Network settings reference

Network settings decide how each deployment's Network is built. They live in the deployment's stack settings, the per-deployment options chosen at initial setup (for example the NetworkMode CloudFormation parameter), not in alien.ts.

The generated Network resource appears in stack state, but your code doesn't create it, link to it, or call it at runtime.

type StackSettings = {
  network?: NetworkSettings | null
  endpointAccess?: "internet" | "private"
}

When network is omitted and the stack needs a network, Alien uses { "type": "create", "availability_zones": 2 }.

Field names inside network use snake case.

use-default

Uses the cloud's default network. For development and tests.

{ "network": { "type": "use-default" } }

Field	Type	Required	Notes
`type`	`"use-default"`	Yes

AWS: the account's default VPC. Subnets are public with auto-assigned IPs. No NAT.
GCP: the project's default network and regional subnet. Instances get ephemeral external IPs. No NAT.
Azure: there is no default VNet, so Alien creates one with a NAT Gateway. Instances stay private.

create

Creates an isolated network for the deployment.

{
  "network": {
    "type": "create",
    "cidr": "100.88.0.0/16",
    "availability_zones": 2
  }
}

Field	Type	Required	Notes
`type`	`"create"`	Yes
`cidr`	`string`	No	VPC or VNet CIDR. Chosen for you when omitted. See CIDR selection.
`availability_zones`	`number`	No	Default `2`.

byo-vpc-aws

References an existing AWS VPC.

{
  "network": {
    "type": "byo-vpc-aws",
    "vpc_id": "vpc-0123456789abcdef0",
    "public_subnet_ids": ["subnet-0aaa", "subnet-0bbb"],
    "private_subnet_ids": ["subnet-0ccc", "subnet-0ddd"],
    "security_group_ids": ["sg-0123456789abcdef0"]
  }
}

Field	Type	Required	Notes
`type`	`"byo-vpc-aws"`	Yes
`vpc_id`	`string`	Yes	Existing VPC id.
`public_subnet_ids`	`string[]`	Yes	Subnets for public ingress.
`private_subnet_ids`	`string[]`	Yes	Subnets for instances that get no public IP.
`security_group_ids`	`string[]`	No	Security groups to attach.

byo-vpc-gcp

References an existing GCP VPC and subnet.

{
  "network": {
    "type": "byo-vpc-gcp",
    "network_name": "customer-vpc",
    "subnet_name": "app-us-central1",
    "region": "us-central1"
  }
}

Field	Type	Required	Notes
`type`	`"byo-vpc-gcp"`	Yes
`network_name`	`string`	Yes	Existing VPC network name.
`subnet_name`	`string`	Yes	Existing subnet name.
`region`	`string`	Yes	Region of the subnet.

byo-vnet-azure

References an existing Azure VNet.

{
  "network": {
    "type": "byo-vnet-azure",
    "vnet_resource_id": "/subscriptions/.../virtualNetworks/customer-vnet",
    "public_subnet_name": "public",
    "private_subnet_name": "private"
  }
}

Field	Type	Required	Notes
`type`	`"byo-vnet-azure"`	Yes
`vnet_resource_id`	`string`	Yes	Full resource id of the VNet.
`public_subnet_name`	`string`	Yes
`private_subnet_name`	`string`	Yes	Claimed by the Container Apps environment.
`application_gateway_subnet_name`	`string`	No	A dedicated subnet for a classic Application Gateway.
`private_endpoint_subnet_name`	`string`	No	A dedicated subnet for Private Endpoints. Required when the stack has a Postgres, since a Private Endpoint can't share the private subnet.

endpointAccess

Value	Notes
`internet`	Default. Public endpoints are reachable from the internet.
`private`	Public endpoints are reachable only through the deployment network. AWS managed containers only.

Fixed at initial setup. To change it, create a new deployment.

Network settings reference

use-defaultCopy Anchor Link

createCopy Anchor Link

byo-vpc-awsCopy Anchor Link

byo-vpc-gcpCopy Anchor Link

byo-vnet-azureCopy Anchor Link

endpointAccessCopy Anchor Link