VpcEndpoint
An interface VPC endpoint that keeps AWS traffic off the public internet, with its own security group open only to the compute you attach.
Minimal
The smallest config that deploys.
import { App } from '@anvil-cloud/sdk';
import * as anvil from '@anvil-cloud/sdk';
export default new App({
run(ctx) {
const network = new anvil.aws.Vpc('network', { availabilityZones: 2 });
const endpoint = new anvil.aws.VpcEndpoint('sqs-endpoint', {
vpcId: network.vpcId,
privateSubnetIds: network.privateSubnetIds,
service: 'sqs',
});
ctx.export('endpointId', endpoint.endpointId);
},
});import anvil_cloud as anvil
def infra(ctx: anvil.Context):
network = anvil.aws.Vpc("network", availability_zones=2)
endpoint = anvil.aws.VpcEndpoint("sqs-endpoint",
vpc_id=network.vpc_id,
private_subnet_ids=network.private_subnet_ids,
service="sqs",
)
ctx.export("endpoint_id", endpoint.endpoint_id)
anvil.App(run=infra)package main
import (
"github.com/anvil-cloud/anvil/sdk/go/anvil"
anvilaws "github.com/anvil-cloud/anvil/sdk/go/anvil/aws"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
anvil.Run(anvil.AppConfig{
Run: func(ctx *anvil.Context) error {
network, err := anvilaws.NewVpc(ctx.PulumiCtx(), "network", &anvilaws.VpcArgs{
AvailabilityZones: pulumi.Int(2),
})
if err != nil {
return err
}
endpoint, err := anvilaws.NewVpcEndpoint(ctx.PulumiCtx(), "sqs-endpoint", &anvilaws.VpcEndpointArgs{
VpcId: network.VpcId,
PrivateSubnetIds: network.PrivateSubnetIds,
Service: pulumi.String("sqs"),
})
if err != nil {
return err
}
ctx.Export("endpointId", endpoint.EndpointId)
return nil
},
})
}Good to know
- Give
serviceas the short name, e.g.'sqs'. Anvil builds the fullcom.amazonaws.<region>.<service>name for the stack's region. - Pass every private subnet, usually one per availability zone. AWS places one network interface in each.
- The endpoint's security group only allows the compute you attach to it. A Lambda lists it under
vpc.vpcEndpoints, and Anvil adds both sides of the rule. - Without
overridePermissions, the endpoint policy allows every action for Anvil compute. Set it to allow or deny specific actions.
The Full example tab has a complete program. Every argument and attribute is on the Reference tab.