Everything CreateMicrovmImage needs.
What is deliberately not a field
A clientToken. There is no such field on the core’s request type and none here: a
digest-derived token replays the original create and wedges an image in CREATING for
fifteen hours with no error at all (TRAP-1). tokenScope is a CloudTrail label folded
in beside a fresh nonce and cannot become the token.
A capabilities list. repairGuestIdentity is a boolean and the request injects ["ALL"]
itself, so ["CAP_SYS_ADMIN"] — the request AWS rejects after the artifact upload — is not
something a caller can write (TRAP-3).
An architecture. The model’s enum has exactly one value, so the only thing a field could
express is a rejected request.
Properties
Section titled “Properties”baseImage?
Section titled “baseImage?”optional baseImage?: BaseImageInput;baseImageVersion?
Section titled “baseImageVersion?”optional baseImageVersion?: string;Pins the managed base to one version, a value managedBaseVersions lists.
binary
Section titled “binary”binary: Uint8Array;The daemon binary’s bytes, zipped into the artifact.
buildRoleArn
Section titled “buildRoleArn”buildRoleArn: string;The build role, which must grant logs on /aws/lambda-microvms/*.
codeArtifactUri
Section titled “codeArtifactUri”codeArtifactUri: string;Where the artifact is uploaded to. buildImage does not upload: the caller puts the
bytes there and passes the URI. ensureImage is the path that uploads for itself.
dockerfile?
Section titled “dockerfile?”optional dockerfile?: string;A caller-supplied Dockerfile, checked against the base image’s FROM.
inheritWorkdir?
Section titled “inheritWorkdir?”optional inheritWorkdir?: boolean;Whether the daemon should inherit the image’s WORKDIR. Refused when nothing declares
one, because the inheritance would silently resolve to /.
logGroup?
Section titled “logGroup?”optional logGroup?: string;logging.cloudWatch.logGroup, or absent for the service default (a service-created
group under /aws/lambda-microvms/<image-name> with random stream names). The
build role must grant logs on whatever this names.
logStream?
Section titled “logStream?”optional logStream?: string;A log-stream name prefix inside logGroup, never the exact name: the platform
member is an exact stream name (prefixes unsupported) and one build is three VMs
writing three streams, so the client appends /<16 hex> per build attempt and the
resolved name comes back on Image.logStream. Requires logGroup.
name: string;projectDir?
Section titled “projectDir?”optional projectDir?: string;A directory whose one manifest+lockfile pair bakes an environment layer, by the rule
the CLI’s --project uses. A directory without exactly one pair is refused before any
call.
repairGuestIdentity?
Section titled “repairGuestIdentity?”optional repairGuestIdentity?: boolean;Whether to repair guest identity. A boolean, not a capability list — see above.
optional tags?: Record<string, string>;tokenScope?
Section titled “tokenScope?”optional tokenScope?: string;A CloudTrail-readability label, defaulting to the image name. Not the token.
Provenance
Section titled “Provenance”This page is generated from bindings/microvms-js/index.d.ts by TypeDoc 0.28.20 and typedoc-plugin-markdown 4.13.1, run from site/scripts/gen-reference.mjs on every pnpm run sync, so an edit made here is overwritten by the next run.
To change the page, change the doc comment in the binding’s Rust source, then regenerate the declarations with mise run dts. mise run dts:check fails when the committed file no longer matches the source.