@anvil-cloud/sdk 0.0.12 → 0.0.14

package/types/input.ts

@@ -542,6 +542,54 @@ export namespace aws {
         lambda?: pulumi.Input<inputs.aws.LambdaOverridesArgs>;
     }
 
+    export interface LambdaVpcArgsArgs {
+        /**
+         * CIDR-scoped egress rules. One SG rule per port per CIDR. Use for peered VPCs or on-premise ranges.
+         */
+        cidrs?: pulumi.Input<pulumi.Input<inputs.aws.LambdaVpcCidrArgsArgs>[]>;
+        /**
+         * Only needed for imported VPCs with NAT. Omit when using an Anvil Vpc component.
+         */
+        hasNat?: pulumi.Input<boolean>;
+        /**
+         * The IDs of the private subnets to attach the Lambda to. Always private — Lambda must never be placed in public subnets.
+         */
+        privateSubnetIds: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * VPC endpoints this Lambda needs access to. Anvil wires both SG rules automatically.
+         */
+        vpcEndpoints?: pulumi.Input<pulumi.Input<inputs.aws.LambdaVpcEndpointArgsArgs>[]>;
+        /**
+         * The ID of the VPC to place the Lambda in.
+         */
+        vpcId: pulumi.Input<string>;
+    }
+
+    export interface LambdaVpcCidrArgsArgs {
+        /**
+         * TCP ports to allow. Required — be explicit.
+         */
+        ports: pulumi.Input<pulumi.Input<number>[]>;
+        /**
+         * IPv4 CIDR block, e.g. 10.0.0.0/8
+         */
+        range: pulumi.Input<string>;
+    }
+
+    /**
+     * A VPC endpoint to grant this Lambda access to.
+     */
+    export interface LambdaVpcEndpointArgsArgs {
+        /**
+         * The endpoint's ID. Use ep.endpointId. Used for SG rule naming.
+         */
+        endpointId: pulumi.Input<string>;
+        /**
+         * The endpoint's security group ID. Use ep.securityGroupId.
+         */
+        securityGroupId: pulumi.Input<string>;
+    }
+
     export interface PABTransformArgs {
         /**
          * Whether Amazon S3 should block public ACLs for this bucket. Defaults to <span pulumi-lang-nodejs="`false`" pulumi-lang-dotnet="`False`" pulumi-lang-go="`false`" pulumi-lang-python="`false`" pulumi-lang-yaml="`false`" pulumi-lang-java="`false`">`false`</span>. Enabling this setting does not affect existing policies or ACLs. When set to <span pulumi-lang-nodejs="`true`" pulumi-lang-dotnet="`True`" pulumi-lang-go="`true`" pulumi-lang-python="`true`" pulumi-lang-yaml="`true`" pulumi-lang-java="`true`">`true`</span> causes the following behavior:
@@ -577,6 +625,53 @@ export namespace aws {
          */
         skipDestroy?: pulumi.Input<boolean>;
     }
+
+    export interface VpcBastionArgsArgs {
+        /**
+         * Source IP CIDRs allowed to initiate SSM sessions via IAM policy condition. Omit to allow any authenticated IAM principal. Example: ['203.0.113.0/32'] to restrict to your office IP.
+         */
+        allowedCidrs?: pulumi.Input<pulumi.Input<string>[]>;
+        /**
+         * EC2 instance type for the bastion host. Default: 't4g.nano' — the bastion is purely a jump box with minimal resource requirements.
+         */
+        instanceType?: pulumi.Input<string>;
+    }
+
+    export interface VpcCloudWatchFlowLogArgsArgs {
+        /**
+         * Number of days to retain flow log data in CloudWatch Logs. Common values: 7, 14, 30, 90.
+         */
+        retention: pulumi.Input<number>;
+    }
+
+    export interface VpcFlowLogsArgsArgs {
+        /**
+         * Enable flow log delivery to a CloudWatch Log Group. Use for fast querying with CloudWatch Logs Insights and active debugging of connection issues.
+         */
+        cloudwatch?: pulumi.Input<inputs.aws.VpcCloudWatchFlowLogArgsArgs>;
+        /**
+         * Enable flow log delivery to a dedicated S3 bucket with auto-tiered lifecycle policy. Use for compliance retention and audit evidence.
+         */
+        s3?: pulumi.Input<inputs.aws.VpcS3FlowLogArgsArgs>;
+    }
+
+    export interface VpcNatArgsArgs {
+        /**
+         * EC2 instance type for the fck-nat instance. Only applies when natType is 'fck-nat'. Default: 't4g.small'.
+         */
+        instanceType?: pulumi.Input<string>;
+        /**
+         * Type of NAT to provision. 'gateway' provisions one AWS managed NAT Gateway per AZ. 'fck-nat' provisions a single fck-nat EC2 instance shared across all AZs.
+         */
+        natType: pulumi.Input<enums.aws.VpcNatType>;
+    }
+
+    export interface VpcS3FlowLogArgsArgs {
+        /**
+         * Storage tiering policy for flow log retention.
+         */
+        lifecycle: pulumi.Input<enums.aws.S3FlowLogLifecycle>;
+    }
 }
 
 export namespace gcp {