VPC networking and security groups

Networking classes make VPC attachment, subnet placement, endpoints, security groups, and ingress/egress decisions explicit.

Source: mde/metamodels/psm/awspsm-networking.emf.

`VpcAttachmentConfig`

Represents vpc attachment config in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`vpcId`	`String` [1]	Stores the stable name/key/code used for vpc id on the vpc attachment config. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. Semantic validation: `ModeledVpcAttachmentShouldNotContradictRawIds` (modeled vpc attachment should not contradict raw ids) in `mde/validation/psm/rules/networking.evl` the value must be present and non-blank.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `order-123`.
`subnetIds`	`String` [*]	Records the subnet ids value for vpc attachment config. It keeps this decision explicit during review and transformation, so later steps do not have to infer it. Semantic validation: `VpcAttachmentHasSubnetsAndSecurityGroups` (vpc attachment has subnets and security groups) in `mde/validation/psm/rules/networking.evl` the collection or referenced set must not be empty. `ModeledVpcAttachmentShouldNotContradictRawIds` (modeled vpc attachment should not contradict raw ids) in `mde/validation/psm/rules/networking.evl` the value must be present and non-blank. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A collection of values. Example: [`Vpc Attachment Config Subnet Ids`, `Vpc Attachment Config Subnet Ids-2`].
`securityGroupIds`	`String` [*]	Records the security group ids value for vpc attachment config. It keeps this decision explicit during review and transformation, so later steps do not have to infer it. Semantic validation: `VpcAttachmentHasSubnetsAndSecurityGroups` (vpc attachment has subnets and security groups) in `mde/validation/psm/rules/networking.evl` the collection or referenced set must not be empty. `ModeledVpcAttachmentShouldNotContradictRawIds` (modeled vpc attachment should not contradict raw ids) in `mde/validation/psm/rules/networking.evl` the value must be present and non-blank. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A collection of values. Example: [`Vpc Attachment Config Security Group Ids`, `Vpc Attachment Config Security Group Ids-2`].
`ipv6AllowedForDualStack`	`Boolean` [1]	For a vpc attachment config, the model records whether ipv6 allowed for dual stack applies. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	Either `true` or `false`. Example: `true`.
`privateSubnetsRequireNatOrEndpoints`	`Boolean` [1]	For a vpc attachment config, the model records whether private subnets require nat or endpoints applies. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Semantic validation: `PrivateSubnetsRequireEndpointsWhenFlagged` (private subnets require endpoints when flagged) in `mde/validation/psm/rules/networking.evl` the flag must be enabled for this rule to pass.	Either `true` or `false`. Example: `false`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`requiredEndpoints` → `VpcEndpointReference`	containment, [*]	Contains the vpc endpoint reference element(s) that make up this vpc attachment config; the contained objects belong to this model element.
`vpc` → `Vpc`	reference, [?]	References the vpc element(s) used as vpc by this vpc attachment config; the target may be shared elsewhere in the model.
`subnets` → `Subnet`	reference, [*]	References the subnet element(s) used as subnets by this vpc attachment config; the target may be shared elsewhere in the model.
`securityGroups` → `SecurityGroup`	reference, [*]	References the security group element(s) used as security groups by this vpc attachment config; the target may be shared elsewhere in the model.

`VpcEndpointReference`

Represents vpc endpoint reference in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`serviceName`	`String` [1]	Records the stable name/key/code used for service name for the vpc endpoint reference. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `VpcEndpointReferenceExample`.
`endpointType`	`String` [1]	For a vpc endpoint reference, the model records the controlled classification or strategy represented by endpoint type. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `BUSINESS`.
`requiredForPrivateAccess`	`Boolean` [1]	Records whether required for private access applies to vpc endpoint reference. The field records an explicit architectural or governance decision as an explicit, reviewable input. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	Either `true` or `false`. Example: `true`.

Relationships

This class declares no direct relationships.

`Vpc`

Represents vpc in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`cidrBlock`	`String` [1]	Stores the cidr block value on the vpc. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Vpc Cidr Block`.
`enableDnsHostnames`	`Boolean` [1]	Records whether enable dns hostnames applies to vpc. This keeps the decision explicit even when the element's class or relationships remain unchanged. Semantic validation: `VpcShouldEnableDns` (vpc should enable dns) in `mde/validation/psm/rules/networking.evl` the flag must be enabled for this rule to pass. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	Either `true` or `false`. Example: `true`.
`enableDnsSupport`	`Boolean` [1]	Records whether enable dns support applies to vpc. The field records an explicit architectural or governance decision as an explicit, reviewable input. Semantic validation: `VpcShouldEnableDns` (vpc should enable dns) in `mde/validation/psm/rules/networking.evl` the flag must be enabled for this rule to pass. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	Either `true` or `false`. Example: `true`.

Relationships

This class declares no direct relationships.

`Subnet`

Represents subnet in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`subnetName`	`String` [1]	Records the stable name/key/code used for subnet name for the subnet. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `SubnetExample`.
`cidrBlock`	`String` [1]	Stores the cidr block value on the subnet. The field keeps the model explicit and reviewable during review and transformation instead of leaving the decision to an inferred default. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Subnet Cidr Block`.
`availabilityZone`	`String` [1]	For a subnet, the model records the availability zone value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Subnet Availability Zone`.
`mapPublicIpOnLaunch`	`Boolean` [1]	Records whether map public ip on launch applies to subnet. This keeps the decision explicit even when the element's class or relationships remain unchanged. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	Either `true` or `false`. Example: `true`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`vpc` → `Vpc`	reference, [?]	References the vpc element(s) used as vpc by this subnet; the target may be shared elsewhere in the model.

`VpcEndpoint`

Represents vpc endpoint in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`serviceName`	`String` [1]	For a vpc endpoint, the model records the stable name/key/code used for service name. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `VpcEndpointExample`.
`endpointType`	`String` [1]	Records controlled classification or strategy represented by endpoint type for vpc endpoint. It keeps this decision explicit during review and transformation, so later steps do not have to infer it. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `BUSINESS`.
`policyDocumentJson`	`String` [1]	Records the serialized JSON representation of policy document for the vpc endpoint. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `{"enabled":true}`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`vpc` → `Vpc`	reference, [?]	References the vpc element(s) used as vpc by this vpc endpoint; the target may be shared elsewhere in the model.
`subnets` → `Subnet`	reference, [*]	References the subnet element(s) used as subnets by this vpc endpoint; the target may be shared elsewhere in the model.
`securityGroups` → `SecurityGroup`	reference, [*]	References the security group element(s) used as security groups by this vpc endpoint; the target may be shared elsewhere in the model.

`SecurityGroup`

Represents security group in the PSM vocabulary. It specializes AwsResource with the details needed for this modeling concern.

Direct supertypes: AwsResource. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`groupDescription`	`String` [1]	Stores the human explanation of group description on the security group. The field records human review and generated guidance as an explicit, reviewable input. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Processes confirmed orders for the owning capability.`.
`vpcId`	`String` [1]	Records the stable name/key/code used for vpc id for the security group. This keeps the decision explicit even when the element's class or relationships remain unchanged. The repository contains no direct EVL rule, ETL assignment, or artifact-generator read for this declared field. For now, it remains a model-level fact for review and future refinement.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `order-123`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`vpc` → `Vpc`	reference, [?]	References the vpc element(s) used as vpc by this security group; the target may be shared elsewhere in the model.
`ingressRules` → `SecurityGroupRule`	containment, [*]	Contains the security group rule element(s) that make up this security group; the contained objects belong to this model element.
`egressRules` → `SecurityGroupRule`	containment, [*]	Contains the security group rule element(s) that make up this security group; the contained objects belong to this model element.

`SecurityGroupRule`

Represents security group rule in the PSM vocabulary. It specializes TraceableElement with the details needed for this modeling concern.

Direct supertypes: TraceableElement. Inherited attributes and marker capabilities are documented in the shared kernel; this section lists every attribute declared by this class.

Declared attributes

Attribute	Type and multiplicity	What it captures and why it exists	Accepted values and example
`ipProtocol`	`String` [1]	For a security group rule, the model records the ip protocol value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Security Group Rule Ip Protocol`.
`fromPort`	`Integer` [1]	Stores the from port value on the security group rule. The field records an operational boundary explicitly instead of leaving it to provider defaults. Semantic validation: `PortRangeValid` (port range valid) in `mde/validation/psm/rules/networking.evl` the value must remain absent in this modeling situation. `PublicAdminIngressRequiresReview` (public admin ingress requires review) in `mde/validation/psm/rules/networking.evl` the related value or object must be explicitly provided. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A numeric `Integer` value; use the unit or boundary documented for this attribute. Example: `1`.
`toPort`	`Integer` [1]	Records the to port value for security group rule. It keeps an operational boundary that should not be left to provider defaults explicit during review and transformation, so later steps do not have to infer it. Semantic validation: `PortRangeValid` (port range valid) in `mde/validation/psm/rules/networking.evl` the value must remain absent in this modeling situation. `PublicAdminIngressRequiresReview` (public admin ingress requires review) in `mde/validation/psm/rules/networking.evl` the related value or object must be explicitly provided. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A numeric `Integer` value; use the unit or boundary documented for this attribute. Example: `1`.
`cidrIp`	`String` [1]	For a security group rule, the model records the cidr ip value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Semantic validation: `PublicAdminIngressRequiresReview` (public admin ingress requires review) in `mde/validation/psm/rules/networking.evl` the related value or object must be explicitly provided. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Security Group Rule Cidr Ip`.
`cidrIpv6`	`String` [1]	For a security group rule, the model records the cidr ipv6 value. Keeping the fact with its owning element lets validation and refinement inspect it before artifact generation. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `Security Group Rule Cidr Ipv6`.
`ruleDescription`	`String` [1]	Records human explanation of rule description for security group rule. It keeps human review and generated guidance explicit during review and transformation, so later steps do not have to infer it. Semantic validation: `PublicAdminIngressRequiresReview` (public admin ingress requires review) in `mde/validation/psm/rules/networking.evl` the value must be present and non-blank. Generation role: The artifact generator references this feature in `mde/generation/awspsm-to-artifacts/lib/cfn.eol`.	A free-form `String`, subject to this class's semantic meaning and any EVL constraints. Example: `$.status == 'READY'`.

Relationships

Relationship	Kind and multiplicity	Meaning in the model
`sourceSecurityGroup` → `SecurityGroup`	reference, [?]	References the security group element(s) used as source security group by this security group rule; the target may be shared elsewhere in the model.