Carina

A strongly typed infrastructure management tool written in Rust.

Key Features

• Custom DSL for infrastructure definition (.crn files)
• Effects as Values - side effects are represented as data, inspectable before execution
• Strong Typing - resource attributes are validated at parse time
• Provider Architecture - pluggable providers (AWS, AWSCC)
• Modules - reusable infrastructure components
• State Management - S3 backend for remote state
• LSP Support - editor integration with completions and diagnostics

Quick Start

# Build from source
cargo build --release

# Validate a configuration
cargo run --bin carina -- validate example.crn

# Preview changes
aws-vault exec <profile> -- cargo run --bin carina -- plan example.crn

# Apply changes
aws-vault exec <profile> -- cargo run --bin carina -- apply example.crn

Providers

• AWSCC Provider - AWS Cloud Control API provider

For more details, see the README.

AWSCC Provider

The awscc provider manages AWS resources through the AWS Cloud Control API.

Configuration

provider awscc {
  region = aws.Region.ap_northeast_1
}

Usage

Resources are defined using the awscc.<resource_type> syntax:

let vpc = awscc.ec2_vpc {
  name       = "my-vpc"
  cidr_block = "10.0.0.0/16"
  tags = {
    Environment = "production"
  }
}

Named resources (using let) can be referenced by other resources:

let subnet = awscc.ec2_subnet {
  name              = "my-subnet"
  vpc_id            = vpc.vpc_id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "ap-northeast-1a"
}

Enum Values

Some attributes accept enum values. These can be specified in three formats:

• Bare value: instance_tenancy = default
• TypeName.value: instance_tenancy = InstanceTenancy.default
• Full namespace: instance_tenancy = awscc.ec2_vpc.InstanceTenancy.default

Supported Resource Types

awscc.ec2_vpc

CloudFormation Type: AWS::EC2::VPC

Specifies a virtual private cloud (VPC). To add an IPv6 CIDR block to the VPC, see AWS::EC2::VPCCidrBlock. For more information, see Virtual private clouds (VPC) in the Amazon VPC User Guide.

Attributes

Enum Values

instance_tenancy (InstanceTenancy)

Shorthand formats: default or InstanceTenancy.default

Example

awscc.ec2_vpc {
  name                 = "example-vpc"
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
  instance_tenancy     = default

  tags = {
    Environment = "example"
  }
}

awscc.ec2_subnet

CloudFormation Type: AWS::EC2::Subnet

Specifies a subnet for the specified VPC. For an IPv4 only subnet, specify an IPv4 CIDR block. If the VPC has an IPv6 CIDR block, you can create an IPv6 only subnet or a dual stack subnet instead. For an IPv6 only subnet, specify an IPv6 CIDR block. For a dual stack subnet, specify both an IPv4 CIDR block and an IPv6 CIDR block. For more information, see Subnets for your VPC in the Amazon VPC User Guide.

Attributes

Example

let vpc = awscc.ec2_vpc {
  name                 = "example-vpc"
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

awscc.ec2_subnet {
  name                    = "example-public-subnet"
  vpc_id                  = vpc.vpc_id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "ap-northeast-1a"
  map_public_ip_on_launch = true

  tags = {
    Environment = "example"
  }
}

awscc.ec2_internet_gateway

CloudFormation Type: AWS::EC2::InternetGateway

Allocates an internet gateway for use with a VPC. After creating the Internet gateway, you then attach it to a VPC.

Attributes

Example

awscc.ec2_internet_gateway {
  name = "example-igw"

  tags = {
    Environment = "example"
  }
}

awscc.ec2_route_table

CloudFormation Type: AWS::EC2::RouteTable

Specifies a route table for the specified VPC. After you create a route table, you can add routes and associate the table with a subnet. For more information, see Route tables in the Amazon VPC User Guide.

Attributes

Example

let vpc = awscc.ec2_vpc {
  name                 = "example-vpc"
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

awscc.ec2_route_table {
  name   = "example-public-rt"
  vpc_id = vpc.vpc_id

  tags = {
    Environment = "example"
  }
}

awscc.ec2_route

CloudFormation Type: AWS::EC2::Route

Specifies a route in a route table. For more information, see Routes in the Amazon VPC User Guide. You must specify either a destination CIDR block or prefix list ID. You must also specify exactly one of the resources as the target. If you create a route that references a transit gateway in the same template where you create the transit gateway, you must declare a dependency on the transit gateway attachment. The route table cannot use the transit gateway until it has successfully attached to the VPC. Add a DependsOn Attribute in the AWS::EC2::Route resource to explicitly declare a dependency on the AWS::EC2::TransitGatewayAttachment resource.

Attributes

Example

let vpc = awscc.ec2_vpc {
  name                 = "example-vpc"
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

let igw = awscc.ec2_internet_gateway {
  name = "example-igw"
}

let igw_attachment = awscc.ec2_vpc_gateway_attachment {
  name                = "example-igw-attachment"
  vpc_id              = vpc.vpc_id
  internet_gateway_id = igw.internet_gateway_id
}

let rt = awscc.ec2_route_table {
  name   = "example-public-rt"
  vpc_id = vpc.vpc_id
}

awscc.ec2_route {
  name                   = "example-internet-route"
  route_table_id         = rt.route_table_id
  destination_cidr_block = "0.0.0.0/0"
  gateway_id             = igw_attachment.internet_gateway_id
}

awscc.ec2_subnet_route_table_association

CloudFormation Type: AWS::EC2::SubnetRouteTableAssociation

Associates a subnet with a route table. The subnet and route table must be in the same VPC. This association causes traffic originating from the subnet to be routed according to the routes in the route table. A route table can be associated with multiple subnets. To create a route table, see AWS::EC2::RouteTable.

Attributes

Example

let vpc = awscc.ec2_vpc {
  name                 = "example-vpc"
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

let subnet = awscc.ec2_subnet {
  name              = "example-subnet"
  vpc_id            = vpc.vpc_id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "ap-northeast-1a"
}

let rt = awscc.ec2_route_table {
  name   = "example-rt"
  vpc_id = vpc.vpc_id
}

awscc.ec2_subnet_route_table_association {
  name           = "example-subnet-rt-assoc"
  subnet_id      = subnet.subnet_id
  route_table_id = rt.route_table_id
}

awscc.ec2_eip

CloudFormation Type: AWS::EC2::EIP

Specifies an Elastic IP (EIP) address and can, optionally, associate it with an Amazon EC2 instance. You can allocate an Elastic IP address from an address pool owned by AWS or from an address pool created from a public IPv4 address range that you have brought to AWS for use with your AWS resources using bring your own IP addresses (BYOIP). For more information, see Bring Your Own IP Addresses (BYOIP) in the Amazon EC2 User Guide. For more information, see Elastic IP Addresses in the Amazon EC2 User Guide.

Attributes

Example

awscc.ec2_eip {
  name   = "example-eip"
  domain = "vpc"

  tags = {
    Environment = "example"
  }
}

awscc.ec2_nat_gateway

CloudFormation Type: AWS::EC2::NatGateway

Specifies a network address translation (NAT) gateway in the specified subnet. You can create either a public NAT gateway or a private NAT gateway. The default is a public NAT gateway. If you create a public NAT gateway, you must specify an elastic IP address. With a NAT gateway, instances in a private subnet can connect to the internet, other AWS services, or an on-premises network using the IP address of the NAT gateway. For more information, see NAT gateways in the Amazon VPC User Guide. If you add a default route (AWS::EC2::Route resource) that points to a NAT gateway, specify the NAT gateway ID for the route’s NatGatewayId property. When you associate an Elastic IP address or secondary Elastic IP address with a public NAT gateway, the network border group of the Elastic IP address must match the network border group of the Availability Zone (AZ) that the public NAT gateway is in. Otherwise, the NAT gateway fails to launch. You can see the network border group for the AZ by viewing the details of the subnet. Similarly, you can view the network border group for the Elastic IP address by viewing its details. For more information, see Allocate an Elastic IP address in the Amazon VPC User Guide.

Attributes

Example

let vpc = awscc.ec2_vpc {
  name                 = "example-vpc"
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

let public_subnet = awscc.ec2_subnet {
  name                    = "example-public-subnet"
  vpc_id                  = vpc.vpc_id
  cidr_block              = "10.0.1.0/24"
  availability_zone       = "ap-northeast-1a"
  map_public_ip_on_launch = true
}

let eip = awscc.ec2_eip {
  name   = "example-nat-eip"
  domain = "vpc"
}

awscc.ec2_nat_gateway {
  name          = "example-nat-gw"
  allocation_id = eip.allocation_id
  subnet_id     = public_subnet.subnet_id

  tags = {
    Environment = "example"
  }
}

awscc.ec2_security_group

CloudFormation Type: AWS::EC2::SecurityGroup

Resource Type definition for AWS::EC2::SecurityGroup

Attributes

Example

let vpc = awscc.ec2_vpc {
  name       = "example-vpc"
  cidr_block = "10.0.0.0/16"
}

awscc.ec2_security_group {
  name              = "example-sg"
  vpc_id            = vpc.vpc_id
  group_description = "Example security group"

  tags = {
    Environment = "example"
  }
}

awscc.ec2_security_group_ingress

CloudFormation Type: AWS::EC2::SecurityGroupIngress

Resource Type definition for AWS::EC2::SecurityGroupIngress

Attributes

Example

let vpc = awscc.ec2_vpc {
  name       = "example-vpc"
  cidr_block = "10.0.0.0/16"
}

let sg = awscc.ec2_security_group {
  name              = "example-sg"
  vpc_id            = vpc.vpc_id
  group_description = "Example security group"
}

awscc.ec2_security_group_ingress {
  name        = "example-https-ingress"
  group_id    = sg.group_id
  description = "Allow HTTPS from VPC"
  ip_protocol = "tcp"
  from_port   = 443
  to_port     = 443
  cidr_ip     = "10.0.0.0/16"
}

awscc.ec2_security_group_egress

CloudFormation Type: AWS::EC2::SecurityGroupEgress

Adds the specified outbound (egress) rule to a security group. An outbound rule permits instances to send traffic to the specified IPv4 or IPv6 address range, the IP addresses that are specified by a prefix list, or the instances that are associated with a destination security group. For more information, see Security group rules. You must specify exactly one of the following destinations: an IPv4 address range, an IPv6 address range, a prefix list, or a security group. You must specify a protocol for each rule (for example, TCP). If the protocol is TCP or UDP, you must also specify a port or port range. If the protocol is ICMP or ICMPv6, you must also specify the ICMP/ICMPv6 type and code. To specify all types or all codes, use -1. Rule changes are propagated to instances associated with the security group as quickly as possible. However, a small delay might occur.

Attributes

Enum Values

ip_protocol (IpProtocol)

Shorthand formats: tcp or IpProtocol.tcp

Example

let vpc = awscc.ec2_vpc {
  name       = "example-vpc"
  cidr_block = "10.0.0.0/16"
}

let sg = awscc.ec2_security_group {
  name              = "example-sg"
  vpc_id            = vpc.vpc_id
  group_description = "Example security group"
}

awscc.ec2_security_group_egress {
  name        = "example-all-outbound"
  group_id    = sg.group_id
  description = "Allow all outbound traffic"
  ip_protocol = "-1"
  cidr_ip     = "0.0.0.0/0"
}

awscc.ec2_vpc_endpoint

CloudFormation Type: AWS::EC2::VPCEndpoint

Specifies a VPC endpoint. A VPC endpoint provides a private connection between your VPC and an endpoint service. You can use an endpoint service provided by AWS, an MKT Partner, or another AWS accounts in your organization. For more information, see the User Guide. An endpoint of type Interface establishes connections between the subnets in your VPC and an AWS-service, your own service, or a service hosted by another AWS-account. With an interface VPC endpoint, you specify the subnets in which to create the endpoint and the security groups to associate with the endpoint network interfaces. An endpoint of type gateway serves as a target for a route in your route table for traffic destined for S3 or DDB. You can specify an endpoint policy for the endpoint, which controls access to the service from your VPC. You can also specify the VPC route tables that use the endpoint. For more information about connectivity to S3, see Why can’t I connect to an S3 bucket using a gateway VPC endpoint? An endpoint of type GatewayLoadBalancer provides private connectivity between your VPC and virtual appliances from a service provider.

Attributes

Enum Values

ip_address_type (IpAddressType)

Shorthand formats: ipv4 or IpAddressType.ipv4

vpc_endpoint_type (VpcEndpointType)

Shorthand formats: Interface or VpcEndpointType.Interface

Example

let vpc = awscc.ec2_vpc {
  name                 = "example-vpc"
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

let subnet = awscc.ec2_subnet {
  name              = "example-private-subnet"
  vpc_id            = vpc.vpc_id
  cidr_block        = "10.0.100.0/24"
  availability_zone = "ap-northeast-1a"
}

let sg = awscc.ec2_security_group {
  name              = "example-endpoint-sg"
  vpc_id            = vpc.vpc_id
  group_description = "SG for VPC Endpoint"
}

awscc.ec2_security_group_ingress {
  name        = "example-endpoint-https"
  group_id    = sg.group_id
  description = "Allow HTTPS from VPC"
  ip_protocol = "tcp"
  from_port   = 443
  to_port     = 443
  cidr_ip     = "10.0.0.0/16"
}

awscc.ec2_vpc_endpoint {
  name                = "example-ecr-dkr"
  vpc_id              = vpc.vpc_id
  service_name        = "com.amazonaws.ap-northeast-1.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = [subnet.subnet_id]
  security_group_ids  = [sg.group_id]
  private_dns_enabled = true
}

awscc.ec2_vpc_gateway_attachment

CloudFormation Type: AWS::EC2::VPCGatewayAttachment

Resource Type definition for AWS::EC2::VPCGatewayAttachment

Attributes

Example

let vpc = awscc.ec2_vpc {
  name                 = "example-vpc"
  cidr_block           = "10.0.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true
}

let igw = awscc.ec2_internet_gateway {
  name = "example-igw"
}

awscc.ec2_vpc_gateway_attachment {
  name                = "example-igw-attachment"
  vpc_id              = vpc.vpc_id
  internet_gateway_id = igw.internet_gateway_id
}

awscc.ec2_flow_log

CloudFormation Type: AWS::EC2::FlowLog

Specifies a VPC flow log, which enables you to capture IP traffic for a specific network interface, subnet, or VPC.

Attributes

Enum Values

log_destination_type (LogDestinationType)

Shorthand formats: cloud-watch-logs or LogDestinationType.cloud-watch-logs

resource_type (ResourceType)

Shorthand formats: NetworkInterface or ResourceType.NetworkInterface

traffic_type (TrafficType)

Shorthand formats: ACCEPT or TrafficType.ACCEPT

Example

let vpc = awscc.ec2_vpc {
  name       = "example-vpc"
  cidr_block = "10.0.0.0/16"
}

awscc.ec2_flow_log {
  name                 = "example-flow-log"
  resource_id          = vpc.vpc_id
  resource_type        = VPC
  traffic_type         = ALL
  log_destination_type = s3
  log_destination      = "arn:aws:s3:::example-flow-logs-bucket"

  tags = {
    Environment = "example"
  }
}