrp",

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #445 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

################################################################################
        # VPC
        vpc = ec2.Vpc(self, "OpenSearch VPC", max_azs=3)

        ################################################################################
        # Amazon OpenSearch Service domain
        es_sec_grp = ec2.SecurityGroup(
            self,
            "OpenSearchSecGrp",

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #446 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "IcePlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #447 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super().__init__(scope, id, **kwargs)

    vpc = ec2.Vpc(self, "LavaPlainsVpc",
      cidr                 = "10.99.0.0/16",
      max_azs              = 3,
      enable_dns_hostnames = True,
      enable_dns_support   = True,
      subnet_configuration = [
        ec2.SubnetConfiguration(

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #448 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# Create VPC and Fargate Cluster
        # NOTE: Limit AZs to avoid reaching resource quotas
        vpc = ec2.Vpc(
            self, "MyVpc",
            max_azs=2
        )

        cluster = ecs.Cluster(
            self, 'Ec2Cluster',

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #449 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super().__init__(scope, construct_id, **kwargs)

        vpc = ec2.Vpc(self, "ecsVpc")

        s3_bucket = s3.Bucket(
            self,
            "bucket",
            access_control=s3.BucketAccessControl.PRIVATE,
            encryption=s3.BucketEncryption.S3_MANAGED,

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #450 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

# VPC
        vpc = ec2.Vpc(self, "VPC",
            nat_gateways=0,
            subnet_configuration=[ec2.SubnetConfiguration(name="public",subnet_type=ec2.SubnetType.PUBLIC,cidr_mask=24)],
        )

        # Instance Role and SSM Managed Policy
        role = iam.Role(self, "ec2Role", assumed_by=iam.ServicePrincipal("ec2.amazonaws.com"))

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #451 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

)

        vpc = ec2.Vpc(self, "infrastructure_vpc",
            vpc_name="emr_cdk_vpc",
            nat_gateways=1,
            cidr= '10.0.0.0/16',
            gateway_endpoints=
                {
                    "S3":

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #452 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

def create_VPC(self):
        vpc = ec2.Vpc(
            self,
            "Vpc",
            ip_addresses = ec2.IpAddresses.cidr(VPC_CIDR),
            subnet_configuration = [
                ec2.SubnetConfiguration(
                    name = 'Public-Subent',

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #453 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

this.vpc = new ec2.Vpc(this, 'nested-stack-vpc', {
      ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16'),
      natGateways: 0,
      maxAzs: 3,
      subnetConfiguration: [
        {
          name: 'public-subnet-1',
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 24,

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #454 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #455 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

this.vpc = new Vpc(this, 'vpc', {
        maxAzs: 3,
        natGateways: 1,
        enableDnsHostnames: true,
        enableDnsSupport: true,
        ipAddresses: IpAddresses.cidr('10.0.0.0/16'),
        subnetConfiguration: [
        {
            cidrMask: 24,

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #456 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      maxAzs: 2,
      natGateways: 0,
    });

    // Create the required IAM role which allows the SFTP server
    // to log to CloudWatch.
    const cloudWatchLoggingRole = new iam.Role(this, 'CloudWatchLoggingRole', {
      assumedBy: new iam.ServicePrincipal('transfer.amazonaws.com'),

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #457 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// VPC for Batch compute environment
    const vpc = new ec2.Vpc(this, 'OpenMPVPC', {
      maxAzs: 2,
      natGateways: 1,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'Public',

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #458 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super(scope, id, props);

        this.vpc = new ec2.Vpc(this, 'Vpc', {
            natGateways: 1,
        });

    }
}

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #459 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC');

    const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
      vpc,
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.MICRO),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #460 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// Create ECS resources
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with a cluster and a local image that gets
    // uploaded to an S3 staging bucket prior to being uploaded to ECR.
    // A new repository is created in ECR and the Fargate service is created
    // with the image from ECR.

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #461 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// Creates VPC for the ECS Cluster
    const clusterVpc = new ec2.Vpc(this, "ClusterVpc", {
      ipAddresses: ec2.IpAddresses.cidr("10.50.0.0/16"),
    });

    // Deploys the cluster VPC after the initial image build triggers
    clusterVpc.node.addDependency(triggerLambda);

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #462 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

const stack = new Stack(app, 'integ-testing-eicendpoint', { env });

    const vpc = new ec2.Vpc(stack, 'Vpc', { subnetConfiguration: [{ cidrMask: 24, name: 'rds', subnetType: ec2.SubnetType.PRIVATE_ISOLATED }] });

    const instance = new ec2.Instance(stack, 'instance', {
      vpc,
      vpcSubnets: vpc.selectSubnets({ subnetType: ec2.SubnetType.PRIVATE_ISOLATED }),
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.LARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023(),

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #463 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// Create a VPC with public subnets in 2 AZs
    this.vpc = new Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: 'ServerPublic',
          subnetType: SubnetType.PUBLIC,
          mapPublicIpOnLaunch: true,

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #464 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const asg = new autoscaling.AutoScalingGroup(this, 'MyFleet', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE4_GRAVITON, ec2.InstanceSize.XLARGE),
      machineImage: ec2.MachineImage.latestAmazonLinux2023({
        cpuType: ec2.AmazonLinuxCpuType.ARM_64
      }),

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #465 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super(scope, id, props);

    this.vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    this.cluster = new ecs.Cluster(this, 'Cluster', {
      vpc: this.vpc
    });
  }
}

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #466 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// deploy, but VPC creation is slow so we'll only have to do that once
    // and can iterate quickly on consuming stacks. Not doing that for now.
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

    // Instantiate ECS Service with just cluster and image

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #467 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #468 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });

    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });
    cluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
    });

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #469 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// Create the cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'awsvpc-ecs-demo-cluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3, ec2.InstanceSize.MICRO)
});

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #470 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// Create a cluster
const vpc = new ec2.Vpc(stack, 'Vpc', { maxAzs: 2 });

const cluster = new ecs.Cluster(stack, 'EcsCluster', { vpc });
cluster.addCapacity('DefaultAutoScalingGroup', {
  instanceType: ec2.InstanceType.of(ec2.InstanceClass.BURSTABLE3_AMD, ec2.InstanceSize.MICRO)
});

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #471 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// Create VPC and Fargate Cluster
    // NOTE: Limit AZs to avoid reaching resource quotas
    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Cluster', { vpc });

    // Instantiate Fargate Service with just cluster and image
    new ecs_patterns.ApplicationLoadBalancedFargateService(this, "FargateService", {
      cluster,
      taskImageOptions: {

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #472 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// Create a cluster
    const vpc = new ec2.Vpc(this, 'Vpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'fargate-service-autoscaling', { vpc });

    // Create Fargate Service
    const fargateService = new ecs_patterns.NetworkLoadBalancedFargateService(this, 'sample-app', {
      cluster,
      taskImageOptions: {

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #473 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'DefaultVpc', { maxAzs: 2});
    const ecsCluster = new ecs.Cluster(this, 'DefaultEcsCluster', {vpc: vpc});

    const fileSystem = new efs.FileSystem(this, 'MyEfsFileSystem', {
      vpc: vpc,
      encrypted: true,
      lifecyclePolicy: efs.LifecyclePolicy.AFTER_14_DAYS,

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #474 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// NOTE: Limit AZs to avoid reaching resource quotas
//       NAT needed to pull from ECR and to push cloudwatch logs
const vpc = new ec2.Vpc(stack, 'MyVpc', { maxAzs: 2, natGateways: 1 });
const cluster = new ecs.Cluster(stack, 'Cluster', { vpc });

// Instantiate Fargate Service with a cluster and a local image that gets
// uploaded to an S3 staging bucket prior to being uploaded to ECR.
// A new repository is created in ECR and the Fargate service is created
// with the image from ECR.

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #475 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super(scope, id, props);

    const vpc = new ec2.Vpc(this, 'MyVpc', { maxAzs: 2 });
    const cluster = new ecs.Cluster(this, 'Ec2Cluster', { vpc });

    // create a task definition with CloudWatch Logs
    const logging = new ecs.AwsLogDriver({
      streamPrefix: "myapp",
    })

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #476 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// Create a new VPC for our cluster
    const vpc = new ec2.Vpc(this, "EKSVpc");

    // Create Cluster with no default capacity (node group will be added later)
    const eksCluster = new eks.Cluster(this, "EKSCluster", {
      vpc: vpc,
      defaultCapacity: 0,
      version: kubernetesVersion,

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #477 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super(app, id);

    const vpc = new ec2.Vpc(this, 'VPC', {});

    const privateSubnets = vpc.privateSubnets.slice(0,2).map(x => x.subnetId)

    const templatedSecret = new sm.Secret(this, adDnsDomainName + '_credentials', {
      generateSecretString: {
        secretStringTemplate: JSON.stringify({ username: 'admin' }),

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #478 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

cidr: "10.192.0.0/16",
      maxAzs: 2,
      natGateways: 0,
      enableDnsHostnames: true,
      enableDnsSupport: true,
      /**
       * Each entry in this list configures a Subnet Group
       *
       * ISOLATED: Isolated Subnets do not route traffic to the Internet (in this VPC).

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #479 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// VPC
    const vpc = new ec2.Vpc(this, "Vpc", {
      vpcName: `${Aws.STACK_NAME}-vpc`,
    });
    this.vpc = vpc;

    // Create Cognito User Pool
    const userPool = new cognito.UserPool(this, 'CognitoUserPool', {

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #480 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

// Create a VPC for our application
    const vpc = new ec2.Vpc(this, 'PostgresLambdaVpc', {
      maxAzs: 2,
      natGateways: 1,
    });

    // Create a PostgreSQL Aurora Serverless v2 cluster
    const dbCluster = new rds.DatabaseCluster(this, 'PostgresCluster', {

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #481 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super(scope, id);
    // @see https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.Vpc.html
    this.vpc = new ec2.Vpc(this, "R53ResolverTestVPC", {
      ipAddresses: ec2.IpAddresses.cidr("10.24.34.0/23"),
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #482 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

bucketResource.addPropertyDeletionOverride('CorsConfiguration.Bar');

        const vpc = new ec2.Vpc(this, 'VPC', { maxAzs: 1 });
        const asg = new autoscaling.AutoScalingGroup(this, 'ASG', {
            instanceType: ec2.InstanceType.of(ec2.InstanceClass.M4, ec2.InstanceSize.XLARGE),
            machineImage: new ec2.AmazonLinuxImage(),
            vpc
        });

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #483 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

super(scope, id, props);

        const vpc = new ec2.Vpc(this, 'Vpc', {
            ipAddresses: ec2.IpAddresses.cidr('10.0.0.0/16')
        });

        const logGroup = new logs.LogGroup(
            this,
            'DNSFirewallLogGroup',

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #484 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

const clusterId = "redis-demo-cluster";

    const vpc = new ec2.Vpc(this, "Vpc", {
      subnetConfiguration: [
        {
          cidrMask: 24,
          name: "Private",
          subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
        }

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #485 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

const vpc = new ec2.Vpc(this, 'VPC', {
      natGateways: 0,
      subnetConfiguration: [{
        cidrMask: 24,
        name: 'public',
        subnetType: ec2.SubnetType.PUBLIC,
      }]
    });

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

Opportunity #486 — VPC with NAT Gateway is missing the SSM Interface VPC Endpoint $100/mo

const vpc = new ec2.Vpc(this, 'SSMDocumentTestVpc', {
      maxAzs: 1,
      natGateways: 0,
      subnetConfiguration: [
        {
          name: 'public',
          subnetType: ec2.SubnetType.PUBLIC,
        }
      ]

# Terraform — add SSM Interface VPC Endpoint:
resource "aws_vpc_endpoint" "ssm" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.${var.region}.ssm"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = aws_subnet.private[*].id
  security_group_ids  = [aws_security_group.vpce.id]
  private_dns_enabled = true
}

# AWS docs: https://docs.aws.amazon.com/vpc/latest/privatelink/create-interface-endpoint.html

How AWS NAT Gateway billing works

AWS NAT Gateway charges have three components, all visible in the AWS Cost Explorer under Services -> EC2-Other:

• NAT Gateway hourly: $0.045/hr (~$33/month) per gateway, billed even when idle. Multi-AZ deployments multiply this — 3 AZs = ~$100/month before any data charges.
• NAT Gateway data processing: $0.045/GB on EVERY byte that traverses the gateway, in OR out. This is the dominant charge for most teams. A workload doing 1 TB/month of S3-to-private-subnet traffic burns $45/month just on NAT processing.
• Data transfer: $0.01-0.02/GB cross-AZ, plus $0.05-0.09/GB egress to the internet. NAT itself doesn't add egress charges, but it sits in the path so all egress is processed.

VPC Endpoints sidestep NAT entirely for AWS-service traffic:

• Gateway endpoints (S3, DynamoDB): FREE. No per-hour, no per-GB. The fastest single-fix win in this audit.
• Interface endpoints (ECR, Logs, STS, SSM, others): ~$0.01/hour per AZ per service ($7.30/mo/AZ). For a 3-AZ setup, ~$22/mo per service — trivial compared to the NAT processing cost they eliminate. Most teams pay back the endpoint cost in 1-3 days of NAT savings.

The fastest single-fix wins (in dollar order): add the S3 Gateway endpoint (Pattern 1), add the ECR Interface endpoint pair if you use EKS/ECS/Fargate (Patterns 3+4), add the DynamoDB Gateway endpoint (Pattern 2), then the CloudWatch Logs + STS Interface endpoints (Patterns 5+6). Verify each fix's impact in AWS Cost Explorer on the next billing cycle — the line items are itemized by Usage Type (NatGateway-Bytes drops, VpcEndpoint-Hours rises by a small fraction of the savings).

30-day re-audit voucher

Why this matters: AWS NAT/VPC savings only materialize once the IaC changes apply to production (Terraform apply, CDK deploy, or CloudFormation update). The re-audit voucher creates an accountability loop — we can't claim "issue resolved" unless the v1 ruleset agrees on re-scan. Same deterministic engine, same file paths, same line numbers. No moving goalposts.

Verification path for customers: after applying the changes, watch AWS Cost Explorer filtered to Services -> EC2-Other with usage type NatGateway-Bytes over a 7-30 day window. The drop is typically visible within 48 hours of the Terraform apply and stabilizes by day 7. We can supply the exact Cost Explorer filter URL on request.