alchemy 0.60.2 → 0.62.0

package/src/aws/ec2/internet-gateway.ts

@@ -9,12 +9,13 @@ import {
   type TimeoutConfig,
   waitForResourceState,
 } from "../../util/timeout.ts";
+import type { AwsClientProps } from "../client-props.ts";
 import { callEC2Api, createEC2Client } from "./utils.ts";
 
 /**
  * Properties for creating or updating an Internet Gateway
  */
-export interface InternetGatewayProps {
+export interface InternetGatewayProps extends AwsClientProps {
   /**
    * Tags to apply to the Internet Gateway
    */
@@ -145,12 +146,15 @@ async function waitForInternetGatewayDeleted(
  * 1. Provide a target in your VPC route tables for internet-routable traffic
  * 2. Perform network address translation (NAT) for instances with public IPv4 addresses
  *
+ * Supports AWS credential overrides at the resource level, allowing you to deploy Internet Gateways
+ * to different AWS accounts or regions than the default scope configuration.
+ *
  * @example
  * ```typescript
  * // Create a basic Internet Gateway
- * const igw = new InternetGateway({
+ * const igw = await InternetGateway("main-igw", {
  *   tags: {
- *     Name: "my-internet-gateway",
+ *     Name: "main-internet-gateway",
  *     Environment: "production"
  *   }
  * });
@@ -158,59 +162,49 @@ async function waitForInternetGatewayDeleted(
  *
  * @example
  * ```typescript
- * // Create Internet Gateway with custom timeout configuration
- * const igw = new InternetGateway({
- *   tags: { Name: "custom-igw" },
- *   timeoutConfig: {
- *     maxAttempts: 30,
- *     delayMs: 1000
+ * // Create Internet Gateway with AWS credential overrides
+ * const crossAccountIgw = await InternetGateway("cross-account-igw", {
+ *   // Override AWS credentials for this specific resource
+ *   region: "us-east-1",
+ *   profile: "production-account",
+ *   tags: {
+ *     Name: "cross-account-internet-gateway",
+ *     Environment: "production"
  *   }
  * });
  * ```
  *
  * @example
  * ```typescript
- * // Create Internet Gateway and attach to VPC
- * const vpc = new VPC({ cidrBlock: "10.0.0.0/16" });
- * const igw = new InternetGateway({ tags: { Name: "vpc-igw" } });
- * const attachment = new InternetGatewayAttachment({
- *   internetGatewayId: igw.internetGatewayId,
- *   vpcId: vpc.vpcId
- * });
- * ```
- *
- * @example
- * ```typescript
- * // Access Internet Gateway properties
- * const igw = new InternetGateway({ tags: { Name: "example-igw" } });
- * logger.log(`Internet Gateway ID: ${igw.internetGatewayId}`);
- * logger.log(`State: ${igw.state}`);
- * ```
- *
- * Creates and manages Internet Gateways that provide internet access to VPCs.
- * Note: Use InternetGatewayAttachment to attach the gateway to a VPC.
- *
- * @example
- * // Create a basic Internet Gateway
- * const igw = await InternetGateway("main-igw", {
+ * // Create Internet Gateway in different region with role assumption
+ * const multiRegionIgw = await InternetGateway("multi-region-igw", {
+ *   region: "eu-west-1",
+ *   roleArn: "arn:aws:iam::123456789012:role/CrossRegionRole",
+ *   roleSessionName: "internet-gateway-deployment",
  *   tags: {
- *     Name: "main-internet-gateway",
- *     Environment: "production"
+ *     Name: "eu-internet-gateway",
+ *     Region: "europe"
  *   }
  * });
+ * ```
  *
  * @example
- * // Create an Internet Gateway for development environment
- * const devIgw = await InternetGateway("dev-igw", {
+ * ```typescript
+ * // Create Internet Gateway with explicit credentials
+ * const explicitCredsIgw = await InternetGateway("explicit-creds-igw", {
+ *   accessKeyId: alchemy.secret("AKIAIOSFODNN7EXAMPLE"),
+ *   secretAccessKey: alchemy.secret("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"),
+ *   region: "us-west-2",
  *   tags: {
- *     Name: "dev-internet-gateway",
- *     Environment: "development",
- *     Team: "backend"
+ *     Name: "explicit-credentials-igw",
+ *     Purpose: "testing"
  *   }
  * });
+ * ```
  *
  * @example
- * // Create an Internet Gateway with custom timeout configuration
+ * ```typescript
+ * // Create Internet Gateway with custom timeout configuration
  * const customIgw = await InternetGateway("custom-igw", {
  *   timeout: {
  *     maxAttempts: 90,
@@ -221,6 +215,40 @@ async function waitForInternetGatewayDeleted(
  *     Purpose: "high-availability"
  *   }
  * });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Create Internet Gateway and attach to VPC
+ * const vpc = await VPC("main-vpc", { cidrBlock: "10.0.0.0/16" });
+ * const igw = await InternetGateway("vpc-igw", {
+ *   tags: { Name: "vpc-internet-gateway" }
+ * });
+ * const attachment = await InternetGatewayAttachment("igw-attachment", {
+ *   internetGatewayId: igw.internetGatewayId,
+ *   vpcId: vpc.vpcId
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Multi-account deployment with scope-level and resource-level overrides
+ * await alchemy.run("production", {
+ *   aws: { region: "us-west-2", profile: "main-account" }
+ * }, async () => {
+ *   // This IGW uses scope credentials (main-account, us-west-2)
+ *   const mainIgw = await InternetGateway("main-igw", {
+ *     tags: { Name: "main-account-igw" }
+ *   });
+ *
+ *   // This IGW overrides to use different account
+ *   const crossAccountIgw = await InternetGateway("cross-account-igw", {
+ *     profile: "secondary-account",
+ *     region: "us-east-1", // Also override region
+ *     tags: { Name: "secondary-account-igw" }
+ *   });
+ * });
+ * ```
  */
 export const InternetGateway = Resource(
   "aws::InternetGateway",
@@ -229,7 +257,8 @@ export const InternetGateway = Resource(
     _id: string,
     props: InternetGatewayProps,
   ): Promise<InternetGateway> {
-    const client = await createEC2Client();
+    // Create EC2 client with credential resolution handled internally
+    const client = await createEC2Client(props);
     const timeoutConfig = mergeTimeoutConfig(
       INTERNET_GATEWAY_TIMEOUT,
       props.timeout,

package/src/aws/ec2/nat-gateway.ts

@@ -8,13 +8,14 @@ import {
   type TimeoutConfig,
   waitForResourceState,
 } from "../../util/timeout.ts";
+import type { AwsClientProps } from "../client-props.ts";
 import type { Subnet } from "./subnet.ts";
 import { callEC2Api, createEC2Client } from "./utils.ts";
 
 /**
  * Properties for creating or updating a NAT Gateway
  */
-export interface NatGatewayProps {
+export interface NatGatewayProps extends AwsClientProps {
   /**
    * The subnet to create the NAT Gateway in (must be a public subnet)
    */
@@ -99,39 +100,94 @@ export interface NatGateway
  * if one is not provided. NAT Gateways are slow resources that can take
  * up to 10 minutes to become available.
  *
+ * Supports AWS credential overrides at the resource level, allowing you to deploy NAT Gateways
+ * to different AWS accounts or regions than the default scope configuration.
+ *
  * @example
+ * ```typescript
  * // Create a NAT Gateway with automatic Elastic IP allocation
  * const natGateway = await NatGateway("main-nat", {
- * subnet: publicSubnet,
- * tags: {
- * Name: "main-nat-gateway",
- * Environment: "production"
- * }
+ *   subnet: publicSubnet,
+ *   tags: {
+ *     Name: "main-nat-gateway",
+ *     Environment: "production"
+ *   }
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Create NAT Gateway with AWS credential overrides
+ * const crossAccountNat = await NatGateway("cross-account-nat", {
+ *   subnet: publicSubnet,
+ *   // Override AWS credentials for this specific resource
+ *   region: "us-east-1",
+ *   profile: "production-account",
+ *   tags: {
+ *     Name: "cross-account-nat-gateway",
+ *     Environment: "production"
+ *   }
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Create NAT Gateway in different region with role assumption
+ * const multiRegionNat = await NatGateway("multi-region-nat", {
+ *   subnet: euPublicSubnet,
+ *   region: "eu-west-1",
+ *   roleArn: "arn:aws:iam::123456789012:role/CrossRegionRole",
+ *   roleSessionName: "nat-gateway-deployment",
+ *   tags: {
+ *     Name: "eu-nat-gateway",
+ *     Region: "europe"
+ *   }
  * });
+ * ```
  *
  * @example
+ * ```typescript
+ * // Create NAT Gateway with explicit credentials
+ * const explicitCredsNat = await NatGateway("explicit-creds-nat", {
+ *   subnet: testPublicSubnet,
+ *   accessKeyId: alchemy.secret("AKIAIOSFODNN7EXAMPLE"),
+ *   secretAccessKey: alchemy.secret("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"),
+ *   region: "us-west-2",
+ *   tags: {
+ *     Name: "explicit-credentials-nat",
+ *     Purpose: "testing"
+ *   }
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
  * // Create a NAT Gateway with existing Elastic IP
  * const natGateway = await NatGateway("custom-nat", {
- * subnet: "subnet-12345678",
- * allocationId: "eipalloc-12345678",
- * connectivityType: "public",
- * tags: {
- * Name: "custom-nat-gateway"
- * }
+ *   subnet: "subnet-12345678",
+ *   allocationId: "eipalloc-12345678",
+ *   connectivityType: "public",
+ *   tags: {
+ *     Name: "custom-nat-gateway"
+ *   }
  * });
+ * ```
  *
  * @example
+ * ```typescript
  * // Create a private NAT Gateway (for VPC-to-VPC communication)
  * const privateNat = await NatGateway("private-nat", {
- * subnet: privateSubnet,
- * connectivityType: "private",
- * tags: {
- * Name: "private-nat-gateway",
- * Type: "internal"
- * }
+ *   subnet: privateSubnet,
+ *   connectivityType: "private",
+ *   tags: {
+ *     Name: "private-nat-gateway",
+ *     Type: "internal"
+ *   }
  * });
+ * ```
  *
  * @example
+ * ```typescript
  * // Create a NAT Gateway with custom timeout configuration
  * const slowNat = await NatGateway("slow-nat", {
  *   subnet: publicSubnet,
@@ -143,8 +199,32 @@ export interface NatGateway
  *     Name: "slow-nat-gateway"
  *   }
  * });
+ * ```
  *
  * @example
+ * ```typescript
+ * // Multi-account deployment with scope-level and resource-level overrides
+ * await alchemy.run("production", {
+ *   aws: { region: "us-west-2", profile: "main-account" }
+ * }, async () => {
+ *   // This NAT Gateway uses scope credentials (main-account, us-west-2)
+ *   const mainNat = await NatGateway("main-nat", {
+ *     subnet: mainPublicSubnet,
+ *     tags: { Name: "main-account-nat" }
+ *   });
+ *
+ *   // This NAT Gateway overrides to use different account
+ *   const crossAccountNat = await NatGateway("cross-account-nat", {
+ *     subnet: crossPublicSubnet,
+ *     profile: "secondary-account",
+ *     region: "us-east-1", // Also override region
+ *     tags: { Name: "secondary-account-nat" }
+ *   });
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
  * // Use NAT Gateway in route table for private subnet internet access
  * const privateRoute = await Route("private-internet", {
  *   routeTable: privateRouteTable,
@@ -154,6 +234,7 @@ export interface NatGateway
  *     Name: "private-to-internet"
  *   }
  * });
+ * ```
  */
 export const NatGateway = Resource(
   "aws::NatGateway",
@@ -162,6 +243,8 @@ export const NatGateway = Resource(
     _id: string,
     props: NatGatewayProps,
   ): Promise<NatGateway> {
+    // Create EC2 client with credential resolution handled internally
+    const client = await createEC2Client(props);
     const subnetId =
       typeof props.subnet === "string" ? props.subnet : props.subnet.subnetId;
     const timeoutConfig = mergeTimeoutConfig(
@@ -174,7 +257,6 @@ export const NatGateway = Resource(
         logger.log(`🗑️ Deleting NAT Gateway: ${this.output.natGatewayId}`);
         // Delete NAT Gateway if it exists
         await ignore("InvalidNatGatewayID.NotFound", async () => {
-          const client = await createEC2Client();
           await callEC2Api(
             client,
             "DeleteNatGateway",
@@ -192,6 +274,7 @@ export const NatGateway = Resource(
         await waitForNatGatewayFullyDeleted(
           this.output.natGatewayId,
           timeoutConfig,
+          props,
         );
 
         logger.log(
@@ -204,9 +287,8 @@ export const NatGateway = Resource(
           await ignore(
             ["InvalidAllocationID.NotFound", "InvalidAddress.NotFound"],
             async () => {
-              const eipClient = await createEC2Client();
               await callEC2Api(
-                eipClient,
+                client,
                 "ReleaseAddress",
                 parseNatGatewayXmlResponse,
                 convertReleaseAddressParamsToAwsFormat({
@@ -216,7 +298,11 @@ export const NatGateway = Resource(
             },
           );
           // Wait for the EIP to be fully released
-          await waitForEipReleased(this.output.allocationId, timeoutConfig);
+          await waitForEipReleased(
+            this.output.allocationId,
+            timeoutConfig,
+            props,
+          );
           logger.log(
             `  ✅ Elastic IP ${this.output.allocationId} released successfully`,
           );
@@ -232,7 +318,6 @@ export const NatGateway = Resource(
 
     if (this.phase === "update" && this.output?.natGatewayId) {
       // Get existing NAT Gateway
-      const client = await createEC2Client();
       const response = await callEC2Api<DescribeNatGatewaysResponse>(
         client,
         "DescribeNatGateways",
@@ -270,7 +355,6 @@ export const NatGateway = Resource(
           ];
         }
 
-        const client = await createEC2Client();
         const eipResponse = await callEC2Api<AllocateAddressResponse>(
           client,
           "AllocateAddress",
@@ -287,7 +371,6 @@ export const NatGateway = Resource(
         createdElasticIp = true;
       } else {
         // Get public IP of existing allocation
-        const client = await createEC2Client();
         const addressResponse = await callEC2Api<DescribeAddressesResponse>(
           client,
           "DescribeAddresses",
@@ -319,9 +402,8 @@ export const NatGateway = Resource(
         ];
       }
 
-      const natClient = await createEC2Client();
       const response = await callEC2Api<CreateNatGatewayResponse>(
-        natClient,
+        client,
         "CreateNatGateway",
         parseNatGatewayXmlResponse,
         convertCreateNatGatewayParamsToAwsFormat(createParams),
@@ -334,7 +416,11 @@ export const NatGateway = Resource(
       natGateway = response.NatGateway;
 
       // Wait for NAT Gateway to be available
-      await waitForNatGatewayAvailable(natGateway.NatGatewayId!, timeoutConfig);
+      await waitForNatGatewayAvailable(
+        natGateway.NatGatewayId!,
+        timeoutConfig,
+        props,
+      );
     }
 
     const result = this({
@@ -359,9 +445,10 @@ export const NatGateway = Resource(
 async function waitForNatGatewayAvailable(
   natGatewayId: string,
   timeoutConfig: TimeoutConfig,
+  credentials?: AwsClientProps,
 ): Promise<void> {
   const checkFunction = async () => {
-    const client = await createEC2Client();
+    const client = await createEC2Client(credentials);
     const response = await callEC2Api<DescribeNatGatewaysResponse>(
       client,
       "DescribeNatGateways",
@@ -398,10 +485,11 @@ async function waitForNatGatewayAvailable(
 async function waitForNatGatewayDeleted(
   natGatewayId: string,
   timeoutConfig: TimeoutConfig,
+  credentials?: AwsClientProps,
 ): Promise<void> {
   const checkFunction = async () => {
     try {
-      const client = await createEC2Client();
+      const client = await createEC2Client(credentials);
       const response = await callEC2Api<DescribeNatGatewaysResponse>(
         client,
         "DescribeNatGateways",
@@ -481,10 +569,11 @@ function parseDescribeNetworkInterfacesResponse(
 async function waitForEipReleased(
   allocationId: string,
   timeoutConfig: TimeoutConfig,
+  credentials?: AwsClientProps,
 ): Promise<void> {
   const checkFunction = async () => {
     try {
-      const eipClient = await createEC2Client();
+      const eipClient = await createEC2Client(credentials);
       const addressResponse = await callEC2Api<DescribeAddressesResponse>(
         eipClient,
         "DescribeAddresses",
@@ -525,14 +614,15 @@ async function waitForEipReleased(
 async function waitForNatGatewayFullyDeleted(
   natGatewayId: string,
   timeoutConfig: TimeoutConfig,
+  credentials?: AwsClientProps,
 ): Promise<void> {
   // First wait for the NAT Gateway itself to be deleted
-  await waitForNatGatewayDeleted(natGatewayId, timeoutConfig);
+  await waitForNatGatewayDeleted(natGatewayId, timeoutConfig, credentials);
 
   // Then wait for network interfaces to be cleaned up
   const checkNetworkInterfaces = async () => {
     try {
-      const client = await createEC2Client();
+      const client = await createEC2Client(credentials);
       const response = await callEC2Api<DescribeNetworkInterfacesResponse>(
         client,
         "DescribeNetworkInterfaces",

package/src/aws/ec2/route-table-association.ts

@@ -236,7 +236,7 @@ async function waitForRouteTableAssociationDeleted(
  *   publicSubnets.map((subnet, index) =>
  *     RouteTableAssociation(`public-association-${index}`, {
  *       routeTable: publicRouteTable,
- *       subnet
+ *       subnet: subnet
  *     })
  *   )
  * );

package/src/aws/ec2/route-table.ts

@@ -9,13 +9,14 @@ import {
   type TimeoutConfig,
   waitForResourceState,
 } from "../../util/timeout.ts";
+import type { AwsClientProps } from "../client-props.ts";
 import { callEC2Api, createEC2Client } from "./utils.ts";
 import type { Vpc } from "./vpc.ts";
 
 /**
  * Properties for creating or updating a Route Table
  */
-export interface RouteTableProps {
+export interface RouteTableProps extends AwsClientProps {
   /**
    * The VPC to create the route table in
    */
@@ -58,6 +59,9 @@ export interface RouteTable
  * traffic is directed. Subnet associations are managed separately using the
  * RouteTableAssociation resource.
  *
+ * Supports AWS credential overrides at the resource level, allowing you to deploy Route Tables
+ * to different AWS accounts or regions than the default scope configuration.
+ *
  * @example
  * // Create a basic route table
  * const routeTable = await RouteTable("main-route-table", {
@@ -80,6 +84,45 @@ export interface RouteTable
  * });
  *
  * @example
+ * // Create Route Table with AWS credential overrides
+ * const crossAccountRouteTable = await RouteTable("cross-account-rt", {
+ *   vpc: mainVpc,
+ *   // Override AWS credentials for this specific resource
+ *   region: "us-east-1",
+ *   profile: "production-account",
+ *   tags: {
+ *     Name: "cross-account-route-table",
+ *     Environment: "production"
+ *   }
+ * });
+ *
+ * @example
+ * // Create Route Table in different region with role assumption
+ * const multiRegionRouteTable = await RouteTable("multi-region-rt", {
+ *   vpc: euVpc,
+ *   region: "eu-west-1",
+ *   roleArn: "arn:aws:iam::123456789012:role/CrossRegionRole",
+ *   roleSessionName: "route-table-deployment",
+ *   tags: {
+ *     Name: "eu-route-table",
+ *     Region: "europe"
+ *   }
+ * });
+ *
+ * @example
+ * // Create Route Table with explicit credentials
+ * const explicitCredsRouteTable = await RouteTable("explicit-creds-rt", {
+ *   vpc: testVpc,
+ *   accessKeyId: alchemy.secret("AKIAIOSFODNN7EXAMPLE"),
+ *   secretAccessKey: alchemy.secret("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"),
+ *   region: "us-west-2",
+ *   tags: {
+ *     Name: "explicit-credentials-rt",
+ *     Purpose: "testing"
+ *   }
+ * });
+ *
+ * @example
  * // Create a private route table for internal traffic
  * const privateRouteTable = await RouteTable("private-routes", {
  *   vpc: myVpc,
@@ -102,6 +145,26 @@ export interface RouteTable
  *     Name: "custom-timeout-route-table"
  *   }
  * });
+ *
+ * @example
+ * // Multi-account deployment with scope-level and resource-level overrides
+ * await alchemy.run("production", {
+ *   aws: { region: "us-west-2", profile: "main-account" }
+ * }, async () => {
+ *   // This Route Table uses scope credentials (main-account, us-west-2)
+ *   const mainRouteTable = await RouteTable("main-rt", {
+ *     vpc: mainVpc,
+ *     tags: { Name: "main-account-rt" }
+ *   });
+ *
+ *   // This Route Table overrides to use different account
+ *   const crossAccountRouteTable = await RouteTable("cross-account-rt", {
+ *     vpc: crossVpc,
+ *     profile: "secondary-account",
+ *     region: "us-east-1", // Also override region
+ *     tags: { Name: "secondary-account-rt" }
+ *   });
+ * });
  */
 export const RouteTable = Resource(
   "aws::RouteTable",
@@ -110,7 +173,8 @@ export const RouteTable = Resource(
     _id: string,
     props: RouteTableProps,
   ): Promise<RouteTable> {
-    const client = await createEC2Client();
+    // Create EC2 client with credential resolution handled internally
+    const client = await createEC2Client(props);
     const timeoutConfig = mergeTimeoutConfig(
       ROUTE_TABLE_TIMEOUT,
       props.timeout,