Vpc
A VPC with public and private subnets across availability zones and a locked-down default security group. NAT, SSM bastion and flow logs are opt-in.
Arguments
Names below are TypeScript (camelCase). In Python use snake_case (e.g. dataClassification → data_classification); in Go use PascalCase on the Args struct (e.g. DataClassification).
cidr string The IPv4 CIDR block for the VPC. Default: '10.0.0.0/16'. Public subnets carved from offset 0 (/24 each), private subnets from offset 10 (/24 each).
availabilityZones integer Number of Availability Zones to deploy subnets into. Valid values: 1, 2, 3. Defaults to 1. Inherits from App.defaults.availability — 'high' maps to 3, 'low' maps to 1.
nat object (VpcNatArgs) Optional NAT configuration for outbound internet access from private subnets. Omit for a fully private VPC.
gateway— AWS managed NAT Gateway. One per AZ for true HA. ~$32/month per AZ plus data processing.fck-nat— fck-nat EC2 instance. Single instance regardless of AZ count. ~$4-6/month — accepted single point of failure for cost savings.
bastion object (VpcBastionArgs) Optional SSM bastion host for private network access. No SSH, no port 22 — access via AWS SSM Session Manager only. Use to connect to RDS, ElastiCache, and other private resources locally.
flowLogs object (VpcFlowLogsArgs) Optional VPC Flow Log configuration. Opt-in only. Either or both destinations can be enabled simultaneously: CloudWatch for active debugging, S3 for long-term compliance retention.
flowLogs 2 fields
cloudwatch object (VpcCloudWatchFlowLogArgs) Enable flow log delivery to a CloudWatch Log Group. Use for fast querying with CloudWatch Logs Insights and active debugging of connection issues.
s3 object (VpcS3FlowLogArgs) Enable flow log delivery to a dedicated S3 bucket with auto-tiered lifecycle policy. Use for compliance retention and audit evidence.
flowLogs.cloudwatch 1 field
retention requiredinteger Number of days to retain flow log data in CloudWatch Logs. Common values: 7, 14, 30, 90.
flowLogs.s3 1 field
lifecycle requiredstring Storage tiering policy for flow log retention.
standard— Auto-tiered: Standard (0-30d) → Standard-IA (30-90d) → Glacier Instant Retrieval (90d+). Suitable for compliance retention at minimal long-term cost.
nat 2 fields
natType requiredstring Type of NAT to provision. 'gateway' provisions one AWS managed NAT Gateway per AZ. 'fck-nat' provisions a single fck-nat EC2 instance shared across all AZs.
gateway— AWS managed NAT Gateway. One per AZ for true HA. ~$32/month per AZ plus $0.045/GB data processed.fck-nat— fck-nat EC2 instance. Single instance regardless of AZ count. ~$4-6/month for t4g.small. Accepted single point of failure tradeoff for cost savings.
instanceType string EC2 instance type for the fck-nat instance. Only applies when natType is 'fck-nat'. Default: 't4g.small'.
bastion 2 fields
instanceType string EC2 instance type for the bastion host. Default: 't4g.nano' — the bastion is purely a jump box with minimal resource requirements.
allowedCidrs array<string> Source IP CIDRs allowed to initiate SSM sessions via IAM policy condition. Omit to allow any authenticated IAM principal. Example: ['203.0.113.0/32'] to restrict to your office IP.
Attributes
Outputs available once the resource is deployed.
vpcId string The ID of the VPC.
privateSubnetIds string[] The IDs of the private subnets, one per AZ. Used by Lambda, ECS, EC2, and RDS.
publicSubnetIds string[] The IDs of the public subnets, one per AZ. Used by load balancers, NAT Gateways, and the bastion host.
availabilityZones string[] The resolved AZ names, e.g. ['ap-southeast-2a'].
defaultSecurityGroupId string The ID of the VPC default security group. All rules removed — not used by Anvil components.
bastionInstanceId string The EC2 instance ID of the bastion host. Only populated when bastion is enabled.
bastionSecurityGroupId string The security group ID of the bastion host. Only populated when bastion is enabled.