Add AWS EC2 VM provider support

agent-vm.nix

@@ -35,7 +35,7 @@ in
       LinkLocalAddressing = "no";
     };
     address = [ "${net.agentIp}/${toString net.networkPrefix}" ];
-    routes = [ { Gateway = net.firewallIp; } ];
+    routes = [ { Gateway = net.agentDefaultGatewayIp; } ];
     dns = [ net.firewallIp ];
   };
 

common.nix

@@ -4,10 +4,16 @@
 # that are genuinely VM-specific (hostname, networking, firewall policy,
 # services) live in agent-vm.nix and firewall-vm.nix respectively.
 
+let
+  net = import ./network.nix;
+  isAwsEc2 = (net.provider or "lima") == "aws-ec2";
+in
 {
   imports = [
     # Required for the guest to boot under virtio VM runtimes.
     (modulesPath + "/profiles/qemu-guest.nix")
+  ] ++ lib.optionals isAwsEc2 [
+    (modulesPath + "/virtualisation/amazon-image.nix")
   ];
 
   config = {
@@ -42,13 +48,13 @@
       options = "--delete-older-than 14d";
     };
 
-    boot.loader.grub = {
+    boot.loader.grub = lib.mkIf (!isAwsEc2) {
       device = lib.mkDefault "nodev";
       efiSupport = lib.mkDefault true;
       efiInstallAsRemovable = lib.mkDefault true;
     };
 
-    fileSystems."/boot" = {
+    fileSystems."/boot" = lib.mkIf (!isAwsEc2) {
       device = lib.mkDefault "/dev/vda1";
       fsType = lib.mkDefault "vfat";
     };
@@ -61,7 +67,7 @@
     };
 
     environment.enableAllTerminfo = true;
-    services.lima.enable = true;
+    services.lima.enable = !isAwsEc2;
     networking.nat.enable = lib.mkForce false;
 
     # Lima's hostagent probes `/bin/bash` even when the configured user shell is

firewall-vm.nix

@@ -89,6 +89,7 @@ in
   systemd.network.networks."10-egress" = {
     matchConfig = egressMatch;
     networkConfig.DHCP = "ipv4";
+    dns = net.firewallUpstreamDns;
   };
 
   # Private Lima user-v2 link to the agent VM.

network.nix

@@ -13,6 +13,8 @@
 
 let
   defaults = {
+    provider = "lima";
+
     # IP of the firewall VM on the private inter-VM network. The agent VM uses
     # this as its default route, DNS server, and SSH proxy.
     #
@@ -23,6 +25,11 @@ let
     # IP of the agent VM on the same private network.
     agentIp = "192.168.100.11";
 
+    # Default gateway inside the agent VM. Lima uses the firewall's private IP.
+    # AWS uses the VPC subnet router, whose private route table sends default
+    # traffic to the firewall ENI.
+    agentDefaultGatewayIp = "192.168.100.10";
+
     # Subnet prefix length for the inter-VM network.
     networkPrefix = 24;
 
@@ -31,6 +38,11 @@ let
     firewallPrivateInterface = "enp0s1";
     firewallEgressInterface = "enp0s2";
     firewallControlInterface = "enp0s2";
+
+    # Optional static upstream resolvers for the firewall VM. Lima normally
+    # gets this from DHCP. AWS disables VPC DNS for the rootcell VPC, so the
+    # firewall receives explicit public upstream resolvers instead.
+    firewallUpstreamDns = [];
   };
 
   override =

package.json

@@ -25,7 +25,10 @@
     "vitest": "^4.0.0"
   },
   "dependencies": {
+    "@aws-sdk/client-ec2": "^3.1050.0",
+    "@aws-sdk/client-s3": "^3.1050.0",
     "@aws-sdk/client-secrets-manager": "^3.1050.0",
+    "@aws-sdk/client-sts": "^3.1050.0",
     "@aws-sdk/credential-providers": "^3.1050.0",
     "yargs": "18.0.0",
     "zod": "^4.4.3"

src/rootcell/instance.ts

@@ -131,7 +131,8 @@ function instanceHasVmState(repoDir: string, instanceName: string, env: NodeJS.P
   const paths = instancePaths(repoDir, instanceName, env);
   return existsSync(join(paths.dir, "v", "a"))
     || existsSync(join(paths.dir, "v", "f"))
-    || existsSync(join(paths.dir, "v", "n"));
+    || existsSync(join(paths.dir, "v", "n"))
+    || existsSync(join(paths.dir, "v", "aws-ec2"));
 }
 
 function rootcellInstanceFromPaths(paths: InstancePaths, state: InstanceState): RootcellInstance {

src/rootcell/integration/common/assertions.ts

@@ -31,7 +31,7 @@ export async function expectSpyWiring(flow: IntegrationFlow): Promise<void> {
 export async function expectPrivateNetworkRouting(flow: IntegrationFlow): Promise<void> {
   const network = flow.providers.network.plan().guest;
   await flow.agentSh(`ip -4 -o addr show ${network.agentPrivateInterface} | grep -q '${network.agentIp}/'`);
-  await flow.agentSh(`ip route show default | grep -q '^default via ${network.firewallIp} dev ${network.agentPrivateInterface}'`);
+  await flow.agentSh(`ip route show default | grep -q '^default via ${network.agentDefaultGatewayIp ?? network.firewallIp} dev ${network.agentPrivateInterface}'`);
   await flow.firewallSh(`ip -4 -o addr show ${network.firewallPrivateInterface} | grep -q '${network.firewallIp}/'`);
   await flow.agentSh(`dig @${network.firewallIp} +short +time=3 +tries=1 github.com | grep -qE '^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$'`);
 }

src/rootcell/integration/common/provider-spec.ts

@@ -1,5 +1,6 @@
 import type { RootcellConfig } from "../../types.ts";
 import type { ProviderBundle, VmNetworkAttachment } from "../../providers/types.ts";
+import { awsEc2IntegrationProvider } from "../providers/aws-ec2/provider.ts";
 import { macOsLimaUserV2IntegrationProvider } from "../providers/macos-lima-user-v2/provider.ts";
 
 export interface IntegrationProviderSpec<TAttachment extends VmNetworkAttachment = VmNetworkAttachment> {
@@ -14,6 +15,7 @@ export interface IntegrationProviderSpec<TAttachment extends VmNetworkAttachment
 }
 
 const providers = [
+  awsEc2IntegrationProvider,
   macOsLimaUserV2IntegrationProvider,
 ] as const satisfies readonly IntegrationProviderSpec[];
 

src/rootcell/integration/providers/aws-ec2/provider.ts

@@ -0,0 +1,103 @@
+import { existsSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import type { IntegrationProviderSpec } from "../../common/provider-spec.ts";
+import {
+  LIFECYCLE_INSTANCE,
+  TEST_INSTANCE,
+} from "../../common/fixtures.ts";
+import { instancePaths } from "../../../instance.ts";
+import { commandExists, runInherited } from "../../../process.ts";
+import type { RootcellConfig } from "../../../types.ts";
+import { AwsEc2VmProvider } from "../../../providers/aws-ec2.ts";
+import {
+  AwsEc2NetworkProvider,
+  type AwsEc2NetworkAttachment,
+} from "../../../providers/aws-ec2-network.ts";
+import type { ProviderBundle } from "../../../providers/types.ts";
+import { AwsSecretsManagerSecretProvider } from "../../../secrets/aws-secrets-manager.ts";
+import { MacOsKeychainSecretProvider } from "../../../secrets/macos-keychain.ts";
+import { StaticSecretProviderRegistry } from "../../../secrets/registry.ts";
+
+export const awsEc2IntegrationProvider: IntegrationProviderSpec<AwsEc2NetworkAttachment> = {
+  id: "aws-ec2",
+  platform: "darwin",
+  architecture: "arm64",
+  guestArchitecture: "aarch64-linux",
+  createBundle,
+  preflight: preflightAwsEc2Integration,
+  stopTestResources: stopAwsEc2TestResources,
+  removeTestState: removeAwsEc2TestState,
+};
+
+export function createBundle(
+  config: RootcellConfig,
+  log: (message: string) => void,
+): ProviderBundle<AwsEc2NetworkAttachment> {
+  return {
+    network: new AwsEc2NetworkProvider(config, log),
+    vm: new AwsEc2VmProvider(config, log),
+    secrets: new StaticSecretProviderRegistry([
+      new MacOsKeychainSecretProvider(),
+      ...config.awsSecretsManagerProviders.map((providerConfig) => new AwsSecretsManagerSecretProvider(providerConfig)),
+    ]),
+  };
+}
+
+export function preflightAwsEc2Integration(): Promise<void> {
+  requireEnv("ROOTCELL_VM_PROVIDER", "aws-ec2");
+  requireEnv("ROOTCELL_AWS_PROFILE");
+  requireEnv("ROOTCELL_AWS_REGION");
+  for (const tool of ["terraform", "ssh", "scp", "ssh-keygen", "curl"]) {
+    if (!commandExists(tool)) {
+      throw new Error(`aws-ec2 integration tests require '${tool}' on PATH`);
+    }
+  }
+  return Promise.resolve();
+}
+
+export async function stopAwsEc2TestResources(repoDir: string): Promise<void> {
+  await stopAwsEc2InstanceResources(repoDir, TEST_INSTANCE);
+  await stopAwsEc2InstanceResources(repoDir, LIFECYCLE_INSTANCE);
+}
+
+export async function removeAwsEc2TestState(repoDir: string): Promise<void> {
+  await removeAwsEc2InstanceState(repoDir, TEST_INSTANCE);
+  await removeAwsEc2InstanceState(repoDir, LIFECYCLE_INSTANCE);
+}
+
+function stopAwsEc2InstanceResources(repoDir: string, instance: string): Promise<void> {
+  if (!existsSync(instancePaths(repoDir, instance, process.env).statePath)) {
+    return Promise.resolve();
+  }
+  runInherited(join(repoDir, "rootcell"), ["stop", "--instance", instance], {
+    cwd: repoDir,
+    allowFailure: true,
+  });
+  return Promise.resolve();
+}
+
+function removeAwsEc2InstanceState(repoDir: string, instance: string): Promise<void> {
+  const paths = instancePaths(repoDir, instance, process.env);
+  if (!existsSync(paths.statePath)) {
+    return Promise.resolve();
+  }
+  const result = runInherited(join(repoDir, "rootcell"), ["remove", "--instance", instance], {
+    cwd: repoDir,
+    allowFailure: true,
+  });
+  if (result.status !== 0) {
+    throw new Error(`rootcell remove failed for AWS EC2 integration instance '${instance}'`);
+  }
+  rmSync(paths.dir, { recursive: true, force: true });
+  return Promise.resolve();
+}
+
+function requireEnv(name: string, expected?: string): void {
+  const value = process.env[name];
+  if (value === undefined || value.length === 0) {
+    throw new Error(`aws-ec2 integration tests require ${name}`);
+  }
+  if (expected !== undefined && value !== expected) {
+    throw new Error(`aws-ec2 integration tests require ${name}=${expected}`);
+  }
+}