Vpc

A VPC with public and private subnets across availability zones and a locked-down default security group. NAT, SSM bastion and flow logs are opt-in.

Networking · anvil:aws:Vpc

Minimal

The smallest config that deploys.

import { App } from '@anvil-cloud/sdk';
import * as anvil from '@anvil-cloud/sdk';

export default new App({
  run(ctx) {
    const network = new anvil.aws.Vpc('network');
  },
});

import anvil_cloud as anvil

def infra(ctx: anvil.Context):
    network = anvil.aws.Vpc("network")

anvil.App(run=infra)

package main

import (
    "github.com/anvil-cloud/anvil/sdk/go/anvil"
    anvilaws "github.com/anvil-cloud/anvil/sdk/go/anvil/aws"
)

func main() {
    anvil.Run(anvil.AppConfig{
        Run: func(ctx *anvil.Context) error {
            _, err := anvilaws.NewVpc(ctx.PulumiCtx(), "network", nil)
            if err != nil {
                return err
            }
            return nil
        },
    })
}

Good to know

• Defaults: 10.0.0.0/16 in one availability zone, with one public and one private /24 subnet per zone. Set availabilityZones to 2 or 3 for production.
• Without nat, private subnets have no internet access. Compute there reaches AWS services through VpcEndpoints.
• The VPC's default security group is locked down. An Anvil Lambda in the VPC gets its own security group with only the rules you declare.
• bastion is reached through SSM Session Manager only: no SSH and no open port 22.
• Flow logs are opt-in: CloudWatch for debugging, S3 for long-term retention, or both.