Vpc

Source: src/AWS/EC2/Vpc.ts

An Amazon VPC (Virtual Private Cloud) — an isolated virtual network that is the root of any custom AWS networking topology. Subnets, route tables, gateways, security groups, and instances are all created inside a VPC.

Changing the cidrBlock, instanceTenancy, or an IPAM/IPv6 pool replaces the VPC.

Creating a VPC

A VPC is defined by a private IPv4 address range (cidrBlock). Pick a block from the RFC 1918 private space (e.g. 10.0.0.0/16) that is large enough to subdivide into subnets across your Availability Zones.

Basic VPC

const vpc = yield* AWS.EC2.Vpc("MyVpc", {
  cidrBlock: "10.0.0.0/16",
});

A /16 gives you 65,536 addresses to carve into subnets — enough headroom for a multi-AZ, multi-tier network. This is the minimal config every other networking resource builds on.

Allocating IPv4 from an IPAM pool

const vpc = yield* AWS.EC2.Vpc("MyVpc", {
  ipv4IpamPoolId: "ipam-pool-0123456789abcdef0",
  ipv4NetmaskLength: 16,
});

Instead of hard-coding cidrBlock, let AWS IPAM hand out a non-overlapping range of the requested size. Use this when an organization centrally manages address space to avoid CIDR collisions between accounts.

DNS Resolution

Two independent toggles control DNS behavior inside the VPC. enableDnsSupport lets instances resolve names via the Amazon DNS server; enableDnsHostnames additionally assigns public DNS hostnames to instances with public IPs.

const vpc = yield* AWS.EC2.Vpc("MyVpc", {
  cidrBlock: "10.0.0.0/16",
  enableDnsSupport: true,
  enableDnsHostnames: true,
});

Enable both when instances need public DNS names or when you rely on private hosted zones and VPC endpoints, which require DNS resolution to function.

Instance Tenancy

const vpc = yield* AWS.EC2.Vpc("MyVpc", {
  cidrBlock: "10.0.0.0/16",
  instanceTenancy: "dedicated",
});

Forcing "dedicated" tenancy ensures every instance launched in the VPC runs on single-tenant hardware — required by some compliance regimes, but more expensive than the "default" shared tenancy. This property cannot be changed after creation without replacing the VPC.

IPv6 Addressing

A VPC can carry an IPv6 /56 block alongside its IPv4 range. The block can come from Amazon’s pool, an IPAM pool, or your own BYOIP pool (ipv6CidrBlock + ipv6Pool, optionally scoped to a ipv6CidrBlockNetworkBorderGroup).

Amazon-provided IPv6 block

const vpc = yield* AWS.EC2.Vpc("MyVpc", {
  cidrBlock: "10.0.0.0/16",
  amazonProvidedIpv6CidrBlock: true,
});

Requests an Amazon-assigned IPv6 /56, the simplest way to make a VPC dual-stack. Pair it with IPv6-enabled subnets and an egress-only internet gateway for outbound-only IPv6 connectivity.

IPv6 from an IPAM pool

const vpc = yield* AWS.EC2.Vpc("MyVpc", {
  cidrBlock: "10.0.0.0/16",
  ipv6IpamPoolId: "ipam-pool-0fedcba9876543210",
  ipv6NetmaskLength: 56,
});

Draws the IPv6 block from a centrally-managed IPAM pool instead of Amazon’s pool, giving you deterministic, organization-governed IPv6 ranges.

Composing a Network

const vpc = yield* AWS.EC2.Vpc("MyVpc", {
  cidrBlock: "10.0.0.0/16",
  enableDnsSupport: true,
  enableDnsHostnames: true,
});

const subnet = yield* AWS.EC2.Subnet("PublicSubnet", {
  vpcId: vpc.vpcId,
  cidrBlock: "10.0.1.0/24",
  availabilityZone: "us-east-1a",
  mapPublicIpOnLaunch: true,
});

Passing vpc.vpcId into a Subnet is how you build out a topology — the subnet’s CIDR must fall within the VPC’s cidrBlock. Add route tables, gateways, and security groups the same way.

Tagging

const vpc = yield* AWS.EC2.Vpc("MyVpc", {
  cidrBlock: "10.0.0.0/16",
  tags: {
    Name: "production-vpc",
    Environment: "production",
  },
});

User tags are merged with alchemy’s auto-tags (alchemy::stack, alchemy::stage, alchemy::id), which brand the VPC as managed by your stack. The Name tag is what surfaces in the EC2 console.