create-virtual-node
Description
Creates a virtual node within a service mesh.
A virtual node acts as a logical pointer to a particular task group, such as an Amazon ECS service or a Kubernetes deployment. When you create a virtual node, you can specify the service discovery information for your task group, and whether the proxy running in a task group will communicate with other proxies using Transport Layer Security (TLS).
You define a listener for any inbound traffic that your virtual node expects. Any virtual service that your virtual node expects to communicate to is specified as a backend .
The response metadata for your new virtual node contains the arn that is associated with the virtual node. Set this value to the full ARN; for example, arn:aws:appmesh:us-west-2:123456789012:myMesh/default/virtualNode/myApp ) as the APPMESH_RESOURCE_ARN environment variable for your task group’s Envoy proxy container in your task definition or pod spec. This is then mapped to the node.id and node.cluster Envoy parameters.
Note
By default, App Mesh uses the name of the resource you specified inAPPMESH_RESOURCE_ARN when Envoy is referring to itself in metrics and traces. You can override this behavior by setting the APPMESH_RESOURCE_CLUSTER environment variable with your own name.For more information about virtual nodes, see Virtual nodes . You must be using 1.15.0 or later of the Envoy image when setting these variables. For more information aboutApp Mesh Envoy variables, see Envoy image in the App Mesh User Guide.
See also: AWS API Documentation
Synopsis
create-virtual-node
[--client-token <value>]
--mesh-name <value>
[--mesh-owner <value>]
--spec <value>
[--tags <value>]
--virtual-node-name <value>
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]
Options
--client-token (string)
--mesh-name (string)
--mesh-owner (string)
--spec (structure)
The virtual node specification to apply.
backendDefaults -> (structure)
A reference to an object that represents the defaults for backends.
clientPolicy -> (structure)
A reference to an object that represents a client policy.
tls -> (structure)
A reference to an object that represents a Transport Layer Security (TLS) client policy.
certificate -> (tagged union structure)
A reference to an object that represents a client’s TLS certificate.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:file, sds.file -> (structure)
An object that represents a local file certificate. The certificate must meet specific requirements and you must have proxy authorization enabled. For more information, see Transport Layer Security (TLS) .
certificateChain -> (string)
privateKey -> (string)
sds -> (structure)
A reference to an object that represents a client’s TLS Secret Discovery Service certificate.
secretName -> (string)
enforce -> (boolean)
True , if a value isn’t specified.ports -> (list)
One or more ports that the policy is enforced for.
(integer)
validation -> (structure)
A reference to an object that represents a TLS validation context.
subjectAlternativeNames -> (structure)
A reference to an object that represents the SANs for a Transport Layer Security (TLS) validation context. If you don’t specify SANs on the terminating mesh endpoint, the Envoy proxy for that node doesn’t verify the SAN on a peer client certificate. If you don’t specify SANs on the originating mesh endpoint, the SAN on the certificate provided by the terminating endpoint must match the mesh endpoint service discovery configuration. Since SPIRE vended certificates have a SPIFFE ID as a name, you must set the SAN since the name doesn’t match the service discovery name.
match -> (structure)
An object that represents the criteria for determining a SANs match.
exact -> (list)
The values sent must match the specified values exactly.
(string)
trust -> (tagged union structure)
A reference to where to retrieve the trust chain when validating a peer’s Transport Layer Security (TLS) certificate.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:acm, file, sds.acm -> (structure)
A reference to an object that represents a Transport Layer Security (TLS) validation context trust for an Certificate Manager certificate.
certificateAuthorityArns -> (list)
One or more ACM Amazon Resource Name (ARN)s.
(string)
file -> (structure)
An object that represents a Transport Layer Security (TLS) validation context trust for a local file.
certificateChain -> (string)
sds -> (structure)
A reference to an object that represents a Transport Layer Security (TLS) Secret Discovery Service validation context trust.
secretName -> (string)
backends -> (list)
The backends that the virtual node is expected to send outbound traffic to.
(tagged union structure)
An object that represents the backends that a virtual node is expected to send outbound traffic to.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:virtualService.virtualService -> (structure)
Specifies a virtual service to use as a backend.
clientPolicy -> (structure)
A reference to an object that represents the client policy for a backend.
tls -> (structure)
A reference to an object that represents a Transport Layer Security (TLS) client policy.
certificate -> (tagged union structure)
A reference to an object that represents a client’s TLS certificate.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:file, sds.file -> (structure)
An object that represents a local file certificate. The certificate must meet specific requirements and you must have proxy authorization enabled. For more information, see Transport Layer Security (TLS) .
certificateChain -> (string)
privateKey -> (string)
sds -> (structure)
A reference to an object that represents a client’s TLS Secret Discovery Service certificate.
secretName -> (string)
enforce -> (boolean)
True , if a value isn’t specified.ports -> (list)
One or more ports that the policy is enforced for.
(integer)
validation -> (structure)
A reference to an object that represents a TLS validation context.
subjectAlternativeNames -> (structure)
A reference to an object that represents the SANs for a Transport Layer Security (TLS) validation context. If you don’t specify SANs on the terminating mesh endpoint, the Envoy proxy for that node doesn’t verify the SAN on a peer client certificate. If you don’t specify SANs on the originating mesh endpoint, the SAN on the certificate provided by the terminating endpoint must match the mesh endpoint service discovery configuration. Since SPIRE vended certificates have a SPIFFE ID as a name, you must set the SAN since the name doesn’t match the service discovery name.
match -> (structure)
An object that represents the criteria for determining a SANs match.
exact -> (list)
The values sent must match the specified values exactly.
(string)
trust -> (tagged union structure)
A reference to where to retrieve the trust chain when validating a peer’s Transport Layer Security (TLS) certificate.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:acm, file, sds.acm -> (structure)
A reference to an object that represents a Transport Layer Security (TLS) validation context trust for an Certificate Manager certificate.
certificateAuthorityArns -> (list)
One or more ACM Amazon Resource Name (ARN)s.
(string)
file -> (structure)
An object that represents a Transport Layer Security (TLS) validation context trust for a local file.
certificateChain -> (string)
sds -> (structure)
A reference to an object that represents a Transport Layer Security (TLS) Secret Discovery Service validation context trust.
secretName -> (string)
virtualServiceName -> (string)
listeners -> (list)
The listener that the virtual node is expected to receive inbound traffic from. You can specify one listener.
(structure)
An object that represents a listener for a virtual node.
connectionPool -> (tagged union structure)
The connection pool information for the listener.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:grpc, http, http2, tcp.grpc -> (structure)
An object that represents a type of connection pool.
maxRequests -> (integer)
http -> (structure)
An object that represents a type of connection pool.
maxConnections -> (integer)
maxPendingRequests -> (integer)
max_connections Envoy will queue to upstream cluster.http2 -> (structure)
An object that represents a type of connection pool.
maxRequests -> (integer)
tcp -> (structure)
An object that represents a type of connection pool.
maxConnections -> (integer)
healthCheck -> (structure)
The health check information for the listener.
healthyThreshold -> (integer)
intervalMillis -> (long)
path -> (string)
port -> (integer)
protocol -> (string)
grpc , then your service must conform to the GRPC Health Checking Protocol .timeoutMillis -> (long)
unhealthyThreshold -> (integer)
outlierDetection -> (structure)
The outlier detection information for the listener.
baseEjectionDuration -> (structure)
The base amount of time for which a host is ejected.
unit -> (string)
value -> (long)
interval -> (structure)
The time interval between ejection sweep analysis.
unit -> (string)
value -> (long)
maxEjectionPercent -> (integer)
maxServerErrors -> (long)
5xx errors required for ejection.portMapping -> (structure)
The port mapping information for the listener.
port -> (integer)
protocol -> (string)
timeout -> (tagged union structure)
An object that represents timeouts for different protocols.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:grpc, http, http2, tcp.grpc -> (structure)
An object that represents types of timeouts.
idle -> (structure)
An object that represents an idle timeout. An idle timeout bounds the amount of time that a connection may be idle. The default value is none.
unit -> (string)
value -> (long)
perRequest -> (structure)
An object that represents a per request timeout. The default value is 15 seconds. If you set a higher timeout, then make sure that the higher value is set for each App Mesh resource in a conversation. For example, if a virtual node backend uses a virtual router provider to route to another virtual node, then the timeout should be greater than 15 seconds for the source and destination virtual node and the route.
unit -> (string)
value -> (long)
http -> (structure)
An object that represents types of timeouts.
idle -> (structure)
An object that represents an idle timeout. An idle timeout bounds the amount of time that a connection may be idle. The default value is none.
unit -> (string)
value -> (long)
perRequest -> (structure)
An object that represents a per request timeout. The default value is 15 seconds. If you set a higher timeout, then make sure that the higher value is set for each App Mesh resource in a conversation. For example, if a virtual node backend uses a virtual router provider to route to another virtual node, then the timeout should be greater than 15 seconds for the source and destination virtual node and the route.
unit -> (string)
value -> (long)
http2 -> (structure)
An object that represents types of timeouts.
idle -> (structure)
An object that represents an idle timeout. An idle timeout bounds the amount of time that a connection may be idle. The default value is none.
unit -> (string)
value -> (long)
perRequest -> (structure)
An object that represents a per request timeout. The default value is 15 seconds. If you set a higher timeout, then make sure that the higher value is set for each App Mesh resource in a conversation. For example, if a virtual node backend uses a virtual router provider to route to another virtual node, then the timeout should be greater than 15 seconds for the source and destination virtual node and the route.
unit -> (string)
value -> (long)
tcp -> (structure)
An object that represents types of timeouts.
idle -> (structure)
An object that represents an idle timeout. An idle timeout bounds the amount of time that a connection may be idle. The default value is none.
unit -> (string)
value -> (long)
tls -> (structure)
A reference to an object that represents the Transport Layer Security (TLS) properties for a listener.
certificate -> (tagged union structure)
A reference to an object that represents a listener’s Transport Layer Security (TLS) certificate.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:acm, file, sds.acm -> (structure)
A reference to an object that represents an Certificate Manager certificate.
certificateArn -> (string)
file -> (structure)
A reference to an object that represents a local file certificate.
certificateChain -> (string)
privateKey -> (string)
sds -> (structure)
A reference to an object that represents a listener’s Secret Discovery Service certificate.
secretName -> (string)
mode -> (string)
Specify one of the following modes.
- STRICT – Listener only accepts connections with TLS enabled.
- PERMISSIVE – Listener accepts connections with or without TLS enabled.
- DISABLED – Listener only accepts connections without TLS.
validation -> (structure)
A reference to an object that represents a listener’s Transport Layer Security (TLS) validation context.
subjectAlternativeNames -> (structure)
A reference to an object that represents the SANs for a listener’s Transport Layer Security (TLS) validation context.
match -> (structure)
An object that represents the criteria for determining a SANs match.
exact -> (list)
The values sent must match the specified values exactly.
(string)
trust -> (tagged union structure)
A reference to where to retrieve the trust chain when validating a peer’s Transport Layer Security (TLS) certificate.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:file, sds.file -> (structure)
An object that represents a Transport Layer Security (TLS) validation context trust for a local file.
certificateChain -> (string)
sds -> (structure)
A reference to an object that represents a listener’s Transport Layer Security (TLS) Secret Discovery Service validation context trust.
secretName -> (string)
logging -> (structure)
The inbound and outbound access logging information for the virtual node.
accessLog -> (tagged union structure)
The access log configuration for a virtual node.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:file.file -> (structure)
The file object to send virtual node access logs to.
format -> (tagged union structure)
The specified format for the logs. The format is either json_format or text_format .
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:json, text.json -> (list)
(structure)
An object that represents the key value pairs for the JSON.
key -> (string)
value -> (string)
text -> (string)
path -> (string)
The file path to write access logs to. You can use /dev/stdout to send access logs to standard out and configure your Envoy container to use a log driver, such as awslogs , to export the access logs to a log storage service such as Amazon CloudWatch Logs. You can also specify a path in the Envoy container’s file system to write the files to disk.
Note
The Envoy process must have write permissions to the path that you specify here. Otherwise, Envoy fails to bootstrap properly.serviceDiscovery -> (tagged union structure)
The service discovery information for the virtual node. If your virtual node does not expect ingress traffic, you can omit this parameter. If you specify a listener , then you must specify service discovery information.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:awsCloudMap, dns.awsCloudMap -> (structure)
Specifies any Cloud Map information for the virtual node.
attributes -> (list)
A string map that contains attributes with values that you can use to filter instances by any custom attribute that you specified when you registered the instance. Only instances that match all of the specified key/value pairs will be returned.
(structure)
An object that represents the Cloud Map attribute information for your virtual node.
Note
Cloud Map is not available in the eu-south-1 Region.key -> (string)
value -> (string)
ipPreference -> (string)
namespaceName -> (string)
serviceName -> (string)
dns -> (structure)
Specifies the DNS information for the virtual node.
hostname -> (string)
ipPreference -> (string)
responseType -> (string)
JSON Syntax:
{
"backendDefaults": {
"clientPolicy": {
"tls": {
"certificate": {
"file": {
"certificateChain": "string",
"privateKey": "string"
},
"sds": {
"secretName": "string"
}
},
"enforce": true|false,
"ports": [integer, ...],
"validation": {
"subjectAlternativeNames": {
"match": {
"exact": ["string", ...]
}
},
"trust": {
"acm": {
"certificateAuthorityArns": ["string", ...]
},
"file": {
"certificateChain": "string"
},
"sds": {
"secretName": "string"
}
}
}
}
}
},
"backends": [
{
"virtualService": {
"clientPolicy": {
"tls": {
"certificate": {
"file": {
"certificateChain": "string",
"privateKey": "string"
},
"sds": {
"secretName": "string"
}
},
"enforce": true|false,
"ports": [integer, ...],
"validation": {
"subjectAlternativeNames": {
"match": {
"exact": ["string", ...]
}
},
"trust": {
"acm": {
"certificateAuthorityArns": ["string", ...]
},
"file": {
"certificateChain": "string"
},
"sds": {
"secretName": "string"
}
}
}
}
},
"virtualServiceName": "string"
}
}
...
],
"listeners": [
{
"connectionPool": {
"grpc": {
"maxRequests": integer
},
"http": {
"maxConnections": integer,
"maxPendingRequests": integer
},
"http2": {
"maxRequests": integer
},
"tcp": {
"maxConnections": integer
}
},
"healthCheck": {
"healthyThreshold": integer,
"intervalMillis": long,
"path": "string",
"port": integer,
"protocol": "http"|"tcp"|"http2"|"grpc",
"timeoutMillis": long,
"unhealthyThreshold": integer
},
"outlierDetection": {
"baseEjectionDuration": {
"unit": "s"|"ms",
"value": long
},
"interval": {
"unit": "s"|"ms",
"value": long
},
"maxEjectionPercent": integer,
"maxServerErrors": long
},
"portMapping": {
"port": integer,
"protocol": "http"|"tcp"|"http2"|"grpc"
},
"timeout": {
"grpc": {
"idle": {
"unit": "s"|"ms",
"value": long
},
"perRequest": {
"unit": "s"|"ms",
"value": long
}
},
"http": {
"idle": {
"unit": "s"|"ms",
"value": long
},
"perRequest": {
"unit": "s"|"ms",
"value": long
}
},
"http2": {
"idle": {
"unit": "s"|"ms",
"value": long
},
"perRequest": {
"unit": "s"|"ms",
"value": long
}
},
"tcp": {
"idle": {
"unit": "s"|"ms",
"value": long
}
}
},
"tls": {
"certificate": {
"acm": {
"certificateArn": "string"
},
"file": {
"certificateChain": "string",
"privateKey": "string"
},
"sds": {
"secretName": "string"
}
},
"mode": "STRICT"|"PERMISSIVE"|"DISABLED",
"validation": {
"subjectAlternativeNames": {
"match": {
"exact": ["string", ...]
}
},
"trust": {
"file": {
"certificateChain": "string"
},
"sds": {
"secretName": "string"
}
}
}
}
}
...
],
"logging": {
"accessLog": {
"file": {
"format": {
"json": [
{
"key": "string",
"value": "string"
}
...
],
"text": "string"
},
"path": "string"
}
}
},
"serviceDiscovery": {
"awsCloudMap": {
"attributes": [
{
"key": "string",
"value": "string"
}
...
],
"ipPreference": "IPv6_PREFERRED"|"IPv4_PREFERRED"|"IPv4_ONLY"|"IPv6_ONLY",
"namespaceName": "string",
"serviceName": "string"
},
"dns": {
"hostname": "string",
"ipPreference": "IPv6_PREFERRED"|"IPv4_PREFERRED"|"IPv4_ONLY"|"IPv6_ONLY",
"responseType": "LOADBALANCER"|"ENDPOINTS"
}
}
}
--tags (list)
Optional metadata that you can apply to the virtual node to assist with categorization and organization. Each tag consists of a key and an optional value, both of which you define. Tag keys can have a maximum character length of 128 characters, and tag values can have a maximum length of 256 characters.
(structure)
Optional metadata that you apply to a resource to assist with categorization and organization. Each tag consists of a key and an optional value, both of which you define. Tag keys can have a maximum character length of 128 characters, and tag values can have a maximum length of 256 characters.
key -> (string)
key is a general label that acts like a category for more specific tag values.value -> (string)
value acts as a descriptor within a tag category (key).Shorthand Syntax:
key=string,value=string ...
JSON Syntax:
[
{
"key": "string",
"value": "string"
}
...
]
--virtual-node-name (string)
--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.
--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.
Global Options
--debug (boolean)
Turn on debug logging.
--endpoint-url (string)
Override command’s default URL with the given URL.
--no-verify-ssl (boolean)
By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.
--no-paginate (boolean)
Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.
--output (string)
The formatting style for command output.
- json
- text
- table
- yaml
- yaml-stream
--query (string)
A JMESPath query to use in filtering the response data.
--profile (string)
Use a specific profile from your credential file.
--region (string)
The region to use. Overrides config/env settings.
--version (string)
Display the version of this tool.
--color (string)
Turn on/off color output.
- on
- off
- auto
--no-sign-request (boolean)
Do not sign requests. Credentials will not be loaded if this argument is provided.
--ca-bundle (string)
The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.
--cli-read-timeout (int)
The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.
--cli-connect-timeout (int)
The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.
--cli-binary-format (string)
The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob fileb:// will always be treated as binary and use the file contents directly regardless of the cli-binary-format setting. When using file:// the file contents will need to properly formatted for the configured cli-binary-format.
- base64
- raw-in-base64-out
--no-cli-pager (boolean)
Disable cli pager for output.
--cli-auto-prompt (boolean)
Automatically prompt for CLI input parameters.
--no-cli-auto-prompt (boolean)
Disable automatically prompt for CLI input parameters.
Examples
Note
To use the following examples, you must have the AWS CLI installed and configured. See the Getting started guide in the AWS CLI User Guide for more information.
Unless otherwise stated, all examples have unix-like quotation rules. These examples will need to be adapted to your terminal’s quoting rules. See Using quotation marks with strings in the AWS CLI User Guide .
Example 1: To create a new virtual node that uses DNS for discovery
The following create-virtual-node example uses a JSON input file to create a virtual node that uses DNS for service discovery.
aws appmesh create-virtual-node \
--cli-input-json file://create-virtual-node-dns.json
Contents of create-virtual-node-dns.json:
{
"meshName": "app1",
"spec": {
"listeners": [
{
"portMapping": {
"port": 80,
"protocol": "http"
}
}
],
"serviceDiscovery": {
"dns": {
"hostname": "serviceBv1.svc.cluster.local"
}
}
},
"virtualNodeName": "vnServiceBv1"
}
Output:
{
"virtualNode": {
"meshName": "app1",
"metadata": {
"arn": "arn:aws:appmesh:us-east-1:123456789012:mesh/app1/virtualNode/vnServiceBv1",
"createdAt": 1563810019.874,
"lastUpdatedAt": 1563810019.874,
"uid": "a1b2c3d4-5678-90ab-cdef-11111EXAMPLE",
"version": 1
},
"spec": {
"listeners": [
{
"portMapping": {
"port": 80,
"protocol": "http"
}
}
],
"serviceDiscovery": {
"dns": {
"hostname": "serviceBv1.svc.cluster.local"
}
}
},
"status": {
"status": "ACTIVE"
},
"virtualNodeName": "vnServiceBv1"
}
}
Example 2: To create a new virtual node that uses AWS Cloud Map for discovery
The following create-virtual-node example uses a JSON input file to create a virtual node that uses AWS Cloud Map for service discovery.
aws appmesh create-virtual-node \
--cli-input-json file://create-virtual-node-cloud-map.json
Contents of create-virtual-node-cloud-map.json:
{
"meshName": "app1",
"spec": {
"backends": [
{
"virtualService": {
"virtualServiceName": "serviceA.svc.cluster.local"
}
}
],
"listeners": [
{
"portMapping": {
"port": 80,
"protocol": "http"
}
}
],
"serviceDiscovery": {
"awsCloudMap": {
"attributes": [
{
"key": "Environment",
"value": "Testing"
}
],
"namespaceName": "namespace1",
"serviceName": "serviceA"
}
}
},
"virtualNodeName": "vnServiceA"
}
Output:
{
"virtualNode": {
"meshName": "app1",
"metadata": {
"arn": "arn:aws:appmesh:us-east-1:123456789012:mesh/app1/virtualNode/vnServiceA",
"createdAt": 1563810859.465,
"lastUpdatedAt": 1563810859.465,
"uid": "a1b2c3d4-5678-90ab-cdef-11111EXAMPLE",
"version": 1
},
"spec": {
"backends": [
{
"virtualService": {
"virtualServiceName": "serviceA.svc.cluster.local"
}
}
],
"listeners": [
{
"portMapping": {
"port": 80,
"protocol": "http"
}
}
],
"serviceDiscovery": {
"awsCloudMap": {
"attributes": [
{
"key": "Environment",
"value": "Testing"
}
],
"namespaceName": "namespace1",
"serviceName": "serviceA"
}
}
},
"status": {
"status": "ACTIVE"
},
"virtualNodeName": "vnServiceA"
}
}
For more information, see Virtual Nodes in the AWS App Mesh User Guide.
Output
virtualNode -> (structure)
The full description of your virtual node following the create call.
meshName -> (string)
metadata -> (structure)
The associated metadata for the virtual node.
arn -> (string)
createdAt -> (timestamp)
lastUpdatedAt -> (timestamp)
meshOwner -> (string)
resourceOwner -> (string)
uid -> (string)
version -> (long)
spec -> (structure)
The specifications of the virtual node.
backendDefaults -> (structure)
A reference to an object that represents the defaults for backends.
clientPolicy -> (structure)
A reference to an object that represents a client policy.
tls -> (structure)
A reference to an object that represents a Transport Layer Security (TLS) client policy.
certificate -> (tagged union structure)
A reference to an object that represents a client’s TLS certificate.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:file, sds.file -> (structure)
An object that represents a local file certificate. The certificate must meet specific requirements and you must have proxy authorization enabled. For more information, see Transport Layer Security (TLS) .
certificateChain -> (string)
privateKey -> (string)
sds -> (structure)
A reference to an object that represents a client’s TLS Secret Discovery Service certificate.
secretName -> (string)
enforce -> (boolean)
True , if a value isn’t specified.ports -> (list)
One or more ports that the policy is enforced for.
(integer)
validation -> (structure)
A reference to an object that represents a TLS validation context.
subjectAlternativeNames -> (structure)
A reference to an object that represents the SANs for a Transport Layer Security (TLS) validation context. If you don’t specify SANs on the terminating mesh endpoint, the Envoy proxy for that node doesn’t verify the SAN on a peer client certificate. If you don’t specify SANs on the originating mesh endpoint, the SAN on the certificate provided by the terminating endpoint must match the mesh endpoint service discovery configuration. Since SPIRE vended certificates have a SPIFFE ID as a name, you must set the SAN since the name doesn’t match the service discovery name.
match -> (structure)
An object that represents the criteria for determining a SANs match.
exact -> (list)
The values sent must match the specified values exactly.
(string)
trust -> (tagged union structure)
A reference to where to retrieve the trust chain when validating a peer’s Transport Layer Security (TLS) certificate.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:acm, file, sds.acm -> (structure)
A reference to an object that represents a Transport Layer Security (TLS) validation context trust for an Certificate Manager certificate.
certificateAuthorityArns -> (list)
One or more ACM Amazon Resource Name (ARN)s.
(string)
file -> (structure)
An object that represents a Transport Layer Security (TLS) validation context trust for a local file.
certificateChain -> (string)
sds -> (structure)
A reference to an object that represents a Transport Layer Security (TLS) Secret Discovery Service validation context trust.
secretName -> (string)
backends -> (list)
The backends that the virtual node is expected to send outbound traffic to.
(tagged union structure)
An object that represents the backends that a virtual node is expected to send outbound traffic to.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:virtualService.virtualService -> (structure)
Specifies a virtual service to use as a backend.
clientPolicy -> (structure)
A reference to an object that represents the client policy for a backend.
tls -> (structure)
A reference to an object that represents a Transport Layer Security (TLS) client policy.
certificate -> (tagged union structure)
A reference to an object that represents a client’s TLS certificate.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:file, sds.file -> (structure)
An object that represents a local file certificate. The certificate must meet specific requirements and you must have proxy authorization enabled. For more information, see Transport Layer Security (TLS) .
certificateChain -> (string)
privateKey -> (string)
sds -> (structure)
A reference to an object that represents a client’s TLS Secret Discovery Service certificate.
secretName -> (string)
enforce -> (boolean)
True , if a value isn’t specified.ports -> (list)
One or more ports that the policy is enforced for.
(integer)
validation -> (structure)
A reference to an object that represents a TLS validation context.
subjectAlternativeNames -> (structure)
A reference to an object that represents the SANs for a Transport Layer Security (TLS) validation context. If you don’t specify SANs on the terminating mesh endpoint, the Envoy proxy for that node doesn’t verify the SAN on a peer client certificate. If you don’t specify SANs on the originating mesh endpoint, the SAN on the certificate provided by the terminating endpoint must match the mesh endpoint service discovery configuration. Since SPIRE vended certificates have a SPIFFE ID as a name, you must set the SAN since the name doesn’t match the service discovery name.
match -> (structure)
An object that represents the criteria for determining a SANs match.
exact -> (list)
The values sent must match the specified values exactly.
(string)
trust -> (tagged union structure)
A reference to where to retrieve the trust chain when validating a peer’s Transport Layer Security (TLS) certificate.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:acm, file, sds.acm -> (structure)
A reference to an object that represents a Transport Layer Security (TLS) validation context trust for an Certificate Manager certificate.
certificateAuthorityArns -> (list)
One or more ACM Amazon Resource Name (ARN)s.
(string)
file -> (structure)
An object that represents a Transport Layer Security (TLS) validation context trust for a local file.
certificateChain -> (string)
sds -> (structure)
A reference to an object that represents a Transport Layer Security (TLS) Secret Discovery Service validation context trust.
secretName -> (string)
virtualServiceName -> (string)
listeners -> (list)
The listener that the virtual node is expected to receive inbound traffic from. You can specify one listener.
(structure)
An object that represents a listener for a virtual node.
connectionPool -> (tagged union structure)
The connection pool information for the listener.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:grpc, http, http2, tcp.grpc -> (structure)
An object that represents a type of connection pool.
maxRequests -> (integer)
http -> (structure)
An object that represents a type of connection pool.
maxConnections -> (integer)
maxPendingRequests -> (integer)
max_connections Envoy will queue to upstream cluster.http2 -> (structure)
An object that represents a type of connection pool.
maxRequests -> (integer)
tcp -> (structure)
An object that represents a type of connection pool.
maxConnections -> (integer)
healthCheck -> (structure)
The health check information for the listener.
healthyThreshold -> (integer)
intervalMillis -> (long)
path -> (string)
port -> (integer)
protocol -> (string)
grpc , then your service must conform to the GRPC Health Checking Protocol .timeoutMillis -> (long)
unhealthyThreshold -> (integer)
outlierDetection -> (structure)
The outlier detection information for the listener.
baseEjectionDuration -> (structure)
The base amount of time for which a host is ejected.
unit -> (string)
value -> (long)
interval -> (structure)
The time interval between ejection sweep analysis.
unit -> (string)
value -> (long)
maxEjectionPercent -> (integer)
maxServerErrors -> (long)
5xx errors required for ejection.portMapping -> (structure)
The port mapping information for the listener.
port -> (integer)
protocol -> (string)
timeout -> (tagged union structure)
An object that represents timeouts for different protocols.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:grpc, http, http2, tcp.grpc -> (structure)
An object that represents types of timeouts.
idle -> (structure)
An object that represents an idle timeout. An idle timeout bounds the amount of time that a connection may be idle. The default value is none.
unit -> (string)
value -> (long)
perRequest -> (structure)
An object that represents a per request timeout. The default value is 15 seconds. If you set a higher timeout, then make sure that the higher value is set for each App Mesh resource in a conversation. For example, if a virtual node backend uses a virtual router provider to route to another virtual node, then the timeout should be greater than 15 seconds for the source and destination virtual node and the route.
unit -> (string)
value -> (long)
http -> (structure)
An object that represents types of timeouts.
idle -> (structure)
An object that represents an idle timeout. An idle timeout bounds the amount of time that a connection may be idle. The default value is none.
unit -> (string)
value -> (long)
perRequest -> (structure)
An object that represents a per request timeout. The default value is 15 seconds. If you set a higher timeout, then make sure that the higher value is set for each App Mesh resource in a conversation. For example, if a virtual node backend uses a virtual router provider to route to another virtual node, then the timeout should be greater than 15 seconds for the source and destination virtual node and the route.
unit -> (string)
value -> (long)
http2 -> (structure)
An object that represents types of timeouts.
idle -> (structure)
An object that represents an idle timeout. An idle timeout bounds the amount of time that a connection may be idle. The default value is none.
unit -> (string)
value -> (long)
perRequest -> (structure)
An object that represents a per request timeout. The default value is 15 seconds. If you set a higher timeout, then make sure that the higher value is set for each App Mesh resource in a conversation. For example, if a virtual node backend uses a virtual router provider to route to another virtual node, then the timeout should be greater than 15 seconds for the source and destination virtual node and the route.
unit -> (string)
value -> (long)
tcp -> (structure)
An object that represents types of timeouts.
idle -> (structure)
An object that represents an idle timeout. An idle timeout bounds the amount of time that a connection may be idle. The default value is none.
unit -> (string)
value -> (long)
tls -> (structure)
A reference to an object that represents the Transport Layer Security (TLS) properties for a listener.
certificate -> (tagged union structure)
A reference to an object that represents a listener’s Transport Layer Security (TLS) certificate.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:acm, file, sds.acm -> (structure)
A reference to an object that represents an Certificate Manager certificate.
certificateArn -> (string)
file -> (structure)
A reference to an object that represents a local file certificate.
certificateChain -> (string)
privateKey -> (string)
sds -> (structure)
A reference to an object that represents a listener’s Secret Discovery Service certificate.
secretName -> (string)
mode -> (string)
Specify one of the following modes.
- STRICT – Listener only accepts connections with TLS enabled.
- PERMISSIVE – Listener accepts connections with or without TLS enabled.
- DISABLED – Listener only accepts connections without TLS.
validation -> (structure)
A reference to an object that represents a listener’s Transport Layer Security (TLS) validation context.
subjectAlternativeNames -> (structure)
A reference to an object that represents the SANs for a listener’s Transport Layer Security (TLS) validation context.
match -> (structure)
An object that represents the criteria for determining a SANs match.
exact -> (list)
The values sent must match the specified values exactly.
(string)
trust -> (tagged union structure)
A reference to where to retrieve the trust chain when validating a peer’s Transport Layer Security (TLS) certificate.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:file, sds.file -> (structure)
An object that represents a Transport Layer Security (TLS) validation context trust for a local file.
certificateChain -> (string)
sds -> (structure)
A reference to an object that represents a listener’s Transport Layer Security (TLS) Secret Discovery Service validation context trust.
secretName -> (string)
logging -> (structure)
The inbound and outbound access logging information for the virtual node.
accessLog -> (tagged union structure)
The access log configuration for a virtual node.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:file.file -> (structure)
The file object to send virtual node access logs to.
format -> (tagged union structure)
The specified format for the logs. The format is either json_format or text_format .
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:json, text.json -> (list)
(structure)
An object that represents the key value pairs for the JSON.
key -> (string)
value -> (string)
text -> (string)
path -> (string)
The file path to write access logs to. You can use /dev/stdout to send access logs to standard out and configure your Envoy container to use a log driver, such as awslogs , to export the access logs to a log storage service such as Amazon CloudWatch Logs. You can also specify a path in the Envoy container’s file system to write the files to disk.
Note
The Envoy process must have write permissions to the path that you specify here. Otherwise, Envoy fails to bootstrap properly.serviceDiscovery -> (tagged union structure)
The service discovery information for the virtual node. If your virtual node does not expect ingress traffic, you can omit this parameter. If you specify a listener , then you must specify service discovery information.
Note
This is a Tagged Union structure. Only one of the following top level keys can be set:awsCloudMap, dns.awsCloudMap -> (structure)
Specifies any Cloud Map information for the virtual node.
attributes -> (list)
A string map that contains attributes with values that you can use to filter instances by any custom attribute that you specified when you registered the instance. Only instances that match all of the specified key/value pairs will be returned.
(structure)
An object that represents the Cloud Map attribute information for your virtual node.
Note
Cloud Map is not available in the eu-south-1 Region.key -> (string)
value -> (string)
ipPreference -> (string)
namespaceName -> (string)
serviceName -> (string)
dns -> (structure)
Specifies the DNS information for the virtual node.
hostname -> (string)
ipPreference -> (string)
responseType -> (string)
status -> (structure)
The current status for the virtual node.
status -> (string)
virtualNodeName -> (string)
© Copyright 2025, Amazon Web Services. Created using Sphinx.
