AcceptVpcPeeringConnection | ✅ Supported | Transitions from pending-acceptance to active | docs |
AllocateAddress | ✅ Supported | Generates eipalloc- ID and synthetic public IP; Domain honoured; supports TagSpecification | docs |
AssociateAddress | ✅ Supported | Associates EIP with instance; generates eipassoc- ID | docs |
AssociateRouteTable | ✅ Supported | Associates route table with subnet | docs |
AttachInternetGateway | ✅ Supported | Takes the VPC Docker network out of --internal, moving any containers already on it to the recreated network with their addresses and DNS aliases; fails with InternalError, attaching nothing, if Docker refuses. A network shared by several VPCs is external while any of them has a gateway | docs |
AttachVpnGateway | ✅ Supported | Metadata-only VPC attachment | docs |
AuthorizeSecurityGroupEgress | ✅ Supported | | docs |
AuthorizeSecurityGroupIngress | ✅ Supported | IpPermissions with protocol, ports, CIDR ranges | docs |
CreateInternetGateway | ✅ Supported | Generates igw-xxx ID | docs |
CreateKeyPair | ✅ Supported | Generates dummy fingerprint and key material | docs |
CreateNatGateway | ✅ Supported | Requires subnet and EIP; supports TagSpecification | docs |
CreateNetworkInterface | ✅ Supported | Requires subnet; assigns synthetic private IP | docs |
CreateRoute | ✅ Supported | DestinationCidrBlock + GatewayId or NatGatewayId | docs |
CreateRouteTable | ✅ Supported | VPC must exist; auto-creates local route | docs |
CreateSecurityGroup | ✅ Supported | Default egress allow-all rule added on create | docs |
CreateSubnet | ✅ Supported | VPC must exist; honors AvailabilityZone; defaults to region+“a” | docs |
CreateTags | ✅ Supported | Tag any resource by ID; visible to that resource’s own describe | docs |
CreateVpc | ✅ Supported | CidrBlock required; creates Docker bridge network (--internal unless IGW attached) and main route table | docs |
CreateLaunchTemplate | ✅ Supported | Mints an lt- ID and version 1; LaunchTemplateData, VersionDescription and TagSpecification supported | docs |
CreateLaunchTemplateVersion | ✅ Supported | Numbers from the latest version; SourceVersion inherits the parameters the request does not set | docs |
CreateVpcEndpoint | ✅ Supported | Metadata-only; Gateway and Interface types accepted; state always “available” | docs |
CreateVpnGateway | ✅ Supported | Metadata-only; type ipsec.1 with AmazonSideAsn | docs |
CreateVpcPeeringConnection | ✅ Supported | Both VPCs must exist; starts in pending-acceptance state | docs |
DeleteInternetGateway | ✅ Supported | Must be detached first | docs |
DeleteKeyPair | ✅ Supported | Idempotent (no error if not found) | docs |
DeleteNatGateway | ✅ Supported | Marks as deleted | docs |
DeleteNetworkInterface | ✅ Supported | | docs |
DeleteRoute | ✅ Supported | Removes route by RouteTableId + DestinationCidrBlock | docs |
DeleteRouteTable | ✅ Supported | Cannot delete main route table | docs |
DeleteSecurityGroup | ✅ Supported | Fails with DependencyViolation while attached to a running/pending instance; the VPC’s default group answers CannotDelete | docs |
DeleteSubnet | ✅ Supported | Fails with DependencyViolation while ENIs, non-terminated instances, or NAT gateways remain in the subnet | docs |
DeleteTags | ✅ Supported | Remove tags by key; a resource’s tags are removed with the resource | docs |
DeleteVpc | ✅ Supported | Removes Docker network; fails with DependencyViolation while subnets, gateways, endpoints, peering connections, ENIs, or instances remain | docs |
DeleteLaunchTemplate | ✅ Supported | Deletes the template and every version it owns | docs |
DeleteLaunchTemplateVersions | ✅ Supported | Per-version outcomes; the default version is refused with OperationNotPermitted | docs |
DeleteVpcEndpoints | ✅ Supported | Accepts VpcEndpointId.N; silently skips unknown IDs | docs |
DeleteVpnGateway | ✅ Supported | Requires gateway to be detached | docs |
DeleteVpcPeeringConnection | ✅ Supported | From active or pending-acceptance; transitions to deleted | docs |
DescribeAccountAttributes | ✅ Supported | Hardcoded defaults (supported-platforms, max-instances…) | docs |
DescribeAddresses | ✅ Supported | Selects by AllocationId.N, raising InvalidAllocationID.NotFound for an allocation the region does not hold (AWS documents no Malformed code for one, so a wrongly shaped ID is NotFound too), and by PublicIp.N, raising InvalidAddress.NotFound for an address the region does not hold and InvalidAddress.Malformed for one that is not an IPv4 address; returns tags; Filters: allocation-id, association-id, domain, instance-id, network-interface-id, private-ip-address, public-ip | docs |
DescribeAvailabilityZones | ✅ Supported | 3 AZs per region (a, b, c); Filters: region-name, state, zone-name | docs |
DescribeDhcpOptions | ✅ Supported | Returns a fabricated default DHCP options set; Filters: none | docs |
DescribeImages | ✅ Supported | Hardcoded set of 4 AMIs (AL2, Ubuntu, Windows, AL2023); selects by ImageId.N; Filters: architecture, description, image-id, image-type, is-public, name, owner-id, root-device-type, state, virtualization-type | docs |
DescribeInstanceTypes | ✅ Supported | Hardcoded set: t3.micro/small/medium, m5.large/xlarge; Filters: current-generation, instance-type, memory-info.size-in-mib, vcpu-info.default-vcpus | docs |
DescribeInstances | ✅ Supported | Selects by InstanceId.N, raising InvalidInstanceID.NotFound for an ID the region does not hold and InvalidInstanceID.Malformed for one that is not an ID; Filters: availability-zone, image-id, instance-id, instance-state-code, instance-state-name, instance-type, placement.availability-zone, subnet-id, vpc-id, tag:, tag-key, tag-value | docs |
DescribeInternetGateways | ✅ Supported | Selects by InternetGatewayId.N, raising InvalidInternetGatewayID.NotFound for an ID the region does not hold and InvalidInternetGatewayId.Malformed for one that is not an ID; Filters: attachment.state, attachment.vpc-id, internet-gateway-id, tag:, tag-key, tag-value | docs |
DescribeKeyPairs | ✅ Supported | Selects by KeyName.N; Filters: fingerprint, key-name, key-pair-id | docs |
DescribeNatGateways | ✅ Supported | Selects by NatGatewayId.N, raising NatGatewayNotFound for an ID the region does not hold and NatGatewayMalformed for one that is not an ID; Filters: nat-gateway-id, state, subnet-id, vpc-id, tag:, tag-key, tag-value | docs |
DescribeNetworkInterfaces | ✅ Supported | Selects by NetworkInterfaceId.N, raising InvalidNetworkInterfaceID.NotFound for an ID the region does not hold and InvalidNetworkInterfaceId.Malformed for one that is not an ID; Filters: availability-zone, description, mac-address, network-interface-id, status, subnet-id, vpc-id, tag:, tag-key, tag-value | docs |
DescribeRegions | ✅ Supported | Hardcoded list of 8 regions; Filters: endpoint, opt-in-status, region-name | docs |
DescribeRouteTables | ✅ Supported | Selects by RouteTableId.N, raising InvalidRouteTableID.NotFound for an ID the region does not hold and InvalidRouteTableId.Malformed for one that is not an ID; includes NAT gateway routes; Filters: association.main, association.route-table-association-id, association.subnet-id, route-table-id, vpc-id, tag:, tag-key, tag-value | docs |
DescribeSecurityGroups | ✅ Supported | Selects by GroupId.N, raising InvalidGroup.NotFound for an ID the region does not hold and InvalidGroupId.Malformed for one that is not an ID; Filters: description, group-id, group-name, vpc-id, tag:, tag-key, tag-value | docs |
DescribeSubnets | ✅ Supported | Selects by SubnetId.N, raising InvalidSubnetID.NotFound for an ID the region does not hold and InvalidSubnetID.Malformed for one that is not an ID; includes tagSet for CDK subnet groups; Filters: availability-zone, cidr-block, state, subnet-id, vpc-id, tag:, tag-key, tag-value | docs |
DescribeTags | ✅ Supported | Filters: key, resource-id, resource-type, value | docs |
DescribeVpcAttribute | ✅ Supported | Returns the stored enableDnsSupport or enableDnsHostnames value | docs |
DescribeLaunchTemplateVersions | ✅ Supported | Resolves $Latest and $Default; honours LaunchTemplateVersion.N, MinVersion and MaxVersion; Filters: create-time, image-id, instance-type | docs |
DescribeLaunchTemplates | ✅ Supported | Selects by LaunchTemplateId.N or LaunchTemplateName.N; Filters: create-time, launch-template-name, tag:, tag-key, tag-value | docs |
DescribeVpcEndpoints | ✅ Supported | Selects by VpcEndpointId.N, raising InvalidVpcEndpointId.NotFound for an ID the region does not hold and InvalidVpcEndpointId.Malformed for one that is not an ID; Filters: service-name, vpc-endpoint-id, vpc-endpoint-state, vpc-endpoint-type, vpc-id | docs |
DescribeVpnGateways | ✅ Supported | Selects by VpnGatewayId.N, raising InvalidVpnGatewayID.NotFound for an ID the region does not hold (AWS documents no Malformed code for one, so a wrongly shaped ID is NotFound too); Filters: amazon-side-asn, attachment.state, attachment.vpc-id, availability-zone, state, type, vpn-gateway-id, tag:, tag-key, tag-value | docs |
DescribeVpcPeeringConnections | ✅ Supported | Selects by VpcPeeringConnectionId.N, raising InvalidVpcPeeringConnectionID.NotFound for an ID the region does not hold and InvalidVpcPeeringConnectionId.Malformed for one that is not an ID; Filters: accepter-vpc-info.vpc-id, requester-vpc-info.vpc-id, status-code, vpc-peering-connection-id | docs |
DescribeVpcs | ✅ Supported | Selects by VpcId.N, raising InvalidVpcID.NotFound for an ID the region does not hold and InvalidVpcID.Malformed for one that is not an ID; Filters: cidr, isDefault, state, vpc-id, tag:, tag-key, tag-value | docs |
DetachInternetGateway | ✅ Supported | Puts the VPC Docker network back into --internal, moving attached containers the same way as AttachInternetGateway; fails with InternalError, detaching nothing, if Docker refuses. Stays external while another VPC sharing the network has a gateway | docs |
DetachVpnGateway | ✅ Supported | Metadata-only VPC detachment | docs |
DisassociateAddress | ✅ Supported | By AssociationId | docs |
DisassociateRouteTable | ✅ Supported | Cannot disassociate main association | docs |
ModifyLaunchTemplate | ✅ Supported | SetDefaultVersion only, accepting a version number or $Latest/$Default | docs |
ModifyInstanceAttribute | ✅ Supported | InstanceType.Value persisted; all other attributes accepted | docs |
ModifySubnetAttribute | ✅ Supported | MapPublicIpOnLaunch is persisted and returned by DescribeSubnets | docs |
ModifyVpcAttribute | ✅ Supported | EnableDnsSupport, EnableDnsHostnames are persisted and returned by DescribeVpcAttribute | docs |
ReleaseAddress | ✅ Supported | By AllocationId; an allocation that does not exist raises InvalidAllocationID.NotFound | docs |
RevokeSecurityGroupEgress | ✅ Supported | | docs |
RevokeSecurityGroupIngress | ✅ Supported | | docs |
RunInstances | ✅ Supported | MinCount/MaxCount, TagSpecifications, async pending→running; each state emits an EC2 Instance State-change Notification to the default EventBridge bus. LaunchTemplate supplies ImageId, InstanceType, security groups, subnet and instance tags beneath any parameter the request passes | docs |
StartInstances | ✅ Supported | From stopped state only; each state emits an EC2 Instance State-change Notification to the default EventBridge bus | docs |
StopInstances | ✅ Supported | From running state only; async stopping→stopped; each state emits an EC2 Instance State-change Notification to the default EventBridge bus | docs |
TerminateInstances | ✅ Supported | Async shutting-down→terminated transition; each state emits an EC2 Instance State-change Notification to the default EventBridge bus | docs |
