alchemy 2.0.0-beta.52 → 2.0.0-beta.53

package/src/AWS/EC2/EgressOnlyInternetGateway.ts

@@ -1,14 +1,13 @@
 import * as ec2 from "@distilled.cloud/aws/ec2";
-import { Region } from "@distilled.cloud/aws/Region";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
-import type { Providers } from "../Providers.ts";
 import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
 import type { AccountID } from "../Environment.ts";
 import { AWSEnvironment } from "../Environment.ts";
+import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
 import type { VpcId } from "./Vpc.ts";
 
@@ -74,9 +73,6 @@ export const EgressOnlyInternetGatewayProvider = () =>
   Provider.effect(
     EgressOnlyInternetGateway,
     Effect.gen(function* () {
-      const region = yield* Region;
-      const { accountId } = yield* AWSEnvironment;
-
       const createTags = Effect.fn(function* (
         id: string,
         tags?: Record<string, string>,
@@ -106,16 +102,23 @@ export const EgressOnlyInternetGatewayProvider = () =>
             ),
           );
 
-      const toAttrs = (gw: ec2.EgressOnlyInternetGateway) => ({
-        egressOnlyInternetGatewayId:
-          gw.EgressOnlyInternetGatewayId as EgressOnlyInternetGatewayId,
-        egressOnlyInternetGatewayArn:
-          `arn:aws:ec2:${region}:${accountId}:egress-only-internet-gateway/${gw.EgressOnlyInternetGatewayId}` as EgressOnlyInternetGatewayArn,
-        attachments: gw.Attachments?.map((a) => ({
-          state: a.State as "attaching" | "attached" | "detaching" | "detached",
-          vpcId: a.VpcId as VpcId,
-        })),
-      });
+      const toAttrs = (gw: ec2.EgressOnlyInternetGateway) =>
+        AWSEnvironment.current.pipe(
+          Effect.map((env) => ({
+            egressOnlyInternetGatewayId:
+              gw.EgressOnlyInternetGatewayId as EgressOnlyInternetGatewayId,
+            egressOnlyInternetGatewayArn:
+              `arn:aws:ec2:${env.region}:${env.accountId}:egress-only-internet-gateway/${gw.EgressOnlyInternetGatewayId}` as EgressOnlyInternetGatewayArn,
+            attachments: gw.Attachments?.map((a) => ({
+              state: a.State as
+                | "attaching"
+                | "attached"
+                | "detaching"
+                | "detached",
+              vpcId: a.VpcId as VpcId,
+            })),
+          })),
+        );
 
       return {
         stables: [
@@ -128,7 +131,7 @@ export const EgressOnlyInternetGatewayProvider = () =>
           const gw = yield* describeEgressOnlyInternetGateway(
             output.egressOnlyInternetGatewayId,
           );
-          return toAttrs(gw);
+          return yield* toAttrs(gw);
         }),
 
         diff: Effect.fn(function* ({ news, olds }) {
@@ -222,7 +225,7 @@ export const EgressOnlyInternetGatewayProvider = () =>
 
           // Re-read to reflect current cloud state in the returned attributes.
           const final = yield* describeEgressOnlyInternetGateway(eigwId);
-          return toAttrs(final);
+          return yield* toAttrs(final);
         }),
 
         delete: Effect.fn(function* ({ output, session }) {

package/src/AWS/EC2/Instance.ts

@@ -4,7 +4,6 @@ import { Region } from "@distilled.cloud/aws/Region";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
-import * as Option from "effect/Option";
 import * as Schedule from "effect/Schedule";
 import * as Stream from "effect/Stream";
 import type * as rolldown from "rolldown";
@@ -23,7 +22,6 @@ import {
   createInternalTags,
   diffTags,
 } from "../../Tags.ts";
-import { Assets } from "../Assets.ts";
 import type { AccountID } from "../Environment.ts";
 import { AWSEnvironment } from "../Environment.ts";
 import type { PolicyStatement } from "../IAM/Policy.ts";
@@ -259,7 +257,11 @@ export interface Instance extends Resource<
   Providers
 > {}
 
-export type InstanceServices = ServerHost | Credentials | Region;
+export type InstanceServices =
+  | ServerHost
+  | Credentials
+  | Region
+  | AWSEnvironment;
 
 export type InstanceShape = Main<InstanceServices>;
 
@@ -315,27 +317,24 @@ export const InstanceProvider = () =>
   Provider.effect(
     Instance,
     Effect.gen(function* () {
-      const region = yield* Region;
-      const { accountId } = yield* AWSEnvironment;
       const stack = yield* Stack;
       const stage = yield* Stage;
       const fs = yield* FileSystem.FileSystem;
       const virtualEntryPlugin = yield* Bundle.virtualEntryPlugin;
-      const assets = (yield* Effect.serviceOption(Assets)).pipe(
-        Option.getOrUndefined,
-      );
 
       const toInstanceArn = (instanceId: InstanceId) =>
-        `arn:aws:ec2:${region}:${accountId}:instance/${instanceId}` as InstanceArn;
+        AWSEnvironment.current.pipe(
+          Effect.map(
+            (env) =>
+              `arn:aws:ec2:${env.region}:${env.accountId}:instance/${instanceId}` as InstanceArn,
+          ),
+        );
 
       const hosted = createEc2HostedSupport({
-        accountId,
-        region,
         stackName: stack.name,
         stage,
         fs,
         virtualEntryPlugin,
-        assets,
         resourceType: "EC2.Instance",
       });
 
@@ -387,34 +386,36 @@ export const InstanceProvider = () =>
             .map((tag) => [tag.Key, tag.Value]),
         );
 
-      const toAttributes = (
+      const toAttributes = Effect.fnUntraced(function* (
         instance: ec2.Instance,
-      ): Instance["Attributes"] => ({
-        instanceId: instance.InstanceId as InstanceId,
-        instanceArn: toInstanceArn(instance.InstanceId as InstanceId),
-        imageId: instance.ImageId!,
-        instanceType: String(instance.InstanceType ?? ""),
-        state: instance.State?.Name ?? "unknown",
-        vpcId: instance.VpcId as VpcId | undefined,
-        subnetId: instance.SubnetId as SubnetId | undefined,
-        availabilityZone: instance.Placement?.AvailabilityZone,
-        securityGroupIds: (instance.SecurityGroups ?? [])
-          .map((group) => group.GroupId)
-          .filter((value): value is string => Boolean(value)),
-        privateIpAddress: instance.PrivateIpAddress,
-        publicIpAddress: instance.PublicIpAddress,
-        privateDnsName: instance.PrivateDnsName,
-        publicDnsName: instance.PublicDnsName,
-        keyName: instance.KeyName,
-        instanceProfileArn: instance.IamInstanceProfile?.Arn,
-        instanceProfileId: instance.IamInstanceProfile?.Id,
-        instanceProfileName: undefined,
-        sourceDestCheck: instance.SourceDestCheck,
-        launchTime:
-          instance.LaunchTime instanceof Date
-            ? instance.LaunchTime.toISOString()
-            : (instance.LaunchTime as string | undefined),
-        tags: toTagRecord(instance.Tags),
+      ) {
+        return {
+          instanceId: instance.InstanceId as InstanceId,
+          instanceArn: yield* toInstanceArn(instance.InstanceId as InstanceId),
+          imageId: instance.ImageId!,
+          instanceType: String(instance.InstanceType ?? ""),
+          state: instance.State?.Name ?? "unknown",
+          vpcId: instance.VpcId as VpcId | undefined,
+          subnetId: instance.SubnetId as SubnetId | undefined,
+          availabilityZone: instance.Placement?.AvailabilityZone,
+          securityGroupIds: (instance.SecurityGroups ?? [])
+            .map((group) => group.GroupId)
+            .filter((value): value is string => Boolean(value)),
+          privateIpAddress: instance.PrivateIpAddress,
+          publicIpAddress: instance.PublicIpAddress,
+          privateDnsName: instance.PrivateDnsName,
+          publicDnsName: instance.PublicDnsName,
+          keyName: instance.KeyName,
+          instanceProfileArn: instance.IamInstanceProfile?.Arn,
+          instanceProfileId: instance.IamInstanceProfile?.Id,
+          instanceProfileName: undefined,
+          sourceDestCheck: instance.SourceDestCheck,
+          launchTime:
+            instance.LaunchTime instanceof Date
+              ? instance.LaunchTime.toISOString()
+              : (instance.LaunchTime as string | undefined),
+          tags: toTagRecord(instance.Tags),
+        } satisfies Instance["Attributes"];
       });
 
       const describeInstance = (instanceId: string) =>
@@ -625,7 +626,7 @@ export const InstanceProvider = () =>
             : yield* findInstanceByTags(id);
           return instance
             ? {
-                ...toAttributes(instance),
+                ...(yield* toAttributes(instance)),
                 instanceProfileName: output?.instanceProfileName,
                 roleArn: output?.roleArn,
                 roleName: output?.roleName,
@@ -813,7 +814,7 @@ export const InstanceProvider = () =>
           // Re-read final state so attributes reflect the post-sync cloud.
           const final = yield* describeInstance(instanceId);
           return {
-            ...toAttributes(final),
+            ...(yield* toAttributes(final)),
             instanceProfileName:
               runtime.instanceProfileName ?? output?.instanceProfileName,
             roleArn: runtime.roleArn ?? output?.roleArn,

package/src/AWS/EC2/InternetGateway.ts

@@ -1,14 +1,12 @@
 import * as ec2 from "@distilled.cloud/aws/ec2";
-import { Region } from "@distilled.cloud/aws/Region";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
 import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
-import type { Providers } from "../Providers.ts";
 import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
-import type { AccountID } from "../Environment.ts";
-import { AWSEnvironment } from "../Environment.ts";
+import { AWSEnvironment, type AccountID } from "../Environment.ts";
+import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
 import type { VpcId } from "./Vpc.ts";
 
@@ -71,15 +69,13 @@ export const InternetGatewayProvider = () =>
   Provider.effect(
     InternetGateway,
     Effect.gen(function* () {
-      const region = yield* Region;
-      const { accountId } = yield* AWSEnvironment;
-
       return {
         stables: ["internetGatewayId", "internetGatewayArn", "ownerId"],
 
         reconcile: Effect.fn(function* ({ id, news = {}, output, session }) {
+          const { accountId, region } = yield* AWSEnvironment.current;
           const alchemyTags = yield* createInternalTags(id);
-          const desiredTags = { ...alchemyTags, ...(news.tags ?? {}) };
+          const desiredTags = { ...alchemyTags, ...news.tags };
 
           // Observe — find the IGW via cached id, else fall through to create.
           let igw: ec2.InternetGateway | undefined;

package/src/AWS/EC2/NatGateway.ts

@@ -1,5 +1,4 @@
 import * as ec2 from "@distilled.cloud/aws/ec2";
-import { Region } from "@distilled.cloud/aws/Region";
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
@@ -8,7 +7,6 @@ import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
-import type { Providers } from "../Providers.ts";
 import {
   createAlchemyTagFilters,
   createInternalTags,
@@ -17,6 +15,7 @@ import {
 } from "../../Tags.ts";
 import type { AccountID } from "../Environment.ts";
 import { AWSEnvironment } from "../Environment.ts";
+import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
 import type { AllocationId } from "./EIP.ts";
 import type { SubnetId } from "./Subnet.ts";
@@ -165,9 +164,6 @@ export const NatGatewayProvider = () =>
   Provider.effect(
     NatGateway,
     Effect.gen(function* () {
-      const region = yield* Region;
-      const { accountId } = yield* AWSEnvironment;
-
       const createTags = Effect.fn(function* (
         id: string,
         tags?: Record<string, string>,
@@ -189,7 +185,8 @@ export const NatGatewayProvider = () =>
           ),
         );
 
-      const toAttrs = (gw: ec2.NatGateway): NatGateway["Attributes"] => {
+      const toAttrs = Effect.fnUntraced(function* (gw: ec2.NatGateway) {
+        const { accountId, region } = yield* AWSEnvironment.current;
         const primaryAddress =
           gw.NatGatewayAddresses?.find((a) => a.IsPrimary) ??
           gw.NatGatewayAddresses?.[0];
@@ -223,8 +220,8 @@ export const NatGatewayProvider = () =>
             gw.DeleteTime instanceof Date
               ? gw.DeleteTime.toISOString()
               : (gw.DeleteTime as string | undefined),
-        };
-      };
+        } satisfies NatGateway["Attributes"];
+      });
 
       // Find NAT Gateway by alchemy tags when we don't have the ID
       const findNatGatewayByTags = Effect.fn(function* (id: string) {
@@ -244,13 +241,15 @@ export const NatGatewayProvider = () =>
         read: Effect.fn(function* ({ id, output }) {
           if (output) {
             // We have the NAT Gateway ID, use it directly
-            return toAttrs(yield* describeNatGateway(output.natGatewayId));
+            return yield* toAttrs(
+              yield* describeNatGateway(output.natGatewayId),
+            );
           }
 
           // No output - try to find by tags (recovery from incomplete create)
           const gw = yield* findNatGatewayByTags(id);
           if (gw) {
-            return toAttrs(gw);
+            return yield* toAttrs(gw);
           }
 
           // Not found
@@ -365,7 +364,7 @@ export const NatGatewayProvider = () =>
 
           // Re-read final state.
           const final = yield* describeNatGateway(natGatewayId);
-          return toAttrs(final);
+          return yield* toAttrs(final);
         }),
 
         delete: Effect.fn(function* ({ output, session }) {

package/src/AWS/EC2/Network.ts

@@ -1,7 +1,7 @@
 import * as ec2 from "@distilled.cloud/aws/ec2";
-import { Region } from "@distilled.cloud/aws/Region";
 import * as Effect from "effect/Effect";
 import * as Namespace from "../../Namespace.ts";
+import { AWSEnvironment } from "../Environment.ts";
 import type { EIP as EIPResource } from "./EIP.ts";
 import { EIP } from "./EIP.ts";
 import type { InternetGateway as InternetGatewayResource } from "./InternetGateway.ts";
@@ -306,7 +306,7 @@ export const Network = (id: string, props: NetworkProps) =>
         }
       }
 
-      const region = yield* Region;
+      const { region } = yield* AWSEnvironment.current;
       const gatewayEndpoints: VpcEndpointResource[] = [];
       for (const service of uniqueGatewayEndpoints(props.gatewayEndpoints)) {
         gatewayEndpoints.push(

package/src/AWS/EC2/NetworkAcl.ts

@@ -1,15 +1,14 @@
 import * as ec2 from "@distilled.cloud/aws/ec2";
-import { Region } from "@distilled.cloud/aws/Region";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
 
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
-import type { Providers } from "../Providers.ts";
 import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
 import type { AccountID } from "../Environment.ts";
 import { AWSEnvironment } from "../Environment.ts";
+import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
 import type { VpcId } from "./Vpc.ts";
 
@@ -73,9 +72,6 @@ export const NetworkAclProvider = () =>
   Provider.effect(
     NetworkAcl,
     Effect.gen(function* () {
-      const region = yield* Region;
-      const { accountId } = yield* AWSEnvironment;
-
       const createTags = Effect.fn(function* (
         id: string,
         tags?: Record<string, string>,
@@ -97,38 +93,41 @@ export const NetworkAclProvider = () =>
           ),
         );
 
-      const toAttrs = (acl: ec2.NetworkAcl) => ({
-        networkAclId: acl.NetworkAclId as NetworkAclId,
-        networkAclArn:
-          `arn:aws:ec2:${region}:${accountId}:network-acl/${acl.NetworkAclId}` as NetworkAclArn,
-        vpcId: acl.VpcId as VpcId,
-        isDefault: acl.IsDefault ?? false,
-        ownerId: acl.OwnerId!,
-        entries: acl.Entries?.map((e) => ({
-          ruleNumber: e.RuleNumber!,
-          protocol: e.Protocol!,
-          ruleAction: e.RuleAction!,
-          egress: e.Egress!,
-          cidrBlock: e.CidrBlock,
-          ipv6CidrBlock: e.Ipv6CidrBlock,
-          icmpTypeCode: e.IcmpTypeCode
-            ? {
-                code: e.IcmpTypeCode.Code,
-                type: e.IcmpTypeCode.Type,
-              }
-            : undefined,
-          portRange: e.PortRange
-            ? {
-                from: e.PortRange.From,
-                to: e.PortRange.To,
-              }
-            : undefined,
-        })),
-        associations: acl.Associations?.map((a) => ({
-          networkAclAssociationId: a.NetworkAclAssociationId!,
-          networkAclId: a.NetworkAclId!,
-          subnetId: a.SubnetId!,
-        })),
+      const toAttrs = Effect.fnUntraced(function* (acl: ec2.NetworkAcl) {
+        const { accountId, region } = yield* AWSEnvironment.current;
+        return {
+          networkAclId: acl.NetworkAclId as NetworkAclId,
+          networkAclArn:
+            `arn:aws:ec2:${region}:${accountId}:network-acl/${acl.NetworkAclId}` as NetworkAclArn,
+          vpcId: acl.VpcId as VpcId,
+          isDefault: acl.IsDefault ?? false,
+          ownerId: acl.OwnerId!,
+          entries: acl.Entries?.map((e) => ({
+            ruleNumber: e.RuleNumber!,
+            protocol: e.Protocol!,
+            ruleAction: e.RuleAction!,
+            egress: e.Egress!,
+            cidrBlock: e.CidrBlock,
+            ipv6CidrBlock: e.Ipv6CidrBlock,
+            icmpTypeCode: e.IcmpTypeCode
+              ? {
+                  code: e.IcmpTypeCode.Code,
+                  type: e.IcmpTypeCode.Type,
+                }
+              : undefined,
+            portRange: e.PortRange
+              ? {
+                  from: e.PortRange.From,
+                  to: e.PortRange.To,
+                }
+              : undefined,
+          })),
+          associations: acl.Associations?.map((a) => ({
+            networkAclAssociationId: a.NetworkAclAssociationId!,
+            networkAclId: a.NetworkAclId!,
+            subnetId: a.SubnetId!,
+          })),
+        } satisfies NetworkAcl["Attributes"];
       });
 
       return {
@@ -137,7 +136,7 @@ export const NetworkAclProvider = () =>
         read: Effect.fn(function* ({ output }) {
           if (!output) return undefined;
           const acl = yield* describeNetworkAcl(output.networkAclId);
-          return toAttrs(acl);
+          return yield* toAttrs(acl);
         }),
 
         diff: Effect.fn(function* ({ news, olds }) {
@@ -207,7 +206,7 @@ export const NetworkAclProvider = () =>
 
           // Re-read final state.
           const final = yield* describeNetworkAcl(networkAclId);
-          return toAttrs(final);
+          return yield* toAttrs(final);
         }),
 
         delete: Effect.fn(function* ({ output, session }) {

package/src/AWS/EC2/RouteTable.ts

@@ -1,6 +1,5 @@
 import type * as EC2 from "@distilled.cloud/aws/ec2";
 import * as ec2 from "@distilled.cloud/aws/ec2";
-import { Region } from "@distilled.cloud/aws/Region";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
 
@@ -8,10 +7,10 @@ import type { ScopedPlanStatusSession } from "../../Cli/Cli.ts";
 import { isResolved } from "../../Diff.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
-import type { Providers } from "../Providers.ts";
 import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
 import type { AccountID } from "../Environment.ts";
 import { AWSEnvironment } from "../Environment.ts";
+import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
 import type { VpcId } from "./Vpc.ts";
 
@@ -177,9 +176,6 @@ export const RouteTableProvider = () =>
   Provider.effect(
     RouteTable,
     Effect.gen(function* () {
-      const region = yield* Region;
-      const { accountId } = yield* AWSEnvironment;
-
       return {
         stables: ["routeTableId", "ownerId", "routeTableArn", "vpcId"],
         diff: Effect.fn(function* ({ news, olds }) {
@@ -192,8 +188,9 @@ export const RouteTableProvider = () =>
         }),
 
         reconcile: Effect.fn(function* ({ id, news, output, session }) {
+          const { accountId, region } = yield* AWSEnvironment.current;
           const alchemyTags = yield* createInternalTags(id);
-          const desiredTags = { ...alchemyTags, ...(news.tags ?? {}) };
+          const desiredTags = { ...alchemyTags, ...news.tags };
 
           // Observe — find the route table via cached id, else fall through
           // to create.

package/src/AWS/EC2/SecurityGroup.ts

@@ -1,15 +1,14 @@
 import * as ec2 from "@distilled.cloud/aws/ec2";
-import { Region } from "@distilled.cloud/aws/Region";
 import * as Effect from "effect/Effect";
 import * as Schedule from "effect/Schedule";
 import { isResolved } from "../../Diff.ts";
 import { createPhysicalName } from "../../PhysicalName.ts";
 import * as Provider from "../../Provider.ts";
 import { Resource } from "../../Resource.ts";
-import type { Providers } from "../Providers.ts";
 import { createInternalTags, createTagsList, diffTags } from "../../Tags.ts";
 import type { AccountID } from "../Environment.ts";
 import { AWSEnvironment } from "../Environment.ts";
+import type { Providers } from "../Providers.ts";
 import type { RegionID } from "../Region.ts";
 import type { VpcId } from "./Vpc.ts";
 
@@ -180,9 +179,6 @@ export const SecurityGroupProvider = () =>
   Provider.effect(
     SecurityGroup,
     Effect.gen(function* () {
-      const region = yield* Region;
-      const { accountId } = yield* AWSEnvironment;
-
       const createTags = Effect.fn(function* (
         id: string,
         tags?: Record<string, string>,
@@ -215,45 +211,48 @@ export const SecurityGroupProvider = () =>
           Filters: [{ Name: "group-id", Values: [groupId] }],
         });
 
-      const toAttrs = (
+      const toAttrs = Effect.fnUntraced(function* (
         sg: ec2.SecurityGroup,
         rules: ec2.SecurityGroupRule[],
-      ): SecurityGroup["Attributes"] => ({
-        groupId: sg.GroupId as SecurityGroupId,
-        groupArn:
-          `arn:aws:ec2:${region}:${accountId}:security-group/${sg.GroupId as SecurityGroupId}` as SecurityGroupArn,
-        groupName: sg.GroupName!,
-        description: sg.Description!,
-        vpcId: sg.VpcId as VpcId,
-        ownerId: sg.OwnerId!,
-        ingressRules: rules
-          .filter((r) => !r.IsEgress)
-          .map((r) => ({
-            securityGroupRuleId: r.SecurityGroupRuleId!,
-            ipProtocol: r.IpProtocol!,
-            fromPort: r.FromPort,
-            toPort: r.ToPort,
-            cidrIpv4: r.CidrIpv4,
-            cidrIpv6: r.CidrIpv6,
-            referencedGroupId: r.ReferencedGroupInfo?.GroupId,
-            prefixListId: r.PrefixListId,
-            description: r.Description,
-            isEgress: false as const,
-          })),
-        egressRules: rules
-          .filter((r) => r.IsEgress)
-          .map((r) => ({
-            securityGroupRuleId: r.SecurityGroupRuleId!,
-            ipProtocol: r.IpProtocol!,
-            fromPort: r.FromPort,
-            toPort: r.ToPort,
-            cidrIpv4: r.CidrIpv4,
-            cidrIpv6: r.CidrIpv6,
-            referencedGroupId: r.ReferencedGroupInfo?.GroupId,
-            prefixListId: r.PrefixListId,
-            description: r.Description,
-            isEgress: true as const,
-          })),
+      ) {
+        const { accountId, region } = yield* AWSEnvironment.current;
+        return {
+          groupId: sg.GroupId as SecurityGroupId,
+          groupArn:
+            `arn:aws:ec2:${region}:${accountId}:security-group/${sg.GroupId as SecurityGroupId}` as SecurityGroupArn,
+          groupName: sg.GroupName!,
+          description: sg.Description!,
+          vpcId: sg.VpcId as VpcId,
+          ownerId: sg.OwnerId!,
+          ingressRules: rules
+            .filter((r) => !r.IsEgress)
+            .map((r) => ({
+              securityGroupRuleId: r.SecurityGroupRuleId!,
+              ipProtocol: r.IpProtocol!,
+              fromPort: r.FromPort,
+              toPort: r.ToPort,
+              cidrIpv4: r.CidrIpv4,
+              cidrIpv6: r.CidrIpv6,
+              referencedGroupId: r.ReferencedGroupInfo?.GroupId,
+              prefixListId: r.PrefixListId,
+              description: r.Description,
+              isEgress: false as const,
+            })),
+          egressRules: rules
+            .filter((r) => r.IsEgress)
+            .map((r) => ({
+              securityGroupRuleId: r.SecurityGroupRuleId!,
+              ipProtocol: r.IpProtocol!,
+              fromPort: r.FromPort,
+              toPort: r.ToPort,
+              cidrIpv4: r.CidrIpv4,
+              cidrIpv6: r.CidrIpv6,
+              referencedGroupId: r.ReferencedGroupInfo?.GroupId,
+              prefixListId: r.PrefixListId,
+              description: r.Description,
+              isEgress: true as const,
+            })),
+        } satisfies SecurityGroup["Attributes"];
       });
 
       const toIpPermission = (
@@ -293,7 +292,7 @@ export const SecurityGroupProvider = () =>
           if (!output) return undefined;
           const sg = yield* describeSecurityGroup(output.groupId);
           const rulesResult = yield* describeSecurityGroupRules(output.groupId);
-          return toAttrs(sg, rulesResult.SecurityGroupRules ?? []);
+          return yield* toAttrs(sg, rulesResult.SecurityGroupRules ?? []);
         }),
 
         diff: Effect.fn(function* ({ id, news, olds, output }) {
@@ -450,7 +449,7 @@ export const SecurityGroupProvider = () =>
           // Re-read final state.
           const finalSg = yield* describeSecurityGroup(groupId);
           const finalRules = yield* describeSecurityGroupRules(groupId);
-          return toAttrs(finalSg, finalRules.SecurityGroupRules ?? []);
+          return yield* toAttrs(finalSg, finalRules.SecurityGroupRules ?? []);
         }),
 
         delete: Effect.fn(function* ({ output, session }) {