alchemy 2.0.0-beta.59 → 2.0.0-beta.60

package/src/AWS/Credentials.ts

@@ -1,9 +1,29 @@
-import { Credentials } from "@distilled.cloud/aws/Credentials";
+import {
+  AwsCredentialProviderError,
+  Credentials,
+  type ResolvedCredentials,
+} from "@distilled.cloud/aws/Credentials";
+import { Region } from "@distilled.cloud/aws/Region";
+import * as sts from "@distilled.cloud/aws/sts";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import * as Ref from "effect/Ref";
+import * as Schedule from "effect/Schedule";
+import * as Semaphore from "effect/Semaphore";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
 import { AWSEnvironment } from "./Environment.ts";
 
-export { Credentials } from "@distilled.cloud/aws/Credentials";
+/**
+ * Refresh assumed-role credentials this long before they actually expire, so a
+ * request never signs with credentials on the verge of expiring.
+ */
+const CREDENTIAL_REFRESH_WINDOW_MS = 5 * 60 * 1000;
+
+// NB: do not re-export `fromEnv` here — it is unavailable under the
+// browser/workerd bundle condition (`credentials.browser`), which would break
+// any Cloudflare Worker that transitively imports this module.
+export { Credentials, fromCredentials } from "@distilled.cloud/aws/Credentials";
 
 declare module "@distilled.cloud/aws/Credentials" {
   interface Credentials {
@@ -22,3 +42,159 @@ export const fromEnvironment = Layer.effect(
     return Effect.flatMap(yield* AWSEnvironment, (env) => env.credentials);
   }),
 );
+
+/**
+ * Build a single-flight, expiry-aware assumed-role credentials **resolver**,
+ * constructing the cache (a `Ref` + a 1-permit refresh semaphore) exactly once.
+ *
+ * The OUTER effect builds the cache and returns the INNER resolver; run the
+ * outer ONCE (e.g. when a binding initializes) and reuse the returned resolver
+ * for every request. That is what makes the cache actually cache: each request
+ * runs the shared resolver, which only calls `AssumeRole` when the cached
+ * credentials are missing or within the refresh window — never per request.
+ *
+ * `roleArn` and `base` are accepted as effects/layers so the long-lived signing
+ * credentials and role ARN can be read lazily at refresh time (e.g. from a
+ * deployed Worker's environment), rather than captured eagerly.
+ */
+export const makeAssumeRoleResolver = (options: {
+  /** ARN of the IAM Role to assume (resolved lazily on each refresh). */
+  readonly roleArn: Effect.Effect<string>;
+  /** Layer supplying the long-lived credentials used to sign `AssumeRole`. */
+  readonly base: Layer.Layer<Credentials>;
+  /** STS role session name. @default "alchemy-microvm" */
+  readonly roleSessionName?: string;
+  /**
+   * Region for the STS endpoint. STS `AssumeRole` is global, so this only
+   * selects the regional STS endpoint. @default "us-east-1"
+   */
+  readonly region?: string;
+}): Effect.Effect<
+  Effect.Effect<ResolvedCredentials, AwsCredentialProviderError>
+> =>
+  Effect.gen(function* () {
+    const resolve = Effect.gen(function* () {
+      const roleArn = yield* options.roleArn;
+      const response = yield* sts
+        .assumeRole({
+          RoleArn: roleArn,
+          RoleSessionName: options.roleSessionName ?? "alchemy-microvm",
+        })
+        .pipe(
+          // A freshly-created IAM user/role/access-key is eventually
+          // consistent: the first `AssumeRole` calls can fail with
+          // `AccessDenied` until the trust policy + permissions propagate.
+          // Retry those for up to ~30s.
+          Effect.retry({
+            while: (error) =>
+              (error as { name?: string }).name === "AccessDeniedException" ||
+              (error as { _tag?: string })._tag === "AccessDeniedException",
+            schedule: Schedule.exponential("1 second"),
+            times: 8,
+          }),
+        );
+      const creds = response.Credentials;
+      if (!creds) {
+        return yield* new AwsCredentialProviderError({
+          message: "STS AssumeRole returned no credentials",
+          provider: "assume-role",
+        });
+      }
+      return {
+        accessKeyId: Redacted.make(creds.AccessKeyId),
+        secretAccessKey: Redacted.isRedacted(creds.SecretAccessKey)
+          ? creds.SecretAccessKey
+          : Redacted.make(creds.SecretAccessKey),
+        sessionToken: Redacted.make(creds.SessionToken),
+        expiration: creds.Expiration?.getTime(),
+      } satisfies ResolvedCredentials;
+    }).pipe(
+      // Sign AssumeRole with the static base credentials, and provide a
+      // (regional) STS endpoint + HttpClient so the resolve effect is
+      // self-contained (`R = never`).
+      Effect.provide(options.base),
+      Effect.provide(
+        Layer.succeed(Region, Effect.succeed(options.region ?? "us-east-1")),
+      ),
+      Effect.provide(FetchHttpClient.layer),
+      Effect.mapError((cause) =>
+        cause instanceof AwsCredentialProviderError
+          ? cause
+          : new AwsCredentialProviderError({
+              message: "STS AssumeRole failed",
+              provider: "assume-role",
+              cause,
+            }),
+      ),
+    );
+
+    // Single-flight, expiry-aware cache. A `Ref` holds the last-resolved
+    // credentials; a 1-permit semaphore serializes refreshes so that N
+    // concurrent callers observing stale/expiring credentials trigger
+    // exactly ONE `AssumeRole` call (the rest await the permit and then see
+    // the freshly-cached value via the re-check inside the critical section).
+    const cache = yield* Ref.make<ResolvedCredentials | undefined>(undefined);
+    const refreshLock = yield* Semaphore.make(1);
+
+    const isFresh = (
+      creds: ResolvedCredentials | undefined,
+    ): creds is ResolvedCredentials =>
+      creds !== undefined &&
+      (creds.expiration === undefined ||
+        creds.expiration - CREDENTIAL_REFRESH_WINDOW_MS > Date.now());
+
+    return Effect.gen(function* () {
+      const current = yield* Ref.get(cache);
+      // Fast path: cached and not within the refresh window.
+      if (isFresh(current)) return current;
+      // Slow path: acquire the refresh permit, re-check (another fiber may
+      // have refreshed while we waited), then resolve once and cache.
+      return yield* refreshLock.withPermits(1)(
+        Effect.gen(function* () {
+          const latest = yield* Ref.get(cache);
+          if (isFresh(latest)) return latest;
+          const resolved = yield* resolve;
+          yield* Ref.set(cache, resolved);
+          return resolved;
+        }),
+      );
+    });
+  });
+
+/**
+ * A `Credentials` layer that assumes an IAM Role via STS and serves the
+ * returned temporary credentials (cached until shortly before expiry).
+ *
+ * `base` supplies the long-lived credentials used to *sign* the `AssumeRole`
+ * call — typically static IAM-user access keys (see
+ * {@link fromCredentials}). The `AssumeRole` request itself is signed against
+ * `base`, while the temporary credentials it returns become the resolved
+ * `Credentials` for every downstream AWS call.
+ *
+ * The cache is built once when the layer is constructed; build/provide this
+ * layer ONCE and reuse it. To share the same cache across many `Effect.provide`
+ * sites without re-providing the layer, build {@link makeAssumeRoleResolver}
+ * directly and supply the resolver via `Layer.succeed(Credentials, resolver)`.
+ */
+export const fromAssumeRole = (options: {
+  /** ARN of the IAM Role to assume. */
+  readonly roleArn: string;
+  /** Static credentials used to sign the `AssumeRole` call. */
+  readonly base: Layer.Layer<Credentials>;
+  /** STS role session name. @default "alchemy-microvm" */
+  readonly roleSessionName?: string;
+  /**
+   * Region for the STS endpoint. STS `AssumeRole` is global, so this only
+   * selects the regional STS endpoint. @default "us-east-1"
+   */
+  readonly region?: string;
+}): Layer.Layer<Credentials> =>
+  Layer.effect(
+    Credentials,
+    makeAssumeRoleResolver({
+      roleArn: Effect.succeed(options.roleArn),
+      base: options.base,
+      roleSessionName: options.roleSessionName,
+      region: options.region,
+    }),
+  );

package/src/AWS/EC2/Image.ts

@@ -66,7 +66,10 @@ export const amazonLinux2023 = (options?: {
 }) =>
   findLatestImage({
     owners: ["amazon"],
-    name: ["al2023-ami-*-*"],
+    // `al2023-ami-2023.*` selects the standard image. The broader
+    // `al2023-ami-*` also matches `al2023-ami-minimal-*`, which ships without
+    // the SSM agent and a stripped toolset and frequently sorts newest.
+    name: ["al2023-ami-2023.*"],
     architecture: options?.architecture,
     description: "Amazon Linux 2023",
   });

package/src/AWS/EC2/Instance.ts

@@ -70,9 +70,10 @@ export interface InstanceProps extends PlatformProps {
    */
   securityGroupIds?: Input<SecurityGroupId>[];
   /**
-   * Optional EC2 key pair name for SSH access.
+   * Optional EC2 key pair name for SSH access. Accepts a reference such as
+   * `AWS.EC2.KeyPair(...).keyName`.
    */
-  keyName?: string;
+  keyName?: Input<string>;
   /**
    * Optional IAM instance profile name to attach at launch.
    */
@@ -290,7 +291,7 @@ export type InstanceRuntimeContext = Ec2HostRuntimeContext;
  *   );
  *
  *   return {
- *     main: import.meta.filename,
+ *     main: import.meta.url,
  *     imageId,
  *     instanceType: "t3.small",
  *     subnetId: subnet.subnetId,
@@ -527,8 +528,10 @@ export const InstanceProvider = () =>
           ),
           Effect.retry({
             while: (error) => error instanceof InstanceStillExists,
-            schedule: Schedule.exponential("250 millis").pipe(
-              Schedule.both(Schedule.recurs(8)),
+            // Termination (shutting-down -> terminated) can take a couple of
+            // minutes; the prior ~64s budget timed out intermittently.
+            schedule: Schedule.spaced("5 seconds").pipe(
+              Schedule.both(Schedule.recurs(48)),
             ),
           }),
           Effect.catchTag("InvalidInstanceID.NotFound", () => Effect.void),
@@ -553,7 +556,7 @@ export const InstanceProvider = () =>
             {
               imageId: news.imageId,
               instanceType: news.instanceType,
-              keyName: news.keyName,
+              keyName: news.keyName as string | undefined,
               subnetId: news.subnetId as string | undefined,
               securityGroupIds: news.securityGroupIds as string[] | undefined,
               associatePublicIpAddress: news.associatePublicIpAddress,

package/src/AWS/EC2/KeyPair.ts

@@ -0,0 +1,319 @@
+import * as ec2 from "@distilled.cloud/aws/ec2";
+import * as Effect from "effect/Effect";
+import * as Redacted from "effect/Redacted";
+import { Unowned } from "../../AdoptPolicy.ts";
+import { isResolved } from "../../Diff.ts";
+import { createPhysicalName } from "../../PhysicalName.ts";
+import * as Provider from "../../Provider.ts";
+import { Resource } from "../../Resource.ts";
+import {
+  createInternalTags,
+  createTagsList,
+  diffTags,
+  hasTags,
+} from "../../Tags.ts";
+import type { Providers } from "../Providers.ts";
+
+export type KeyPairId<ID extends string = string> = `key-${ID}`;
+
+/** Key algorithm for a generated EC2 key pair. */
+export type KeyPairType = "rsa" | "ed25519";
+
+/** Private-key file format for a generated EC2 key pair. */
+export type KeyPairFormat = "pem" | "ppk";
+
+export interface KeyPairProps {
+  /**
+   * Name of the key pair. If omitted, a unique name is generated from the
+   * stack, stage, and logical id. Changing it replaces the key pair.
+   */
+  keyName?: string;
+  /**
+   * Algorithm used when Alchemy generates the key pair. Ignored when
+   * {@link publicKeyMaterial} is supplied (an imported key keeps its own type).
+   * Changing it replaces the key pair.
+   * @default "rsa"
+   */
+  keyType?: KeyPairType;
+  /**
+   * Format of the returned private key material. Only meaningful when Alchemy
+   * generates the key pair. Changing it replaces the key pair.
+   * @default "pem"
+   */
+  keyFormat?: KeyPairFormat;
+  /**
+   * Public key material (PEM or OpenSSH) to import instead of generating a new
+   * key pair. When set, AWS stores only the public key — no `privateKey` is
+   * returned. Changing it replaces the key pair.
+   */
+  publicKeyMaterial?: string;
+  /**
+   * Tags to assign to the key pair. Merged with the alchemy auto-tags.
+   */
+  tags?: Record<string, string>;
+}
+
+export interface KeyPair extends Resource<
+  "AWS.EC2.KeyPair",
+  KeyPairProps,
+  {
+    /** The ID of the key pair (e.g. `key-0123456789abcdef0`). */
+    keyPairId: KeyPairId;
+    /** The name of the key pair. */
+    keyName: string;
+    /** SHA-1/MD5 fingerprint of the key pair. */
+    keyFingerprint: string;
+    /** The algorithm of the key pair. */
+    keyType: KeyPairType;
+    /**
+     * The unencrypted PEM/PPK private key material. Only present when Alchemy
+     * generated the key pair (not when {@link KeyPairProps.publicKeyMaterial}
+     * was imported). AWS returns this exactly once, at create time; it is then
+     * persisted as a secret in alchemy state.
+     */
+    privateKey?: Redacted.Redacted<string>;
+  },
+  never,
+  Providers
+> {}
+
+/**
+ * An EC2 key pair used to grant SSH access to instances launched with its
+ * `keyName`.
+ *
+ * By default Alchemy asks EC2 to generate the key pair and captures the
+ * private key (returned only once, at create time) as a secret in state. Pass
+ * {@link KeyPairProps.publicKeyMaterial} to import your own public key instead,
+ * in which case no private key is stored.
+ *
+ * @resource
+ * @section Creating a Key Pair
+ * @example Generated key pair
+ * ```typescript
+ * const keyPair = yield* AWS.EC2.KeyPair("DeployKey", {
+ *   keyType: "ed25519",
+ * });
+ * // keyPair.keyName       -> pass to AWS.EC2.Instance({ keyName })
+ * // keyPair.privateKey    -> Redacted<string> (the PEM private key)
+ * ```
+ *
+ * @example Imported public key
+ * ```typescript
+ * const keyPair = yield* AWS.EC2.KeyPair("ImportedKey", {
+ *   publicKeyMaterial: "ssh-ed25519 AAAAC3Nz... user@host",
+ * });
+ * ```
+ */
+export const KeyPair = Resource<KeyPair>("AWS.EC2.KeyPair");
+
+const toKeyName = (id: string, props: { keyName?: string } = {}) =>
+  props.keyName
+    ? Effect.succeed(props.keyName)
+    : createPhysicalName({ id, maxLength: 255 });
+
+const asRedacted = (
+  material: string | Redacted.Redacted<string> | undefined,
+): Redacted.Redacted<string> | undefined =>
+  material === undefined
+    ? undefined
+    : Redacted.isRedacted(material)
+      ? material
+      : Redacted.make(material);
+
+export const KeyPairProvider = () =>
+  Provider.effect(
+    KeyPair,
+    Effect.gen(function* () {
+      const describeByName = (keyName: string) =>
+        ec2.describeKeyPairs({ KeyNames: [keyName] }).pipe(
+          Effect.catchTag("InvalidKeyPair.NotFound", () =>
+            Effect.succeed({ KeyPairs: [] }),
+          ),
+          Effect.map((r) => r.KeyPairs?.[0]),
+        );
+
+      return {
+        stables: ["keyPairId", "keyName", "keyType"],
+
+        // Generated key pairs are immutable except for tags. A changed name /
+        // type / format / imported material means a different key pair.
+        diff: Effect.fn(function* ({ id, olds, news }) {
+          if (!isResolved(news)) return;
+          const oldName = yield* toKeyName(id, olds ?? {});
+          const newName = yield* toKeyName(id, news);
+          if (
+            oldName !== newName ||
+            (olds?.keyType ?? "rsa") !== (news.keyType ?? "rsa") ||
+            (olds?.keyFormat ?? "pem") !== (news.keyFormat ?? "pem") ||
+            olds?.publicKeyMaterial !== news.publicKeyMaterial
+          ) {
+            return { action: "replace" } as const;
+          }
+        }),
+
+        read: Effect.fn(function* ({ id, olds, output }) {
+          const keyName = output?.keyName ?? (yield* toKeyName(id, olds ?? {}));
+          const info = yield* describeByName(keyName);
+          if (!info?.KeyPairId) return undefined;
+          const tags = yield* createInternalTags(id);
+          const observedTags: Record<string, string | undefined> =
+            Object.fromEntries(
+              (info.Tags ?? []).map((t) => [t.Key ?? "", t.Value]),
+            );
+          if (!hasTags(tags, observedTags)) {
+            // Exists but unbranded — let the engine gate adoption behind --adopt.
+            return Unowned({
+              keyPairId: info.KeyPairId as KeyPairId,
+              keyName: info.KeyName ?? keyName,
+              keyFingerprint: info.KeyFingerprint ?? "",
+              keyType: (info.KeyType ?? "rsa") as KeyPairType,
+              // Private key is only available at create time; keep any cached
+              // copy from prior state.
+              privateKey: output?.privateKey,
+            });
+          }
+          return {
+            keyPairId: info.KeyPairId as KeyPairId,
+            keyName: info.KeyName ?? keyName,
+            keyFingerprint: info.KeyFingerprint ?? output?.keyFingerprint ?? "",
+            keyType: (info.KeyType ?? output?.keyType ?? "rsa") as KeyPairType,
+            privateKey: output?.privateKey,
+          };
+        }),
+
+        list: () =>
+          Effect.gen(function* () {
+            const result = yield* ec2.describeKeyPairs({});
+            return (result.KeyPairs ?? [])
+              .filter(
+                (
+                  kp,
+                ): kp is ec2.KeyPairInfo & {
+                  KeyPairId: string;
+                  KeyName: string;
+                } => kp.KeyPairId != null && kp.KeyName != null,
+              )
+              .filter((kp) =>
+                (kp.Tags ?? []).some((t) => t.Key === "alchemy::stack"),
+              )
+              .map((kp) => ({
+                keyPairId: kp.KeyPairId as KeyPairId,
+                keyName: kp.KeyName,
+                keyFingerprint: kp.KeyFingerprint ?? "",
+                keyType: (kp.KeyType ?? "rsa") as KeyPairType,
+                privateKey: undefined,
+              }));
+          }),
+
+        reconcile: Effect.fn(function* ({ id, news = {}, output, session }) {
+          const keyName = output?.keyName ?? (yield* toKeyName(id, news));
+          const internalTags = yield* createInternalTags(id);
+          const desiredTags = { ...internalTags, ...news.tags };
+
+          // Observe — is the key pair already present?
+          let info = yield* describeByName(keyName);
+          let privateKey = output?.privateKey;
+
+          // Ensure — import or generate when missing.
+          if (!info?.KeyPairId) {
+            if (news.publicKeyMaterial !== undefined) {
+              const imported = yield* ec2
+                .importKeyPair({
+                  KeyName: keyName,
+                  PublicKeyMaterial: new TextEncoder().encode(
+                    news.publicKeyMaterial,
+                  ),
+                  TagSpecifications: [
+                    {
+                      ResourceType: "key-pair",
+                      Tags: createTagsList(desiredTags),
+                    },
+                  ],
+                })
+                .pipe(
+                  Effect.catchTag("InvalidKeyPair.Duplicate", () =>
+                    Effect.succeed(undefined),
+                  ),
+                );
+              if (imported?.KeyPairId) {
+                info = {
+                  KeyPairId: imported.KeyPairId,
+                  KeyName: imported.KeyName,
+                  KeyFingerprint: imported.KeyFingerprint,
+                  KeyType: "rsa",
+                };
+              } else {
+                info = yield* describeByName(keyName);
+              }
+            } else {
+              const created = yield* ec2
+                .createKeyPair({
+                  KeyName: keyName,
+                  KeyType: news.keyType ?? "rsa",
+                  KeyFormat: news.keyFormat ?? "pem",
+                  TagSpecifications: [
+                    {
+                      ResourceType: "key-pair",
+                      Tags: createTagsList(desiredTags),
+                    },
+                  ],
+                })
+                .pipe(
+                  Effect.catchTag("InvalidKeyPair.Duplicate", () =>
+                    Effect.succeed(undefined),
+                  ),
+                );
+              if (created?.KeyPairId) {
+                privateKey = asRedacted(created.KeyMaterial) ?? privateKey;
+                info = {
+                  KeyPairId: created.KeyPairId,
+                  KeyName: created.KeyName,
+                  KeyFingerprint: created.KeyFingerprint,
+                  KeyType: (news.keyType ?? "rsa") as KeyPairType,
+                };
+              } else {
+                info = yield* describeByName(keyName);
+              }
+            }
+          }
+
+          if (!info?.KeyPairId) {
+            return yield* Effect.die(
+              new Error(`Failed to resolve EC2 key pair '${keyName}'`),
+            );
+          }
+          const keyPairId = info.KeyPairId as KeyPairId;
+
+          // Sync tags — observed cloud tags vs desired.
+          const observedTags = Object.fromEntries(
+            (info.Tags ?? []).map((t) => [t.Key!, t.Value!]),
+          ) as Record<string, string>;
+          const { removed, upsert } = diffTags(observedTags, desiredTags);
+          if (removed.length > 0) {
+            yield* ec2.deleteTags({
+              Resources: [keyPairId],
+              Tags: removed.map((key) => ({ Key: key })),
+            });
+          }
+          if (upsert.length > 0) {
+            yield* ec2.createTags({ Resources: [keyPairId], Tags: upsert });
+          }
+
+          yield* session.note(`Key pair ${keyName} (${keyPairId})`);
+          return {
+            keyPairId,
+            keyName: info.KeyName ?? keyName,
+            keyFingerprint: info.KeyFingerprint ?? "",
+            keyType: (info.KeyType ?? news.keyType ?? "rsa") as KeyPairType,
+            privateKey,
+          };
+        }),
+
+        delete: Effect.fn(function* ({ output }) {
+          // `deleteKeyPair` is idempotent — deleting a missing key pair
+          // succeeds, so there is no NotFound error to catch.
+          yield* ec2.deleteKeyPair({ KeyPairId: output.keyPairId });
+        }),
+      };
+    }),
+  );

package/src/AWS/EC2/NetworkAcl.ts

@@ -234,7 +234,10 @@ export const NetworkAclProvider = () =>
                 Array.from(chunk).flatMap((page) =>
                   (page.NetworkAcls ?? []).filter(
                     (acl): acl is ec2.NetworkAcl & { NetworkAclId: string } =>
-                      acl.NetworkAclId != null,
+                      acl.NetworkAclId != null &&
+                      // Each VPC's default NACL is AWS-managed and cannot be
+                      // deleted (InvalidParameterValue) — don't enumerate it.
+                      acl.IsDefault !== true,
                   ),
                 ),
               ),

package/src/AWS/EC2/SecurityGroup.ts

@@ -476,7 +476,10 @@ export const SecurityGroupProvider = () =>
                 Array.from(chunk).flatMap((page) =>
                   (page.SecurityGroups ?? []).filter(
                     (sg): sg is ec2.SecurityGroup & { GroupId: string } =>
-                      sg.GroupId != null,
+                      sg.GroupId != null &&
+                      // Every VPC's `default` group is AWS-managed and can
+                      // never be deleted (CannotDelete) — don't enumerate it.
+                      sg.GroupName !== "default",
                   ),
                 ),
               ),

package/src/AWS/EC2/SecurityGroupRule.ts

@@ -515,13 +515,20 @@ export const SecurityGroupRuleProvider = () =>
 
         delete: Effect.fn(function* ({ olds, output, session }) {
           const ruleId = output.securityGroupRuleId;
+          const groupId = (output.groupId ?? olds?.groupId) as string;
+          // Prefer the observed attribute (`isEgress`) — `olds` may be the
+          // listed Attributes (e.g. during nuke) rather than the Props shape,
+          // in which case `olds.type` is undefined.
+          const isEgress = output.isEgress ?? olds?.type !== "ingress";
 
           yield* session.note(`Deleting Security Group Rule: ${ruleId}`);
 
-          if (olds.type === "ingress") {
+          // The whole security group may already be gone, taking its rules
+          // with it (InvalidGroup.NotFound) — the rule is deleted either way.
+          if (isEgress) {
             yield* ec2
-              .revokeSecurityGroupIngress({
-                GroupId: olds.groupId as string,
+              .revokeSecurityGroupEgress({
+                GroupId: groupId,
                 SecurityGroupRuleIds: [ruleId],
                 DryRun: false,
               })
@@ -530,11 +537,12 @@ export const SecurityGroupRuleProvider = () =>
                   "InvalidPermission.NotFound",
                   () => Effect.void,
                 ),
+                Effect.catchTag("InvalidGroup.NotFound", () => Effect.void),
               );
           } else {
             yield* ec2
-              .revokeSecurityGroupEgress({
-                GroupId: olds.groupId as string,
+              .revokeSecurityGroupIngress({
+                GroupId: groupId,
                 SecurityGroupRuleIds: [ruleId],
                 DryRun: false,
               })
@@ -543,6 +551,7 @@ export const SecurityGroupRuleProvider = () =>
                   "InvalidPermission.NotFound",
                   () => Effect.void,
                 ),
+                Effect.catchTag("InvalidGroup.NotFound", () => Effect.void),
               );
           }