Add WithInternetAccess() opt-in and fix default override ordering

Add ec2.WithInternetAccess() VMOption as the explicit opt-in counterpart
to WithoutInternetAccess(). Provisioners that default to no-internet now
prepend the default option (instead of appending it) so that caller-provided
ec2.WithInternetAccess() can override it.

Tests that need to reach external hosts must now explicitly pass
ec2.WithInternetAccess() via their provisioner options.

Author: KevinFairise2

test/e2e-framework/scenarios/aws/ec2/vmargs.go

@@ -161,3 +161,14 @@ func WithoutInternetAccess() VMOption {
 		return nil
 	}
 }
+
+// WithInternetAccess explicitly opts the VM into internet access, overriding any
+// no-internet default set by the provisioner. Tests that need to reach external
+// hosts (e.g. to download packages, pull images, or contact external APIs) must
+// call this option explicitly.
+func WithInternetAccess() VMOption {
+	return func(p *vmArgs) error {
+		p.withoutInternetAccess = false
+		return nil
+	}
+}

test/e2e-framework/testing/provisioners/aws/host/host.go

@@ -74,7 +74,8 @@ func Provisioner(opts ...ProvisionerOption) provisioners.TypedProvisioner[enviro
 	provisioner := provisioners.NewTypedPulumiProvisioner(provisionerBaseID+runParams.Name, func(ctx *pulumi.Context, env *environments.Host) error {
 		// We ALWAYS need to make a deep copy of `params`, as the provisioner can be called multiple times.
 		// and it's easy to forget about it, leading to hard to debug issues.
-		opts = append(opts, WithRunOptions(ec2.WithEC2InstanceOptions(ec2.WithoutInternetAccess())))
+		// Prepend the no-internet default so that caller-provided opts (e.g. ec2.WithInternetAccess()) can override it.
+		opts = append([]ProvisionerOption{WithRunOptions(ec2.WithEC2InstanceOptions(ec2.WithoutInternetAccess()))}, opts...)
 		params := getProvisionerParams(opts...)
 		runParams := ec2.GetParams(params.runOptions...)