VpcEndpoint
An interface VPC endpoint that keeps AWS traffic off the public internet, with its own security group open only to the compute you attach.
Arguments
Names below are TypeScript (camelCase). In Python use snake_case (e.g. dataClassification → data_classification); in Go use PascalCase on the Args struct (e.g. DataClassification).
vpcId requiredstring The ID of the VPC to create the endpoint in. Accepts both Anvil-managed VPC IDs and imported VPC IDs.
privateSubnetIds requiredstring[] The IDs of the private subnets to attach the endpoint to. AWS places one ENI per subnet — pass all private subnet IDs, typically one per AZ.
service requiredstring The AWS service to route privately. The full com.amazonaws.{region}.{service} name is constructed at deploy time from the resolved region — you never write it manually.
overridePermissions array Explicit Allow/Deny permission statements for the endpoint policy. When omitted, the endpoint policy allows all actions for all Anvil compute principals. When set, only the declared actions are permitted — supports both Allow and Deny effects.
overridePermissions[] 3 fields
A single permission statement in the VPC endpoint policy. Effect must be Allow or Deny. Action is an IAM action string. Resource defaults to * if omitted.
effect requiredstring The IAM effect — "Allow" or "Deny".
action requiredstring The IAM action string, e.g. "sqs:SendMessage", "secretsmanager:GetSecretValue".
resource string The ARN to scope this permission to. Defaults to "*" if omitted — applies to all resources of this service. Accepts Output<string> — pass resource ARNs directly, e.g. queue.arn, secret.arn.
Attributes
Outputs available once the resource is deployed.
endpointId string The ID of the VPC endpoint, e.g. vpce-0abc1234567890abc.
dnsName string The first DNS name assigned to the endpoint. Exposed for debugging and multi-VPC architectures only.
securityGroupId string The ID of the dedicated security group attached to this endpoint.