alchemy 2.0.0-beta.30 → 2.0.0-beta.32

package/src/AWS/EC2/Subnet.ts

@@ -235,214 +235,132 @@ export const SubnetProvider = () =>
           }
         }),
 
-        create: Effect.fn(function* ({ id, news, session }) {
-          // 1. Get VPC ID from the VPC resource
-          // TODO(sam): i need to make it possible to pass Resources as input Props to Resources
-          const vpcId = news.vpcId;
-
-          // 2. Prepare tags
+        reconcile: Effect.fn(function* ({ id, news, output, session }) {
           const alchemyTags = yield* createInternalTags(id);
-          const userTags = news.tags ?? {};
-          const allTags = { ...alchemyTags, ...userTags };
-
-          // 3. Call CreateSubnet
-          const createResult = yield* ec2
-            .createSubnet({
-              VpcId: vpcId,
-              CidrBlock: news.cidrBlock,
-              Ipv6CidrBlock: news.ipv6CidrBlock,
-              AvailabilityZone: news.availabilityZone,
-              AvailabilityZoneId: news.availabilityZoneId,
-              Ipv4IpamPoolId: news.ipv4IpamPoolId,
-              Ipv4NetmaskLength: news.ipv4NetmaskLength,
-              Ipv6IpamPoolId: news.ipv6IpamPoolId,
-              Ipv6NetmaskLength: news.ipv6NetmaskLength,
-              Ipv6Native: false, // Explicitly set to false for now
-              TagSpecifications: [
-                {
-                  ResourceType: "subnet",
-                  Tags: createTagsList(allTags),
-                },
-              ],
-              DryRun: false,
-            })
-            .pipe(
-              Effect.retry({
-                while: (e) => e._tag === "InvalidVpcID.NotFound",
-                schedule: Schedule.exponential(100),
-              }),
-            );
-
-          const subnetId = createResult.Subnet!.SubnetId! as SubnetId;
-          yield* session.note(`Subnet created: ${subnetId}`);
-
-          // 4. Modify subnet attributes if specified
-          if (news.mapPublicIpOnLaunch !== undefined) {
-            yield* ec2.modifySubnetAttribute({
-              SubnetId: subnetId,
-              MapPublicIpOnLaunch: { Value: news.mapPublicIpOnLaunch },
-            });
-          }
-
-          if (news.assignIpv6AddressOnCreation !== undefined) {
-            yield* ec2.modifySubnetAttribute({
-              SubnetId: subnetId,
-              AssignIpv6AddressOnCreation: {
-                Value: news.assignIpv6AddressOnCreation,
-              },
-            });
-          }
-
-          if (news.enableDns64 !== undefined) {
-            yield* ec2.modifySubnetAttribute({
-              SubnetId: subnetId,
-              EnableDns64: { Value: news.enableDns64 },
-            });
+          const desiredTags = { ...alchemyTags, ...(news.tags ?? {}) };
+
+          // Observe — find the subnet via cached id, else fall through to
+          // create.
+          let subnet: ec2.Subnet | undefined;
+          if (output?.subnetId) {
+            const lookup = yield* ec2
+              .describeSubnets({ SubnetIds: [output.subnetId] })
+              .pipe(
+                Effect.catchTag("InvalidSubnetID.NotFound", () =>
+                  Effect.succeed({ Subnets: [] }),
+                ),
+              );
+            subnet = lookup.Subnets?.[0];
           }
 
-          if (
-            news.enableResourceNameDnsARecordOnLaunch !== undefined ||
-            news.enableResourceNameDnsAAAARecordOnLaunch !== undefined ||
-            news.hostnameType !== undefined
-          ) {
-            yield* ec2.modifySubnetAttribute({
-              SubnetId: subnetId,
-              PrivateDnsHostnameTypeOnLaunch: news.hostnameType,
-              EnableResourceNameDnsARecordOnLaunch:
-                news.enableResourceNameDnsARecordOnLaunch !== undefined
-                  ? { Value: news.enableResourceNameDnsARecordOnLaunch }
-                  : undefined,
-              EnableResourceNameDnsAAAARecordOnLaunch:
-                news.enableResourceNameDnsAAAARecordOnLaunch !== undefined
-                  ? { Value: news.enableResourceNameDnsAAAARecordOnLaunch }
-                  : undefined,
-            });
+          // Ensure — create the subnet when missing.
+          if (subnet === undefined) {
+            const createResult = yield* ec2
+              .createSubnet({
+                VpcId: news.vpcId,
+                CidrBlock: news.cidrBlock,
+                Ipv6CidrBlock: news.ipv6CidrBlock,
+                AvailabilityZone: news.availabilityZone,
+                AvailabilityZoneId: news.availabilityZoneId,
+                Ipv4IpamPoolId: news.ipv4IpamPoolId,
+                Ipv4NetmaskLength: news.ipv4NetmaskLength,
+                Ipv6IpamPoolId: news.ipv6IpamPoolId,
+                Ipv6NetmaskLength: news.ipv6NetmaskLength,
+                Ipv6Native: false,
+                TagSpecifications: [
+                  {
+                    ResourceType: "subnet",
+                    Tags: createTagsList(desiredTags),
+                  },
+                ],
+                DryRun: false,
+              })
+              .pipe(
+                Effect.retry({
+                  while: (e) => e._tag === "InvalidVpcID.NotFound",
+                  schedule: Schedule.exponential(100),
+                }),
+              );
+            const newSubnetId = createResult.Subnet!.SubnetId! as SubnetId;
+            yield* session.note(`Subnet created: ${newSubnetId}`);
+            subnet = yield* waitForSubnetAvailable(newSubnetId, session);
           }
 
-          // 5. Wait for subnet to be available
-          const subnet = yield* waitForSubnetAvailable(subnetId, session);
-
-          // 6. Return attributes
-          return {
-            subnetId,
-            subnetArn: subnet.SubnetArn! as SubnetArn,
-            cidrBlock: subnet.CidrBlock!,
-            vpcId: news.vpcId,
-            availabilityZone: subnet.AvailabilityZone!,
-            availabilityZoneId: subnet.AvailabilityZoneId,
-            state: subnet.State!,
-            availableIpAddressCount: subnet.AvailableIpAddressCount ?? 0,
-            mapPublicIpOnLaunch: subnet.MapPublicIpOnLaunch ?? false,
-            assignIpv6AddressOnCreation:
-              subnet.AssignIpv6AddressOnCreation ?? false,
-            defaultForAz: subnet.DefaultForAz ?? false,
-            ownerId: subnet.OwnerId,
-            ipv6CidrBlockAssociationSet:
-              subnet.Ipv6CidrBlockAssociationSet?.map((assoc) => ({
-                associationId: assoc.AssociationId!,
-                ipv6CidrBlock: assoc.Ipv6CidrBlock!,
-                ipv6CidrBlockState: {
-                  state: assoc.Ipv6CidrBlockState!.State!,
-                  statusMessage: assoc.Ipv6CidrBlockState!.StatusMessage,
-                },
-              })),
-            enableDns64: subnet.EnableDns64,
-            ipv6Native: subnet.Ipv6Native,
-            privateDnsNameOptionsOnLaunch: subnet.PrivateDnsNameOptionsOnLaunch
-              ? {
-                  hostnameType:
-                    subnet.PrivateDnsNameOptionsOnLaunch.HostnameType,
-                  enableResourceNameDnsARecord:
-                    subnet.PrivateDnsNameOptionsOnLaunch
-                      .EnableResourceNameDnsARecord,
-                  enableResourceNameDnsAAAARecord:
-                    subnet.PrivateDnsNameOptionsOnLaunch
-                      .EnableResourceNameDnsAAAARecord,
-                }
-              : undefined,
-          };
-        }),
-
-        update: Effect.fn(function* ({ id, news, olds, output, session }) {
-          const subnetId = output.subnetId;
+          const subnetId = subnet.SubnetId! as SubnetId;
 
-          // Update MapPublicIpOnLaunch if changed
-          if (news.mapPublicIpOnLaunch !== olds.mapPublicIpOnLaunch) {
+          // Sync subnet attributes — diff observed cloud state against desired
+          // and only call modifySubnetAttribute on real drift.
+          const desiredMapPublicIp = news.mapPublicIpOnLaunch ?? false;
+          if ((subnet.MapPublicIpOnLaunch ?? false) !== desiredMapPublicIp) {
             yield* ec2.modifySubnetAttribute({
               SubnetId: subnetId,
-              MapPublicIpOnLaunch: { Value: news.mapPublicIpOnLaunch ?? false },
+              MapPublicIpOnLaunch: { Value: desiredMapPublicIp },
             });
-            yield* session.note("Updated map public IP on launch");
+            yield* session.note(
+              `Updated map public IP on launch: ${desiredMapPublicIp}`,
+            );
           }
 
-          // Update AssignIpv6AddressOnCreation if changed
+          const desiredAssignIpv6 = news.assignIpv6AddressOnCreation ?? false;
           if (
-            news.assignIpv6AddressOnCreation !==
-            olds.assignIpv6AddressOnCreation
+            (subnet.AssignIpv6AddressOnCreation ?? false) !== desiredAssignIpv6
           ) {
             yield* ec2.modifySubnetAttribute({
               SubnetId: subnetId,
-              AssignIpv6AddressOnCreation: {
-                Value: news.assignIpv6AddressOnCreation ?? false,
-              },
+              AssignIpv6AddressOnCreation: { Value: desiredAssignIpv6 },
             });
-            yield* session.note("Updated assign IPv6 address on creation");
+            yield* session.note(
+              `Updated assign IPv6 address on creation: ${desiredAssignIpv6}`,
+            );
           }
 
-          // Update EnableDns64 if changed
-          if (news.enableDns64 !== olds.enableDns64) {
+          const desiredEnableDns64 = news.enableDns64 ?? false;
+          if ((subnet.EnableDns64 ?? false) !== desiredEnableDns64) {
             yield* ec2.modifySubnetAttribute({
               SubnetId: subnetId,
-              EnableDns64: { Value: news.enableDns64 ?? false },
+              EnableDns64: { Value: desiredEnableDns64 },
             });
-            yield* session.note("Updated DNS64 setting");
+            yield* session.note(`Updated DNS64 setting: ${desiredEnableDns64}`);
           }
 
-          // Update private DNS hostname settings if changed
+          const observedHostnameType =
+            subnet.PrivateDnsNameOptionsOnLaunch?.HostnameType;
+          const observedDnsA =
+            subnet.PrivateDnsNameOptionsOnLaunch?.EnableResourceNameDnsARecord;
+          const observedDnsAAAA =
+            subnet.PrivateDnsNameOptionsOnLaunch
+              ?.EnableResourceNameDnsAAAARecord;
           if (
-            news.enableResourceNameDnsARecordOnLaunch !==
-              olds.enableResourceNameDnsARecordOnLaunch ||
-            news.enableResourceNameDnsAAAARecordOnLaunch !==
-              olds.enableResourceNameDnsAAAARecordOnLaunch ||
-            news.hostnameType !== olds.hostnameType
+            observedHostnameType !== news.hostnameType ||
+            observedDnsA !== news.enableResourceNameDnsARecordOnLaunch ||
+            observedDnsAAAA !== news.enableResourceNameDnsAAAARecordOnLaunch
           ) {
-            yield* ec2.modifySubnetAttribute({
-              SubnetId: subnetId,
-              PrivateDnsHostnameTypeOnLaunch: news.hostnameType,
-              EnableResourceNameDnsARecordOnLaunch:
-                news.enableResourceNameDnsARecordOnLaunch !== undefined
-                  ? { Value: news.enableResourceNameDnsARecordOnLaunch }
-                  : undefined,
-              EnableResourceNameDnsAAAARecordOnLaunch:
-                news.enableResourceNameDnsAAAARecordOnLaunch !== undefined
-                  ? { Value: news.enableResourceNameDnsAAAARecordOnLaunch }
-                  : undefined,
-            });
-            yield* session.note("Updated private DNS hostname settings");
+            if (
+              news.enableResourceNameDnsARecordOnLaunch !== undefined ||
+              news.enableResourceNameDnsAAAARecordOnLaunch !== undefined ||
+              news.hostnameType !== undefined
+            ) {
+              yield* ec2.modifySubnetAttribute({
+                SubnetId: subnetId,
+                PrivateDnsHostnameTypeOnLaunch: news.hostnameType,
+                EnableResourceNameDnsARecordOnLaunch:
+                  news.enableResourceNameDnsARecordOnLaunch !== undefined
+                    ? { Value: news.enableResourceNameDnsARecordOnLaunch }
+                    : undefined,
+                EnableResourceNameDnsAAAARecordOnLaunch:
+                  news.enableResourceNameDnsAAAARecordOnLaunch !== undefined
+                    ? { Value: news.enableResourceNameDnsAAAARecordOnLaunch }
+                    : undefined,
+              });
+              yield* session.note("Updated private DNS hostname settings");
+            }
           }
 
-          // Handle tag updates
-          const alchemyTags = yield* createInternalTags(id);
-          const newTags = { ...alchemyTags, ...news.tags };
-          const oldTags =
-            (yield* ec2
-              .describeTags({
-                Filters: [
-                  { Name: "resource-id", Values: [subnetId] },
-                  { Name: "resource-type", Values: ["subnet"] },
-                ],
-              })
-              .pipe(
-                Effect.map(
-                  (r) =>
-                    Object.fromEntries(
-                      r.Tags?.map((t) => [t.Key!, t.Value!]) ?? [],
-                    ) as Record<string, string>,
-                ),
-              )) ?? {};
-
-          const { removed, upsert } = diffTags(oldTags, newTags);
-
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (subnet.Tags ?? []).map((t) => [t.Key!, t.Value!]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
           if (removed.length > 0) {
             yield* ec2.deleteTags({
               Resources: [subnetId],
@@ -456,10 +374,57 @@ export const SubnetProvider = () =>
               Tags: upsert,
               DryRun: false,
             });
-            yield* session.note("Updated tags");
           }
 
-          return output; // Subnet attributes don't change from these updates
+          // Re-read final state.
+          const finalLookup = yield* ec2.describeSubnets({
+            SubnetIds: [subnetId],
+          });
+          const final = finalLookup.Subnets?.[0];
+          if (!final) {
+            return yield* Effect.fail(
+              new Error(`Subnet ${subnetId} disappeared during reconcile`),
+            );
+          }
+          return {
+            subnetId,
+            subnetArn: final.SubnetArn! as SubnetArn,
+            cidrBlock: final.CidrBlock!,
+            vpcId: news.vpcId,
+            availabilityZone: final.AvailabilityZone!,
+            availabilityZoneId: final.AvailabilityZoneId,
+            state: final.State!,
+            availableIpAddressCount: final.AvailableIpAddressCount ?? 0,
+            mapPublicIpOnLaunch: final.MapPublicIpOnLaunch ?? false,
+            assignIpv6AddressOnCreation:
+              final.AssignIpv6AddressOnCreation ?? false,
+            defaultForAz: final.DefaultForAz ?? false,
+            ownerId: final.OwnerId,
+            ipv6CidrBlockAssociationSet: final.Ipv6CidrBlockAssociationSet?.map(
+              (assoc) => ({
+                associationId: assoc.AssociationId!,
+                ipv6CidrBlock: assoc.Ipv6CidrBlock!,
+                ipv6CidrBlockState: {
+                  state: assoc.Ipv6CidrBlockState!.State!,
+                  statusMessage: assoc.Ipv6CidrBlockState!.StatusMessage,
+                },
+              }),
+            ),
+            enableDns64: final.EnableDns64,
+            ipv6Native: final.Ipv6Native,
+            privateDnsNameOptionsOnLaunch: final.PrivateDnsNameOptionsOnLaunch
+              ? {
+                  hostnameType:
+                    final.PrivateDnsNameOptionsOnLaunch.HostnameType,
+                  enableResourceNameDnsARecord:
+                    final.PrivateDnsNameOptionsOnLaunch
+                      .EnableResourceNameDnsARecord,
+                  enableResourceNameDnsAAAARecord:
+                    final.PrivateDnsNameOptionsOnLaunch
+                      .EnableResourceNameDnsAAAARecord,
+                }
+              : undefined,
+          };
         }),
 
         delete: Effect.fn(function* ({ output, session }) {

package/src/AWS/EC2/Vpc.ts

@@ -200,115 +200,97 @@ export const VpcProvider = () =>
           }
         }),
 
-        create: Effect.fn(function* ({ id, news = {}, session }) {
-          // 1. Call CreateVpc
-          const createResult = yield* ec2.createVpc({
-            // TODO(sam): add all properties
-            AmazonProvidedIpv6CidrBlock: news.amazonProvidedIpv6CidrBlock,
-            InstanceTenancy: news.instanceTenancy,
-            CidrBlock: news.cidrBlock,
-            Ipv4IpamPoolId: news.ipv4IpamPoolId,
-            Ipv4NetmaskLength: news.ipv4NetmaskLength,
-            Ipv6Pool: news.ipv6Pool,
-            Ipv6CidrBlock: news.ipv6CidrBlock,
-            Ipv6IpamPoolId: news.ipv6IpamPoolId,
-            Ipv6NetmaskLength: news.ipv6NetmaskLength,
-            Ipv6CidrBlockNetworkBorderGroup:
-              news.ipv6CidrBlockNetworkBorderGroup,
-            TagSpecifications: [
-              {
-                ResourceType: "vpc",
-                Tags: createTagsList(yield* createTags(id, news.tags)),
-              },
-            ],
-            DryRun: false,
-          });
-
-          const vpcId = createResult.Vpc!.VpcId! as VpcId;
-          yield* session.note(`VPC created: ${vpcId}`);
-
-          // 3. Modify DNS attributes if specified (separate API calls)
-          yield* ec2.modifyVpcAttribute({
-            VpcId: vpcId,
-            EnableDnsSupport: { Value: news.enableDnsSupport ?? true },
-          });
-
-          if (news.enableDnsHostnames !== undefined) {
-            yield* ec2.modifyVpcAttribute({
-              VpcId: vpcId,
-              EnableDnsHostnames: { Value: news.enableDnsHostnames },
-            });
+        reconcile: Effect.fn(function* ({ id, news = {}, output, session }) {
+          const desiredTags = yield* createTags(id, news.tags);
+
+          // Observe — find the VPC if we already have its id, else describe
+          // returns empty and we fall through to create. We don't trust
+          // `output.vpcId` blindly: a VPC deleted out of band shows up as
+          // missing and we recreate.
+          let vpc: EC2.Vpc | undefined;
+
+          if (output?.vpcId) {
+            const lookup = yield* ec2
+              .describeVpcs({ VpcIds: [output.vpcId] })
+              .pipe(
+                Effect.catchTag("InvalidVpcID.NotFound", () =>
+                  Effect.succeed({ Vpcs: [] }),
+                ),
+              );
+            vpc = lookup.Vpcs?.[0];
           }
 
-          // 4. Wait for VPC to be available
-          const vpc = yield* waitForVpcAvailable(vpcId, session);
-
-          // 6. Return attributes
-          return {
-            vpcId,
-            vpcArn: `arn:aws:ec2:${region}:${accountId}:vpc/${vpcId}` as VpcArn,
-            cidrBlock: vpc.CidrBlock!,
-            dhcpOptionsId: vpc.DhcpOptionsId!,
-            state: vpc.State!,
-            isDefault: vpc.IsDefault ?? false,
-            ownerId: vpc.OwnerId,
-            cidrBlockAssociationSet: vpc.CidrBlockAssociationSet?.map(
-              (assoc) => ({
-                associationId: assoc.AssociationId!,
-                cidrBlock: assoc.CidrBlock!,
-                cidrBlockState: {
-                  state: assoc.CidrBlockState!.State!,
-                  statusMessage: assoc.CidrBlockState!.StatusMessage,
+          if (vpc === undefined) {
+            const createResult = yield* ec2.createVpc({
+              // TODO(sam): add all properties
+              AmazonProvidedIpv6CidrBlock: news.amazonProvidedIpv6CidrBlock,
+              InstanceTenancy: news.instanceTenancy,
+              CidrBlock: news.cidrBlock,
+              Ipv4IpamPoolId: news.ipv4IpamPoolId,
+              Ipv4NetmaskLength: news.ipv4NetmaskLength,
+              Ipv6Pool: news.ipv6Pool,
+              Ipv6CidrBlock: news.ipv6CidrBlock,
+              Ipv6IpamPoolId: news.ipv6IpamPoolId,
+              Ipv6NetmaskLength: news.ipv6NetmaskLength,
+              Ipv6CidrBlockNetworkBorderGroup:
+                news.ipv6CidrBlockNetworkBorderGroup,
+              TagSpecifications: [
+                {
+                  ResourceType: "vpc",
+                  Tags: createTagsList(desiredTags),
                 },
-              }),
-            ),
-            ipv6CidrBlockAssociationSet: vpc.Ipv6CidrBlockAssociationSet?.map(
-              (assoc) => ({
-                associationId: assoc.AssociationId!,
-                ipv6CidrBlock: assoc.Ipv6CidrBlock!,
-                ipv6CidrBlockState: {
-                  state: assoc.Ipv6CidrBlockState!.State!,
-                  statusMessage: assoc.Ipv6CidrBlockState!.StatusMessage,
-                },
-                networkBorderGroup: assoc.NetworkBorderGroup,
-                ipv6Pool: assoc.Ipv6Pool,
-              }),
-            ),
-          };
-        }),
+              ],
+              DryRun: false,
+            });
+            const newVpcId = createResult.Vpc!.VpcId! as VpcId;
+            yield* session.note(`VPC created: ${newVpcId}`);
+            vpc = yield* waitForVpcAvailable(newVpcId, session);
+          }
 
-        update: Effect.fn(function* ({
-          id,
-          news = {},
-          olds = {},
-          output,
-          session,
-        }) {
-          const vpcId = output.vpcId;
+          const vpcId = vpc.VpcId! as VpcId;
 
-          // Only DNS and metrics settings can be updated
-          // Everything else requires replacement (handled by diff)
+          // Sync DNS attributes — observed cloud state vs desired. The default
+          // values DNS support/hostnames default to differ across new vs
+          // existing VPCs, so we always read first and only modify on a real
+          // delta to avoid pointless API calls.
+          const desiredDnsSupport = news.enableDnsSupport ?? true;
+          const desiredDnsHostnames = news.enableDnsHostnames ?? false;
 
-          if (news.enableDnsSupport !== olds.enableDnsSupport) {
+          const dnsSupportResult = yield* ec2.describeVpcAttribute({
+            VpcId: vpcId,
+            Attribute: "enableDnsSupport",
+          });
+          const currentDnsSupport =
+            dnsSupportResult.EnableDnsSupport?.Value ?? true;
+          if (currentDnsSupport !== desiredDnsSupport) {
             yield* ec2.modifyVpcAttribute({
               VpcId: vpcId,
-              EnableDnsSupport: { Value: news.enableDnsSupport ?? true },
+              EnableDnsSupport: { Value: desiredDnsSupport },
             });
-            yield* session.note("Updated DNS support");
+            yield* session.note(`Updated DNS support: ${desiredDnsSupport}`);
           }
 
-          if (news.enableDnsHostnames !== olds.enableDnsHostnames) {
+          const dnsHostnamesResult = yield* ec2.describeVpcAttribute({
+            VpcId: vpcId,
+            Attribute: "enableDnsHostnames",
+          });
+          const currentDnsHostnames =
+            dnsHostnamesResult.EnableDnsHostnames?.Value ?? false;
+          if (currentDnsHostnames !== desiredDnsHostnames) {
             yield* ec2.modifyVpcAttribute({
               VpcId: vpcId,
-              EnableDnsHostnames: { Value: news.enableDnsHostnames ?? false },
+              EnableDnsHostnames: { Value: desiredDnsHostnames },
             });
-            yield* session.note("Updated DNS hostnames");
+            yield* session.note(
+              `Updated DNS hostnames: ${desiredDnsHostnames}`,
+            );
           }
 
-          // Handle user tag updates
-          const newTags = yield* createTags(id, news.tags);
-          const oldTags = output.tags ?? {};
-          const { removed, upsert } = diffTags(oldTags, newTags);
+          // Sync tags — observed cloud tags vs desired.
+          const currentTags = Object.fromEntries(
+            (vpc.Tags ?? []).map((tag: EC2.Tag) => [tag.Key!, tag.Value!]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(currentTags, desiredTags);
           if (removed.length > 0) {
             yield* ec2.deleteTags({
               Resources: [vpcId],
@@ -324,10 +306,47 @@ export const VpcProvider = () =>
             });
           }
 
+          // Re-read final state so the returned attributes reflect what's
+          // actually in the cloud after all sync steps.
+          const final = yield* ec2.describeVpcs({ VpcIds: [vpcId] });
+          const finalVpc = final.Vpcs?.[0];
+          if (!finalVpc) {
+            return yield* Effect.fail(
+              new Error(`VPC ${vpcId} disappeared during reconcile`),
+            );
+          }
+
           return {
-            ...output,
-            tags: newTags,
-          }; // VPC attributes don't change from these updates
+            vpcId,
+            vpcArn: `arn:aws:ec2:${region}:${accountId}:vpc/${vpcId}` as VpcArn,
+            cidrBlock: finalVpc.CidrBlock!,
+            dhcpOptionsId: finalVpc.DhcpOptionsId!,
+            state: finalVpc.State!,
+            isDefault: finalVpc.IsDefault ?? false,
+            ownerId: finalVpc.OwnerId,
+            cidrBlockAssociationSet: finalVpc.CidrBlockAssociationSet?.map(
+              (assoc) => ({
+                associationId: assoc.AssociationId!,
+                cidrBlock: assoc.CidrBlock!,
+                cidrBlockState: {
+                  state: assoc.CidrBlockState!.State!,
+                  statusMessage: assoc.CidrBlockState!.StatusMessage,
+                },
+              }),
+            ),
+            ipv6CidrBlockAssociationSet:
+              finalVpc.Ipv6CidrBlockAssociationSet?.map((assoc) => ({
+                associationId: assoc.AssociationId!,
+                ipv6CidrBlock: assoc.Ipv6CidrBlock!,
+                ipv6CidrBlockState: {
+                  state: assoc.Ipv6CidrBlockState!.State!,
+                  statusMessage: assoc.Ipv6CidrBlockState!.StatusMessage,
+                },
+                networkBorderGroup: assoc.NetworkBorderGroup,
+                ipv6Pool: assoc.Ipv6Pool,
+              })),
+            tags: desiredTags,
+          };
         }),
 
         delete: Effect.fn(function* ({ output, session }) {