No L2 for aws_eip (Elastic IP)

[so0k]

There is no L2 for aws_eip (nor aws_eip_association). grep -rn "class Eip\|ElasticIp" src/aws/ returns nothing on terraconstructs@0.2.12.

Context

An L3 that pins a stable public address to a single-instance ASG has to reach past the L2 layer for this one resource:

import { eip } from "@cdktn/provider-aws";

this.elasticIp = new eip.Eip(this, "Eip", {
  domain: "vpc",
  tags: { Name: `${namePrefix}-eip` },
});

That is workable, but it means the construct's public API leaks a raw provider type (eip.Eip) where every other member is a TerraConstructs L2, and consumers pick up a direct @cdktn/provider-aws dependency purely for this.

Suggestion

An ElasticIp construct with an IElasticIp interface exposing at least allocationId, publicIp and arn.

Worth noting the IAM side too: granting an instance the ability to associate its own EIP needs ec2:AssociateAddress on both the instance ARN and the elastic-ip/${allocationId} ARN. A grantAssociate(grantee) method in the shape of the existing IVolume.grantAttachVolumeByResourceTag would cover the self-association pattern nicely — right now that policy is hand-rolled:

role.addToPrincipalPolicy(new aws.iam.PolicyStatement({
  actions: ["ec2:AssociateAddress"],
  resources: [
    stack.formatArn({ service: "ec2", resource: "instance", resourceName: "*" }),
    stack.formatArn({ service: "ec2", resource: "elastic-ip", resourceName: allocationId }),
  ],
}));