pangea-aws 0.1.0

data/lib/pangea/resources/aws_s3_bucket_replication_configuration/types/validators.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Validators for S3 bucket replication configuration
+        module S3BucketReplicationValidators
+          IAM_ROLE_ARN_PATTERN = /^arn:aws:iam::\d{12}:role\/[\w+=,.@-]+$/
+          S3_BUCKET_ARN_PATTERN = /^arn:aws:s3:::[\w.\-]+$/
+
+          def self.validate_role_arn(role)
+            return if role.match?(IAM_ROLE_ARN_PATTERN)
+
+            raise Dry::Struct::Error, 'Role must be a valid IAM role ARN'
+          end
+
+          def self.validate_rule_priorities(rules)
+            return unless rules.size > 1
+
+            priorities = rules.filter_map { |rule| rule[:priority] }
+
+            if priorities.size != rules.size
+              raise Dry::Struct::Error, 'All rules must have priority when multiple rules are defined'
+            end
+
+            return unless priorities.size != priorities.uniq.size
+
+            raise Dry::Struct::Error, 'Rule priorities must be unique'
+          end
+
+          def self.validate_destination_bucket_arn(bucket_arn, rule_index)
+            return if bucket_arn.match?(S3_BUCKET_ARN_PATTERN)
+
+            raise Dry::Struct::Error, "Rule #{rule_index}: destination bucket must be a valid S3 bucket ARN"
+          end
+
+          def self.validate_cross_account_requirements(rule, rule_index)
+            destination = rule[:destination]
+            return unless destination[:account_id] && !destination[:access_control_translation]
+
+            raise Dry::Struct::Error, "Rule #{rule_index}: cross-account replication requires access_control_translation"
+          end
+
+          def self.validate_replication_time_consistency(rule, rule_index)
+            destination = rule[:destination]
+            rtc = destination[:replication_time]
+            metrics = destination[:metrics]
+
+            if rtc&.dig(:status) == 'Enabled' && !rtc[:time]
+              raise Dry::Struct::Error, "Rule #{rule_index}: replication_time requires time when enabled"
+            end
+
+            return unless rtc&.dig(:status) == 'Enabled' && metrics&.dig(:status) != 'Enabled'
+
+            raise Dry::Struct::Error, "Rule #{rule_index}: replication_time requires metrics to be enabled"
+          end
+
+          def self.validate_metrics_and_rtc_consistency(rule, rule_index)
+            metrics = rule[:destination][:metrics]
+            return unless metrics&.dig(:status) == 'Enabled' && !metrics[:event_threshold]
+
+            raise Dry::Struct::Error, "Rule #{rule_index}: metrics requires event_threshold when enabled"
+          end
+
+          def self.validate_filter_configuration(filter, rule_index)
+            return unless filter
+
+            single_conditions = [filter[:prefix], filter[:tag]].compact.size
+            and_condition = filter[:and] ? 1 : 0
+
+            if single_conditions.positive? && and_condition.positive?
+              raise Dry::Struct::Error,
+                    "Rule #{rule_index}: filter cannot have both single conditions and 'and' condition"
+            end
+
+            return unless filter[:and]
+
+            and_conditions = [filter[:and][:prefix], filter[:and][:tags]].compact.size
+            return unless and_conditions.zero?
+
+            raise Dry::Struct::Error, "Rule #{rule_index}: 'and' filter must have at least one condition"
+          end
+
+          def self.validate_all(attrs)
+            validate_role_arn(attrs.role)
+            validate_rule_priorities(attrs.rule)
+
+            attrs.rule.each_with_index do |rule, index|
+              validate_destination_bucket_arn(rule[:destination][:bucket], index)
+              validate_cross_account_requirements(rule, index)
+              validate_replication_time_consistency(rule, index)
+              validate_metrics_and_rtc_consistency(rule, index)
+              validate_filter_configuration(rule[:filter], index)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_s3_bucket_replication_configuration/types.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+require_relative 'types/filter'
+require_relative 'types/destination'
+require_relative 'types/rule'
+require_relative 'types/validators'
+require_relative 'types/helpers'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Type-safe attributes for AWS S3 Bucket Replication Configuration resources
+        class S3BucketReplicationConfigurationAttributes < Pangea::Resources::BaseAttributes
+          include S3BucketReplicationHelpers
+
+          transform_keys(&:to_sym)
+
+          # The name of the bucket for which replication configuration is set
+          attribute? :bucket, Resources::Types::String.optional
+
+          # IAM role ARN that S3 can assume to replicate objects
+          attribute? :role, Resources::Types::String.optional
+
+          # Array of replication rules
+          attribute? :rule, S3BucketReplicationRule::Rules.optional
+
+          # Custom validation
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            S3BucketReplicationValidators.validate_all(attrs)
+            attrs
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_s3_bucket_versioning/resource.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_s3_bucket_versioning/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS S3 Bucket Versioning configuration with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] S3 bucket versioning attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_s3_bucket_versioning(name, attributes = {})
+        # Validate attributes using dry-struct
+        versioning_attrs = Types::S3BucketVersioningAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_s3_bucket_versioning, name) do
+          # Set bucket name
+          bucket versioning_attrs.bucket
+          
+          # Set expected bucket owner if provided
+          expected_bucket_owner versioning_attrs.expected_bucket_owner if versioning_attrs.expected_bucket_owner
+          
+          # Configure versioning
+          versioning_configuration do
+            status versioning_attrs.versioning_configuration&.dig(:status)
+            mfa_delete versioning_attrs.versioning_configuration&.dig(:mfa_delete) if versioning_attrs.versioning_configuration&.dig(:mfa_delete)
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_s3_bucket_versioning',
+          name: name,
+          resource_attributes: versioning_attrs.to_h,
+          outputs: {
+            id: "${aws_s3_bucket_versioning.#{name}.id}",
+            bucket: "${aws_s3_bucket_versioning.#{name}.bucket}"
+          },
+          computed: {
+            versioning_enabled: versioning_attrs.versioning_enabled?,
+            versioning_suspended: versioning_attrs.versioning_suspended?,
+            mfa_delete_enabled: versioning_attrs.mfa_delete_enabled?,
+            mfa_delete_configured: versioning_attrs.mfa_delete_configured?,
+            status: versioning_attrs.status
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_s3_bucket_versioning/types.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+      # Type-safe attributes for AWS S3 Bucket Versioning resources
+      class S3BucketVersioningAttributes < Pangea::Resources::BaseAttributes
+        transform_keys(&:to_sym)
+
+        # Bucket name (required)
+        attribute? :bucket, Resources::Types::String.optional
+
+        # Versioning configuration (required)
+        attribute? :versioning_configuration, Resources::Types::Hash.schema(
+          status: Resources::Types::String.constrained(included_in: ['Enabled', 'Suspended']),
+          mfa_delete?: Resources::Types::String.constrained(included_in: ['Enabled', 'Disabled']).optional
+        ).lax
+
+        # Expected bucket owner for multi-account scenarios
+        attribute? :expected_bucket_owner, Resources::Types::String.optional
+
+        # Custom validation
+        def self.new(attributes = {})
+          attrs = super(attributes)
+
+          # Ensure versioning_configuration is provided
+          unless attrs.versioning_configuration
+            raise Dry::Struct::Error, "versioning_configuration is required"
+          end
+
+          attrs
+        end
+
+        # Helper methods
+        def versioning_enabled?
+          versioning_configuration&.dig(:status) == 'Enabled'
+        end
+
+        def versioning_suspended?
+          versioning_configuration&.dig(:status) == 'Suspended'
+        end
+
+        def mfa_delete_enabled?
+          versioning_configuration&.dig(:mfa_delete) == 'Enabled'
+        end
+
+        def mfa_delete_configured?
+          versioning_configuration.key?(:mfa_delete)
+        end
+
+        def status
+          versioning_configuration&.dig(:status)
+        end
+      end
+    end
+      end
+    end
+  end

data/lib/pangea/resources/aws_s3_bucket_website_configuration/resource.rb

@@ -0,0 +1,120 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_s3_bucket_website_configuration/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS S3 Bucket Website Configuration with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] Resource attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_s3_bucket_website_configuration(name, attributes = {})
+        # Validate attributes using dry-struct
+        attrs = Types::S3BucketWebsiteConfigurationAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_s3_bucket_website_configuration, name) do
+          # Bucket is required
+          bucket attrs.bucket
+          
+          # Expected bucket owner
+          expected_bucket_owner attrs.expected_bucket_owner if attrs.expected_bucket_owner
+          
+          # Error document configuration
+          if attrs.error_document
+            error_document do
+              key attrs.error_document.key
+            end
+          end
+          
+          # Index document configuration
+          if attrs.index_document
+            index_document do
+              suffix attrs.index_document.suffix
+            end
+          end
+          
+          # Redirect all requests configuration
+          if attrs.redirect_all_requests_to
+            redirect_all_requests_to do
+              host_name attrs.redirect_all_requests_to.host_name
+              protocol attrs.redirect_all_requests_to.protocol if attrs.redirect_all_requests_to.protocol
+            end
+          end
+          
+          # Routing rules
+          if attrs.routing_rule
+            attrs.routing_rule.each do |routing_rule|
+              routing_rule do
+                # Condition (optional)
+                if routing_rule.condition
+                  condition do
+                    http_error_code_returned_equals routing_rule.condition.http_error_code_returned_equals if routing_rule.condition.http_error_code_returned_equals
+                    key_prefix_equals routing_rule.condition.key_prefix_equals if routing_rule.condition.key_prefix_equals
+                  end
+                end
+                
+                # Redirect (required)
+                redirect do
+                  host_name routing_rule.redirect.host_name if routing_rule.redirect.host_name
+                  http_redirect_code routing_rule.redirect.http_redirect_code if routing_rule.redirect.http_redirect_code
+                  protocol routing_rule.redirect.protocol if routing_rule.redirect.protocol
+                  replace_key_prefix_with routing_rule.redirect.replace_key_prefix_with if routing_rule.redirect.replace_key_prefix_with
+                  replace_key_with routing_rule.redirect.replace_key_with if routing_rule.redirect.replace_key_with
+                end
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_s3_bucket_website_configuration',
+          name: name,
+          resource_attributes: attrs.to_h,
+          outputs: {
+            id: "${aws_s3_bucket_website_configuration.#{name}.id}",
+            bucket: "${aws_s3_bucket_website_configuration.#{name}.bucket}",
+            expected_bucket_owner: "${aws_s3_bucket_website_configuration.#{name}.expected_bucket_owner}",
+            website_domain: "${aws_s3_bucket_website_configuration.#{name}.website_domain}",
+            website_endpoint: "${aws_s3_bucket_website_configuration.#{name}.website_endpoint}"
+          },
+          computed_properties: {
+            hosting_mode: attrs.website_hosting_mode? ? "website_hosting" : "redirect_all",
+            has_error_document: attrs.has_error_document?,
+            has_routing_rules: attrs.has_routing_rules?,
+            routing_rules_count: attrs.routing_rules_count,
+            unconditional_rules_count: attrs.unconditional_routing_rules.length,
+            error_code_rules_count: attrs.error_code_routing_rules.length,
+            prefix_rules_count: attrs.prefix_routing_rules.length,
+            permanent_redirect_rules_count: attrs.permanent_redirect_rules.length,
+            temporary_redirect_rules_count: attrs.temporary_redirect_rules.length,
+            index_document_suffix: attrs.index_document&.suffix,
+            error_document_key: attrs.error_document&.key,
+            redirect_target_host: attrs.redirect_all_requests_to&.host_name,
+            redirect_target_protocol: attrs.redirect_all_requests_to&.protocol
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_s3_bucket_website_configuration/types/attributes.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require_relative 'documents'
+require_relative 'redirect'
+require_relative 'routing_rules'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Type-safe attributes for AWS S3 Bucket Website Configuration
+        class S3BucketWebsiteConfigurationAttributes < Pangea::Resources::BaseAttributes
+          attribute? :bucket, Resources::Types::String.optional
+          attribute? :expected_bucket_owner, Resources::Types::String.optional
+          attribute? :error_document, WebsiteErrorDocument.optional
+          attribute? :index_document, WebsiteIndexDocument.optional
+          attribute? :redirect_all_requests_to, WebsiteRedirectAllRequestsTo.optional
+          attribute? :routing_rule, Resources::Types::Array.of(WebsiteRoutingRule).constrained(max_size: 50).optional
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+
+            has_website_config = attrs.index_document || attrs.error_document || attrs.routing_rule
+            has_redirect_all = attrs.redirect_all_requests_to
+
+            if has_website_config && has_redirect_all
+              raise Dry::Struct::Error, "Cannot specify both website hosting configuration and redirect_all_requests_to"
+            end
+
+            if !has_website_config && !has_redirect_all
+              raise Dry::Struct::Error, "Must specify either website hosting configuration (index_document) or redirect_all_requests_to"
+            end
+
+            if has_website_config && !attrs.index_document
+              raise Dry::Struct::Error, "index_document is required when using website hosting configuration"
+            end
+
+            attrs
+          end
+
+          def website_hosting_mode? = !index_document.nil?
+          def redirect_all_mode? = !redirect_all_requests_to.nil?
+          def has_error_document? = !error_document.nil?
+          def has_routing_rules? = !routing_rule.nil? && routing_rule.any?
+          def routing_rules_count = routing_rule&.length || 0
+          def unconditional_routing_rules = routing_rule&.select(&:unconditional?) || []
+          def error_code_routing_rules = routing_rule&.select(&:error_code_rule?) || []
+          def prefix_routing_rules = routing_rule&.select(&:prefix_rule?) || []
+          def permanent_redirect_rules = routing_rule&.select { |rule| rule.redirect.permanent_redirect? } || []
+          def temporary_redirect_rules = routing_rule&.select { |rule| rule.redirect.temporary_redirect? } || []
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_s3_bucket_website_configuration/types/documents.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # S3 website error document configuration
+        class WebsiteErrorDocument < Pangea::Resources::BaseAttributes
+          attribute? :key, Resources::Types::String.optional
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+
+            if attrs.key.start_with?('/')
+              raise Dry::Struct::Error, "Error document key should not start with '/': #{attrs.key}"
+            end
+
+            unless attrs.key.match?(/\.(html|htm)$/i) || attrs.key == 'error.html' || attrs.key.include?('error')
+              warn "Error document key '#{attrs.key}' doesn't appear to be an HTML file. Consider using .html extension."
+            end
+
+            attrs
+          end
+
+          def html_file? = key.match?(/\.(html|htm)$/i)
+          def in_subdirectory? = key.include?('/')
+          def filename = key.split('/').last
+          def directory
+            parts = key.split('/')
+            parts.length > 1 ? parts[0..-2].join('/') : ''
+          end
+        end
+
+        # S3 website index document configuration
+        class WebsiteIndexDocument < Pangea::Resources::BaseAttributes
+          attribute? :suffix, Resources::Types::String.optional
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+
+            if attrs.suffix.start_with?('/')
+              raise Dry::Struct::Error, "Index document suffix should not start with '/': #{attrs.suffix}"
+            end
+
+            unless %w[index.html index.htm default.html default.htm].include?(attrs.suffix.downcase)
+              warn "Index document suffix '#{attrs.suffix}' is not a common index file name. Consider 'index.html'."
+            end
+
+            attrs
+          end
+
+          def html_file? = suffix.match?(/\.(html|htm)$/i)
+          def common_index_file? = %w[index.html index.htm default.html default.htm].include?(suffix.downcase)
+          def filename = suffix.split('/').last
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_s3_bucket_website_configuration/types/redirect.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # S3 website redirect all requests configuration
+        class WebsiteRedirectAllRequestsTo < Pangea::Resources::BaseAttributes
+          attribute? :host_name, Resources::Types::String.optional
+          attribute? :protocol, Resources::Types::String.constrained(included_in: ["http", "https"]).optional
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+
+            unless attrs.host_name.match?(/^[a-zA-Z0-9][a-zA-Z0-9\-\.]*[a-zA-Z0-9]$/)
+              raise Dry::Struct::Error, "Invalid hostname format: #{attrs.host_name}"
+            end
+
+            if attrs.protocol == "http" && !attrs.host_name.match?(/^(localhost|127\.0\.0\.1|.*\.local|.*\.dev)/)
+              warn "Using HTTP protocol for production hostname '#{attrs.host_name}' may be insecure. Consider HTTPS."
+            end
+
+            attrs
+          end
+
+          def uses_https? = protocol == "https"
+          def uses_http? = protocol == "http"
+          def same_protocol? = protocol.nil?
+          def localhost? = host_name.match?(/^(localhost|127\.0\.0\.1|.*\.local|.*\.dev)/)
+
+          def target_url(path = "")
+            protocol_part = protocol ? "#{protocol}://" : "//"
+            "#{protocol_part}#{host_name}#{path}"
+          end
+        end
+      end
+    end
+  end
+end