# EC2 / VPC operations All 79 listed operations are implemented. Back to [EC2 / VPC](/docs/services/ec2/index.md). ## Summary | Category | ✅ Supported | | --- | --- | | General | 76 | | VPC network states | 3 | --- ## Endpoints ### General | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `AcceptVpcPeeringConnection` | ✅ Supported | Transitions from `pending-acceptance` to `active` | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AcceptVpcPeeringConnection.html) | | `AllocateAddress` | ✅ Supported | Generates eipalloc- ID and synthetic public IP; Domain honoured; supports TagSpecification | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AllocateAddress.html) | | `AssociateAddress` | ✅ Supported | Associates EIP with instance; generates eipassoc- ID | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateAddress.html) | | `AssociateRouteTable` | ✅ Supported | Associates route table with subnet | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AssociateRouteTable.html) | | `AttachInternetGateway` | ✅ Supported | Takes the VPC Docker network out of `--internal`, moving any containers already on it to the recreated network with their addresses and DNS aliases; fails with InternalError, attaching nothing, if Docker refuses. A network shared by several VPCs is external while any of them has a gateway | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachInternetGateway.html) | | `AttachVpnGateway` | ✅ Supported | Metadata-only VPC attachment | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AttachVpnGateway.html) | | `AuthorizeSecurityGroupEgress` | ✅ Supported | | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupEgress.html) | | `AuthorizeSecurityGroupIngress` | ✅ Supported | IpPermissions with protocol, ports, CIDR ranges | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupIngress.html) | | `CreateInternetGateway` | ✅ Supported | Generates igw-xxx ID | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateInternetGateway.html) | | `CreateKeyPair` | ✅ Supported | Generates dummy fingerprint and key material | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateKeyPair.html) | | `CreateNatGateway` | ✅ Supported | Requires subnet and EIP; supports TagSpecification | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNatGateway.html) | | `CreateNetworkInterface` | ✅ Supported | Requires subnet; assigns synthetic private IP | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateNetworkInterface.html) | | `CreateRoute` | ✅ Supported | DestinationCidrBlock + GatewayId or NatGatewayId | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRoute.html) | | `CreateRouteTable` | ✅ Supported | VPC must exist; auto-creates local route | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateRouteTable.html) | | `CreateSecurityGroup` | ✅ Supported | Default egress allow-all rule added on create | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSecurityGroup.html) | | `CreateSubnet` | ✅ Supported | VPC must exist; honors AvailabilityZone; defaults to region+"a" | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateSubnet.html) | | `CreateTags` | ✅ Supported | Tag any resource by ID; visible to that resource's own describe | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateTags.html) | | `CreateVpc` | ✅ Supported | CidrBlock required; creates Docker bridge network (`--internal` unless IGW attached) and main route table | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpc.html) | | `CreateLaunchTemplate` | ✅ Supported | Mints an lt- ID and version 1; LaunchTemplateData, VersionDescription and TagSpecification supported | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLaunchTemplate.html) | | `CreateLaunchTemplateVersion` | ✅ Supported | Numbers from the latest version; SourceVersion inherits the parameters the request does not set | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateLaunchTemplateVersion.html) | | `CreateVpcEndpoint` | ✅ Supported | Metadata-only; Gateway and Interface types accepted; state always "available" | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcEndpoint.html) | | `CreateVpnGateway` | ✅ Supported | Metadata-only; type ipsec.1 with AmazonSideAsn | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpnGateway.html) | | `CreateVpcPeeringConnection` | ✅ Supported | Both VPCs must exist; starts in `pending-acceptance` state | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_CreateVpcPeeringConnection.html) | | `DeleteInternetGateway` | ✅ Supported | Must be detached first | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteInternetGateway.html) | | `DeleteKeyPair` | ✅ Supported | Idempotent (no error if not found) | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteKeyPair.html) | | `DeleteNatGateway` | ✅ Supported | Marks as deleted | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNatGateway.html) | | `DeleteNetworkInterface` | ✅ Supported | | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteNetworkInterface.html) | | `DeleteRoute` | ✅ Supported | Removes route by RouteTableId + DestinationCidrBlock | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteRoute.html) | | `DeleteRouteTable` | ✅ Supported | Cannot delete main route table | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteRouteTable.html) | | `DeleteSecurityGroup` | ✅ Supported | Fails with DependencyViolation while attached to a running/pending instance; the VPC's default group answers CannotDelete | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteSecurityGroup.html) | | `DeleteSubnet` | ✅ Supported | Fails with DependencyViolation while ENIs, non-terminated instances, or NAT gateways remain in the subnet | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteSubnet.html) | | `DeleteTags` | ✅ Supported | Remove tags by key; a resource's tags are removed with the resource | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTags.html) | | `DeleteVpc` | ✅ Supported | Removes Docker network; fails with DependencyViolation while subnets, gateways, endpoints, peering connections, ENIs, or instances remain | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpc.html) | | `DeleteLaunchTemplate` | ✅ Supported | Deletes the template and every version it owns | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteLaunchTemplate.html) | | `DeleteLaunchTemplateVersions` | ✅ Supported | Per-version outcomes; the default version is refused with OperationNotPermitted | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteLaunchTemplateVersions.html) | | `DeleteVpcEndpoints` | ✅ Supported | Accepts VpcEndpointId.N; silently skips unknown IDs | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpcEndpoints.html) | | `DeleteVpnGateway` | ✅ Supported | Requires gateway to be detached | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpnGateway.html) | | `DeleteVpcPeeringConnection` | ✅ Supported | From `active` or `pending-acceptance`; transitions to `deleted` | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteVpcPeeringConnection.html) | | `DescribeAccountAttributes` | ✅ Supported | Hardcoded defaults (supported-platforms, max-instances…) | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAccountAttributes.html) | | `DescribeAddresses` | ✅ Supported | Selects by AllocationId.N, raising InvalidAllocationID.NotFound for an allocation the region does not hold (AWS documents no Malformed code for one, so a wrongly shaped ID is NotFound too), and by PublicIp.N, raising InvalidAddress.NotFound for an address the region does not hold and InvalidAddress.Malformed for one that is not an IPv4 address; returns tags; Filters: allocation-id, association-id, domain, instance-id, network-interface-id, private-ip-address, public-ip | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAddresses.html) | | `DescribeAvailabilityZones` | ✅ Supported | 3 AZs per region (a, b, c); Filters: region-name, state, zone-name | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeAvailabilityZones.html) | | `DescribeDhcpOptions` | ✅ Supported | Returns a fabricated default DHCP options set; Filters: none | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeDhcpOptions.html) | | `DescribeImages` | ✅ Supported | Hardcoded set of 4 AMIs (AL2, Ubuntu, Windows, AL2023); selects by ImageId.N; Filters: architecture, description, image-id, image-type, is-public, name, owner-id, root-device-type, state, virtualization-type | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeImages.html) | | `DescribeInstanceTypes` | ✅ Supported | Hardcoded set: t3.micro/small/medium, m5.large/xlarge; Filters: current-generation, instance-type, memory-info.size-in-mib, vcpu-info.default-vcpus | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstanceTypes.html) | | `DescribeInstances` | ✅ Supported | Selects by InstanceId.N, raising InvalidInstanceID.NotFound for an ID the region does not hold and InvalidInstanceID.Malformed for one that is not an ID; Filters: availability-zone, image-id, instance-id, instance-state-code, instance-state-name, instance-type, placement.availability-zone, subnet-id, vpc-id, tag:, tag-key, tag-value | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInstances.html) | | `DescribeInternetGateways` | ✅ Supported | Selects by InternetGatewayId.N, raising InvalidInternetGatewayID.NotFound for an ID the region does not hold and InvalidInternetGatewayId.Malformed for one that is not an ID; Filters: attachment.state, attachment.vpc-id, internet-gateway-id, tag:, tag-key, tag-value | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeInternetGateways.html) | | `DescribeKeyPairs` | ✅ Supported | Selects by KeyName.N; Filters: fingerprint, key-name, key-pair-id | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeKeyPairs.html) | | `DescribeNatGateways` | ✅ Supported | Selects by NatGatewayId.N, raising NatGatewayNotFound for an ID the region does not hold and NatGatewayMalformed for one that is not an ID; Filters: nat-gateway-id, state, subnet-id, vpc-id, tag:, tag-key, tag-value | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNatGateways.html) | | `DescribeNetworkInterfaces` | ✅ Supported | Selects by NetworkInterfaceId.N, raising InvalidNetworkInterfaceID.NotFound for an ID the region does not hold and InvalidNetworkInterfaceId.Malformed for one that is not an ID; Filters: availability-zone, description, mac-address, network-interface-id, status, subnet-id, vpc-id, tag:, tag-key, tag-value | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeNetworkInterfaces.html) | | `DescribeRegions` | ✅ Supported | Hardcoded list of 8 regions; Filters: endpoint, opt-in-status, region-name | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRegions.html) | | `DescribeRouteTables` | ✅ Supported | Selects by RouteTableId.N, raising InvalidRouteTableID.NotFound for an ID the region does not hold and InvalidRouteTableId.Malformed for one that is not an ID; includes NAT gateway routes; Filters: association.main, association.route-table-association-id, association.subnet-id, route-table-id, vpc-id, tag:, tag-key, tag-value | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeRouteTables.html) | | `DescribeSecurityGroups` | ✅ Supported | Selects by GroupId.N, raising InvalidGroup.NotFound for an ID the region does not hold and InvalidGroupId.Malformed for one that is not an ID; Filters: description, group-id, group-name, vpc-id, tag:, tag-key, tag-value | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroups.html) | | `DescribeSubnets` | ✅ Supported | Selects by SubnetId.N, raising InvalidSubnetID.NotFound for an ID the region does not hold and InvalidSubnetID.Malformed for one that is not an ID; includes tagSet for CDK subnet groups; Filters: availability-zone, cidr-block, state, subnet-id, vpc-id, tag:, tag-key, tag-value | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSubnets.html) | | `DescribeTags` | ✅ Supported | Filters: key, resource-id, resource-type, value | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeTags.html) | | `DescribeVpcAttribute` | ✅ Supported | Returns the stored enableDnsSupport or enableDnsHostnames value | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcAttribute.html) | | `DescribeLaunchTemplateVersions` | ✅ Supported | Resolves $Latest and $Default; honours LaunchTemplateVersion.N, MinVersion and MaxVersion; Filters: create-time, image-id, instance-type | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLaunchTemplateVersions.html) | | `DescribeLaunchTemplates` | ✅ Supported | Selects by LaunchTemplateId.N or LaunchTemplateName.N; Filters: create-time, launch-template-name, tag:, tag-key, tag-value | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeLaunchTemplates.html) | | `DescribeVpcEndpoints` | ✅ Supported | Selects by VpcEndpointId.N, raising InvalidVpcEndpointId.NotFound for an ID the region does not hold and InvalidVpcEndpointId.Malformed for one that is not an ID; Filters: service-name, vpc-endpoint-id, vpc-endpoint-state, vpc-endpoint-type, vpc-id | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcEndpoints.html) | | `DescribeVpnGateways` | ✅ Supported | Selects by VpnGatewayId.N, raising InvalidVpnGatewayID.NotFound for an ID the region does not hold (AWS documents no Malformed code for one, so a wrongly shaped ID is NotFound too); Filters: amazon-side-asn, attachment.state, attachment.vpc-id, availability-zone, state, type, vpn-gateway-id, tag:, tag-key, tag-value | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpnGateways.html) | | `DescribeVpcPeeringConnections` | ✅ Supported | Selects by VpcPeeringConnectionId.N, raising InvalidVpcPeeringConnectionID.NotFound for an ID the region does not hold and InvalidVpcPeeringConnectionId.Malformed for one that is not an ID; Filters: accepter-vpc-info.vpc-id, requester-vpc-info.vpc-id, status-code, vpc-peering-connection-id | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcPeeringConnections.html) | | `DescribeVpcs` | ✅ Supported | Selects by VpcId.N, raising InvalidVpcID.NotFound for an ID the region does not hold and InvalidVpcID.Malformed for one that is not an ID; Filters: cidr, isDefault, state, vpc-id, tag:, tag-key, tag-value | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeVpcs.html) | | `DetachInternetGateway` | ✅ Supported | Puts the VPC Docker network back into `--internal`, moving attached containers the same way as AttachInternetGateway; fails with InternalError, detaching nothing, if Docker refuses. Stays external while another VPC sharing the network has a gateway | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DetachInternetGateway.html) | | `DetachVpnGateway` | ✅ Supported | Metadata-only VPC detachment | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DetachVpnGateway.html) | | `DisassociateAddress` | ✅ Supported | By AssociationId | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateAddress.html) | | `DisassociateRouteTable` | ✅ Supported | Cannot disassociate main association | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisassociateRouteTable.html) | | `ModifyLaunchTemplate` | ✅ Supported | SetDefaultVersion only, accepting a version number or $Latest/$Default | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyLaunchTemplate.html) | | `ModifyInstanceAttribute` | ✅ Supported | InstanceType.Value persisted; all other attributes accepted | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyInstanceAttribute.html) | | `ModifySubnetAttribute` | ✅ Supported | MapPublicIpOnLaunch is persisted and returned by DescribeSubnets | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifySubnetAttribute.html) | | `ModifyVpcAttribute` | ✅ Supported | EnableDnsSupport, EnableDnsHostnames are persisted and returned by DescribeVpcAttribute | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ModifyVpcAttribute.html) | | `ReleaseAddress` | ✅ Supported | By AllocationId; an allocation that does not exist raises InvalidAllocationID.NotFound | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ReleaseAddress.html) | | `RevokeSecurityGroupEgress` | ✅ Supported | | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RevokeSecurityGroupEgress.html) | | `RevokeSecurityGroupIngress` | ✅ Supported | | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RevokeSecurityGroupIngress.html) | | `RunInstances` | ✅ Supported | MinCount/MaxCount, TagSpecifications, async pending→running; each state emits an EC2 Instance State-change Notification to the default EventBridge bus. LaunchTemplate supplies ImageId, InstanceType, security groups, subnet and instance tags beneath any parameter the request passes | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RunInstances.html) | | `StartInstances` | ✅ Supported | From stopped state only; each state emits an EC2 Instance State-change Notification to the default EventBridge bus | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_StartInstances.html) | | `StopInstances` | ✅ Supported | From running state only; async stopping→stopped; each state emits an EC2 Instance State-change Notification to the default EventBridge bus | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_StopInstances.html) | | `TerminateInstances` | ✅ Supported | Async shutting-down→terminated transition; each state emits an EC2 Instance State-change Notification to the default EventBridge bus | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_TerminateInstances.html) | ### VPC network states | Operation | Status | Notes | AWS Docs | | --- | --- | --- | --- | | `unbacked` | ✅ Supported | No Docker network (Docker unavailable, or the last create failed) | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_unbacked.html) | | `conflict` | ✅ Supported | Reserved for strict mode when CIDR collides with another existing VPC | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_conflict.html) | | `remapped` | ✅ Supported | Reserved for remapped mode and backed by a shadow CIDR | [docs](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_remapped.html) | ## Related - [EC2 / VPC](/docs/services/ec2/index.md) — quick start, what works, and the differences from AWS - [All service pages](/docs/services/index.md)