Enum ConnectorIntent 

pub enum ConnectorIntent {
    AllIngress,
    HttpIngress,
    ShellIngress,
    Egress,
}

Lambda-managed connector intents. Customer-managed VPC connectors use explicit ARNs.

Named for the intent rather than for the wire value, because the intent is what a caller has: “let the proxy reach the VM” and “let the VM reach the internet”. The wire spellings (ConnectorIntent::wire_name) are an implementation detail of the ARN.

Variants

AllIngress

Lets the endpoint proxy reach the VM. Required for any session to work.

The union that cannot be intersected: the platform refuses to combine it with any other ingress connector, and only at token-mint time — see the module docs. A VM that needs a shell requests ConnectorIntent::HttpIngress plus ConnectorIntent::ShellIngress instead of this.

HttpIngress

Lets the endpoint proxy reach the VM’s HTTP surface, without the shell.

The finer-grained sibling of ConnectorIntent::AllIngress, and the half of the measured pair [HTTP_INGRESS, SHELL_INGRESS] that keeps the daemon reachable (docs/PLATFORM.md, measured 2026-08-15).

ShellIngress

Lets the VM mint shell tokens and serve its PTY WebSocket.

One interactive session, not programmatic exec — the module docs carry the revision of TRAP-11 that admitted this variant. Never combined with ConnectorIntent::AllIngress; the pair that launches and mints is with ConnectorIntent::HttpIngress.

Egress

Lets the VM reach the internet.

Omitted by default — the right default for a daemon that needs none. Omitting it omits the connector from the request; measured 2026-09-11 and 2026-09-12 the platform still gave such a VM outbound network (docs/PLATFORM.md, “A VM launched without the egress connector still has outbound network”).

Implementations

impl ConnectorIntent

pub const ALL: [ConnectorIntent; 4]

Every intent, so a test can enumerate the complete set.

Maintained by hand; the tests below assert its length, so an edit here is a deliberate one. The set grew from two to four when TRAP-11 was revised — see the module docs.

pub fn wire_name(self) -> &'static str

The connector’s name as the ARN spells it.

INTERNET_EGRESS rather than EGRESS: the wire name is not the intent’s name, which is the second reason this is a table rather than a Display derive.

pub fn arn(self, region: &Region) -> String

The fully-qualified ARN for this connector in region.

One interpolation for both directions. The Python client’s earlier shape derived the egress ARN by string-replacing ALL_INGRESS inside the ingress one, which produced a valid ARN only as long as the two names never became substrings of each other (sandbox.py:391-398).

The doubled aws-network-connector segment is not a typo: the resource type and the resource name are both present, and the format is copied from sandbox.py:398 rather than reconstructed from the ARN grammar.

Trait Implementations

impl Clone for ConnectorIntent

fn clone(&self) -> ConnectorIntent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ConnectorIntent

impl Debug for ConnectorIntent

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for ConnectorIntent

impl Hash for ConnectorIntent

fn hash<__H>(&self, state: &mut __H)

where __H: Hasher,

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for ConnectorIntent

fn eq(&self, other: &ConnectorIntent) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ConnectorIntent