pangea-aws 0.1.0

data/lib/pangea/resources/aws_mq_broker/resource.rb

@@ -0,0 +1,154 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_mq_broker/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS MQ Broker for message queuing
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] MQ broker attributes
+      # @option attributes [String] :broker_name The broker name
+      # @option attributes [String] :engine_type ActiveMQ or RabbitMQ
+      # @option attributes [String] :engine_version Engine version
+      # @option attributes [String] :host_instance_type Instance type
+      # @option attributes [Array<Hash>] :users Broker users configuration
+      # @option attributes [Boolean] :apply_immediately Apply changes immediately
+      # @option attributes [String] :authentication_strategy Authentication strategy
+      # @option attributes [Boolean] :auto_minor_version_upgrade Auto upgrade minor versions
+      # @option attributes [Hash] :configuration Broker configuration
+      # @option attributes [String] :deployment_mode Deployment mode
+      # @option attributes [Hash] :encryption_options Encryption settings
+      # @option attributes [Hash] :ldap_server_metadata LDAP configuration
+      # @option attributes [Hash] :logs Logging configuration
+      # @option attributes [Hash] :maintenance_window_start_time Maintenance window
+      # @option attributes [Boolean] :publicly_accessible Public accessibility
+      # @option attributes [Array<String>] :security_groups Security group IDs
+      # @option attributes [String] :storage_type Storage type
+      # @option attributes [Array<String>] :subnet_ids Subnet IDs
+      # @option attributes [Hash] :tags Resource tags
+      # @return [ResourceReference] Reference object with outputs
+      def aws_mq_broker(name, attributes = {})
+        # Validate attributes using dry-struct
+        broker_attrs = Types::MqBrokerAttributes.new(attributes)
+        
+        # Generate terraform resource block
+        resource(:aws_mq_broker, name) do
+          broker_name broker_attrs.broker_name
+          engine_type broker_attrs.engine_type
+          engine_version broker_attrs.engine_version
+          host_instance_type broker_attrs.host_instance_type
+          
+          # Users configuration
+          broker_attrs.users.each do |user|
+            user do
+              username user[:username]
+              password user[:password] if user[:password]
+              console_access user[:console_access] if user.key?(:console_access)
+              groups user[:groups] if user[:groups]
+            end
+          end
+          
+          apply_immediately broker_attrs.apply_immediately if broker_attrs.apply_immediately != false
+          authentication_strategy broker_attrs.authentication_strategy if broker_attrs.authentication_strategy != 'simple'
+          auto_minor_version_upgrade broker_attrs.auto_minor_version_upgrade if broker_attrs.auto_minor_version_upgrade != false
+          
+          # Configuration
+          if broker_attrs.configuration
+            configuration do
+              id broker_attrs.configuration&.dig(:id) if broker_attrs.configuration&.dig(:id)
+              revision broker_attrs.configuration&.dig(:revision) if broker_attrs.configuration&.dig(:revision)
+            end
+          end
+          
+          deployment_mode broker_attrs.deployment_mode if broker_attrs.deployment_mode != 'SINGLE_INSTANCE'
+          
+          # Encryption options
+          if broker_attrs.encryption_options
+            encryption_options do
+              kms_key_id broker_attrs.encryption_options&.dig(:kms_key_id) if broker_attrs.encryption_options&.dig(:kms_key_id)
+              use_aws_owned_key broker_attrs.encryption_options&.dig(:use_aws_owned_key) if broker_attrs.encryption_options.key?(:use_aws_owned_key)
+            end
+          end
+          
+          # LDAP server metadata
+          if broker_attrs.ldap_server_metadata
+            ldap_server_metadata do
+              hosts broker_attrs.ldap_server_metadata&.dig(:hosts)
+              role_base broker_attrs.ldap_server_metadata&.dig(:role_base)
+              role_name broker_attrs.ldap_server_metadata&.dig(:role_name) if broker_attrs.ldap_server_metadata&.dig(:role_name)
+              role_search_matching broker_attrs.ldap_server_metadata&.dig(:role_search_matching) if broker_attrs.ldap_server_metadata&.dig(:role_search_matching)
+              role_search_subtree broker_attrs.ldap_server_metadata&.dig(:role_search_subtree) if broker_attrs.ldap_server_metadata.key?(:role_search_subtree)
+              service_account_password broker_attrs.ldap_server_metadata&.dig(:service_account_password)
+              service_account_username broker_attrs.ldap_server_metadata&.dig(:service_account_username)
+              user_base broker_attrs.ldap_server_metadata&.dig(:user_base)
+              user_role_name broker_attrs.ldap_server_metadata&.dig(:user_role_name) if broker_attrs.ldap_server_metadata&.dig(:user_role_name)
+              user_search_matching broker_attrs.ldap_server_metadata&.dig(:user_search_matching) if broker_attrs.ldap_server_metadata&.dig(:user_search_matching)
+              user_search_subtree broker_attrs.ldap_server_metadata&.dig(:user_search_subtree) if broker_attrs.ldap_server_metadata.key?(:user_search_subtree)
+            end
+          end
+          
+          # Logs
+          if broker_attrs.logs
+            logs do
+              general broker_attrs.logs&.dig(:general) if broker_attrs.logs.key?(:general)
+              audit broker_attrs.logs&.dig(:audit) if broker_attrs.logs.key?(:audit)
+            end
+          end
+          
+          # Maintenance window
+          if broker_attrs.maintenance_window_start_time
+            maintenance_window_start_time do
+              day_of_week broker_attrs.maintenance_window_start_time&.dig(:day_of_week)
+              time_of_day broker_attrs.maintenance_window_start_time&.dig(:time_of_day)
+              time_zone broker_attrs.maintenance_window_start_time&.dig(:time_zone) if broker_attrs.maintenance_window_start_time&.dig(:time_zone)
+            end
+          end
+          
+          publicly_accessible broker_attrs.publicly_accessible if broker_attrs.publicly_accessible != false
+          security_groups broker_attrs.security_groups if broker_attrs.security_groups
+          storage_type broker_attrs.storage_type if broker_attrs.storage_type
+          subnet_ids broker_attrs.subnet_ids if broker_attrs.subnet_ids
+          
+          # Tags
+          if broker_attrs.tags&.any?
+            tags broker_attrs.tags
+          end
+        end
+        
+        # Return resource reference with outputs
+        ResourceReference.new(
+          type: 'aws_mq_broker',
+          name: name,
+          resource_attributes: broker_attrs.to_h,
+          outputs: {
+            id: "${aws_mq_broker.#{name}.id}",
+            arn: "${aws_mq_broker.#{name}.arn}",
+            broker_name: "${aws_mq_broker.#{name}.broker_name}",
+            instances: "${aws_mq_broker.#{name}.instances}",
+            console_url: "${aws_mq_broker.#{name}.instances.0.console_url}",
+            endpoints: "${aws_mq_broker.#{name}.instances.0.endpoints}"
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_mq_broker/types.rb

@@ -0,0 +1,182 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # MQ broker engine types
+        unless const_defined?(:MqEngineType)
+        MqEngineType = Resources::Types::String.constrained(included_in: ['ActiveMQ', 'RabbitMQ'])
+        end
+
+        # MQ instance types
+        MqInstanceType = Resources::Types::String.constrained(included_in: ['mq.t2.micro', 'mq.t3.micro',
+          'mq.m4.large', 'mq.m5.large', 'mq.m5.xlarge', 'mq.m5.2xlarge', 'mq.m5.4xlarge',
+          'mq.c4.large', 'mq.c4.xlarge', 'mq.c5.large', 'mq.c5.xlarge', 'mq.c5.2xlarge', 'mq.c5.4xlarge', 'mq.c5.9xlarge',
+          'mq.r4.large', 'mq.r4.xlarge', 'mq.r4.2xlarge', 'mq.r4.4xlarge',
+          'mq.r5.large', 'mq.r5.xlarge', 'mq.r5.2xlarge', 'mq.r5.4xlarge', 'mq.r5.12xlarge'])
+
+        # MQ deployment mode
+        MqDeploymentMode = Resources::Types::String.constrained(included_in: ['SINGLE_INSTANCE', 'ACTIVE_STANDBY_MULTI_AZ', 'CLUSTER_MULTI_AZ'])
+
+        # MQ storage type
+        MqStorageType = Resources::Types::String.constrained(included_in: ['ebs', 'efs'])
+
+        # MQ authentication strategy
+        unless const_defined?(:MqAuthenticationStrategy)
+        MqAuthenticationStrategy = Resources::Types::String.constrained(included_in: ['simple', 'ldap'])
+        end
+
+        # MQ day of week
+        MqDayOfWeek = Resources::Types::String.constrained(included_in: ['MONDAY', 'TUESDAY', 'WEDNESDAY', 'THURSDAY', 'FRIDAY', 'SATURDAY', 'SUNDAY'])
+
+        # MQ user configuration
+        MqUser = Resources::Types::Hash.schema(
+          username: Resources::Types::String.constrained(size: 1..100),
+          password?: Resources::Types::String.constrained(size: 12..250).optional,
+          console_access?: Resources::Types::Bool.optional,
+          groups?: Resources::Types::Array.of(Resources::Types::String).optional
+        ).lax
+
+        # MQ encryption options
+        MqEncryptionOptions = Resources::Types::Hash.schema(
+          kms_key_id?: Resources::Types::String.optional,
+          use_aws_owned_key?: Resources::Types::Bool.optional
+        ).lax
+
+        # MQ maintenance window start time
+        MqMaintenanceWindowStartTime = Resources::Types::Hash.schema(
+          day_of_week: MqDayOfWeek,
+          time_of_day: Resources::Types::String.constrained(format: /\A([01]?[0-9]|2[0-3]):[0-5][0-9]\z/),
+          time_zone?: Resources::Types::String.optional
+        ).lax
+
+        # MQ logs configuration
+        MqLogs = Resources::Types::Hash.schema(
+          general?: Resources::Types::Bool.optional,
+          audit?: Resources::Types::Bool.optional
+        ).lax
+
+        # MQ LDAP server metadata (for LDAP authentication)
+        MqLdapServerMetadata = Resources::Types::Hash.schema(
+          hosts: Resources::Types::Array.of(Resources::Types::String).constrained(min_size: 1),
+          role_base: Resources::Types::String,
+          role_name?: Resources::Types::String.optional,
+          role_search_matching?: Resources::Types::String.optional,
+          role_search_subtree?: Resources::Types::Bool.optional,
+          service_account_password: Resources::Types::String,
+          service_account_username: Resources::Types::String,
+          user_base: Resources::Types::String,
+          user_role_name?: Resources::Types::String.optional,
+          user_search_matching?: Resources::Types::String.optional,
+          user_search_subtree?: Resources::Types::Bool.optional
+        ).lax
+
+        # MQ Broker resource attributes
+        class MqBrokerAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+
+          attribute? :broker_name, Resources::Types::String.constrained(
+            format: /\A[a-zA-Z0-9_-]+\z/,
+            size: 1..50
+          )
+
+          attribute? :engine_type, MqEngineType.optional
+          
+          attribute? :engine_version, Resources::Types::String.optional
+          
+          attribute? :host_instance_type, MqInstanceType.optional
+          
+          attribute? :users, Resources::Types::Array.of(MqUser).constrained(min_size: 1, max_size: 250).optional
+
+          attribute? :apply_immediately, Resources::Types::Bool.default(false)
+          
+          attribute? :authentication_strategy, MqAuthenticationStrategy.default('simple')
+          
+          attribute? :auto_minor_version_upgrade, Resources::Types::Bool.default(false)
+          
+          attribute? :configuration, Resources::Types::Hash.schema(
+            id?: Resources::Types::String.optional,
+            revision?: Resources::Types::Integer.constrained(gteq: 1).optional
+          ).lax.optional
+          
+          attribute? :deployment_mode, MqDeploymentMode.default('SINGLE_INSTANCE')
+          
+          attribute? :encryption_options, MqEncryptionOptions.optional
+          
+          attribute? :ldap_server_metadata, MqLdapServerMetadata.optional
+          
+          attribute? :logs, MqLogs.optional
+          
+          attribute? :maintenance_window_start_time, MqMaintenanceWindowStartTime.optional
+          
+          attribute? :publicly_accessible, Resources::Types::Bool.default(false)
+          
+          attribute? :security_groups, Resources::Types::Array.of(Resources::Types::String).optional
+          
+          attribute? :storage_type, MqStorageType.optional
+          
+          attribute? :subnet_ids, Resources::Types::Array.of(Resources::Types::String).optional
+
+          attribute? :tags, Resources::Types::AwsTags
+
+          # Custom validation
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+
+            # Validate deployment mode constraints
+            if attrs[:deployment_mode] && attrs[:engine_type]
+              case attrs[:engine_type]
+              when 'ActiveMQ'
+                unless ['SINGLE_INSTANCE', 'ACTIVE_STANDBY_MULTI_AZ'].include?(attrs[:deployment_mode])
+                  raise Dry::Struct::Error, "ActiveMQ only supports SINGLE_INSTANCE and ACTIVE_STANDBY_MULTI_AZ deployment modes"
+                end
+              when 'RabbitMQ'
+                unless ['SINGLE_INSTANCE', 'CLUSTER_MULTI_AZ'].include?(attrs[:deployment_mode])
+                  raise Dry::Struct::Error, "RabbitMQ only supports SINGLE_INSTANCE and CLUSTER_MULTI_AZ deployment modes"
+                end
+              end
+            end
+
+            # Validate multi-AZ requirements
+            if attrs[:deployment_mode] && attrs[:deployment_mode].include?('MULTI_AZ')
+              unless attrs[:subnet_ids] && attrs[:subnet_ids].size >= 2
+                raise Dry::Struct::Error, "Multi-AZ deployment requires at least 2 subnet IDs"
+              end
+            end
+
+            # Validate LDAP authentication requirements
+            if attrs[:authentication_strategy] == 'ldap'
+              unless attrs[:ldap_server_metadata]
+                raise Dry::Struct::Error, "ldap_server_metadata is required when authentication_strategy is 'ldap'"
+              end
+            end
+
+            # Validate storage type constraints
+            if attrs[:storage_type] == 'efs' && attrs[:engine_type] != 'RabbitMQ'
+              raise Dry::Struct::Error, "EFS storage type is only supported for RabbitMQ brokers"
+            end
+
+            super(attrs)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_mq_configuration/resource.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_mq_configuration/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS MQ Configuration
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] MQ configuration attributes
+      # @option attributes [String] :name The configuration name
+      # @option attributes [String] :engine_type ActiveMQ or RabbitMQ
+      # @option attributes [String] :engine_version Engine version
+      # @option attributes [String] :data Configuration data (XML for ActiveMQ, Erlang/JSON for RabbitMQ)
+      # @option attributes [String] :authentication_strategy Authentication strategy
+      # @option attributes [String] :description Configuration description
+      # @option attributes [Hash] :tags Resource tags
+      # @return [ResourceReference] Reference object with outputs
+      def aws_mq_configuration(name, attributes = {})
+        # Validate attributes using dry-struct
+        config_attrs = Types::MqConfigurationAttributes.new(attributes)
+        
+        # Generate terraform resource block
+        resource(:aws_mq_configuration, name) do
+          name config_attrs.name
+          engine_type config_attrs.engine_type
+          engine_version config_attrs.engine_version
+          data config_attrs.data
+          
+          authentication_strategy config_attrs.authentication_strategy if config_attrs.authentication_strategy != 'simple'
+          description config_attrs.description if config_attrs.description
+          
+          # Tags
+          if config_attrs.tags&.any?
+            tags config_attrs.tags
+          end
+        end
+        
+        # Return resource reference with outputs
+        ResourceReference.new(
+          type: 'aws_mq_configuration',
+          name: name,
+          resource_attributes: config_attrs.to_h,
+          outputs: {
+            id: "${aws_mq_configuration.#{name}.id}",
+            arn: "${aws_mq_configuration.#{name}.arn}",
+            name: "${aws_mq_configuration.#{name}.name}",
+            latest_revision: "${aws_mq_configuration.#{name}.latest_revision}"
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_mq_configuration/types.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        unless const_defined?(:MqEngineType)
+        MqEngineType = Resources::Types::String.constrained(included_in: %w[ActiveMQ RabbitMQ])
+        end
+        unless const_defined?(:MqAuthenticationStrategy)
+        MqAuthenticationStrategy = Resources::Types::String.constrained(included_in: %w[simple ldap])
+        end
+
+        # MQ Configuration resource attributes
+        class MqConfigurationAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+
+          attribute? :name, Resources::Types::String.constrained(
+            format: /\A[a-zA-Z0-9_-]+\z/,
+            size: 1..150
+          )
+
+          attribute? :engine_type, MqEngineType.optional
+          
+          attribute? :engine_version, Resources::Types::String.optional
+          
+          attribute? :data, Resources::Types::String.optional
+
+          attribute? :authentication_strategy, MqAuthenticationStrategy.default('simple')
+          
+          attribute? :description, Resources::Types::String.constrained(size: 0..1024).optional
+
+          attribute? :tags, Resources::Types::AwsTags
+
+          # Custom validation
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+
+            # Validate configuration data format
+            if attrs[:data] && attrs[:engine_type]
+              data = attrs[:data].strip
+              
+              case attrs[:engine_type]
+              when 'ActiveMQ'
+                # ActiveMQ configurations are typically XML
+                unless data.start_with?('<?xml') || data.start_with?('<configuration')
+                  raise Dry::Struct::Error, "ActiveMQ configuration data should be XML format"
+                end
+              when 'RabbitMQ'
+                # RabbitMQ configurations are typically in Erlang format or JSON
+                unless data.include?('[') || data.include?('{') || data.match(/^\w+\s*=/)
+                  raise Dry::Struct::Error, "RabbitMQ configuration data should be in Erlang or JSON format"
+                end
+              end
+            end
+
+            super(attrs)
+          end
+
+          # Check if configuration is XML (typically ActiveMQ)
+          def xml_configuration?
+            data.strip.start_with?('<?xml') || data.strip.start_with?('<')
+          end
+
+          # Check if configuration is JSON
+          def json_configuration?
+            data.strip.start_with?('{') || data.strip.start_with?('[')
+          end
+
+          # Get configuration size in bytes
+          def configuration_size_bytes
+            data.bytesize
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_nat_gateway/resource.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_nat_gateway/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS NAT Gateway with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] NAT Gateway attributes
+      # @option attributes [String] :subnet_id The subnet ID (required, must be public subnet)
+      # @option attributes [String, nil] :allocation_id Elastic IP allocation ID for public NAT
+      # @option attributes [String] :connectivity_type 'public' or 'private' (default: 'public')
+      # @option attributes [Hash] :tags Resource tags
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      #
+      # @example Create a public NAT Gateway with Elastic IP
+      #   eip = aws_eip(:nat_eip, { domain: "vpc" })
+      #   
+      #   nat = aws_nat_gateway(:main, {
+      #     subnet_id: public_subnet.id,
+      #     allocation_id: eip.id,
+      #     tags: { Name: "main-nat-gateway" }
+      #   })
+      #
+      # @example Create a private NAT Gateway
+      #   nat = aws_nat_gateway(:private, {
+      #     subnet_id: private_subnet.id,
+      #     connectivity_type: "private",
+      #     tags: { Name: "private-nat-gateway" }
+      #   })
+      def aws_nat_gateway(name, attributes = {})
+        # Validate attributes using dry-struct
+        nat_attrs = Types::NatGatewayAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_nat_gateway, name) do
+          subnet_id nat_attrs.subnet_id
+          allocation_id nat_attrs.allocation_id if nat_attrs.allocation_id
+          connectivity_type nat_attrs.connectivity_type if nat_attrs.connectivity_type != 'public'
+          
+          # Apply tags if present
+          if nat_attrs.tags&.any?
+            tags do
+              nat_attrs.tags.each do |key, value|
+                public_send(key, value)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs and computed properties
+        ref = ResourceReference.new(
+          type: 'aws_nat_gateway',
+          name: name,
+          resource_attributes: nat_attrs.to_h,
+          outputs: {
+            id: "${aws_nat_gateway.#{name}.id}",
+            allocation_id: "${aws_nat_gateway.#{name}.allocation_id}",
+            subnet_id: "${aws_nat_gateway.#{name}.subnet_id}",
+            network_interface_id: "${aws_nat_gateway.#{name}.network_interface_id}",
+            private_ip: "${aws_nat_gateway.#{name}.private_ip}",
+            public_ip: "${aws_nat_gateway.#{name}.public_ip}"
+          }
+        )
+        
+        # Add computed properties via method delegation
+        ref.define_singleton_method(:public?) { nat_attrs.public? }
+        ref.define_singleton_method(:private?) { nat_attrs.private? }
+        ref.define_singleton_method(:requires_elastic_ip?) { nat_attrs.requires_elastic_ip? }
+        
+        ref
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_nat_gateway/types.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # NAT Gateway resource attributes with validation
+        class NatGatewayAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          # Required: Must be in a public subnet
+          attribute? :subnet_id, Resources::Types::String.optional
+          
+          # Optional: Elastic IP allocation ID for public NAT gateway
+          # If not provided, AWS will create a private NAT gateway
+          attribute :allocation_id, Resources::Types::String.optional.default(nil)
+          
+          # Optional: Connectivity type (public or private)
+          attribute :connectivity_type, Resources::Types::String.default('public').enum('public', 'private')
+          
+          attribute :tags, Resources::Types::AwsTags.default({}.freeze)
+
+          # Validate consistency between allocation_id and connectivity_type
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+
+            # Require subnet_id
+            unless attrs.key?(:subnet_id) || attrs.key?('subnet_id')
+              raise Dry::Struct::Error, "subnet_id is required for NAT gateway"
+            end
+
+            # If allocation_id is provided, connectivity_type must be public
+            if attrs[:allocation_id] && attrs[:connectivity_type] == 'private'
+              raise Dry::Struct::Error, "allocation_id can only be used with public NAT gateways"
+            end
+
+            # If connectivity_type is public but no allocation_id, that's ok (AWS will allocate)
+            # But we should warn in computed properties
+
+            super(attrs)
+          end
+          
+          # Computed properties
+          def public?
+            connectivity_type == 'public'
+          end
+          
+          def private?
+            connectivity_type == 'private'
+          end
+          
+          def requires_elastic_ip?
+            public? && allocation_id.nil?
+          end
+          
+          def to_h
+            {
+              subnet_id: subnet_id,
+              allocation_id: allocation_id,
+              connectivity_type: connectivity_type,
+              tags: tags
+            }.compact
+          end
+        end
+      end
+    end
+  end
+end