pangea-aws 0.1.0

data/lib/pangea/resources/aws_rds_global_cluster/types/backup_config.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class GlobalClusterBackupConfiguration < Pangea::Resources::BaseAttributes
+          attribute :backup_retention_period, Resources::Types::Integer.default(7).constrained(gteq: 7, lteq: 35)
+          attribute? :preferred_backup_window, Resources::Types::String.optional
+          attribute :copy_tags_to_snapshot, Resources::Types::Bool.default(true)
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            raise Dry::Struct::Error, "preferred_backup_window must be in format 'hh24:mi-hh24:mi' (UTC)" if attrs.preferred_backup_window && !valid_backup_window?(attrs.preferred_backup_window)
+            attrs
+          end
+
+          def self.valid_backup_window?(window)
+            return false unless window.match?(/^\d{2}:\d{2}-\d{2}:\d{2}$/)
+            start_time, end_time = window.split('-')
+            start_hour, start_min = start_time.split(':').map(&:to_i)
+            end_hour, end_min = end_time.split(':').map(&:to_i)
+            return false if start_hour > 23 || start_min > 59 || end_hour > 23 || end_min > 59
+            start_minutes = start_hour * 60 + start_min
+            end_minutes = end_hour * 60 + end_min
+            end_minutes += 24 * 60 if end_minutes <= start_minutes
+            (end_minutes - start_minutes) >= 30
+          end
+
+          def spans_midnight?
+            return false unless preferred_backup_window
+            start_time, end_time = preferred_backup_window.split('-')
+            end_time.split(':').first.to_i <= start_time.split(':').first.to_i
+          end
+
+          def window_duration_minutes
+            return nil unless preferred_backup_window
+            start_time, end_time = preferred_backup_window.split('-')
+            start_hour, start_min = start_time.split(':').map(&:to_i)
+            end_hour, end_min = end_time.split(':').map(&:to_i)
+            start_minutes = start_hour * 60 + start_min
+            end_minutes = end_hour * 60 + end_min
+            end_minutes += 24 * 60 if end_minutes <= start_minutes
+            end_minutes - start_minutes
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_rds_global_cluster/types/configs.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        module RdsGlobalClusterConfigs
+          def self.production_mysql(identifier: nil)
+            { global_cluster_identifier: identifier, engine: 'aurora-mysql', engine_version: '8.0.mysql_aurora.3.02.0',
+              storage_encrypted: true, manage_master_user_password: true,
+              backup_configuration: { backup_retention_period: 14, preferred_backup_window: '03:00-04:00', copy_tags_to_snapshot: true },
+              tags: { Environment: 'production', Engine: 'mysql', Type: 'global' } }
+          end
+
+          def self.production_postgresql(identifier: nil)
+            { global_cluster_identifier: identifier, engine: 'aurora-postgresql', engine_version: '14.9',
+              storage_encrypted: true, manage_master_user_password: true,
+              backup_configuration: { backup_retention_period: 14, preferred_backup_window: '02:00-03:00', copy_tags_to_snapshot: true },
+              tags: { Environment: 'production', Engine: 'postgresql', Type: 'global' } }
+          end
+
+          def self.development(engine: 'aurora-mysql', identifier: nil)
+            base = { global_cluster_identifier: identifier, engine: engine, storage_encrypted: true, manage_master_user_password: true,
+                     force_destroy: true, backup_configuration: { backup_retention_period: 7, preferred_backup_window: '05:00-06:00', copy_tags_to_snapshot: false },
+                     tags: { Environment: 'development', Type: 'global', Purpose: 'testing' } }
+            version = engine.include?('postgresql') ? { engine_version: '14.9' } : { engine_version: '8.0.mysql_aurora.3.02.0' }
+            base.merge(version)
+          end
+
+          def self.disaster_recovery(primary_region:, engine: 'aurora-mysql')
+            { engine: engine, storage_encrypted: true, manage_master_user_password: true,
+              backup_configuration: { backup_retention_period: 35, preferred_backup_window: '04:00-05:00', copy_tags_to_snapshot: true },
+              tags: { Purpose: 'disaster-recovery', PrimaryRegion: primary_region, Type: 'global', Recovery: 'cross-region' } }
+          end
+
+          def self.from_existing_cluster(source_cluster_identifier:, engine: 'aurora-mysql')
+            { engine: engine, source_db_cluster_identifier: source_cluster_identifier, storage_encrypted: true,
+              backup_configuration: { backup_retention_period: 14, preferred_backup_window: '03:00-04:00', copy_tags_to_snapshot: true },
+              tags: { Source: 'existing-cluster', Type: 'global', Migration: 'cluster-to-global' } }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_rds_global_cluster/types.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require 'pangea/resources/types'
+require_relative 'types/backup_config'
+require_relative 'types/attributes'
+require_relative 'types/configs'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # GlobalClusterBackupConfiguration is defined in types/backup_config.rb
+        # RdsGlobalClusterAttributes is defined in types/attributes.rb
+        # RdsGlobalClusterConfigs is defined in types/configs.rb
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_rds_global_cluster/types.rbs

@@ -0,0 +1,84 @@
+module Pangea
+  module Resources
+    module AWS
+      class GlobalClusterBackupConfiguration < Dry::Struct
+        attribute :backup_retention_period, Types::Integer
+        attribute :preferred_backup_window, Types::String?
+        attribute :copy_tags_to_snapshot, Types::Bool
+
+        def self.new: (Hash[Symbol, untyped] attributes) -> GlobalClusterBackupConfiguration
+        def self.valid_backup_window?: (String window) -> bool
+
+        def backup_retention_period: () -> Integer
+        def preferred_backup_window: () -> String?
+        def copy_tags_to_snapshot: () -> bool
+        def spans_midnight?: () -> bool
+        def window_duration_minutes: () -> Integer?
+      end
+
+      class RdsGlobalClusterAttributes < Dry::Struct
+        attribute :global_cluster_identifier, Types::String?
+        attribute :engine, Types::String
+        attribute :engine_version, Types::String?
+        attribute :database_name, Types::String?
+        attribute :master_username, Types::String?
+        attribute :master_password, Types::String?
+        attribute :manage_master_user_password, Types::Bool
+        attribute :master_user_secret_kms_key_id, Types::String?
+        attribute :storage_encrypted, Types::Bool
+        attribute :kms_key_id, Types::String?
+        attribute :force_destroy, Types::Bool
+        attribute :source_db_cluster_identifier, Types::String?
+        attribute :engine_lifecycle_support, Types::String?
+        attribute :backup_configuration, GlobalClusterBackupConfiguration?
+        attribute :tags, Types::AwsTags
+
+        def self.new: (Hash[Symbol, untyped] attributes) -> RdsGlobalClusterAttributes
+        def self.valid_engine_version?: (String engine, String version) -> bool
+
+        def global_cluster_identifier: () -> String?
+        def engine: () -> String
+        def engine_version: () -> String?
+        def database_name: () -> String?
+        def master_username: () -> String?
+        def master_password: () -> String?
+        def manage_master_user_password: () -> bool
+        def master_user_secret_kms_key_id: () -> String?
+        def storage_encrypted: () -> bool
+        def kms_key_id: () -> String?
+        def force_destroy: () -> bool
+        def source_db_cluster_identifier: () -> String?
+        def engine_lifecycle_support: () -> String?
+        def backup_configuration: () -> GlobalClusterBackupConfiguration?
+        def tags: () -> Hash[Symbol, String]
+
+        def engine_family: () -> String
+        def is_mysql?: () -> bool
+        def is_postgresql?: () -> bool
+        def uses_managed_password?: () -> bool
+        def created_from_source?: () -> bool
+        def is_encrypted?: () -> bool
+        def allows_force_destroy?: () -> bool
+        def has_backup_configuration?: () -> bool
+        def effective_backup_retention_period: () -> Integer
+        def effective_backup_window: () -> String
+        def engine_major_version: () -> String
+        def supported_regions: () -> Array[String]
+        def supports_region?: (String region) -> bool
+        def estimated_monthly_cost: () -> String
+        def configuration_summary: () -> String
+        def recommended_secondary_regions: (String primary_region) -> Array[String]
+      end
+
+      module RdsGlobalClusterConfigs
+        def self.production_mysql: (?identifier: String?) -> Hash[Symbol, untyped]
+        def self.production_postgresql: (?identifier: String?) -> Hash[Symbol, untyped]
+        def self.development: (?engine: String, ?identifier: String?) -> Hash[Symbol, untyped]
+        def self.disaster_recovery: (primary_region: String, ?engine: String) -> Hash[Symbol, untyped]
+        def self.from_existing_cluster: (source_cluster_identifier: String, ?engine: String) -> Hash[Symbol, untyped]
+      end
+
+      def aws_rds_global_cluster: (Symbol name, Hash[Symbol, untyped] attributes) -> ResourceReference
+    end
+  end
+end

data/lib/pangea/resources/aws_rds_proxy/resource.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_rds_proxy/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS RDS Proxy with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] RDS proxy attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_rds_proxy(name, attributes = {})
+        # Validate attributes using dry-struct
+        proxy_attrs = Types::RdsProxyAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_db_proxy, name) do
+          name proxy_attrs.db_proxy_name
+          engine_family proxy_attrs.engine_family
+          role_arn proxy_attrs.role_arn
+          vpc_subnet_ids proxy_attrs.vpc_subnet_ids
+          
+          # Optional VPC security groups
+          vpc_security_group_ids proxy_attrs.vpc_security_group_ids if proxy_attrs.vpc_security_group_ids && proxy_attrs.vpc_security_group_ids&.any?
+          
+          # Authentication configurations
+          proxy_attrs.auth.each do |auth_config|
+            auth do
+              auth_scheme auth_config.auth_scheme
+              client_password_auth_type auth_config.client_password_auth_type if auth_config.client_password_auth_type
+              description auth_config.description if auth_config.description
+              iam_auth auth_config.iam_auth
+              secret_arn auth_config.secret_arn
+              username auth_config.username if auth_config.username
+            end
+          end
+          
+          # Connection and security settings
+          require_tls proxy_attrs.require_tls
+          idle_client_timeout proxy_attrs.idle_client_timeout
+          debug_logging proxy_attrs.debug_logging
+          
+          # Apply tags if present
+          if proxy_attrs.tags&.any?
+            tags do
+              proxy_attrs.tags.each do |key, value|
+                public_send(key, value)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_db_proxy',
+          name: name,
+          resource_attributes: proxy_attrs.to_h,
+          outputs: {
+            id: "${aws_db_proxy.#{name}.id}",
+            arn: "${aws_db_proxy.#{name}.arn}",
+            name: "${aws_db_proxy.#{name}.name}",
+            engine_family: "${aws_db_proxy.#{name}.engine_family}",
+            endpoint: "${aws_db_proxy.#{name}.endpoint}",
+            role_arn: "${aws_db_proxy.#{name}.role_arn}",
+            vpc_subnet_ids: "${aws_db_proxy.#{name}.vpc_subnet_ids}",
+            vpc_security_group_ids: "${aws_db_proxy.#{name}.vpc_security_group_ids}",
+            require_tls: "${aws_db_proxy.#{name}.require_tls}",
+            idle_client_timeout: "${aws_db_proxy.#{name}.idle_client_timeout}",
+            debug_logging: "${aws_db_proxy.#{name}.debug_logging}",
+            tags: "${aws_db_proxy.#{name}.tags}",
+            tags_all: "${aws_db_proxy.#{name}.tags_all}"
+          },
+          computed_properties: {
+            is_mysql: proxy_attrs.is_mysql?,
+            is_postgresql: proxy_attrs.is_postgresql?,
+            requires_tls: proxy_attrs.requires_tls?,
+            debug_logging_enabled: proxy_attrs.debug_logging_enabled?,
+            uses_iam_auth: proxy_attrs.uses_iam_auth?,
+            is_highly_available: proxy_attrs.is_highly_available?,
+            auth_config_count: proxy_attrs.auth_config_count,
+            idle_timeout_hours: proxy_attrs.idle_timeout_hours,
+            secrets_manager_arns: proxy_attrs.secrets_manager_arns,
+            has_security_groups: proxy_attrs.has_security_groups?,
+            configuration_summary: proxy_attrs.configuration_summary,
+            estimated_monthly_cost: proxy_attrs.estimated_monthly_cost,
+            supported_database_engines: proxy_attrs.supported_database_engines
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_rds_proxy/types/attributes.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require_relative 'nested_types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class RdsProxyAttributes < Pangea::Resources::BaseAttributes
+          attribute? :db_proxy_name, Resources::Types::String.optional
+          attribute? :engine_family, Resources::Types::String.constrained(included_in: ['MYSQL', 'POSTGRESQL']).optional
+          attribute? :auth, Resources::Types::Array.of(ProxyAuth).constrained(min_size: 1).optional
+          attribute? :role_arn, Resources::Types::String.optional
+          attribute? :vpc_subnet_ids, Resources::Types::Array.of(Resources::Types::String).constrained(min_size: 1).optional
+          attribute :vpc_security_group_ids, Resources::Types::Array.of(Resources::Types::String).default([].freeze)
+          attribute :require_tls, Resources::Types::Bool.default(true)
+          attribute :idle_client_timeout, Resources::Types::Integer.default(1800).constrained(gteq: 1800, lteq: 28800)
+          attribute :debug_logging, Resources::Types::Bool.default(false)
+          attribute :tags, Resources::Types::AwsTags.default({}.freeze)
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            raise Dry::Struct::Error, 'db_proxy_name must start with a letter and contain only letters, numbers, and hyphens' unless attrs.db_proxy_name.match?(/^[a-zA-Z][a-zA-Z0-9-]*$/)
+            raise Dry::Struct::Error, 'db_proxy_name cannot exceed 63 characters' if attrs.db_proxy_name.length > 63
+            validate_auth_for_engine(attrs)
+            raise Dry::Struct::Error, 'At least 2 VPC subnets required for high availability' if attrs.vpc_subnet_ids.count < 2
+            attrs
+          end
+
+          def self.validate_auth_for_engine(attrs)
+            attrs.auth.each do |auth_config|
+              next unless auth_config.client_password_auth_type
+              case attrs.engine_family
+              when 'MYSQL'
+                raise Dry::Struct::Error, 'Invalid client_password_auth_type for MySQL engine family' unless auth_config.client_password_auth_type == 'MYSQL_NATIVE_PASSWORD'
+              when 'POSTGRESQL'
+                raise Dry::Struct::Error, 'Invalid client_password_auth_type for PostgreSQL engine family' unless %w[POSTGRES_SCRAM_SHA_256 POSTGRES_MD5].include?(auth_config.client_password_auth_type)
+              end
+            end
+          end
+
+          def is_mysql? = engine_family == 'MYSQL'
+          def is_postgresql? = engine_family == 'POSTGRESQL'
+          def requires_tls? = require_tls
+          def debug_logging_enabled? = debug_logging
+          def uses_iam_auth? = auth.any?(&:requires_iam_auth?)
+          def is_highly_available? = vpc_subnet_ids.count >= 2
+          def auth_config_count = auth.count
+          def idle_timeout_hours = (idle_client_timeout / 3600.0).round(2)
+          def secrets_manager_arns = auth.map(&:secret_arn).uniq
+          def has_security_groups? = vpc_security_group_ids&.any?
+
+          def configuration_summary
+            summary = ["Engine: #{engine_family.downcase}", "Auth: #{auth_config_count} configs", "TLS: #{requires_tls? ? 'required' : 'optional'}", "Timeout: #{idle_timeout_hours}h"]
+            summary << 'IAM: enabled' if uses_iam_auth?
+            summary << 'Debug: enabled' if debug_logging_enabled?
+            summary << "HA: #{vpc_subnet_ids.count} subnets"
+            summary.join('; ')
+          end
+
+          def estimated_monthly_cost
+            monthly_cost = 2 * 730 * 0.015
+            "$#{monthly_cost.round(2)}/month (plus target database costs)"
+          end
+
+          def supported_database_engines = is_mysql? ? %w[MySQL Aurora\ MySQL] : %w[PostgreSQL Aurora\ PostgreSQL]
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_rds_proxy/types/configs.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        module RdsProxyConfigs
+          def self.mysql_production(proxy_name:, role_arn:, secret_arn:, vpc_subnet_ids:, vpc_security_group_ids: nil)
+            { db_proxy_name: proxy_name, engine_family: 'MYSQL',
+              auth: [{ auth_scheme: 'SECRETS', client_password_auth_type: 'MYSQL_NATIVE_PASSWORD', description: 'Production MySQL authentication', iam_auth: 'REQUIRED', secret_arn: secret_arn }],
+              role_arn: role_arn, vpc_subnet_ids: vpc_subnet_ids, vpc_security_group_ids: vpc_security_group_ids,
+              require_tls: true, idle_client_timeout: 3600, debug_logging: false,
+              tags: { Environment: 'production', Engine: 'mysql', Type: 'proxy' } }
+          end
+
+          def self.postgresql_production(proxy_name:, role_arn:, secret_arn:, vpc_subnet_ids:, vpc_security_group_ids: nil)
+            { db_proxy_name: proxy_name, engine_family: 'POSTGRESQL',
+              auth: [{ auth_scheme: 'SECRETS', client_password_auth_type: 'POSTGRES_SCRAM_SHA_256', description: 'Production PostgreSQL authentication', iam_auth: 'REQUIRED', secret_arn: secret_arn }],
+              role_arn: role_arn, vpc_subnet_ids: vpc_subnet_ids, vpc_security_group_ids: vpc_security_group_ids,
+              require_tls: true, idle_client_timeout: 3600, debug_logging: false,
+              tags: { Environment: 'production', Engine: 'postgresql', Type: 'proxy' } }
+          end
+
+          def self.development(proxy_name:, engine_family:, role_arn:, secret_arn:, username:, vpc_subnet_ids:)
+            { db_proxy_name: proxy_name, engine_family: engine_family,
+              auth: [{ auth_scheme: 'SECRETS', description: 'Development authentication', iam_auth: 'DISABLED', secret_arn: secret_arn, username: username }],
+              role_arn: role_arn, vpc_subnet_ids: vpc_subnet_ids, require_tls: false, idle_client_timeout: 1800, debug_logging: true,
+              tags: { Environment: 'development', Type: 'proxy', Debug: 'enabled' } }
+          end
+
+          def self.high_availability(proxy_name:, engine_family:, role_arn:, auth_configs:, vpc_subnet_ids:, vpc_security_group_ids:)
+            { db_proxy_name: proxy_name, engine_family: engine_family, auth: auth_configs,
+              role_arn: role_arn, vpc_subnet_ids: vpc_subnet_ids, vpc_security_group_ids: vpc_security_group_ids,
+              require_tls: true, idle_client_timeout: 7200, debug_logging: false,
+              tags: { Purpose: 'high-availability', Type: 'proxy', Redundancy: 'multi-auth' } }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_rds_proxy/types/nested_types.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class ProxyAuth < Pangea::Resources::BaseAttributes
+          attribute? :auth_scheme, Resources::Types::String.constrained(included_in: ['SECRETS']).optional
+          attribute? :client_password_auth_type, Resources::Types::String.constrained(included_in: ['MYSQL_NATIVE_PASSWORD', 'POSTGRES_SCRAM_SHA_256', 'POSTGRES_MD5', 'SQL_SERVER_AUTHENTICATION']).optional
+          attribute? :description, Resources::Types::String.optional
+          attribute :iam_auth, Resources::Types::String.constrained(included_in: ['DISABLED', 'REQUIRED']).default('DISABLED')
+          attribute? :secret_arn, Resources::Types::String.optional
+          attribute? :username, Resources::Types::String.optional
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            raise Dry::Struct::Error, 'username is required when iam_auth is DISABLED' if attrs.iam_auth == 'DISABLED' && !attrs.username
+            raise Dry::Struct::Error, 'SQL Server authentication not supported for Aurora' if attrs.client_password_auth_type == 'SQL_SERVER_AUTHENTICATION'
+            attrs
+          end
+
+          def requires_iam_auth? = iam_auth == 'REQUIRED'
+          def uses_native_auth? = iam_auth == 'DISABLED'
+
+          def auth_summary
+            summary = [auth_scheme, "IAM: #{iam_auth.downcase}"]
+            summary << "Username: #{username}" if username
+            summary << "Client Auth: #{client_password_auth_type}" if client_password_auth_type
+            summary.join(', ')
+          end
+        end
+
+        class ProxyConnectionPoolConfig < Pangea::Resources::BaseAttributes
+          attribute :max_connections_percent, Resources::Types::Integer.default(100).constrained(gteq: 0, lteq: 100)
+          attribute :max_idle_connections_percent, Resources::Types::Integer.default(50).constrained(gteq: 0, lteq: 100)
+          attribute :session_pinning_filters, Resources::Types::Array.of(Resources::Types::String.constrained(included_in: ['EXCLUDE_VARIABLE_SETS'])).default([].freeze)
+          attribute? :init_query, Resources::Types::String.optional
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            raise Dry::Struct::Error, 'max_idle_connections_percent cannot exceed max_connections_percent' if attrs.max_idle_connections_percent > attrs.max_connections_percent
+            attrs
+          end
+
+          def has_session_pinning_filters? = session_pinning_filters.any?
+          def has_init_query? = !init_query.nil?
+          def connection_efficiency_ratio = max_connections_percent.zero? ? 1.0 : max_idle_connections_percent.to_f / max_connections_percent
+
+          def pool_summary
+            summary = ["Max: #{max_connections_percent}%", "Idle: #{max_idle_connections_percent}%"]
+            summary << "Filters: #{session_pinning_filters.count}" if has_session_pinning_filters?
+            summary << 'Init Query: configured' if has_init_query?
+            summary.join(', ')
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_rds_proxy/types.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require 'pangea/resources/types'
+require_relative 'types/nested_types'
+require_relative 'types/attributes'
+require_relative 'types/configs'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # ProxyAuth is defined in types/nested_types.rb
+        # ProxyConnectionPoolConfig is defined in types/nested_types.rb
+        # RdsProxyAttributes is defined in types/attributes.rb
+        # RdsProxyConfigs is defined in types/configs.rb
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_rds_proxy_default_target_group/resource.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_rds_proxy_default_target_group/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS RDS Proxy Default Target Group with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] RDS proxy default target group attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_rds_proxy_default_target_group(name, attributes = {})
+        # Validate attributes using dry-struct
+        target_group_attrs = Types::RdsProxyDefaultTargetGroupAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_db_proxy_default_target_group, name) do
+          db_proxy_name target_group_attrs.db_proxy_name
+          
+          # Connection pool configuration
+          if target_group_attrs.connection_pool_config
+            connection_pool_config do
+              max_connections_percent target_group_attrs.connection_pool_config.max_connections_percent
+              max_idle_connections_percent target_group_attrs.connection_pool_config.max_idle_connections_percent
+              session_pinning_filters target_group_attrs.connection_pool_config.session_pinning_filters if target_group_attrs.connection_pool_config.session_pinning_filters.any?
+              init_query target_group_attrs.connection_pool_config.init_query if target_group_attrs.connection_pool_config.init_query
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_db_proxy_default_target_group',
+          name: name,
+          resource_attributes: target_group_attrs.to_h,
+          outputs: {
+            id: "${aws_db_proxy_default_target_group.#{name}.id}",
+            arn: "${aws_db_proxy_default_target_group.#{name}.arn}",
+            name: "${aws_db_proxy_default_target_group.#{name}.name}",
+            db_proxy_name: "${aws_db_proxy_default_target_group.#{name}.db_proxy_name}"
+          },
+          computed_properties: {
+            has_connection_pool_config: target_group_attrs.has_connection_pool_config?,
+            effective_max_connections_percent: target_group_attrs.effective_max_connections_percent,
+            effective_max_idle_connections_percent: target_group_attrs.effective_max_idle_connections_percent
+          }
+        )
+      end
+    end
+  end
+end