AwsAccountDefaultsDefaultVpcCleanupArgs

interface AwsAccountDefaultsDefaultVpcCleanupArgs {
enabled?: boolean;
regions: Record<string, Record<never, never>>;
}

Capability arguments for default VPC cleanup behaviour.

Remarks

Cleanup permanently deletes the default VPC in each configured region together with its default subnets and internet gateway. It is an imperative delete-only action: nothing is adopted into Pulumi state and no default VPC is ever created. When no default VPC exists in a region the capability succeeds without changing anything, because the desired state is already satisfied.

Region selection: AWS provisions a default VPC in every region. Set regions to the exact AWS regions where the default VPC should be removed. The region list must be available as plain strings at preview time because one deterministic cleanup marker resource is created per configured region.

Run-once semantics and drift: cleanup runs when the marker resource is first created (and again only if an input such as the resolved region changes). It does not continuously reconcile — if a default VPC is recreated later (for example via aws ec2 create-default-vpc), a subsequent pulumi up will not delete it again on its own, because the marker inputs are unchanged. Running pulumi refresh re-queries AWS and updates the marker outputs (AwsAccountDefaults.defaultVpcCleanupApplied and AwsAccountDefaults.defaultVpcCleanupAppliedByRegion) to reflect whether a default VPC currently exists, but refresh is read-only and never deletes. To force another cleanup of a reappeared default VPC, replace the marker resource (for example pulumi up --replace).

Credentials: the cleanup runs inside a Pulumi dynamic-provider subprocess that authenticates with process-level ambient AWS credentials (environment variables, shared config/profile, or an instance/container role). It does not inherit the assumeRole configuration of the aws.Provider passed in options. Ensure the ambient credentials already target the account that owns the default VPCs to be removed.

Example

CODE

new AwsAccountDefaults(
  {
    identity: 'account-defaults',
    defaultVpcCleanup: {
      regions: { 'eu-west-1': {}, 'eu-central-1': {} },
    },
  },
  { provider: accountProvider },
);

Properties

`enabled: boolean`

Enables default VPC cleanup. Defaults to true when this capability block is set.

`regions: Record<string, Record<never, never>>`

AWS regions whose default VPCs should be removed, keyed by the raw AWS region identifier.

Remarks

Must be a non-empty keyed object. Each key is a plain, non-empty AWS region identifier and must be enabled at organisational level via jobcloudAllowedRegions. Each region creates one deterministic cleanup marker resource.