alchemy-effect 0.5.0 → 0.6.2

package/src/AWS/EC2/VpcEndpoint.ts

@@ -0,0 +1,657 @@
+import type * as EC2 from "@distilled.cloud/aws/ec2";
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+import * as Schedule from "effect/Schedule";
+
+import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
+import { isResolved } from "../../Diff.ts";
+import { Resource } from "../../Resource.ts";
+import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
+import type { AccountID } from "../Account.ts";
+import { Account } from "../Account.ts";
+import type { RegionID } from "../Region.ts";
+import type { RouteTableId } from "./RouteTable.ts";
+import type { SecurityGroupId } from "./SecurityGroup.ts";
+import type { SubnetId } from "./Subnet.ts";
+import type { VpcId } from "./Vpc.ts";
+
+export type VpcEndpointId<ID extends string = string> = `vpce-${ID}`;
+export const VpcEndpointId = <ID extends string>(
+  id: ID,
+): ID & VpcEndpointId<ID> => `vpce-${id}` as ID & VpcEndpointId<ID>;
+
+export type VpcEndpointArn =
+  `arn:aws:ec2:${RegionID}:${AccountID}:vpc-endpoint/${VpcEndpointId}`;
+
+export interface VpcEndpointProps {
+  /**
+   * The VPC to create the endpoint in.
+   */
+  vpcId: VpcId;
+
+  /**
+   * The service name.
+   * For AWS services, use the format: com.amazonaws.<region>.<service>
+   * @example "com.amazonaws.us-east-1.s3"
+   */
+  serviceName: string;
+
+  /**
+   * The type of endpoint.
+   * - Gateway: For S3 and DynamoDB (route table based)
+   * - Interface: For most other AWS services (ENI based)
+   * - GatewayLoadBalancer: For Gateway Load Balancer endpoints
+   * @default "Gateway"
+   */
+  vpcEndpointType?: EC2.VpcEndpointType;
+
+  /**
+   * The IDs of route tables for a Gateway endpoint.
+   * Required for Gateway endpoints.
+   */
+  routeTableIds?: RouteTableId[];
+
+  /**
+   * The IDs of subnets for an Interface endpoint.
+   * Required for Interface endpoints.
+   */
+  subnetIds?: SubnetId[];
+
+  /**
+   * The IDs of security groups for an Interface endpoint.
+   * Required for Interface endpoints.
+   */
+  securityGroupIds?: SecurityGroupId[];
+
+  /**
+   * Whether to associate a private hosted zone with the VPC.
+   * Only applicable for Interface endpoints.
+   * @default true
+   */
+  privateDnsEnabled?: boolean;
+
+  /**
+   * A policy to attach to the endpoint that controls access to the service.
+   * The policy document must be in JSON format.
+   */
+  policyDocument?: string;
+
+  /**
+   * The IP address type for the endpoint.
+   */
+  ipAddressType?: EC2.IpAddressType;
+
+  /**
+   * The DNS options for the endpoint.
+   */
+  dnsOptions?: {
+    dnsRecordIpType?: EC2.DnsRecordIpType;
+    privateDnsOnlyForInboundResolverEndpoint?: boolean;
+  };
+
+  /**
+   * Tags to assign to the VPC endpoint.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface VpcEndpoint extends Resource<
+  "AWS.EC2.VpcEndpoint",
+  VpcEndpointProps,
+  {
+    /**
+     * The ID of the VPC endpoint.
+     */
+    vpcEndpointId: VpcEndpointId;
+
+    /**
+     * The Amazon Resource Name (ARN) of the VPC endpoint.
+     */
+    vpcEndpointArn: VpcEndpointArn;
+
+    /**
+     * The type of endpoint.
+     */
+    vpcEndpointType: EC2.VpcEndpointType;
+
+    /**
+     * The ID of the VPC.
+     */
+    vpcId: VpcId;
+
+    /**
+     * The service name.
+     */
+    serviceName: string;
+
+    /**
+     * The current state of the VPC endpoint.
+     */
+    state: EC2.State;
+
+    /**
+     * The policy document associated with the endpoint.
+     */
+    policyDocument?: string;
+
+    /**
+     * The IDs of the route tables associated with the endpoint.
+     */
+    routeTableIds?: string[];
+
+    /**
+     * The IDs of the subnets associated with the endpoint.
+     */
+    subnetIds?: string[];
+
+    /**
+     * Information about the security groups associated with the network interfaces.
+     */
+    groups?: Array<{
+      groupId: string;
+      groupName: string;
+    }>;
+
+    /**
+     * Whether private DNS is enabled.
+     */
+    privateDnsEnabled?: boolean;
+
+    /**
+     * Whether the VPC endpoint is being managed by its service.
+     */
+    requesterManaged?: boolean;
+
+    /**
+     * The IDs of the network interfaces for the endpoint.
+     */
+    networkInterfaceIds?: string[];
+
+    /**
+     * The DNS entries for the endpoint.
+     */
+    dnsEntries?: Array<{
+      dnsName?: string;
+      hostedZoneId?: string;
+    }>;
+
+    /**
+     * The date and time the VPC endpoint was created.
+     */
+    creationTimestamp?: string;
+
+    /**
+     * The ID of the AWS account that owns the VPC endpoint.
+     */
+    ownerId?: string;
+
+    /**
+     * The IP address type for the endpoint.
+     */
+    ipAddressType?: EC2.IpAddressType;
+
+    /**
+     * The DNS options for the endpoint.
+     */
+    dnsOptions?: {
+      dnsRecordIpType?: EC2.DnsRecordIpType;
+      privateDnsOnlyForInboundResolverEndpoint?: boolean;
+    };
+
+    /**
+     * The last error that occurred for VPC endpoint.
+     */
+    lastError?: {
+      code?: string;
+      message?: string;
+    };
+  }
+> {}
+export const VpcEndpoint = Resource<VpcEndpoint>("AWS.EC2.VpcEndpoint");
+
+export const VpcEndpointProvider = () =>
+  VpcEndpoint.provider.effect(
+    Effect.gen(function* () {
+      const region = yield* Region;
+      const accountId = yield* Account;
+
+      const createTags = Effect.fn(function* (
+        id: string,
+        tags?: Record<string, string>,
+      ) {
+        return {
+          Name: id,
+          ...(yield* createInternalTags(id)),
+          ...tags,
+        };
+      });
+
+      const describeVpcEndpoint = (vpcEndpointId: string) =>
+        ec2.describeVpcEndpoints({ VpcEndpointIds: [vpcEndpointId] }).pipe(
+          Effect.map((r) => r.VpcEndpoints?.[0]),
+          Effect.flatMap((ep) =>
+            ep
+              ? Effect.succeed(ep)
+              : Effect.fail(
+                  new Error(`VPC Endpoint ${vpcEndpointId} not found`),
+                ),
+          ),
+        );
+
+      const toAttrs = (ep: ec2.VpcEndpoint): VpcEndpoint["Attributes"] => ({
+        vpcEndpointId: ep.VpcEndpointId as VpcEndpointId,
+        vpcEndpointArn:
+          `arn:aws:ec2:${region}:${accountId}:vpc-endpoint/${ep.VpcEndpointId}` as VpcEndpointArn,
+        vpcEndpointType: ep.VpcEndpointType!,
+        vpcId: ep.VpcId as VpcId,
+        serviceName: ep.ServiceName!,
+        state: ep.State!,
+        policyDocument: ep.PolicyDocument,
+        routeTableIds: ep.RouteTableIds,
+        subnetIds: ep.SubnetIds,
+        groups: ep.Groups?.map((g) => ({
+          groupId: g.GroupId!,
+          groupName: g.GroupName!,
+        })),
+        privateDnsEnabled: ep.PrivateDnsEnabled,
+        requesterManaged: ep.RequesterManaged,
+        networkInterfaceIds: ep.NetworkInterfaceIds,
+        dnsEntries: ep.DnsEntries?.map((d) => ({
+          dnsName: d.DnsName,
+          hostedZoneId: d.HostedZoneId,
+        })),
+        creationTimestamp:
+          ep.CreationTimestamp instanceof Date
+            ? ep.CreationTimestamp.toISOString()
+            : (ep.CreationTimestamp as string | undefined),
+        ownerId: ep.OwnerId,
+        ipAddressType: ep.IpAddressType,
+        dnsOptions: ep.DnsOptions
+          ? {
+              dnsRecordIpType: ep.DnsOptions.DnsRecordIpType,
+              privateDnsOnlyForInboundResolverEndpoint:
+                ep.DnsOptions.PrivateDnsOnlyForInboundResolverEndpoint,
+            }
+          : undefined,
+        lastError: ep.LastError
+          ? {
+              code: ep.LastError.Code,
+              message: ep.LastError.Message,
+            }
+          : undefined,
+      });
+
+      return {
+        stables: ["vpcEndpointId", "vpcEndpointArn", "ownerId"],
+
+        read: Effect.fn(function* ({ output }) {
+          if (!output) return undefined;
+          const ep = yield* describeVpcEndpoint(output.vpcEndpointId);
+          return toAttrs(ep);
+        }),
+
+        diff: Effect.fn(function* ({ news, olds }) {
+          if (!isResolved(news)) return;
+          // Core properties require replacement
+          if (
+            news.vpcId !== olds.vpcId ||
+            news.serviceName !== olds.serviceName ||
+            news.vpcEndpointType !== olds.vpcEndpointType
+          ) {
+            return { action: "replace" };
+          }
+          // Other properties can be updated in-place
+        }),
+
+        create: Effect.fn(function* ({ id, news, session }) {
+          yield* session.note(
+            `Creating VPC Endpoint for ${news.serviceName}...`,
+          );
+
+          const result = yield* ec2.createVpcEndpoint({
+            VpcId: news.vpcId as string,
+            ServiceName: news.serviceName,
+            VpcEndpointType: news.vpcEndpointType ?? "Gateway",
+            RouteTableIds: news.routeTableIds as string[] | undefined,
+            SubnetIds: news.subnetIds as string[] | undefined,
+            SecurityGroupIds: news.securityGroupIds as string[] | undefined,
+            PrivateDnsEnabled: news.privateDnsEnabled,
+            PolicyDocument: news.policyDocument,
+            IpAddressType: news.ipAddressType,
+            DnsOptions: news.dnsOptions
+              ? {
+                  DnsRecordIpType: news.dnsOptions.dnsRecordIpType,
+                  PrivateDnsOnlyForInboundResolverEndpoint:
+                    news.dnsOptions.privateDnsOnlyForInboundResolverEndpoint,
+                }
+              : undefined,
+            TagSpecifications: [
+              {
+                ResourceType: "vpc-endpoint",
+                Tags: createTagsList(yield* createTags(id, news.tags)),
+              },
+            ],
+            DryRun: false,
+          });
+
+          const vpcEndpointId = result.VpcEndpoint!.VpcEndpointId!;
+          yield* session.note(`VPC Endpoint created: ${vpcEndpointId}`);
+
+          // Wait for endpoint to be available (for Interface endpoints)
+          if (
+            news.vpcEndpointType === "Interface" ||
+            news.vpcEndpointType === "GatewayLoadBalancer"
+          ) {
+            yield* waitForVpcEndpointAvailable(vpcEndpointId, session);
+          }
+
+          const ep = yield* describeVpcEndpoint(vpcEndpointId);
+          return toAttrs(ep);
+        }),
+
+        update: Effect.fn(function* ({ id, news, olds, output, session }) {
+          const vpcEndpointId = output.vpcEndpointId;
+
+          // Modify endpoint if needed
+          const modifications: Parameters<typeof ec2.modifyVpcEndpoint>[0] = {
+            VpcEndpointId: vpcEndpointId,
+            DryRun: false,
+          };
+
+          let hasModifications = false;
+
+          // Handle route table changes (for Gateway endpoints)
+          if (news.vpcEndpointType === "Gateway" || !news.vpcEndpointType) {
+            const oldRouteTableIds = new Set(olds.routeTableIds ?? []);
+            const newRouteTableIds = new Set(news.routeTableIds ?? []);
+
+            const addRouteTableIds = [...newRouteTableIds].filter(
+              (id) => !oldRouteTableIds.has(id),
+            );
+            const removeRouteTableIds = [...oldRouteTableIds].filter(
+              (id) => !newRouteTableIds.has(id),
+            );
+
+            if (addRouteTableIds.length > 0) {
+              modifications.AddRouteTableIds = addRouteTableIds as string[];
+              hasModifications = true;
+            }
+            if (removeRouteTableIds.length > 0) {
+              modifications.RemoveRouteTableIds =
+                removeRouteTableIds as string[];
+              hasModifications = true;
+            }
+          }
+
+          // Handle subnet changes (for Interface endpoints)
+          if (
+            news.vpcEndpointType === "Interface" ||
+            news.vpcEndpointType === "GatewayLoadBalancer"
+          ) {
+            const oldSubnetIds = new Set(olds.subnetIds ?? []);
+            const newSubnetIds = new Set(news.subnetIds ?? []);
+
+            const addSubnetIds = [...newSubnetIds].filter(
+              (id) => !oldSubnetIds.has(id),
+            );
+            const removeSubnetIds = [...oldSubnetIds].filter(
+              (id) => !newSubnetIds.has(id),
+            );
+
+            if (addSubnetIds.length > 0) {
+              modifications.AddSubnetIds = addSubnetIds as string[];
+              hasModifications = true;
+            }
+            if (removeSubnetIds.length > 0) {
+              modifications.RemoveSubnetIds = removeSubnetIds as string[];
+              hasModifications = true;
+            }
+
+            // Handle security group changes
+            const oldSecurityGroupIds = new Set(olds.securityGroupIds ?? []);
+            const newSecurityGroupIds = new Set(news.securityGroupIds ?? []);
+
+            const addSecurityGroupIds = [...newSecurityGroupIds].filter(
+              (id) => !oldSecurityGroupIds.has(id),
+            );
+            const removeSecurityGroupIds = [...oldSecurityGroupIds].filter(
+              (id) => !newSecurityGroupIds.has(id),
+            );
+
+            if (addSecurityGroupIds.length > 0) {
+              modifications.AddSecurityGroupIds =
+                addSecurityGroupIds as string[];
+              hasModifications = true;
+            }
+            if (removeSecurityGroupIds.length > 0) {
+              modifications.RemoveSecurityGroupIds =
+                removeSecurityGroupIds as string[];
+              hasModifications = true;
+            }
+
+            // Handle private DNS change
+            if (news.privateDnsEnabled !== olds.privateDnsEnabled) {
+              modifications.PrivateDnsEnabled = news.privateDnsEnabled;
+              hasModifications = true;
+            }
+          }
+
+          // Handle policy document change
+          if (news.policyDocument !== olds.policyDocument) {
+            modifications.PolicyDocument = news.policyDocument ?? "";
+            modifications.ResetPolicy = !news.policyDocument;
+            hasModifications = true;
+          }
+
+          // Handle IP address type change
+          if (news.ipAddressType !== olds.ipAddressType) {
+            modifications.IpAddressType = news.ipAddressType;
+            hasModifications = true;
+          }
+
+          // Handle DNS options change
+          if (
+            news.dnsOptions?.dnsRecordIpType !==
+              olds.dnsOptions?.dnsRecordIpType ||
+            news.dnsOptions?.privateDnsOnlyForInboundResolverEndpoint !==
+              olds.dnsOptions?.privateDnsOnlyForInboundResolverEndpoint
+          ) {
+            modifications.DnsOptions = news.dnsOptions
+              ? {
+                  DnsRecordIpType: news.dnsOptions.dnsRecordIpType,
+                  PrivateDnsOnlyForInboundResolverEndpoint:
+                    news.dnsOptions.privateDnsOnlyForInboundResolverEndpoint,
+                }
+              : undefined;
+            hasModifications = true;
+          }
+
+          if (hasModifications) {
+            yield* ec2.modifyVpcEndpoint(modifications);
+            yield* session.note("Updated VPC Endpoint configuration");
+          }
+
+          // Handle tag updates
+          const newTags = yield* createTags(id, news.tags);
+          const oldTags =
+            (yield* ec2
+              .describeTags({
+                Filters: [
+                  { Name: "resource-id", Values: [vpcEndpointId] },
+                  { Name: "resource-type", Values: ["vpc-endpoint"] },
+                ],
+              })
+              .pipe(
+                Effect.map(
+                  (r) =>
+                    Object.fromEntries(
+                      r.Tags?.map((t) => [t.Key!, t.Value!]) ?? [],
+                    ) as Record<string, string>,
+                ),
+              )) ?? {};
+
+          const { removed, upsert } = diffTags(oldTags, newTags);
+
+          if (removed.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [vpcEndpointId],
+              Tags: removed.map((key) => ({ Key: key })),
+              DryRun: false,
+            });
+          }
+          if (upsert.length > 0) {
+            yield* ec2.createTags({
+              Resources: [vpcEndpointId],
+              Tags: upsert,
+              DryRun: false,
+            });
+            yield* session.note("Updated tags");
+          }
+
+          // Wait for endpoint to be available if we made modifications
+          if (
+            hasModifications &&
+            (news.vpcEndpointType === "Interface" ||
+              news.vpcEndpointType === "GatewayLoadBalancer")
+          ) {
+            yield* waitForVpcEndpointAvailable(vpcEndpointId, session);
+          }
+
+          const ep = yield* describeVpcEndpoint(vpcEndpointId);
+          return toAttrs(ep);
+        }),
+
+        delete: Effect.fn(function* ({ output, session }) {
+          const vpcEndpointId = output.vpcEndpointId;
+
+          yield* session.note(`Deleting VPC Endpoint: ${vpcEndpointId}`);
+
+          yield* ec2
+            .deleteVpcEndpoints({
+              VpcEndpointIds: [vpcEndpointId],
+              DryRun: false,
+            })
+            .pipe(
+              Effect.catchTag(
+                "InvalidVpcEndpointId.NotFound",
+                () => Effect.void,
+              ),
+            );
+
+          // Wait for deletion
+          yield* waitForVpcEndpointDeleted(vpcEndpointId, session);
+
+          yield* session.note(`VPC Endpoint ${vpcEndpointId} deleted`);
+        }),
+      };
+    }),
+  );
+
+// Retryable error: VPC Endpoint is still pending
+class VpcEndpointPending extends Data.TaggedError("VpcEndpointPending")<{
+  vpcEndpointId: string;
+  state: string;
+}> {}
+
+// Terminal error: VPC Endpoint creation failed
+class VpcEndpointFailed extends Data.TaggedError("VpcEndpointFailed")<{
+  vpcEndpointId: string;
+  errorCode?: string;
+  errorMessage?: string;
+}> {}
+
+// Terminal error: VPC Endpoint not found
+class VpcEndpointNotFound extends Data.TaggedError("VpcEndpointNotFound")<{
+  vpcEndpointId: string;
+}> {}
+
+// Retryable error: VPC Endpoint is still deleting
+class VpcEndpointDeleting extends Data.TaggedError("VpcEndpointDeleting")<{
+  vpcEndpointId: string;
+  state: string;
+}> {}
+
+/**
+ * Wait for VPC Endpoint to be in available state
+ */
+const waitForVpcEndpointAvailable = (
+  vpcEndpointId: string,
+  session: ScopedPlanStatusSession,
+) =>
+  Effect.gen(function* () {
+    const result = yield* ec2.describeVpcEndpoints({
+      VpcEndpointIds: [vpcEndpointId],
+    });
+    const ep = result.VpcEndpoints?.[0];
+
+    if (!ep) {
+      return yield* new VpcEndpointNotFound({ vpcEndpointId });
+    }
+
+    if (ep.State === "Available") {
+      return ep;
+    }
+
+    if (ep.State === "Failed" || ep.State === "Rejected") {
+      return yield* new VpcEndpointFailed({
+        vpcEndpointId,
+        errorCode: ep.LastError?.Code,
+        errorMessage: ep.LastError?.Message,
+      });
+    }
+
+    // Still pending - this is the only retryable case
+    return yield* new VpcEndpointPending({ vpcEndpointId, state: ep.State! });
+  }).pipe(
+    Effect.retry({
+      while: (e) => e._tag === "VpcEndpointPending",
+      schedule: Schedule.fixed(3000).pipe(
+        Schedule.both(Schedule.recurs(60)), // Max 3 minutes
+        Schedule.tapOutput(([, attempt]) =>
+          session.note(
+            `Waiting for VPC Endpoint to be available... (${(attempt + 1) * 3}s)`,
+          ),
+        ),
+      ),
+    }),
+  );
+
+/**
+ * Wait for VPC Endpoint to be deleted
+ */
+const waitForVpcEndpointDeleted = (
+  vpcEndpointId: string,
+  session: ScopedPlanStatusSession,
+) =>
+  Effect.gen(function* () {
+    const result = yield* ec2
+      .describeVpcEndpoints({ VpcEndpointIds: [vpcEndpointId] })
+      .pipe(
+        Effect.catchTag("InvalidVpcEndpointId.NotFound", () =>
+          Effect.succeed({ VpcEndpoints: [] }),
+        ),
+      );
+
+    const ep = result.VpcEndpoints?.[0];
+
+    if (!ep || ep.State === "Deleted") {
+      return; // Successfully deleted
+    }
+
+    // Still deleting - this is the only retryable case
+    return yield* new VpcEndpointDeleting({ vpcEndpointId, state: ep.State! });
+  }).pipe(
+    Effect.retry({
+      while: (e) => e._tag === "VpcEndpointDeleting",
+      schedule: Schedule.fixed(3000).pipe(
+        Schedule.both(Schedule.recurs(60)), // Max 3 minutes
+        Schedule.tapOutput(([, attempt]) =>
+          session.note(
+            `Waiting for VPC Endpoint deletion... (${(attempt + 1) * 3}s)`,
+          ),
+        ),
+      ),
+    }),
+  );