Expand description
Managed connector intents and customer-managed VPC egress connector validation.
§Why an enum rather than a string
Two reasons, and both are measurements.
The API takes a fully-qualified ARN and rejects the bare name with “Malformed
network connector ARN” (measured 2026-08-05). NetworkConnector in the service model
is just {type: string, max: 2048, min: 1} — no pattern, no enum — so a free-form
parameter passes every check the model states and fails on the wire, and the value
that reads most natural to write ("ALL_INGRESS") is exactly the one that fails.
Deriving the ARN from an intent means the caller states what they want and the
spelling is not theirs to get wrong.
§TRAP-11, revised: the shell connector is a variant, on measured ground
SHELL_INGRESS is a variant here, and it was not always. This module used to
omit it on the claim that it gated a console-only debugging flow — “not a
programmatic exec path despite the name” — and that omission made requesting it
unwriteable. docs/PLATFORM.md (measured 2026-08-15) refutes the claim: the shell
endpoint is a real PTY over a WebSocket, and it is programmatically drivable. The
ground that actually holds is narrower — one interactive session is not
programmatic exec: no exec ids, no idempotency, no separated stdout/stderr, no exit
codes. So the variant exists for callers that want the PTY, and the exec path never
requests it; the lifecycle test in crate::control::microvm asserts a launch
carries exactly the connectors its caller asked for.
Two measured constraints travel with the variant (both from docs/PLATFORM.md):
ALL_INGRESS cannot combine with any other ingress connector, and the platform says
so only at token-mint time — RunMicrovm accepts the invalid set, the VM reaches
RUNNING, and it bills until something asks for a shell token.
crate::control::ControlPlane::run_microvm refuses the combination locally
instead. The pair that works is [HTTP_INGRESS, SHELL_INGRESS].
The sibling half of TRAP-11, the shell-auth operation, is
crate::control::ControlPlane::mint_shell_auth_token: microvm shell’s door, which the
exec path never calls. See that module’s docs.
Enums§
- Connector
Intent - Lambda-managed connector intents. Customer-managed VPC connectors use explicit ARNs.
- Egress
Posture - Conservative network posture inferred from launch options.
Constants§
- PLATFORM_
HONOURS_ OMITTED_ EGRESS - Compatibility constant: omitting an egress connector does not block internet access. Isolation requires a VPC egress connector and a VPC without an internet gateway or NAT gateway. A launch flag cannot establish the VPC’s routing configuration.
Functions§
- egress_
posture_ for - The egress posture a launch with these options reports, or the refusal it raises (BIND-11, BIND-13). Pure: no AWS call, no credentials.