anvil-cloud
Cloud infrastructure that's secure by default — not by accident.
Anvil wraps raw cloud resources into opinionated, production-ready components. No boilerplate. No copy-pasting security configs. Just declare what you need.
Built on Pulumi.
Install
pip install anvil-cloud
Secure by default
Every Anvil component ships with defaults aligned to production from day one — public access blocked, encryption enforced, cost tags applied. The goal isn't to make compliance automatic, but to make it a platform you can actually build on.
The App class
Every Anvil program starts with anvil.App(). The run callback receives a Context with:
ctx.stage— current deployment stage (defaults to your OS username for dev isolation)ctx.project— project name fromanvil.yamlctx.export(name, value)— export stack outputsctx.providers— named cloud providers for multi-region / multi-accountctx.ref(id)— reference a resource declared elsewhere (see below)
Forward references (ctx.ref)
Normally you reference a resource through the variable it's assigned to, which
means it must be declared first. ctx.ref("id") lets you reference a resource by
its logical name — even one declared later in the program:
def infra(ctx: anvil.Context):
fn = anvil.aws.Lambda("processor",
runtime=LambdaRuntime.NODEJS20_X,
handler="src/index.handler",
environment={
# forward reference — `db` is declared below
"DSQL_ENDPOINT": ctx.ref("db").endpoint,
},
)
db = anvil.aws.DSQL("db", schemas=[...])
ctx.ref("db").endpoint resolves to the same output as db.endpoint — they're
interchangeable.
This is an escape hatch for cases where declaration order is awkward; most code references resources directly. Two things to know:
- Keep references flowing one direction. Because you can point either way, you can accidentally create a cycle (A references B's output and B references A's). That deadlocks the deploy rather than erroring cleanly — so don't do it.
- A typo or never-declared id fails with a clear error before anything deploys.
Running locally:
anvil deployuses whateverpython3is on yourPATH, so activate your project venv first (source .venv/bin/activate) or the program can't importpulumi.
Grants
Grants are how Anvil wires permissions between resources. Instead of writing IAM policies by hand, you call .grant() on a resource and Anvil handles both the IAM role policy and the environment variable injection automatically.
A Lambda reading from a Bucket:
import anvil_cloud as anvil
def infra(ctx: anvil.Context):
bucket = anvil.aws.Bucket("uploads",
data_classification="sensitive",
)
fn = anvil.aws.Lambda("processor",
runtime="nodejs20.x",
handler="src/index.handler",
)
# Grants the Lambda read access to the bucket and scopes down to specific bucket paths.
# Anvil creates the IAM policy and injects UPLOADS_BUCKET_NAME
# into the Lambda's environment automatically.
bucket.grant(fn, actions=["read"], path=["user/*"])
anvil.App(run=infra)
What Anvil does under the hood:
- Creates an IAM
RolePolicyscoped to the exact actions requested - Injects the resource identifier as an environment variable on the target (e.g.
UPLOADS_BUCKET_NAME) - No manual ARN wiring, no forgotten permissions
SvelteKit deployment
Deploy a SvelteKit app to AWS with a single component. Anvil provisions S3, CloudFront, ACM, Lambda (via Lambda Web Adapter), and Route53 — with HTTPS and a custom domain out of the box:
import anvil_cloud as anvil
def infra(ctx: anvil.Context):
site = anvil.aws.SvelteKitSite("web",
path="web", # the SvelteKit project folder — Anvil runs the build
domain="myapp.com",
)
ctx.export("url", site.url)
anvil.App(run=infra)
Escape hatch
Every component accepts a hatch argument — an escape hatch to override the underlying resource config when you need to break from the defaults:
bucket = anvil.aws.Bucket("custom",
data_classification="non-sensitive",
hatch=anvil.aws.BucketHatchArgsArgs(
overrides=anvil.aws.BucketOverridesArgs(
force_destroy=True,
tags={"env": "dev"},
),
),
)
Requirements
- Python >= 3.8
- Pulumi >= 3.0.0
- Anvil CLI:
curl -fsSL https://raw.githubusercontent.com/anvil-cloud/anvil/master/install.sh | sh
Links
License
Apache-2.0
1 maintainer
Metadata
1 maintainer
Release files for anvil-cloud 0.1.22
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| anvil_cloud-0.1.22.tar.gz | 123.4 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| anvil_cloud-0.1.22-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 273.9 kB
Release files / anvil_cloud-0.1.22.tar.gz
| Download URL | anvil_cloud-0.1.22.tar.gz |
|---|---|
| Size | 123.4 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
d278c4eba81f49be1162e32ae94edd21b724984a4a8a02eb8a4b45781fcbd117
|
|
BLAKE2b-256 checksum How to use checksums |
d5091bee14309988cad9f705e6597dc907b6c9169641b0d2a59e62ecef3d1c16
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logRelease files / anvil_cloud-0.1.22-py3-none-any.whl
| Download URL | anvil_cloud-0.1.22-py3-none-any.whl |
|---|---|
| Size | 150.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
446b106bfdc1ad89431f9dcc913cd8458aac7edcf682cb8ede5e1fecebbd4168
|
|
BLAKE2b-256 checksum How to use checksums |
1febd16a69721b39c6028438d95bc391b3bfd78ba61277488736c56829325fcf
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logSecurity for anvil-cloud 0.1.22
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for anvil_cloud-0.1.22.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 24, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
