@composurecdk/ec2 0.8.4 → 0.8.6

package/dist/commonjs/interface-endpoint-builder.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createInterfaceEndpointBuilder = createInterfaceEndpointBuilder;
+const aws_ec2_1 = require("aws-cdk-lib/aws-ec2");
+const core_1 = require("@composurecdk/core");
+const cloudformation_1 = require("@composurecdk/cloudformation");
+const cloudwatch_1 = require("@composurecdk/cloudwatch");
+const security_group_builder_js_1 = require("./security-group-builder.js");
+const interface_endpoint_defaults_js_1 = require("./interface-endpoint-defaults.js");
+const interface_endpoint_alarms_js_1 = require("./interface-endpoint-alarms.js");
+class InterfaceEndpointBuilder {
+    props = {};
+    #access = [];
+    #customAlarms = [];
+    #vpc;
+    #securityGroups;
+    /**
+     * Sets the VPC the endpoint is created in. Accepts a concrete {@link IVpc}
+     * or a {@link Ref} to a sibling {@link IVpcBuilder}.
+     */
+    vpc(vpc) {
+        this.#vpc = vpc;
+        return this;
+    }
+    /**
+     * Bring-your-own security groups. Each entry is a {@link Resolvable}, so it
+     * can be a concrete {@link ISecurityGroup} or a {@link Ref} to a sibling
+     * `SecurityGroupBuilder` — giving you full ingress/egress/port control. When
+     * set, the builder creates no security group of its own and
+     * {@link InterfaceEndpointBuilderResult.securityGroup} is `undefined`.
+     *
+     * Mutually exclusive with {@link allowDefaultPortFrom}.
+     */
+    securityGroups(securityGroups) {
+        this.#securityGroups = securityGroups;
+        return this;
+    }
+    /**
+     * Managed-SG shortcut: wires `peer` to the auto-created security group via
+     * CDK's `endpoint.connections.allowDefaultPortFrom(peer)` — opening ingress
+     * on the managed SG from `peer`'s SG **and** egress from `peer`'s SG to the
+     * managed SG, on the service's default port (443 for AWS services).
+     *
+     * Because this delegates to CDK connections, `peer` must be an
+     * {@link IConnectable} (e.g. a `SecurityGroup` or `Instance`), not a raw
+     * `IPeer` (e.g. `Peer.ipv4(...)`). For CIDR-based rules use BYO mode with
+     * an explicit `addIngressRule` on your own {@link SecurityGroupBuilder}.
+     *
+     * Mutually exclusive with {@link securityGroups}.
+     */
+    allowDefaultPortFrom(peer, description) {
+        this.#access.push({ peer, description });
+        return this;
+    }
+    /**
+     * Adds a custom CloudWatch alarm alongside the recommended ones. The
+     * callback receives an {@link AlarmDefinitionBuilder} typed to the
+     * `InterfaceVpcEndpoint` construct, giving access to the endpoint at
+     * build time for metric dimension wiring.
+     */
+    addAlarm(key, configure) {
+        this.#customAlarms.push(configure(new cloudwatch_1.AlarmDefinitionBuilder(key)));
+        return this;
+    }
+    /** @internal — see ADR-0005. */
+    [core_1.COPY_STATE](target) {
+        target.#vpc = this.#vpc;
+        target.#securityGroups = this.#securityGroups ? [...this.#securityGroups] : undefined;
+        target.#access.push(...this.#access);
+        target.#customAlarms.push(...this.#customAlarms);
+    }
+    build(scope, id, context) {
+        const resolvedVpc = this.#vpc ? (0, core_1.resolve)(this.#vpc, context) : undefined;
+        if (!resolvedVpc) {
+            throw new Error(`InterfaceEndpointBuilder "${id}" requires a VPC. Call .vpc() with an IVpc or a Ref to one.`);
+        }
+        const { recommendedAlarms: alarmConfig, service, ...endpointProps } = this.props;
+        if (service === undefined) {
+            throw new Error(`InterfaceEndpointBuilder "${id}" requires a service. ` +
+                "Call .service() with an InterfaceVpcEndpointAwsService or a custom IInterfaceVpcEndpointService.");
+        }
+        const byo = this.#securityGroups;
+        if (byo !== undefined && this.#access.length > 0) {
+            throw new Error(`InterfaceEndpointBuilder "${id}": .allowDefaultPortFrom() applies only to the ` +
+                "auto-created security group and cannot be combined with .securityGroups() — " +
+                "add the ingress rule to your own SecurityGroupBuilder instead.");
+        }
+        let managedSecurityGroup;
+        let securityGroups;
+        if (byo !== undefined) {
+            securityGroups = byo.map((sg) => (0, core_1.resolve)(sg, context));
+        }
+        else {
+            managedSecurityGroup = (0, security_group_builder_js_1.createSecurityGroupBuilder)()
+                .vpc(resolvedVpc)
+                .description(`Interface endpoint ${id}`)
+                .build(scope, `${id}Sg`).securityGroup;
+            securityGroups = [managedSecurityGroup];
+        }
+        const endpoint = new aws_ec2_1.InterfaceVpcEndpoint(scope, id, {
+            ...interface_endpoint_defaults_js_1.INTERFACE_ENDPOINT_DEFAULTS,
+            ...endpointProps,
+            service,
+            vpc: resolvedVpc,
+            securityGroups,
+            // Always explicit: `open: true` would silently add a VPC-wide :443 rule.
+            open: false,
+        });
+        for (const rule of this.#access) {
+            endpoint.connections.allowDefaultPortFrom((0, core_1.resolve)(rule.peer, context), rule.description);
+        }
+        const alarms = (0, interface_endpoint_alarms_js_1.createInterfaceEndpointAlarms)(scope, id, endpoint, alarmConfig, this.#customAlarms);
+        return { endpoint, securityGroup: managedSecurityGroup, alarms };
+    }
+}
+/**
+ * Creates a new {@link IInterfaceEndpointBuilder} for a single VPC interface
+ * endpoint. The returned builder exposes every
+ * {@link InterfaceEndpointBuilderProps} property as a fluent setter/getter,
+ * plus `.vpc()`, `.securityGroups()` (BYO), and `.allowDefaultPortFrom()`
+ * (managed-SG shortcut).
+ */
+function createInterfaceEndpointBuilder() {
+    return (0, cloudformation_1.taggedBuilder)(InterfaceEndpointBuilder);
+}
+//# sourceMappingURL=interface-endpoint-builder.js.map

package/dist/commonjs/interface-endpoint-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-endpoint-builder.js","sourceRoot":"","sources":["../../src/interface-endpoint-builder.ts"],"names":[],"mappings":";;AA6PA,wEAIC;AAhQD,iDAO6B;AAE7B,6CAA0F;AAC1F,iEAAkF;AAClF,yDAAkE;AAClE,2EAAyE;AACzE,qFAA+E;AAE/E,iFAA+E;AA2F/E,MAAM,wBAAwB;IAC5B,KAAK,GAA2C,EAAE,CAAC;IAC1C,OAAO,GAAiB,EAAE,CAAC;IAC3B,aAAa,GAAmD,EAAE,CAAC;IAC5E,IAAI,CAAoB;IACxB,eAAe,CAAgC;IAE/C;;;OAGG;IACH,GAAG,CAAC,GAAqB;QACvB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,cAAc,CAAC,cAA4C;QACzD,IAAI,CAAC,eAAe,GAAG,cAAc,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,IAA8B,EAAE,WAAoB;QACvE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CACN,GAAW,EACX,SAEiD;QAEjD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,mCAAsB,CAAuB,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,iBAAU,CAAC,CAAC,MAAgC;QAC3C,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACxB,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtF,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CACH,KAAiB,EACjB,EAAU,EACV,OAAgC;QAEhC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAA,cAAO,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,6BAA6B,EAAE,6DAA6D,CAC7F,CAAC;QACJ,CAAC;QAED,MAAM,EAAE,iBAAiB,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,aAAa,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACjF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,6BAA6B,EAAE,wBAAwB;gBACrD,kGAAkG,CACrG,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC;QACjC,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,6BAA6B,EAAE,iDAAiD;gBAC9E,8EAA8E;gBAC9E,gEAAgE,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,oBAA+C,CAAC;QACpD,IAAI,cAAgC,CAAC;QACrC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,cAAc,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAA,cAAO,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,oBAAoB,GAAG,IAAA,sDAA0B,GAAE;iBAChD,GAAG,CAAC,WAAW,CAAC;iBAChB,WAAW,CAAC,sBAAsB,EAAE,EAAE,CAAC;iBACvC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,aAAa,CAAC;YACzC,cAAc,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,8BAAoB,CAAC,KAAK,EAAE,EAAE,EAAE;YACnD,GAAG,4DAA2B;YAC9B,GAAG,aAAa;YAChB,OAAO;YACP,GAAG,EAAE,WAAW;YAChB,cAAc;YACd,yEAAyE;YACzE,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAChC,QAAQ,CAAC,WAAW,CAAC,oBAAoB,CAAC,IAAA,cAAO,EAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,4DAA6B,EAC1C,KAAK,EACL,EAAE,EACF,QAAQ,EACR,WAAW,EACX,IAAI,CAAC,aAAa,CACnB,CAAC;QAEF,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,EAAE,CAAC;IACnE,CAAC;CACF;AAED;;;;;;GAMG;AACH,SAAgB,8BAA8B;IAC5C,OAAO,IAAA,8BAAa,EAClB,wBAAwB,CACzB,CAAC;AACJ,CAAC"}

package/dist/commonjs/interface-endpoint-defaults.d.ts

@@ -0,0 +1,14 @@
+import type { InterfaceVpcEndpointProps } from "aws-cdk-lib/aws-ec2";
+/**
+ * Secure, AWS-recommended defaults applied to every interface endpoint built
+ * with {@link createInterfaceEndpointBuilder}. Each property can be
+ * individually overridden via the builder's fluent API.
+ *
+ * Note `open` is intentionally *not* here: the builder always sets it to
+ * `false` (see the builder's `build()`). Allowing it through would silently
+ * add a VPC-wide rule to the managed security group behind the caller's back;
+ * ingress is always explicit — via `.allowDefaultPortFrom()` (managed SG) or
+ * the BYO `SecurityGroupBuilder`.
+ */
+export declare const INTERFACE_ENDPOINT_DEFAULTS: Partial<InterfaceVpcEndpointProps>;
+//# sourceMappingURL=interface-endpoint-defaults.d.ts.map

package/dist/commonjs/interface-endpoint-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-endpoint-defaults.d.ts","sourceRoot":"","sources":["../../src/interface-endpoint-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAErE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,2BAA2B,EAAE,OAAO,CAAC,yBAAyB,CAW1E,CAAC"}

package/dist/commonjs/interface-endpoint-defaults.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERFACE_ENDPOINT_DEFAULTS = void 0;
+/**
+ * Secure, AWS-recommended defaults applied to every interface endpoint built
+ * with {@link createInterfaceEndpointBuilder}. Each property can be
+ * individually overridden via the builder's fluent API.
+ *
+ * Note `open` is intentionally *not* here: the builder always sets it to
+ * `false` (see the builder's `build()`). Allowing it through would silently
+ * add a VPC-wide rule to the managed security group behind the caller's back;
+ * ingress is always explicit — via `.allowDefaultPortFrom()` (managed SG) or
+ * the BYO `SecurityGroupBuilder`.
+ */
+exports.INTERFACE_ENDPOINT_DEFAULTS = {
+    /**
+     * Private DNS enables `<service>.<region>.amazonaws.com` to resolve to the
+     * endpoint ENIs instead of the public service IP addresses, keeping traffic
+     * on the AWS network without requiring application-level changes. Disabled
+     * by default in raw CDK; always on here because every AWS-service use case
+     * requires it for transparent private access.
+     *
+     * @see https://docs.aws.amazon.com/wellarchitected/latest/security-pillar/sec_network_protection_private_connectivity.html
+     */
+    privateDnsEnabled: true,
+};
+//# sourceMappingURL=interface-endpoint-defaults.js.map

package/dist/commonjs/interface-endpoint-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-endpoint-defaults.js","sourceRoot":"","sources":["../../src/interface-endpoint-defaults.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;GAUG;AACU,QAAA,2BAA2B,GAAuC;IAC7E;;;;;;;;OAQG;IACH,iBAAiB,EAAE,IAAI;CACxB,CAAC"}

package/dist/esm/index.d.ts

@@ -14,6 +14,10 @@ export { createVpcBuilder, type FlowLogsConfig, type IVpcBuilder, type VpcBuilde
 export { VPC_DEFAULTS } from "./vpc-defaults.js";
 export { createSecurityGroupBuilder, type ISecurityGroupBuilder, type SecurityGroupBuilderProps, type SecurityGroupBuilderResult, } from "./security-group-builder.js";
 export { SECURITY_GROUP_DEFAULTS } from "./security-group-defaults.js";
+export { createInterfaceEndpointBuilder, type IInterfaceEndpointBuilder, type InterfaceEndpointBuilderProps, type InterfaceEndpointBuilderResult, } from "./interface-endpoint-builder.js";
+export { INTERFACE_ENDPOINT_DEFAULTS } from "./interface-endpoint-defaults.js";
+export { type InterfaceEndpointAlarmConfig } from "./interface-endpoint-alarm-config.js";
+export { INTERFACE_ENDPOINT_ALARM_DEFAULTS } from "./interface-endpoint-alarm-defaults.js";
 /**
  * This package's AWS-property constraints, grouped by application strategy.
  * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EAC1B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAC1F,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAE5F,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EACL,0BAA0B,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW;;;;;;CAMO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EAC1B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,KAAK,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,KAAK,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAC1F,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAE5F,OAAO,EACL,mBAAmB,EACnB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,gBAAgB,EAChB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,KAAK,gBAAgB,GACtB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EACL,0BAA0B,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,GAChC,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EACL,8BAA8B,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,GACpC,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,EAAE,KAAK,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AACzF,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAE3F;;;;;;;GAOG;AACH,eAAO,MAAM,WAAW;;;;;;CAMO,CAAC"}

package/dist/esm/index.js

@@ -10,6 +10,9 @@ export { createVpcBuilder, } from "./vpc-builder.js";
 export { VPC_DEFAULTS } from "./vpc-defaults.js";
 export { createSecurityGroupBuilder, } from "./security-group-builder.js";
 export { SECURITY_GROUP_DEFAULTS } from "./security-group-defaults.js";
+export { createInterfaceEndpointBuilder, } from "./interface-endpoint-builder.js";
+export { INTERFACE_ENDPOINT_DEFAULTS } from "./interface-endpoint-defaults.js";
+export { INTERFACE_ENDPOINT_ALARM_DEFAULTS } from "./interface-endpoint-alarm-defaults.js";
 /**
  * This package's AWS-property constraints, grouped by application strategy.
  * The `constraints.validate.*` / `constraints.sanitize.*` shape is identical

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,qBAAqB,GAItB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAGvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAE5F,OAAO,EACL,mBAAmB,GAIpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,gBAAgB,GAKjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EACL,0BAA0B,GAI3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,QAAQ,EAAE;QACR,wBAAwB,EAAE,gCAAgC;QAC1D,iBAAiB,EAAE,yBAAyB;KAC7C;IACD,QAAQ,EAAE,EAAE;CACiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,gCAAgC,EAChC,yBAAyB,GAC1B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,qBAAqB,GAItB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAGvE,OAAO,EAAE,gCAAgC,EAAE,MAAM,0CAA0C,CAAC;AAE5F,OAAO,EACL,mBAAmB,GAIpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EACL,gBAAgB,GAKjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EACL,0BAA0B,GAI3B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAEvE,OAAO,EACL,8BAA8B,GAI/B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAE/E,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAE3F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,QAAQ,EAAE;QACR,wBAAwB,EAAE,gCAAgC;QAC1D,iBAAiB,EAAE,yBAAyB;KAC7C;IACD,QAAQ,EAAE,EAAE;CACiB,CAAC"}

package/dist/esm/interface-endpoint-alarm-config.d.ts

@@ -0,0 +1,34 @@
+import type { AlarmConfig } from "@composurecdk/cloudwatch";
+/**
+ * Controls which recommended alarms are created for a VPC interface endpoint.
+ * All alarms are enabled by default with AWS-recommended thresholds.
+ * Set individual alarms to `false` to disable them, or provide an
+ * {@link AlarmConfig} to tune thresholds.
+ *
+ * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#PrivateLinkEndpoints
+ */
+export interface InterfaceEndpointAlarmConfig {
+    /**
+     * Master switch: set to `false` to disable all recommended alarms.
+     * Individual alarms can also be disabled via their own entry.
+     * @default true
+     */
+    enabled?: boolean;
+    /**
+     * Alarm when the endpoint drops packets, indicating the endpoint or
+     * endpoint service is unhealthy, a security group is blocking traffic,
+     * or packets are hitting the 8,500-byte PrivateLink MTU limit.
+     *
+     * Metric: `AWS/PrivateLinkEndpoints PacketsDropped`, statistic Sum,
+     * period 1 minute. Default threshold: > 0 over 5 consecutive 1-minute
+     * windows.
+     *
+     * If your workload intentionally sends packets larger than 8,500 bytes
+     * you may want to raise the threshold to reduce noise from expected MTU
+     * drops.
+     *
+     * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#PrivateLinkEndpoints
+     */
+    packetsDropped?: AlarmConfig | false;
+}
+//# sourceMappingURL=interface-endpoint-alarm-config.d.ts.map

package/dist/esm/interface-endpoint-alarm-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-endpoint-alarm-config.d.ts","sourceRoot":"","sources":["../../src/interface-endpoint-alarm-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,WAAW,4BAA4B;IAC3C;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;;;;;;;;;;OAcG;IACH,cAAc,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CACtC"}

package/dist/esm/interface-endpoint-alarm-config.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=interface-endpoint-alarm-config.js.map

package/dist/esm/interface-endpoint-alarm-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-endpoint-alarm-config.js","sourceRoot":"","sources":["../../src/interface-endpoint-alarm-config.ts"],"names":[],"mappings":""}

package/dist/esm/interface-endpoint-alarm-defaults.d.ts

@@ -0,0 +1,13 @@
+import type { AlarmConfigDefaults } from "@composurecdk/cloudwatch";
+interface InterfaceEndpointAlarmDefaults {
+    enabled: true;
+    packetsDropped: AlarmConfigDefaults;
+}
+/**
+ * AWS-recommended default alarm configuration for VPC interface endpoints.
+ *
+ * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#PrivateLinkEndpoints
+ */
+export declare const INTERFACE_ENDPOINT_ALARM_DEFAULTS: InterfaceEndpointAlarmDefaults;
+export {};
+//# sourceMappingURL=interface-endpoint-alarm-defaults.d.ts.map

package/dist/esm/interface-endpoint-alarm-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-endpoint-alarm-defaults.d.ts","sourceRoot":"","sources":["../../src/interface-endpoint-alarm-defaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,UAAU,8BAA8B;IACtC,OAAO,EAAE,IAAI,CAAC;IACd,cAAc,EAAE,mBAAmB,CAAC;CACrC;AAED;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,8BAkB/C,CAAC"}

package/dist/esm/interface-endpoint-alarm-defaults.js

@@ -0,0 +1,25 @@
+import { TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
+/**
+ * AWS-recommended default alarm configuration for VPC interface endpoints.
+ *
+ * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#PrivateLinkEndpoints
+ */
+export const INTERFACE_ENDPOINT_ALARM_DEFAULTS = {
+    enabled: true,
+    /**
+     * Any sustained packet drop at the endpoint signals a connectivity or
+     * configuration problem — an unhealthy endpoint service, a security group
+     * blocking traffic, or jumbo frames exceeding the 8,500-byte PrivateLink
+     * MTU. Five consecutive 1-minute periods avoids false alarms from isolated
+     * oversized packets while still catching persistent issues quickly.
+     *
+     * @see https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-troubleshoot.html
+     */
+    packetsDropped: {
+        threshold: 0,
+        evaluationPeriods: 5,
+        datapointsToAlarm: 5,
+        treatMissingData: TreatMissingData.NOT_BREACHING,
+    },
+};
+//# sourceMappingURL=interface-endpoint-alarm-defaults.js.map

package/dist/esm/interface-endpoint-alarm-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-endpoint-alarm-defaults.js","sourceRoot":"","sources":["../../src/interface-endpoint-alarm-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAQ9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAmC;IAC/E,OAAO,EAAE,IAAI;IAEb;;;;;;;;OAQG;IACH,cAAc,EAAE;QACd,SAAS,EAAE,CAAC;QACZ,iBAAiB,EAAE,CAAC;QACpB,iBAAiB,EAAE,CAAC;QACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;KACjD;CACF,CAAC"}

package/dist/esm/interface-endpoint-alarms.d.ts

@@ -0,0 +1,13 @@
+import { type Alarm } from "aws-cdk-lib/aws-cloudwatch";
+import { type InterfaceVpcEndpoint } from "aws-cdk-lib/aws-ec2";
+import type { IConstruct } from "constructs";
+import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
+import type { InterfaceEndpointAlarmConfig } from "./interface-endpoint-alarm-config.js";
+/**
+ * Creates AWS-recommended CloudWatch alarms for a VPC interface endpoint,
+ * merging recommended definitions with any custom alarm builders.
+ *
+ * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#PrivateLinkEndpoints
+ */
+export declare function createInterfaceEndpointAlarms(scope: IConstruct, id: string, endpoint: InterfaceVpcEndpoint, config: InterfaceEndpointAlarmConfig | false | undefined, customAlarms?: AlarmDefinitionBuilder<InterfaceVpcEndpoint>[]): Record<string, Alarm>;
+//# sourceMappingURL=interface-endpoint-alarms.d.ts.map

package/dist/esm/interface-endpoint-alarms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-endpoint-alarms.d.ts","sourceRoot":"","sources":["../../src/interface-endpoint-alarms.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,KAAK,EAAqC,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EAAE,KAAK,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,sBAAsB,EAAoC,MAAM,0BAA0B,CAAC;AACpG,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAsDzF;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAC3C,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,oBAAoB,EAC9B,MAAM,EAAE,4BAA4B,GAAG,KAAK,GAAG,SAAS,EACxD,YAAY,GAAE,sBAAsB,CAAC,oBAAoB,CAAC,EAAO,GAChE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAUvB"}

package/dist/esm/interface-endpoint-alarms.js

@@ -0,0 +1,55 @@
+import { Duration } from "aws-cdk-lib";
+import { ComparisonOperator, Metric, Stats } from "aws-cdk-lib/aws-cloudwatch";
+import { createAlarms, resolveAlarmConfig } from "@composurecdk/cloudwatch";
+import { INTERFACE_ENDPOINT_ALARM_DEFAULTS } from "./interface-endpoint-alarm-defaults.js";
+const PACKETS_DROPPED_PERIOD = Duration.minutes(1);
+const PACKETS_DROPPED_PERIOD_LABEL = `${String(PACKETS_DROPPED_PERIOD.toMinutes())} minute`;
+function endpointMetric(endpoint, metricName, statistic, period) {
+    return new Metric({
+        namespace: "AWS/PrivateLinkEndpoints",
+        metricName,
+        dimensionsMap: { "VPC Endpoint Id": endpoint.vpcEndpointId },
+        statistic,
+        period,
+    });
+}
+function resolveEndpointAlarmDefinitions(endpoint, config) {
+    if (config?.enabled === false)
+        return [];
+    const definitions = [];
+    if (config?.packetsDropped !== false) {
+        const cfg = resolveAlarmConfig(config?.packetsDropped, INTERFACE_ENDPOINT_ALARM_DEFAULTS.packetsDropped);
+        definitions.push({
+            key: "packetsDropped",
+            alarmName: cfg.alarmName,
+            metric: endpointMetric(endpoint, "PacketsDropped", Stats.SUM, PACKETS_DROPPED_PERIOD),
+            threshold: cfg.threshold,
+            comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
+            evaluationPeriods: cfg.evaluationPeriods,
+            datapointsToAlarm: cfg.datapointsToAlarm,
+            treatMissingData: cfg.treatMissingData,
+            description: `VPC interface endpoint is dropping packets — possible endpoint service unhealthy, ` +
+                `security group blocking traffic, or packets exceeding the 8,500-byte PrivateLink MTU. ` +
+                `Threshold: > ${String(cfg.threshold)} (sum) over ` +
+                `${String(cfg.evaluationPeriods)} x ${PACKETS_DROPPED_PERIOD_LABEL}.`,
+        });
+    }
+    return definitions;
+}
+/**
+ * Creates AWS-recommended CloudWatch alarms for a VPC interface endpoint,
+ * merging recommended definitions with any custom alarm builders.
+ *
+ * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#PrivateLinkEndpoints
+ */
+export function createInterfaceEndpointAlarms(scope, id, endpoint, config, customAlarms = []) {
+    if (config === false)
+        return {};
+    const enabled = config?.enabled ?? INTERFACE_ENDPOINT_ALARM_DEFAULTS.enabled;
+    if (!enabled)
+        return {};
+    const recommended = resolveEndpointAlarmDefinitions(endpoint, config);
+    const custom = customAlarms.map((b) => b.resolve(endpoint));
+    return createAlarms(scope, id, [...recommended, ...custom]);
+}
+//# sourceMappingURL=interface-endpoint-alarms.js.map

package/dist/esm/interface-endpoint-alarms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-endpoint-alarms.js","sourceRoot":"","sources":["../../src/interface-endpoint-alarms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAc,kBAAkB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AAI3F,OAAO,EAA0B,YAAY,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEpG,OAAO,EAAE,iCAAiC,EAAE,MAAM,wCAAwC,CAAC;AAE3F,MAAM,sBAAsB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACnD,MAAM,4BAA4B,GAAG,GAAG,MAAM,CAAC,sBAAsB,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC;AAE5F,SAAS,cAAc,CACrB,QAA8B,EAC9B,UAAkB,EAClB,SAAiB,EACjB,MAAgB;IAEhB,OAAO,IAAI,MAAM,CAAC;QAChB,SAAS,EAAE,0BAA0B;QACrC,UAAU;QACV,aAAa,EAAE,EAAE,iBAAiB,EAAE,QAAQ,CAAC,aAAa,EAAE;QAC5D,SAAS;QACT,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,SAAS,+BAA+B,CACtC,QAA8B,EAC9B,MAAgD;IAEhD,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,WAAW,GAAsB,EAAE,CAAC;IAE1C,IAAI,MAAM,EAAE,cAAc,KAAK,KAAK,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,kBAAkB,CAC5B,MAAM,EAAE,cAAc,EACtB,iCAAiC,CAAC,cAAc,CACjD,CAAC;QACF,WAAW,CAAC,IAAI,CAAC;YACf,GAAG,EAAE,gBAAgB;YACrB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE,gBAAgB,EAAE,KAAK,CAAC,GAAG,EAAE,sBAAsB,CAAC;YACrF,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;YAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;YACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;YACtC,WAAW,EACT,oFAAoF;gBACpF,wFAAwF;gBACxF,gBAAgB,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc;gBACnD,GAAG,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,MAAM,4BAA4B,GAAG;SACxE,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAC3C,KAAiB,EACjB,EAAU,EACV,QAA8B,EAC9B,MAAwD,EACxD,eAA+D,EAAE;IAEjE,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,OAAO,GAAG,MAAM,EAAE,OAAO,IAAI,iCAAiC,CAAC,OAAO,CAAC;IAC7E,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,MAAM,WAAW,GAAG,+BAA+B,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE5D,OAAO,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/esm/interface-endpoint-builder.d.ts

@@ -0,0 +1,135 @@
+import { type Alarm } from "aws-cdk-lib/aws-cloudwatch";
+import { InterfaceVpcEndpoint, type IConnectable, type InterfaceVpcEndpointProps, type ISecurityGroup, type IVpc, type SecurityGroup } from "aws-cdk-lib/aws-ec2";
+import { type IConstruct } from "constructs";
+import { COPY_STATE, type Lifecycle, type Resolvable } from "@composurecdk/core";
+import { type ITaggedBuilder } from "@composurecdk/cloudformation";
+import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
+import type { InterfaceEndpointAlarmConfig } from "./interface-endpoint-alarm-config.js";
+/**
+ * Configuration properties for the interface-endpoint builder.
+ *
+ * Lifts three CDK props off the props object:
+ * - `vpc` — supplied via {@link IInterfaceEndpointBuilder.vpc | .vpc()} so it
+ *   can accept a {@link Resolvable} for cross-component wiring.
+ * - `securityGroups` — supplied via
+ *   {@link IInterfaceEndpointBuilder.securityGroups | .securityGroups()} so
+ *   each can be a {@link Resolvable} (typically a sibling
+ *   `SecurityGroupBuilder`).
+ * - `open` — always `false`; ingress is explicit (see the builder docs).
+ */
+export interface InterfaceEndpointBuilderProps extends Omit<InterfaceVpcEndpointProps, "vpc" | "securityGroups" | "open"> {
+    /**
+     * Configuration for AWS-recommended CloudWatch alarms.
+     *
+     * By default, the builder creates recommended alarms with sensible
+     * thresholds. Individual alarms can be customized or disabled. Set to
+     * `false` to disable all alarms.
+     *
+     * @see https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Best_Practice_Recommended_Alarms_AWS_Services.html#PrivateLinkEndpoints
+     */
+    recommendedAlarms?: InterfaceEndpointAlarmConfig | false;
+}
+/**
+ * The build output of an {@link IInterfaceEndpointBuilder}.
+ *
+ * `securityGroup` is present only in **managed mode** — i.e. when the caller
+ * did *not* supply `.securityGroups(...)`, so the builder auto-created one. It
+ * is exposed for cases where sibling builders need to reference the
+ * auto-created SG directly. In **BYO mode** it is `undefined`: the caller
+ * already holds refs to the security groups they passed in.
+ */
+export interface InterfaceEndpointBuilderResult {
+    endpoint: InterfaceVpcEndpoint;
+    securityGroup?: SecurityGroup;
+    alarms: Record<string, Alarm>;
+}
+/**
+ * A fluent builder for a single VPC interface endpoint (AWS PrivateLink).
+ *
+ * Unlike raw CDK — where interface endpoints exist only as a post-build
+ * `vpc.addInterfaceEndpoint(...)` call whose security group is never exposed —
+ * this builder is a first-class {@link compose} component. It maps 1:1 to a
+ * CDK `InterfaceVpcEndpoint` (one `service` per endpoint); group several into
+ * one access policy by pointing them at the same security group.
+ *
+ * **Security group, two modes:**
+ * - *BYO* — call {@link IInterfaceEndpointBuilder.securityGroups | .securityGroups([...])}
+ *   with security groups you fully manage (typically sibling
+ *   `SecurityGroupBuilder`s). Full ingress/egress/port control; the builder
+ *   creates no SG and `securityGroup` is absent from the result.
+ * - *Managed shortcut* — omit `.securityGroups()` and the builder auto-creates
+ *   a closed SG, exposes it on the result, and for each peer you pass to
+ *   {@link IInterfaceEndpointBuilder.allowDefaultPortFrom} it opens ingress on
+ *   the managed SG **and** egress on the peer's SG — matching exactly what CDK's
+ *   `connections.allowDefaultPortFrom(...)` does bidirectionally.
+ *
+ * The two are mutually exclusive — combining BYO `.securityGroups()` with
+ * `.allowDefaultPortFrom()` throws, since the rule would have nowhere it
+ * could be applied that the caller isn't already managing.
+ *
+ * @see https://docs.aws.amazon.com/vpc/latest/privatelink/
+ *
+ * @example Managed shortcut (the SSM-from-bastion common case)
+ * ```ts
+ * createInterfaceEndpointBuilder()
+ *   .vpc(ref<VpcBuilderResult>("network").get("vpc"))
+ *   .service(InterfaceVpcEndpointAwsService.SSM)
+ *   .subnets({ subnetType: SubnetType.PRIVATE_ISOLATED })
+ *   .allowDefaultPortFrom(ref<SecurityGroupBuilderResult>("bastionSg").get("securityGroup"));
+ * // result = { endpoint, securityGroup }
+ * ```
+ */
+export type IInterfaceEndpointBuilder = ITaggedBuilder<InterfaceEndpointBuilderProps, InterfaceEndpointBuilder>;
+declare class InterfaceEndpointBuilder implements Lifecycle<InterfaceEndpointBuilderResult> {
+    #private;
+    props: Partial<InterfaceEndpointBuilderProps>;
+    /**
+     * Sets the VPC the endpoint is created in. Accepts a concrete {@link IVpc}
+     * or a {@link Ref} to a sibling {@link IVpcBuilder}.
+     */
+    vpc(vpc: Resolvable<IVpc>): this;
+    /**
+     * Bring-your-own security groups. Each entry is a {@link Resolvable}, so it
+     * can be a concrete {@link ISecurityGroup} or a {@link Ref} to a sibling
+     * `SecurityGroupBuilder` — giving you full ingress/egress/port control. When
+     * set, the builder creates no security group of its own and
+     * {@link InterfaceEndpointBuilderResult.securityGroup} is `undefined`.
+     *
+     * Mutually exclusive with {@link allowDefaultPortFrom}.
+     */
+    securityGroups(securityGroups: Resolvable<ISecurityGroup>[]): this;
+    /**
+     * Managed-SG shortcut: wires `peer` to the auto-created security group via
+     * CDK's `endpoint.connections.allowDefaultPortFrom(peer)` — opening ingress
+     * on the managed SG from `peer`'s SG **and** egress from `peer`'s SG to the
+     * managed SG, on the service's default port (443 for AWS services).
+     *
+     * Because this delegates to CDK connections, `peer` must be an
+     * {@link IConnectable} (e.g. a `SecurityGroup` or `Instance`), not a raw
+     * `IPeer` (e.g. `Peer.ipv4(...)`). For CIDR-based rules use BYO mode with
+     * an explicit `addIngressRule` on your own {@link SecurityGroupBuilder}.
+     *
+     * Mutually exclusive with {@link securityGroups}.
+     */
+    allowDefaultPortFrom(peer: Resolvable<IConnectable>, description?: string): this;
+    /**
+     * Adds a custom CloudWatch alarm alongside the recommended ones. The
+     * callback receives an {@link AlarmDefinitionBuilder} typed to the
+     * `InterfaceVpcEndpoint` construct, giving access to the endpoint at
+     * build time for metric dimension wiring.
+     */
+    addAlarm(key: string, configure: (alarm: AlarmDefinitionBuilder<InterfaceVpcEndpoint>) => AlarmDefinitionBuilder<InterfaceVpcEndpoint>): this;
+    /** @internal — see ADR-0005. */
+    [COPY_STATE](target: InterfaceEndpointBuilder): void;
+    build(scope: IConstruct, id: string, context?: Record<string, object>): InterfaceEndpointBuilderResult;
+}
+/**
+ * Creates a new {@link IInterfaceEndpointBuilder} for a single VPC interface
+ * endpoint. The returned builder exposes every
+ * {@link InterfaceEndpointBuilderProps} property as a fluent setter/getter,
+ * plus `.vpc()`, `.securityGroups()` (BYO), and `.allowDefaultPortFrom()`
+ * (managed-SG shortcut).
+ */
+export declare function createInterfaceEndpointBuilder(): IInterfaceEndpointBuilder;
+export {};
+//# sourceMappingURL=interface-endpoint-builder.d.ts.map

package/dist/esm/interface-endpoint-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface-endpoint-builder.d.ts","sourceRoot":"","sources":["../../src/interface-endpoint-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EACL,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,yBAAyB,EAC9B,KAAK,cAAc,EACnB,KAAK,IAAI,EACT,KAAK,aAAa,EACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAGlE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,sCAAsC,CAAC;AAGzF;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,6BAA8B,SAAQ,IAAI,CACzD,yBAAyB,EACzB,KAAK,GAAG,gBAAgB,GAAG,MAAM,CAClC;IACC;;;;;;;;OAQG;IACH,iBAAiB,CAAC,EAAE,4BAA4B,GAAG,KAAK,CAAC;CAC1D;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAOD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,MAAM,yBAAyB,GAAG,cAAc,CACpD,6BAA6B,EAC7B,wBAAwB,CACzB,CAAC;AAEF,cAAM,wBAAyB,YAAW,SAAS,CAAC,8BAA8B,CAAC;;IACjF,KAAK,EAAE,OAAO,CAAC,6BAA6B,CAAC,CAAM;IAMnD;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI;IAKhC;;;;;;;;OAQG;IACH,cAAc,CAAC,cAAc,EAAE,UAAU,CAAC,cAAc,CAAC,EAAE,GAAG,IAAI;IAKlE;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI;IAKhF;;;;;OAKG;IACH,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CACT,KAAK,EAAE,sBAAsB,CAAC,oBAAoB,CAAC,KAChD,sBAAsB,CAAC,oBAAoB,CAAC,GAChD,IAAI;IAKP,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI;IAOpD,KAAK,CACH,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,8BAA8B;CA6DlC;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,IAAI,yBAAyB,CAI1E"}