AWS.VpcLattice reference

AccessLogSubscription

Source: src/AWS/VpcLattice/AccessLogSubscription.ts

An Amazon VPC Lattice access log subscription — delivers per-request access logs for a service network or lattice service to CloudWatch Logs, Kinesis Data Firehose, or S3.

AccessLogSubscription: Creating Access Log Subscriptions

Log a Service Network to CloudWatch

const logs = yield* AccessLogSubscription("NetworkLogs", {
  resourceIdentifier: network.serviceNetworkId,
  destinationArn: logGroup.logGroupArn,
});

Log a Service to S3

const logs = yield* AccessLogSubscription("ServiceLogs", {
  resourceIdentifier: service.serviceId,
  destinationArn: bucket.bucketArn,
});

AuthPolicy

Source: src/AWS/VpcLattice/AuthPolicy.ts

An auth policy for a VPC Lattice service network or service — the IAM resource policy evaluated on every request when the target’s authType is AWS_IAM.

AuthPolicy: Attaching Auth Policies

Allow Authenticated Invoke on a Service Network

const network = yield* ServiceNetwork("SecureNetwork", {
  authType: "AWS_IAM",
});
const authPolicy = yield* AuthPolicy("NetworkAuthPolicy", {
  resourceIdentifier: network.serviceNetworkId,
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: "*" },
        Action: ["vpc-lattice-svcs:Invoke"],
        Resource: "*",
      },
    ],
  },
});

Raw JSON Escape Hatch

const authPolicy = yield* AuthPolicy("ServiceAuthPolicy", {
  resourceIdentifier: service.serviceId,
  policy: JSON.stringify({
    Version: "2012-10-17",
    Statement: [{ Effect: "Allow", Principal: "*", Action: "vpc-lattice-svcs:Invoke", Resource: "*" }],
  }),
});

DeregisterTargets

Source: src/AWS/VpcLattice/DeregisterTargets.ts

Runtime binding for the DeregisterTargets operation (IAM action vpc-lattice:DeregisterTargets on the target group ARN).

Deregisters targets from the bound TargetGroup at runtime — the graceful-drain half of dynamic self-registration. Provide the implementation with Effect.provide(AWS.VpcLattice.DeregisterTargetsHttp).

DeregisterTargets: Managing Targets at Runtime

const deregisterTargets = yield* AWS.VpcLattice.DeregisterTargets(targetGroup);

yield* deregisterTargets({ targets: [{ id: "10.0.1.10", port: 80 }] });

Listener

Source: src/AWS/VpcLattice/Listener.ts

An Amazon VPC Lattice listener — the process on a lattice service that checks for connection requests on a protocol/port and routes them via its default action and rules.

Listener: Creating Listeners

HTTP Listener with a Fixed Default Response

const listener = yield* Listener("HttpListener", {
  serviceIdentifier: service.serviceId,
  protocol: "HTTP",
  port: 80,
  defaultAction: { fixedResponse: { statusCode: 404 } },
});

Listener Forwarding to a Target Group

const listener = yield* Listener("ApiListener", {
  serviceIdentifier: service.serviceId,
  protocol: "HTTP",
  defaultAction: {
    forward: {
      targetGroups: [
        { targetGroupIdentifier: targets.targetGroupId, weight: 100 },
      ],
    },
  },
});

ListTargets

Source: src/AWS/VpcLattice/ListTargets.ts

Runtime binding for the ListTargets operation (IAM action vpc-lattice:ListTargets on the target group ARN).

Lists the bound TargetGroup’s registered targets with their health status — useful for health dashboards and for compute that verifies its own registration. Provide the implementation with Effect.provide(AWS.VpcLattice.ListTargetsHttp).

ListTargets: Managing Targets at Runtime

const listTargets = yield* AWS.VpcLattice.ListTargets(targetGroup);

const { items } = yield* listTargets({});
for (const target of items) {
  yield* Effect.log(`${target.id}: ${target.status}`);
}

RegisterTargets

Source: src/AWS/VpcLattice/RegisterTargets.ts

Runtime binding for the RegisterTargets operation (IAM action vpc-lattice:RegisterTargets on the target group ARN).

Registers targets with the bound TargetGroup at runtime — the self-registration data plane for workloads that join a lattice service dynamically. Provide the implementation with Effect.provide(AWS.VpcLattice.RegisterTargetsHttp).

RegisterTargets: Managing Targets at Runtime

const registerTargets = yield* AWS.VpcLattice.RegisterTargets(targetGroup);

const { successful, unsuccessful } = yield* registerTargets({
  targets: [{ id: "10.0.1.10", port: 80 }],
});

ResourcePolicy

Source: src/AWS/VpcLattice/ResourcePolicy.ts

A resource-based permission policy on a VPC Lattice service or service network — the policy AWS RAM manages when sharing Lattice resources across accounts, attachable directly for fine-grained cross-account control.

ResourcePolicy: Attaching Resource Policies

const network = yield* ServiceNetwork("SharedNetwork", {});
const policy = yield* ResourcePolicy("SharePolicy", {
  resourceArn: network.serviceNetworkArn,
  policy: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { AWS: "arn:aws:iam::123456789012:root" },
        Action: [
          "vpc-lattice:CreateServiceNetworkVpcAssociation",
          "vpc-lattice:CreateServiceNetworkServiceAssociation",
          "vpc-lattice:GetServiceNetwork",
        ],
        Resource: network.serviceNetworkArn,
      },
    ],
  },
});

Rule

Source: src/AWS/VpcLattice/Rule.ts

An Amazon VPC Lattice listener rule — matches HTTP requests by method, path, or headers and forwards them to target groups (or answers with a fixed response), evaluated in priority order before the listener’s default action.

Rule: Creating Rules

Path-Prefix Rule Forwarding to a Target Group

const rule = yield* Rule("ApiRule", {
  serviceIdentifier: service.serviceId,
  listenerIdentifier: listener.listenerId,
  priority: 10,
  match: { httpMatch: { pathMatch: { match: { prefix: "/api" } } } },
  action: {
    forward: {
      targetGroups: [
        { targetGroupIdentifier: targets.targetGroupId, weight: 100 },
      ],
    },
  },
});

Method Match with a Fixed Response

const rule = yield* Rule("BlockDeletes", {
  serviceIdentifier: service.serviceId,
  listenerIdentifier: listener.listenerId,
  priority: 1,
  match: { httpMatch: { method: "DELETE" } },
  action: { fixedResponse: { statusCode: 403 } },
});

Service

Source: src/AWS/VpcLattice/Service.ts

An Amazon VPC Lattice service — an independently deployable unit of software (running on Lambda, ECS, EC2, or elsewhere) that is made discoverable through a service network. Cheap control-plane resource.

Service: Creating Services

Basic Service

const service = yield* Service("PaymentsService", {});

Service with Custom Domain

const service = yield* Service("PaymentsService", {
  customDomainName: "payments.internal.example.com",
  certificateArn: cert.certificateArn,
  authType: "AWS_IAM",
  idleTimeout: "60 seconds",
});

ServiceNetwork

Source: src/AWS/VpcLattice/ServiceNetwork.ts

An Amazon VPC Lattice service network — the logical boundary that connects services and VPCs into one application network. Cheap control-plane resource with no per-hour charge until VPCs or services are associated.

ServiceNetwork: Creating Service Networks

Basic Service Network

const network = yield* ServiceNetwork("AppNetwork", {});

IAM-Authorized Network

const network = yield* ServiceNetwork("SecureNetwork", {
  authType: "AWS_IAM",
  tags: { Environment: "prod" },
});

ServiceNetworkServiceAssociation

Source: src/AWS/VpcLattice/ServiceNetworkServiceAssociation.ts

Associates a VPC Lattice service with a service network, making the service reachable from every VPC associated with that network.

ServiceNetworkServiceAssociation: Associating a Service

const assoc = yield* ServiceNetworkServiceAssociation("PaymentsLink", {
  serviceNetworkIdentifier: network.serviceNetworkId,
  serviceIdentifier: service.serviceId,
});

ServiceNetworkVpcAssociation

Source: src/AWS/VpcLattice/ServiceNetworkVpcAssociation.ts

Associates a VPC with a VPC Lattice service network, letting workloads in the VPC reach every service in the network (subject to auth policies). The most common VPC Lattice wiring step.

ServiceNetworkVpcAssociation: Associating a VPC

const assoc = yield* ServiceNetworkVpcAssociation("AppVpcLink", {
  serviceNetworkIdentifier: network.serviceNetworkId,
  vpcIdentifier: vpc.vpcId,
  securityGroupIds: [sg.groupId],
});

TargetGroup

Source: src/AWS/VpcLattice/TargetGroup.ts

An Amazon VPC Lattice target group — the collection of compute targets (IPs, EC2 instances, ALBs, or Lambda functions) that a lattice service’s listeners and rules forward traffic to.

TargetGroup: Creating Target Groups

Lambda Target Group

const targets = yield* TargetGroup("ApiTargets", {
  type: "LAMBDA",
  targets: [{ id: fn.functionArn }],
});

IP Target Group with Health Check

const targets = yield* TargetGroup("BackendTargets", {
  type: "IP",
  port: 80,
  protocol: "HTTP",
  vpcIdentifier: vpc.vpcId,
  healthCheck: {
    enabled: true,
    path: "/health",
    healthCheckInterval: "30 seconds",
    healthCheckTimeout: "5 seconds",
  },
  targets: [{ id: "10.0.1.10", port: 80 }],
});