Struct AwsSandboxBinding 

pub struct AwsSandboxBinding {
    pub image_arn: BindingValue<String>,
    pub image_version: BindingValue<String>,
    pub region: BindingValue<String>,
    pub execution_role_arn: Option<BindingValue<String>>,
    pub egress_connector_arns: Vec<BindingValue<String>>,
    pub preview_ports: Vec<u16>,
    pub idle_suspend_seconds: Option<u32>,
    pub max_lifetime_seconds: Option<u32>,
    pub allow_egress: bool,
}

AWS sandbox binding configuration.

Fields

image_arn: BindingValue<String>

MicroVM image ARN that scopes this sandbox’s sessions

image_version: BindingValue<String>

Image version. Sessions are enumerated by image and version together, so a rolled version remains a cleanup scope until its own MicroVMs are gone.

region: BindingValue<String>

Region the MicroVMs run in

execution_role_arn: Option<BindingValue<String>>

Execution role attached to each MicroVM, distinct from the workload’s own role

egress_connector_arns: Vec<BindingValue<String>>

Egress connectors every session is started with.

Carried rather than implied: a MicroVM started with no connector reaches the public internet, so an empty list here is allow, not deny. The declared mode is realised by which connector setup built, and the session has to be started with it.

preview_ports: Vec<u16>

Ports a preview capability may be minted for.

Carried because the token is what grants ingress: CreateMicrovmAuthToken mints access to whatever port it is asked for, so “a port not listed here can never be exposed” is only true if the declared list reaches the code that mints.

idle_suspend_seconds: Option<u32>

Idle seconds after which a session suspends, if the declaration asked for one.

max_lifetime_seconds: Option<u32>

Wall-clock ceiling on a session, if the declaration asked for one.

Enforced by Lambda rather than by us: RunMicrovm takes it as maximumDurationInSeconds and terminates the MicroVM when it elapses.

allow_egress: bool

Whether the declaration asked for open egress.

Carried because an empty connector list cannot otherwise be read: a MicroVM started with no connector reaches the internet, so a deny binding stripped of its connectors would be indistinguishable from allow. Absent means deny, which is the answer that fails closed.

Trait Implementations

impl Clone for AwsSandboxBinding

fn clone(&self) -> AwsSandboxBinding

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for AwsSandboxBinding

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for AwsSandboxBinding

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Eq for AwsSandboxBinding

impl PartialEq for AwsSandboxBinding

fn eq(&self, other: &AwsSandboxBinding) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for AwsSandboxBinding

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for AwsSandboxBinding