alchemy 0.61.0 → 0.62.0

package/src/aws/ec2/nat-gateway.ts

@@ -8,13 +8,14 @@ import {
   type TimeoutConfig,
   waitForResourceState,
 } from "../../util/timeout.ts";
+import type { AwsClientProps } from "../client-props.ts";
 import type { Subnet } from "./subnet.ts";
 import { callEC2Api, createEC2Client } from "./utils.ts";
 
 /**
  * Properties for creating or updating a NAT Gateway
  */
-export interface NatGatewayProps {
+export interface NatGatewayProps extends AwsClientProps {
   /**
    * The subnet to create the NAT Gateway in (must be a public subnet)
    */
@@ -99,39 +100,94 @@ export interface NatGateway
  * if one is not provided. NAT Gateways are slow resources that can take
  * up to 10 minutes to become available.
  *
+ * Supports AWS credential overrides at the resource level, allowing you to deploy NAT Gateways
+ * to different AWS accounts or regions than the default scope configuration.
+ *
  * @example
+ * ```typescript
  * // Create a NAT Gateway with automatic Elastic IP allocation
  * const natGateway = await NatGateway("main-nat", {
- * subnet: publicSubnet,
- * tags: {
- * Name: "main-nat-gateway",
- * Environment: "production"
- * }
+ *   subnet: publicSubnet,
+ *   tags: {
+ *     Name: "main-nat-gateway",
+ *     Environment: "production"
+ *   }
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Create NAT Gateway with AWS credential overrides
+ * const crossAccountNat = await NatGateway("cross-account-nat", {
+ *   subnet: publicSubnet,
+ *   // Override AWS credentials for this specific resource
+ *   region: "us-east-1",
+ *   profile: "production-account",
+ *   tags: {
+ *     Name: "cross-account-nat-gateway",
+ *     Environment: "production"
+ *   }
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Create NAT Gateway in different region with role assumption
+ * const multiRegionNat = await NatGateway("multi-region-nat", {
+ *   subnet: euPublicSubnet,
+ *   region: "eu-west-1",
+ *   roleArn: "arn:aws:iam::123456789012:role/CrossRegionRole",
+ *   roleSessionName: "nat-gateway-deployment",
+ *   tags: {
+ *     Name: "eu-nat-gateway",
+ *     Region: "europe"
+ *   }
  * });
+ * ```
  *
  * @example
+ * ```typescript
+ * // Create NAT Gateway with explicit credentials
+ * const explicitCredsNat = await NatGateway("explicit-creds-nat", {
+ *   subnet: testPublicSubnet,
+ *   accessKeyId: alchemy.secret("AKIAIOSFODNN7EXAMPLE"),
+ *   secretAccessKey: alchemy.secret("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"),
+ *   region: "us-west-2",
+ *   tags: {
+ *     Name: "explicit-credentials-nat",
+ *     Purpose: "testing"
+ *   }
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
  * // Create a NAT Gateway with existing Elastic IP
  * const natGateway = await NatGateway("custom-nat", {
- * subnet: "subnet-12345678",
- * allocationId: "eipalloc-12345678",
- * connectivityType: "public",
- * tags: {
- * Name: "custom-nat-gateway"
- * }
+ *   subnet: "subnet-12345678",
+ *   allocationId: "eipalloc-12345678",
+ *   connectivityType: "public",
+ *   tags: {
+ *     Name: "custom-nat-gateway"
+ *   }
  * });
+ * ```
  *
  * @example
+ * ```typescript
  * // Create a private NAT Gateway (for VPC-to-VPC communication)
  * const privateNat = await NatGateway("private-nat", {
- * subnet: privateSubnet,
- * connectivityType: "private",
- * tags: {
- * Name: "private-nat-gateway",
- * Type: "internal"
- * }
+ *   subnet: privateSubnet,
+ *   connectivityType: "private",
+ *   tags: {
+ *     Name: "private-nat-gateway",
+ *     Type: "internal"
+ *   }
  * });
+ * ```
  *
  * @example
+ * ```typescript
  * // Create a NAT Gateway with custom timeout configuration
  * const slowNat = await NatGateway("slow-nat", {
  *   subnet: publicSubnet,
@@ -143,8 +199,32 @@ export interface NatGateway
  *     Name: "slow-nat-gateway"
  *   }
  * });
+ * ```
  *
  * @example
+ * ```typescript
+ * // Multi-account deployment with scope-level and resource-level overrides
+ * await alchemy.run("production", {
+ *   aws: { region: "us-west-2", profile: "main-account" }
+ * }, async () => {
+ *   // This NAT Gateway uses scope credentials (main-account, us-west-2)
+ *   const mainNat = await NatGateway("main-nat", {
+ *     subnet: mainPublicSubnet,
+ *     tags: { Name: "main-account-nat" }
+ *   });
+ *
+ *   // This NAT Gateway overrides to use different account
+ *   const crossAccountNat = await NatGateway("cross-account-nat", {
+ *     subnet: crossPublicSubnet,
+ *     profile: "secondary-account",
+ *     region: "us-east-1", // Also override region
+ *     tags: { Name: "secondary-account-nat" }
+ *   });
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
  * // Use NAT Gateway in route table for private subnet internet access
  * const privateRoute = await Route("private-internet", {
  *   routeTable: privateRouteTable,
@@ -154,6 +234,7 @@ export interface NatGateway
  *     Name: "private-to-internet"
  *   }
  * });
+ * ```
  */
 export const NatGateway = Resource(
   "aws::NatGateway",
@@ -162,6 +243,8 @@ export const NatGateway = Resource(
     _id: string,
     props: NatGatewayProps,
   ): Promise<NatGateway> {
+    // Create EC2 client with credential resolution handled internally
+    const client = await createEC2Client(props);
     const subnetId =
       typeof props.subnet === "string" ? props.subnet : props.subnet.subnetId;
     const timeoutConfig = mergeTimeoutConfig(
@@ -174,7 +257,6 @@ export const NatGateway = Resource(
         logger.log(`🗑️ Deleting NAT Gateway: ${this.output.natGatewayId}`);
         // Delete NAT Gateway if it exists
         await ignore("InvalidNatGatewayID.NotFound", async () => {
-          const client = await createEC2Client();
           await callEC2Api(
             client,
             "DeleteNatGateway",
@@ -192,6 +274,7 @@ export const NatGateway = Resource(
         await waitForNatGatewayFullyDeleted(
           this.output.natGatewayId,
           timeoutConfig,
+          props,
         );
 
         logger.log(
@@ -204,9 +287,8 @@ export const NatGateway = Resource(
           await ignore(
             ["InvalidAllocationID.NotFound", "InvalidAddress.NotFound"],
             async () => {
-              const eipClient = await createEC2Client();
               await callEC2Api(
-                eipClient,
+                client,
                 "ReleaseAddress",
                 parseNatGatewayXmlResponse,
                 convertReleaseAddressParamsToAwsFormat({
@@ -216,7 +298,11 @@ export const NatGateway = Resource(
             },
           );
           // Wait for the EIP to be fully released
-          await waitForEipReleased(this.output.allocationId, timeoutConfig);
+          await waitForEipReleased(
+            this.output.allocationId,
+            timeoutConfig,
+            props,
+          );
           logger.log(
             `  ✅ Elastic IP ${this.output.allocationId} released successfully`,
           );
@@ -232,7 +318,6 @@ export const NatGateway = Resource(
 
     if (this.phase === "update" && this.output?.natGatewayId) {
       // Get existing NAT Gateway
-      const client = await createEC2Client();
       const response = await callEC2Api<DescribeNatGatewaysResponse>(
         client,
         "DescribeNatGateways",
@@ -270,7 +355,6 @@ export const NatGateway = Resource(
           ];
         }
 
-        const client = await createEC2Client();
         const eipResponse = await callEC2Api<AllocateAddressResponse>(
           client,
           "AllocateAddress",
@@ -287,7 +371,6 @@ export const NatGateway = Resource(
         createdElasticIp = true;
       } else {
         // Get public IP of existing allocation
-        const client = await createEC2Client();
         const addressResponse = await callEC2Api<DescribeAddressesResponse>(
           client,
           "DescribeAddresses",
@@ -319,9 +402,8 @@ export const NatGateway = Resource(
         ];
       }
 
-      const natClient = await createEC2Client();
       const response = await callEC2Api<CreateNatGatewayResponse>(
-        natClient,
+        client,
         "CreateNatGateway",
         parseNatGatewayXmlResponse,
         convertCreateNatGatewayParamsToAwsFormat(createParams),
@@ -334,7 +416,11 @@ export const NatGateway = Resource(
       natGateway = response.NatGateway;
 
       // Wait for NAT Gateway to be available
-      await waitForNatGatewayAvailable(natGateway.NatGatewayId!, timeoutConfig);
+      await waitForNatGatewayAvailable(
+        natGateway.NatGatewayId!,
+        timeoutConfig,
+        props,
+      );
     }
 
     const result = this({
@@ -359,9 +445,10 @@ export const NatGateway = Resource(
 async function waitForNatGatewayAvailable(
   natGatewayId: string,
   timeoutConfig: TimeoutConfig,
+  credentials?: AwsClientProps,
 ): Promise<void> {
   const checkFunction = async () => {
-    const client = await createEC2Client();
+    const client = await createEC2Client(credentials);
     const response = await callEC2Api<DescribeNatGatewaysResponse>(
       client,
       "DescribeNatGateways",
@@ -398,10 +485,11 @@ async function waitForNatGatewayAvailable(
 async function waitForNatGatewayDeleted(
   natGatewayId: string,
   timeoutConfig: TimeoutConfig,
+  credentials?: AwsClientProps,
 ): Promise<void> {
   const checkFunction = async () => {
     try {
-      const client = await createEC2Client();
+      const client = await createEC2Client(credentials);
       const response = await callEC2Api<DescribeNatGatewaysResponse>(
         client,
         "DescribeNatGateways",
@@ -481,10 +569,11 @@ function parseDescribeNetworkInterfacesResponse(
 async function waitForEipReleased(
   allocationId: string,
   timeoutConfig: TimeoutConfig,
+  credentials?: AwsClientProps,
 ): Promise<void> {
   const checkFunction = async () => {
     try {
-      const eipClient = await createEC2Client();
+      const eipClient = await createEC2Client(credentials);
       const addressResponse = await callEC2Api<DescribeAddressesResponse>(
         eipClient,
         "DescribeAddresses",
@@ -525,14 +614,15 @@ async function waitForEipReleased(
 async function waitForNatGatewayFullyDeleted(
   natGatewayId: string,
   timeoutConfig: TimeoutConfig,
+  credentials?: AwsClientProps,
 ): Promise<void> {
   // First wait for the NAT Gateway itself to be deleted
-  await waitForNatGatewayDeleted(natGatewayId, timeoutConfig);
+  await waitForNatGatewayDeleted(natGatewayId, timeoutConfig, credentials);
 
   // Then wait for network interfaces to be cleaned up
   const checkNetworkInterfaces = async () => {
     try {
-      const client = await createEC2Client();
+      const client = await createEC2Client(credentials);
       const response = await callEC2Api<DescribeNetworkInterfacesResponse>(
         client,
         "DescribeNetworkInterfaces",

package/src/aws/ec2/route-table-association.ts

@@ -236,7 +236,7 @@ async function waitForRouteTableAssociationDeleted(
  *   publicSubnets.map((subnet, index) =>
  *     RouteTableAssociation(`public-association-${index}`, {
  *       routeTable: publicRouteTable,
- *       subnet
+ *       subnet: subnet
  *     })
  *   )
  * );

package/src/aws/ec2/route-table.ts

@@ -9,13 +9,14 @@ import {
   type TimeoutConfig,
   waitForResourceState,
 } from "../../util/timeout.ts";
+import type { AwsClientProps } from "../client-props.ts";
 import { callEC2Api, createEC2Client } from "./utils.ts";
 import type { Vpc } from "./vpc.ts";
 
 /**
  * Properties for creating or updating a Route Table
  */
-export interface RouteTableProps {
+export interface RouteTableProps extends AwsClientProps {
   /**
    * The VPC to create the route table in
    */
@@ -58,6 +59,9 @@ export interface RouteTable
  * traffic is directed. Subnet associations are managed separately using the
  * RouteTableAssociation resource.
  *
+ * Supports AWS credential overrides at the resource level, allowing you to deploy Route Tables
+ * to different AWS accounts or regions than the default scope configuration.
+ *
  * @example
  * // Create a basic route table
  * const routeTable = await RouteTable("main-route-table", {
@@ -80,6 +84,45 @@ export interface RouteTable
  * });
  *
  * @example
+ * // Create Route Table with AWS credential overrides
+ * const crossAccountRouteTable = await RouteTable("cross-account-rt", {
+ *   vpc: mainVpc,
+ *   // Override AWS credentials for this specific resource
+ *   region: "us-east-1",
+ *   profile: "production-account",
+ *   tags: {
+ *     Name: "cross-account-route-table",
+ *     Environment: "production"
+ *   }
+ * });
+ *
+ * @example
+ * // Create Route Table in different region with role assumption
+ * const multiRegionRouteTable = await RouteTable("multi-region-rt", {
+ *   vpc: euVpc,
+ *   region: "eu-west-1",
+ *   roleArn: "arn:aws:iam::123456789012:role/CrossRegionRole",
+ *   roleSessionName: "route-table-deployment",
+ *   tags: {
+ *     Name: "eu-route-table",
+ *     Region: "europe"
+ *   }
+ * });
+ *
+ * @example
+ * // Create Route Table with explicit credentials
+ * const explicitCredsRouteTable = await RouteTable("explicit-creds-rt", {
+ *   vpc: testVpc,
+ *   accessKeyId: alchemy.secret("AKIAIOSFODNN7EXAMPLE"),
+ *   secretAccessKey: alchemy.secret("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"),
+ *   region: "us-west-2",
+ *   tags: {
+ *     Name: "explicit-credentials-rt",
+ *     Purpose: "testing"
+ *   }
+ * });
+ *
+ * @example
  * // Create a private route table for internal traffic
  * const privateRouteTable = await RouteTable("private-routes", {
  *   vpc: myVpc,
@@ -102,6 +145,26 @@ export interface RouteTable
  *     Name: "custom-timeout-route-table"
  *   }
  * });
+ *
+ * @example
+ * // Multi-account deployment with scope-level and resource-level overrides
+ * await alchemy.run("production", {
+ *   aws: { region: "us-west-2", profile: "main-account" }
+ * }, async () => {
+ *   // This Route Table uses scope credentials (main-account, us-west-2)
+ *   const mainRouteTable = await RouteTable("main-rt", {
+ *     vpc: mainVpc,
+ *     tags: { Name: "main-account-rt" }
+ *   });
+ *
+ *   // This Route Table overrides to use different account
+ *   const crossAccountRouteTable = await RouteTable("cross-account-rt", {
+ *     vpc: crossVpc,
+ *     profile: "secondary-account",
+ *     region: "us-east-1", // Also override region
+ *     tags: { Name: "secondary-account-rt" }
+ *   });
+ * });
  */
 export const RouteTable = Resource(
   "aws::RouteTable",
@@ -110,7 +173,8 @@ export const RouteTable = Resource(
     _id: string,
     props: RouteTableProps,
   ): Promise<RouteTable> {
-    const client = await createEC2Client();
+    // Create EC2 client with credential resolution handled internally
+    const client = await createEC2Client(props);
     const timeoutConfig = mergeTimeoutConfig(
       ROUTE_TABLE_TIMEOUT,
       props.timeout,

package/src/aws/ec2/route.ts

@@ -9,6 +9,7 @@ import {
   type TimeoutConfig,
   waitForResourceState,
 } from "../../util/timeout.ts";
+import type { AwsClientProps } from "../client-props.ts";
 import { retry } from "../retry.ts";
 import type { InternetGateway } from "./internet-gateway.ts";
 import type { NatGateway } from "./nat-gateway.ts";
@@ -18,7 +19,7 @@ import { callEC2Api, createEC2Client } from "./utils.ts";
 /**
  * Properties for creating or updating a Route
  */
-export interface RouteProps {
+export interface RouteProps extends AwsClientProps {
   /**
    * The route table to add the route to
    */
@@ -74,6 +75,9 @@ export interface Route extends Resource<"aws::Route">, RouteProps {
  * Creates and manages individual routes within route tables, directing traffic
  * to various targets like Internet Gateways, NAT Gateways, or instances.
  *
+ * Supports AWS credential overrides at the resource level, allowing you to deploy Routes
+ * to different AWS accounts or regions than the default scope configuration.
+ *
  * @example
  * // Create a default route to Internet Gateway
  * const publicRoute = await Route("public-default-route", {
@@ -91,6 +95,39 @@ export interface Route extends Resource<"aws::Route">, RouteProps {
  * });
  *
  * @example
+ * // Create Route with AWS credential overrides
+ * const crossAccountRoute = await Route("cross-account-route", {
+ *   routeTable: mainRouteTable,
+ *   destinationCidrBlock: "0.0.0.0/0",
+ *   target: { internetGateway: mainIgw },
+ *   // Override AWS credentials for this specific resource
+ *   region: "us-east-1",
+ *   profile: "production-account",
+ * });
+ *
+ * @example
+ * // Create Route in different region with role assumption
+ * const multiRegionRoute = await Route("multi-region-route", {
+ *   routeTable: euRouteTable,
+ *   destinationCidrBlock: "0.0.0.0/0",
+ *   target: { internetGateway: euIgw },
+ *   region: "eu-west-1",
+ *   roleArn: "arn:aws:iam::123456789012:role/CrossRegionRole",
+ *   roleSessionName: "route-deployment",
+ * });
+ *
+ * @example
+ * // Create Route with explicit credentials
+ * const explicitCredsRoute = await Route("explicit-creds-route", {
+ *   routeTable: testRouteTable,
+ *   destinationCidrBlock: "0.0.0.0/0",
+ *   target: { internetGateway: testIgw },
+ *   accessKeyId: alchemy.secret("AKIAIOSFODNN7EXAMPLE"),
+ *   secretAccessKey: alchemy.secret("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"),
+ *   region: "us-west-2",
+ * });
+ *
+ * @example
  * // Create a route to a specific instance
  * const instanceRoute = await Route("instance-route", {
  *   routeTable: "rtb-12345678",
@@ -133,6 +170,28 @@ export interface Route extends Resource<"aws::Route">, RouteProps {
  *     delayMs: 2000
  *   }
  * });
+ *
+ * @example
+ * // Multi-account deployment with scope-level and resource-level overrides
+ * await alchemy.run("production", {
+ *   aws: { region: "us-west-2", profile: "main-account" }
+ * }, async () => {
+ *   // This Route uses scope credentials (main-account, us-west-2)
+ *   const mainRoute = await Route("main-route", {
+ *     routeTable: mainRouteTable,
+ *     destinationCidrBlock: "0.0.0.0/0",
+ *     target: { internetGateway: mainIgw }
+ *   });
+ *
+ *   // This Route overrides to use different account
+ *   const crossAccountRoute = await Route("cross-account-route", {
+ *     routeTable: crossRouteTable,
+ *     destinationCidrBlock: "0.0.0.0/0",
+ *     target: { internetGateway: crossIgw },
+ *     profile: "secondary-account",
+ *     region: "us-east-1", // Also override region
+ *   });
+ * });
  */
 export const Route = Resource(
   "aws::Route",
@@ -141,7 +200,8 @@ export const Route = Resource(
     _id: string,
     props: RouteProps,
   ): Promise<Route> {
-    const client = await createEC2Client();
+    // Create EC2 client with credential resolution handled internally
+    const client = await createEC2Client(props);
     const _timeoutConfig = mergeTimeoutConfig(ROUTE_TIMEOUT, props.timeout);
     const routeTableId =
       typeof props.routeTable === "string"

package/src/aws/ec2/security-group.ts

@@ -8,6 +8,7 @@ import {
   type TimeoutConfig,
   waitForResourceState,
 } from "../../util/timeout.ts";
+import type { AwsClientProps } from "../client-props.ts";
 import { callEC2Api, createEC2Client } from "./utils.ts";
 import type { Vpc } from "./vpc.ts";
 
@@ -22,7 +23,7 @@ export const SECURITY_GROUP_TIMEOUT: TimeoutConfig = {
 /**
  * Properties for creating or updating a Security Group
  */
-export interface SecurityGroupProps {
+export interface SecurityGroupProps extends AwsClientProps {
   /**
    * The VPC to create the security group in.
    */
@@ -79,8 +80,12 @@ export interface SecurityGroup
  * instances and other AWS resources. Rules are managed separately using the
  * `SecurityGroupRule` resource.
  *
+ * Supports AWS credential overrides at the resource level, allowing you to deploy Security Groups
+ * to different AWS accounts or regions than the default scope configuration.
+ *
  * @example
- * // Create a web server security group
+ * ```typescript
+ * // Create a basic web server security group
  * const webSecurityGroup = await SecurityGroup("web-sg", {
  *   vpc: mainVpc,
  *   groupName: "web-server-sg",
@@ -90,11 +95,72 @@ export interface SecurityGroup
  *     Environment: "production"
  *   }
  * });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Create Security Group with AWS credential overrides
+ * const crossAccountSg = await SecurityGroup("cross-account-sg", {
+ *   vpc: mainVpc,
+ *   groupName: "cross-account-security-group",
+ *   description: "Security group in different account",
+ *   // Override AWS credentials for this specific resource
+ *   region: "us-east-1",
+ *   profile: "production-account",
+ *   tags: {
+ *     Name: "cross-account-sg",
+ *     Environment: "production"
+ *   }
+ * });
+ * ```
  *
  * @example
+ * ```typescript
+ * // Create Security Group in different region with role assumption
+ * const multiRegionSg = await SecurityGroup("multi-region-sg", {
+ *   vpc: euVpc,
+ *   groupName: "eu-security-group",
+ *   description: "Security group in EU region",
+ *   region: "eu-west-1",
+ *   roleArn: "arn:aws:iam::123456789012:role/CrossRegionRole",
+ *   roleSessionName: "security-group-deployment",
+ *   tags: {
+ *     Name: "eu-security-group",
+ *     Region: "europe"
+ *   }
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Create Security Group with explicit credentials
+ * const explicitCredsSg = await SecurityGroup("explicit-creds-sg", {
+ *   vpc: testVpc,
+ *   groupName: "test-security-group",
+ *   description: "Security group with explicit credentials",
+ *   accessKeyId: alchemy.secret("AKIAIOSFODNN7EXAMPLE"),
+ *   secretAccessKey: alchemy.secret("wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"),
+ *   region: "us-west-2",
+ *   tags: {
+ *     Name: "explicit-credentials-sg",
+ *     Purpose: "testing"
+ *   }
+ * });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Create Security Group with rules (rules managed separately)
+ * const webSg = await SecurityGroup("web-sg", {
+ *   vpc: mainVpc,
+ *   groupName: "web-server-sg",
+ *   description: "Security group for web servers",
+ *   tags: { Name: "web-server-security-group" }
+ * });
+ *
  * // Separately, define a rule to allow HTTP traffic
  * const httpRule = await SecurityGroupRule("web-sg-http-rule", {
- *   securityGroup: webSecurityGroup,
+ *   securityGroup: webSg,
  *   type: "ingress",
  *   protocol: "tcp",
  *   fromPort: 80,
@@ -102,6 +168,33 @@ export interface SecurityGroup
  *   cidrBlocks: ["0.0.0.0/0"],
  *   description: "Allow HTTP access from anywhere"
  * });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Multi-account deployment with scope-level and resource-level overrides
+ * await alchemy.run("production", {
+ *   aws: { region: "us-west-2", profile: "main-account" }
+ * }, async () => {
+ *   // This SG uses scope credentials (main-account, us-west-2)
+ *   const mainSg = await SecurityGroup("main-sg", {
+ *     vpc: mainVpc,
+ *     groupName: "main-account-sg",
+ *     description: "Security group in main account",
+ *     tags: { Name: "main-account-sg" }
+ *   });
+ *
+ *   // This SG overrides to use different account
+ *   const crossAccountSg = await SecurityGroup("cross-account-sg", {
+ *     vpc: crossVpc,
+ *     groupName: "secondary-account-sg",
+ *     description: "Security group in secondary account",
+ *     profile: "secondary-account",
+ *     region: "us-east-1", // Also override region
+ *     tags: { Name: "secondary-account-sg" }
+ *   });
+ * });
+ * ```
  */
 export const SecurityGroup = Resource(
   "aws::SecurityGroup",
@@ -110,7 +203,8 @@ export const SecurityGroup = Resource(
     _id: string,
     props: SecurityGroupProps,
   ): Promise<SecurityGroup> {
-    const client = await createEC2Client();
+    // Create EC2 client with credential resolution handled internally
+    const client = await createEC2Client(props);
     const vpcId = typeof props.vpc === "string" ? props.vpc : props.vpc.vpcId;
     const timeoutConfig = mergeTimeoutConfig(
       SECURITY_GROUP_TIMEOUT,