Create a site-to-site connection
Brings up an IPsec tunnel between this VPC and a network the customer runs elsewhere — AWS today.
This spends money and takes a scarce address. IPsec needs UDP 500 and 4500, which are fixed, so one public IPv4 carries exactly one peer: each connection is sold an address of its own out of the region’s pool, at $199/mo for as long as it exists. That is why it takes network:manage, and why a region that has run out of addresses refuses with 422 rather than queueing. Confirm the charge with the user before sending it.
The IPsec gateway is created with the first connection and released with the last, so there is no separate call to enable it.
Read public_ip off the response: that is the address to enter on the far side, and the tunnel does not come up until they do.
Authorizations
Bearer token for authentication. Format: 'Bearer {token}'
Headers
Workspace ID (uses default workspace if not provided)
Path Parameters
VPC UUID
Body
Create a site-to-site connection
Connection name, unique within the gateway. Lowercase letters, numbers and hyphens, 2 to 30 characters. This is the name the platform addresses the tunnel by.
The far side's IPv4 ranges, e.g. ['10.0.0.0/16']. Anything outside them is not routed over the tunnel.
One entry per tunnel from the far side's configuration. AWS gives two; only the first is used today, because running both needs a guest-kernel roll that has not happened yet.
The far side's BGP ASN, when it runs BGP
Response
Create a site-to-site connection
Api_V1_Entities_SiteConnection model
Unique connection identifier
Connection name, unique within the gateway
Far side's platform. Only aws today
Far side's BGP ASN, when it runs BGP
The far side's IPv4 ranges
Addresses of the far side's tunnel endpoints. The pre-shared keys sent alongside them are never returned
Current status (pending, active, failed, deleting)
The public IPv4 this connection holds exclusively. Enter it on the far side
Creation timestamp

