1import * as ec2 from "@distilled.cloud/aws/ec2";
2import * as Effect from "effect/Effect";
3
4/**
5 * The identifiers of the account's default VPC and its intrinsic furniture,
6 * resolved once per `list()` call so census/nuke never enumerate what AWS
7 * itself provisions (and what `test/AWS/DefaultVpc.ts` deliberately
8 * recreates as standing infrastructure).
9 *
10 * All fields are `undefined` when the account has no default VPC — callers
11 * must then exclude nothing that depends on these ids.
12 *
13 * Internal scaffolding — NOT exported from the EC2 service `index.ts`.
14 */
15export interface DefaultVpcScope {
16 /** The default VPC's id, if the account has one. */
17 readonly vpcId: string | undefined;
18 /** The DhcpOptions set the default VPC references (the account default). */
19 readonly dhcpOptionsId: string | undefined;
20}
21
22/**
23 * Resolve the default VPC (if any) for the ambient account/region.
24 */
25export const getDefaultVpcScope = ec2
26 .describeVpcs({ Filters: [{ Name: "isDefault", Values: ["true"] }] })
27 .pipe(
28 Effect.map((r): DefaultVpcScope => {
29 const vpc = (r.Vpcs ?? []).find((v) => v.IsDefault);
30 return { vpcId: vpc?.VpcId, dhcpOptionsId: vpc?.DhcpOptionsId };
31 }),
32 );
33
34/**
35 * The GroupId of the default VPC's "default" security group, or `undefined`
36 * when the account has no default VPC. Rules on this group are AWS-provisioned
37 * furniture; rules on user-created groups inside the default VPC are not.
38 */
39export const getDefaultVpcDefaultSecurityGroupId = (
40 vpcId: string | undefined,
41) =>
42 vpcId === undefined
43 ? Effect.succeed(undefined)
44 : ec2
45 .describeSecurityGroups({
46 Filters: [
47 { Name: "vpc-id", Values: [vpcId] },
48 { Name: "group-name", Values: ["default"] },
49 ],
50 })
51 .pipe(Effect.map((r) => r.SecurityGroups?.[0]?.GroupId));