pangea-aws 0.1.0

data/lib/pangea/resources/aws_iot_provisioning_template/resource.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require_relative 'types'
+require 'pangea/resources/base'
+
+module Pangea
+  module Resources
+    # AWS IoT Provisioning Template Resource
+    # 
+    # Provisioning templates automate device onboarding by defining how devices should be
+    # configured during registration. This enables consistent, scalable device provisioning
+    # with automated policy assignment, certificate creation, and resource allocation.
+    #
+    # @example Basic fleet provisioning template
+    #   template_body = ::JSON.generate({
+    #     "Parameters" => {
+    #       "ThingName" => { "Type" => "String" },
+    #       "SerialNumber" => { "Type" => "String" }
+    #     },
+    #     "Resources" => {
+    #       "thing" => {
+    #         "Type" => "AWS::IoT::Thing",
+    #         "Properties" => {
+    #           "ThingName" => { "Ref" => "ThingName" },
+    #           "AttributePayload" => {
+    #             "version" => "v1",
+    #             "serialNumber" => { "Ref" => "SerialNumber" }
+    #           }
+    #         }
+    #       },
+    #       "certificate" => {
+    #         "Type" => "AWS::IoT::Certificate",
+    #         "Properties" => {
+    #           "CertificateId" => { "Ref" => "AWS::IoT::Certificate::Id" },
+    #           "Status" => "ACTIVE"
+    #         }
+    #       }
+    #     }
+    #   })
+    #   
+    #   aws_iot_provisioning_template(:fleet_template, {
+    #     name: "FleetProvisioningTemplate",
+    #     template_body: template_body,
+    #     provisioning_role_arn: "arn:aws:iam::123456789012:role/IoTProvisioningRole",
+    #     enabled: true
+    #   })
+    #
+    # @example Template with pre-provisioning validation
+    #   aws_iot_provisioning_template(:validated_provisioning, {
+    #     name: "ValidatedDeviceProvisioning",
+    #     template_body: device_template_json,
+    #     provisioning_role_arn: provisioning_role.arn,
+    #     pre_provisioning_hook: {
+    #       target_arn: "arn:aws:lambda:us-east-1:123456789012:function:validate-device",
+    #       payload_version: "2020-04-01"
+    #     },
+    #     enabled: true,
+    #     description: "Device provisioning with validation hook"
+    #   })
+    #
+    # @example JITP (Just-in-Time Provisioning) template
+    #   aws_iot_provisioning_template(:jitp_template, {
+    #     name: "JustInTimeProvisioning", 
+    #     template_body: jitp_template_body,
+    #     provisioning_role_arn: jitp_role_arn,
+    #     type: "JITP",
+    #     description: "Automatic provisioning for CA-signed certificates",
+    #     tags: {
+    #       "ProvisioningType" => "JITP",
+    #       "Environment" => "Production"
+    #     }
+    #   })
+    module AwsIotProvisioningTemplate
+      include AwsIotProvisioningTemplateTypes
+
+      # Creates an AWS IoT provisioning template for automated device onboarding
+      #
+      # @param name [Symbol] Logical name for the provisioning template resource
+      # @param attributes [Hash] Provisioning template configuration attributes
+      # @return [Reference] Resource reference for use in other resources
+      def aws_iot_provisioning_template(name, attributes = {})
+        validated_attributes = Attributes[attributes]
+        
+        resource :aws_iot_provisioning_template, name do
+          name validated_attributes.name
+          template_body validated_attributes.template_body
+          description validated_attributes.description if validated_attributes.description
+          enabled validated_attributes.enabled if validated_attributes.enabled
+          type validated_attributes.type if validated_attributes.type
+          provisioning_role_arn validated_attributes.provisioning_role_arn
+
+          if validated_attributes.pre_provisioning_hook
+            pre_provisioning_hook do
+              target_arn validated_attributes.pre_provisioning_hook.target_arn
+              payload_version validated_attributes.pre_provisioning_hook.payload_version if validated_attributes.pre_provisioning_hook.payload_version
+            end
+          end
+
+          tags validated_attributes.tags if validated_attributes.tags
+        end
+
+        Reference.new(
+          type: :aws_iot_provisioning_template,
+          name: name,
+          attributes: Outputs.new(
+            arn: "${aws_iot_provisioning_template.#{name}.arn}",
+            name: "${aws_iot_provisioning_template.#{name}.name}",
+            default_version_id: "${aws_iot_provisioning_template.#{name}.default_version_id}",
+            id: "${aws_iot_provisioning_template.#{name}.id}",
+            type: "${aws_iot_provisioning_template.#{name}.type}"
+          )
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_iot_provisioning_template/types.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    # AWS IoT Provisioning Template Types
+    # 
+    # Provisioning templates define how devices should be configured during the registration process.
+    # They enable automated device onboarding with consistent configuration, policies, and resources
+    # for fleet management at scale.
+    module AwsIotProvisioningTemplateTypes
+      # Pre-provisioning hook configuration for custom validation
+      class PreProvisioningHook < Pangea::Resources::BaseAttributes
+        schema schema.strict
+
+        # ARN of Lambda function to call for pre-provisioning validation
+        attribute? :target_arn, Resources::Types::String.optional
+
+        # Optional payload template for the Lambda function
+        attribute? :payload_version, Resources::Types::String.optional
+      end
+
+      # Main attributes for IoT provisioning template resource
+
+      # Output attributes from provisioning template resource
+    end
+  end
+end

data/lib/pangea/resources/aws_iot_role_alias/resource.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require_relative 'types'
+require 'pangea/resources/base'
+
+module Pangea
+  module Resources
+    # AWS IoT Role Alias Resource
+    # 
+    # Role aliases enable IoT devices to securely access AWS services by assuming IAM roles
+    # without embedding long-term credentials. Devices use X.509 certificates for authentication
+    # and receive temporary STS credentials through the role alias mechanism.
+    #
+    # @example Basic role alias for device access
+    #   aws_iot_role_alias(:device_s3_access, {
+    #     alias: "DeviceS3Access",
+    #     role_arn: "arn:aws:iam::123456789012:role/IoTDeviceRole"
+    #   })
+    #
+    # @example Role alias with custom credential duration
+    #   aws_iot_role_alias(:long_running_access, {
+    #     alias: "LongRunningDeviceAccess",
+    #     role_arn: "arn:aws:iam::123456789012:role/IoTLongRunningRole",
+    #     credential_duration_seconds: 7200  # 2 hours
+    #   })
+    #
+    # @example Role alias with tags for organization
+    #   aws_iot_role_alias(:production_device_access, {
+    #     alias: "ProductionDeviceAccess",
+    #     role_arn: iam_role_ref.arn,
+    #     credential_duration_seconds: 3600,
+    #     tags: {
+    #       "Environment" => "Production",
+    #       "Application" => "SmartSensors",
+    #       "CostCenter" => "IoT-Operations"
+    #     }
+    #   })
+    #
+    # @example Role alias for specific device groups
+    #   aws_iot_role_alias(:sensor_data_writer, {
+    #     alias: "SensorDataWriter",
+    #     role_arn: "arn:aws:iam::123456789012:role/SensorDataRole",
+    #     credential_duration_seconds: 1800,  # 30 minutes for frequent updates
+    #     tags: {
+    #       "DeviceType" => "Sensor",
+    #       "Access" => "WriteOnly"
+    #     }
+    #   })
+    module AwsIotRoleAlias
+      include AwsIotRoleAliasTypes
+
+      # Creates an AWS IoT role alias for device IAM role assumption
+      #
+      # @param name [Symbol] Logical name for the role alias resource
+      # @param attributes [Hash] Role alias configuration attributes
+      # @return [Reference] Resource reference for use in other resources
+      def aws_iot_role_alias(name, attributes = {})
+        validated_attributes = Attributes[attributes]
+        
+        resource :aws_iot_role_alias, name do
+          send(:alias, validated_attributes.alias)
+          role_arn validated_attributes.role_arn
+          credential_duration_seconds validated_attributes.credential_duration_seconds if validated_attributes.credential_duration_seconds
+          tags validated_attributes.tags if validated_attributes.tags
+        end
+
+        Reference.new(
+          type: :aws_iot_role_alias,
+          name: name,
+          attributes: Outputs.new(
+            arn: "${aws_iot_role_alias.#{name}.arn}",
+            alias: "${aws_iot_role_alias.#{name}.alias}",
+            role_arn: "${aws_iot_role_alias.#{name}.role_arn}",
+            credential_duration_seconds: "${aws_iot_role_alias.#{name}.credential_duration_seconds}",
+            id: "${aws_iot_role_alias.#{name}.id}"
+          )
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_iot_role_alias/types.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    # AWS IoT Role Alias Types
+    # 
+    # Role aliases allow IoT devices to assume IAM roles without embedding credentials.
+    # This enables secure access to AWS services from IoT devices using X.509 certificate
+    # authentication and temporary credentials via AWS STS.
+    module AwsIotRoleAliasTypes
+      # Main attributes for IoT role alias resource
+
+      # Output attributes from role alias resource
+    end
+  end
+end

data/lib/pangea/resources/aws_iot_security_profile/resource.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_iot_security_profile/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      def aws_iot_security_profile(name, attributes = {})
+        profile_attrs = Types::IotSecurityProfileAttributes.new(attributes)
+        
+        resource(:aws_iot_security_profile, name) do
+          security_profile_name profile_attrs.security_profile_name
+          security_profile_description profile_attrs.security_profile_description if profile_attrs.security_profile_description
+          
+          profile_attrs.behaviors.each do |behavior|
+            behaviors do
+              name behavior[:name]
+              metric behavior[:metric] if behavior[:metric]
+              metric_dimension behavior[:metric_dimension] if behavior[:metric_dimension]
+              criteria behavior[:criteria] if behavior[:criteria]
+              suppress_alerts behavior[:suppress_alerts] if behavior.key?(:suppress_alerts)
+            end
+          end
+          
+          if profile_attrs.alert_targets
+            alert_targets do
+              profile_attrs.alert_targets.each { |k, v| public_send(k, v) }
+            end
+          end
+          
+          if profile_attrs.additional_metrics_to_retain_v2&.any?
+            profile_attrs.additional_metrics_to_retain_v2.each do |metric|
+              additional_metrics_to_retain_v2 do
+                metric metric[:metric]
+                metric_dimension metric[:metric_dimension] if metric[:metric_dimension]
+                export_metric metric[:export_metric] if metric.key?(:export_metric)
+              end
+            end
+          end
+          
+          if profile_attrs.tags&.any?
+            tags do
+              profile_attrs.tags.each { |k, v| public_send(k, v) }
+            end
+          end
+        end
+        
+        ResourceReference.new(
+          type: 'aws_iot_security_profile',
+          name: name,
+          resource_attributes: profile_attrs.to_h,
+          outputs: {
+            security_profile_name: "${aws_iot_security_profile.#{name}.security_profile_name}",
+            security_profile_arn: "${aws_iot_security_profile.#{name}.security_profile_arn}",
+            version: "${aws_iot_security_profile.#{name}.version}",
+            creation_date: "${aws_iot_security_profile.#{name}.creation_date}",
+            last_modified_date: "${aws_iot_security_profile.#{name}.last_modified_date}"
+          },
+          computed_properties: {
+            behavior_count: profile_attrs.behavior_count,
+            has_alert_targets: profile_attrs.has_alert_targets?,
+            metric_count: profile_attrs.metric_count,
+            security_coverage_score: profile_attrs.security_coverage_score
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_iot_security_profile/types.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      class IotSecurityProfileAttributes < Pangea::Resources::BaseAttributes
+        attribute? :security_profile_name, Resources::Types::IotSecurityProfileName.optional
+        attribute? :security_profile_description, Resources::Types::String.optional
+        attribute :behaviors, Resources::Types::Array.of(Resources::Types::Hash).default([].freeze)
+        attribute :alert_targets, Resources::Types::Hash.default({}.freeze)
+        attribute :additional_metrics_to_retain_v2, Resources::Types::Array.of(Resources::Types::Hash).default([].freeze)
+        attribute :tags, Resources::Types::AwsTags.default({}.freeze)
+        
+        def behavior_count
+          behaviors.length
+        end
+        
+        def has_alert_targets?
+          !alert_targets.nil? && alert_targets.any?
+        end
+        
+        def metric_count
+          additional_metrics_to_retain_v2&.length || 0
+        end
+        
+        def security_coverage_score
+          # Calculate coverage based on behaviors and metrics
+          base_score = [behavior_count * 10, 100].min
+          alert_bonus = has_alert_targets? ? 20 : 0
+          metric_bonus = [metric_count * 5, 30].min
+          
+          [base_score + alert_bonus + metric_bonus, 100].min
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_iot_thing/resource.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_iot_thing/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS IoT Thing with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] IoT Thing attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_iot_thing(name, attributes = {})
+        # Validate attributes using dry-struct
+        thing_attrs = Resources::Types::IotThingAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_iot_thing, name) do
+          # Required attributes
+          thing_name thing_attrs.thing_name
+          
+          # Optional thing type
+          thing_type_name thing_attrs.thing_type_name if thing_attrs.thing_type_name
+          
+          # Attribute payload configuration
+          attribute_payload do
+            # Set attributes if provided
+            if thing_attrs.attribute_payload&.dig(:attributes)&.any?
+              attributes do
+                thing_attrs.attribute_payload&.dig(:attributes).each do |key, value|
+                  public_send(key, value)
+                end
+              end
+            end
+            
+            # Set merge behavior
+            merge thing_attrs.attribute_payload&.dig(:merge) unless thing_attrs.attribute_payload&.dig(:merge).nil?
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_iot_thing',
+          name: name,
+          resource_attributes: thing_attrs.to_h,
+          outputs: {
+            thing_name: "${aws_iot_thing.#{name}.thing_name}",
+            thing_arn: "${aws_iot_thing.#{name}.arn}",
+            thing_id: "${aws_iot_thing.#{name}.thing_id}",
+            thing_type_name: "${aws_iot_thing.#{name}.thing_type_name}",
+            attributes: "${aws_iot_thing.#{name}.attributes}",
+            default_client_id: "${aws_iot_thing.#{name}.default_client_id}",
+            version: "${aws_iot_thing.#{name}.version}"
+          },
+          computed_properties: {
+            attribute_count: thing_attrs.attribute_count,
+            has_type: thing_attrs.has_type?,
+            fleet_indexing_ready: thing_attrs.fleet_indexing_ready?,
+            estimated_storage_bytes: thing_attrs.estimated_storage_bytes,
+            security_recommendations: thing_attrs.security_recommendations,
+            required_permissions: thing_attrs.required_permissions
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_iot_thing/types.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+      # Type-safe attributes for AWS IoT Thing resources
+      class IotThingAttributes < Pangea::Resources::BaseAttributes
+        # Thing name (required)
+        attribute? :thing_name, Resources::Types::IotThingName.optional
+        
+        # Thing type name (optional)
+        attribute? :thing_type_name, Resources::Types::IotThingTypeName.optional
+        
+        # Attribute payload (optional key-value pairs)
+        attribute? :attribute_payload, Resources::Types::Hash.schema(
+          attributes?: Resources::Types::IotThingAttributes.optional,
+          merge?: Resources::Types::Bool.optional
+        ).lax.default({ attributes: {}, merge: false }.freeze)
+        
+        # Custom validation
+        def self.new(attributes = {})
+          attrs = super(attributes)
+          
+          # Validate attribute payload merge behavior
+          if attrs.attribute_payload&.dig(:merge) && (!attrs.attribute_payload&.dig(:attributes) || attrs.attribute_payload&.dig(:attributes).empty?)
+            raise Dry::Struct::Error, "Cannot set merge: true without providing attributes"
+          end
+          
+          attrs
+        end
+        
+        # Get total attribute count
+        def attribute_count
+          return 0 unless attribute_payload&.dig(:attributes)
+          attribute_payload&.dig(:attributes).keys.length
+        end
+        
+        # Check if thing has a specific attribute
+        def has_attribute?(key)
+          return false unless attribute_payload&.dig(:attributes)
+          attribute_payload&.dig(:attributes).key?(key.to_sym) || attribute_payload&.dig(:attributes).key?(key.to_s)
+        end
+        
+        # Get attribute value
+        def get_attribute(key)
+          return nil unless attribute_payload&.dig(:attributes)
+          attribute_payload&.dig(:attributes)[key.to_sym] || attribute_payload&.dig(:attributes)[key.to_s]
+        end
+        
+        # Check if thing has a type
+        def has_type?
+          !thing_type_name.nil?
+        end
+        
+        # Generate thing ARN (computed)
+        def thing_arn_pattern(region, account_id)
+          "arn:aws:iot:#{region}:#{account_id}:thing/#{thing_name}"
+        end
+        
+        # Estimate storage usage in bytes
+        def estimated_storage_bytes
+          base_size = thing_name.bytesize
+          base_size += thing_type_name.bytesize if thing_type_name
+          
+          if attribute_payload&.dig(:attributes)
+            attribute_size = attribute_payload&.dig(:attributes).map do |k, v|
+              k.to_s.bytesize + v.to_s.bytesize
+            end.sum
+            base_size += attribute_size
+          end
+          
+          base_size
+        end
+        
+        # Check if thing can be used for fleet indexing
+        def fleet_indexing_ready?
+          # Things with attributes are better for fleet indexing
+          attribute_count > 0 || has_type?
+        end
+        
+        # Security recommendations
+        def security_recommendations
+          recommendations = []
+          
+          recommendations << "Consider creating a thing type for better organization" unless has_type?
+          recommendations << "Add meaningful attributes for fleet indexing" if attribute_count == 0
+          recommendations << "Use consistent naming convention for thing names" unless thing_name.match?(/\A[a-zA-Z][a-zA-Z0-9_-]*\z/)
+          
+          if attribute_payload&.dig(:attributes)
+            # Check for potentially sensitive attribute names
+            sensitive_patterns = %w[password secret key token credential]
+            sensitive_attrs = attribute_payload&.dig(:attributes).keys.select do |key|
+              sensitive_patterns.any? { |pattern| key.to_s.downcase.include?(pattern) }
+            end
+            
+            unless sensitive_attrs.empty?
+              recommendations << "Avoid storing sensitive data in thing attributes: #{sensitive_attrs.join(', ')}"
+            end
+          end
+          
+          recommendations
+        end
+        
+        # Generate thing principal permissions needed
+        def required_permissions
+          permissions = [
+            "iot:UpdateThing",
+            "iot:DescribeThing",
+            "iot:DeleteThing"
+          ]
+          
+          permissions << "iot:ListThingPrincipals" if has_type?
+          permissions << "iot:UpdateThingAttribute" if attribute_count > 0
+          
+          permissions
+        end
+        end
+      end
+    end
+  end
+end