pangea-aws 0.1.0

data/lib/pangea/resources/aws_sagemaker_endpoint_configuration/types/variant_types.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # SageMaker Endpoint Configuration instance types for inference
+        SageMakerInferenceInstanceType = Resources::Types::String.enum(
+          # General purpose
+          'ml.t2.medium', 'ml.t2.large', 'ml.t2.xlarge', 'ml.t2.2xlarge',
+          'ml.m4.xlarge', 'ml.m4.2xlarge', 'ml.m4.4xlarge', 'ml.m4.10xlarge', 'ml.m4.16xlarge',
+          'ml.m5.large', 'ml.m5.xlarge', 'ml.m5.2xlarge', 'ml.m5.4xlarge', 'ml.m5.12xlarge', 'ml.m5.24xlarge',
+          'ml.m5d.large', 'ml.m5d.xlarge', 'ml.m5d.2xlarge', 'ml.m5d.4xlarge', 'ml.m5d.12xlarge', 'ml.m5d.24xlarge',
+          # Compute optimized
+          'ml.c4.large', 'ml.c4.xlarge', 'ml.c4.2xlarge', 'ml.c4.4xlarge', 'ml.c4.8xlarge',
+          'ml.c5.large', 'ml.c5.xlarge', 'ml.c5.2xlarge', 'ml.c5.4xlarge', 'ml.c5.9xlarge', 'ml.c5.18xlarge',
+          'ml.c5d.large', 'ml.c5d.xlarge', 'ml.c5d.2xlarge', 'ml.c5d.4xlarge', 'ml.c5d.9xlarge', 'ml.c5d.18xlarge',
+          # Memory optimized
+          'ml.r4.large', 'ml.r4.xlarge', 'ml.r4.2xlarge', 'ml.r4.4xlarge', 'ml.r4.8xlarge', 'ml.r4.16xlarge',
+          'ml.r5.large', 'ml.r5.xlarge', 'ml.r5.2xlarge', 'ml.r5.4xlarge', 'ml.r5.12xlarge', 'ml.r5.24xlarge',
+          'ml.r5d.large', 'ml.r5d.xlarge', 'ml.r5d.2xlarge', 'ml.r5d.4xlarge', 'ml.r5d.12xlarge', 'ml.r5d.24xlarge',
+          # GPU instances
+          'ml.p2.xlarge', 'ml.p2.8xlarge', 'ml.p2.16xlarge',
+          'ml.p3.2xlarge', 'ml.p3.8xlarge', 'ml.p3.16xlarge',
+          'ml.g4dn.xlarge', 'ml.g4dn.2xlarge', 'ml.g4dn.4xlarge', 'ml.g4dn.8xlarge', 'ml.g4dn.12xlarge', 'ml.g4dn.16xlarge',
+          # Inference optimized
+          'ml.inf1.xlarge', 'ml.inf1.2xlarge', 'ml.inf1.6xlarge', 'ml.inf1.24xlarge'
+        )
+
+        # SageMaker Production Variant configuration
+        SageMakerProductionVariant = Resources::Types::Hash.schema(
+          variant_name: Resources::Types::String.constrained(min_size: 1, max_size: 63, format: /\A[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]\z/),
+          model_name: Resources::Types::String,
+          initial_instance_count: Resources::Types::Integer.constrained(gteq: 1, lteq: 1000),
+          instance_type: SageMakerInferenceInstanceType,
+          initial_variant_weight?: Resources::Types::Float.constrained(gteq: 0.0, lteq: 1.0).default(1.0),
+          accelerator_type?: Resources::Types::String.constrained(included_in: ['ml.eia1.medium', 'ml.eia1.large', 'ml.eia1.xlarge', 'ml.eia2.medium', 'ml.eia2.large', 'ml.eia2.xlarge']).optional,
+          core_dump_config?: Resources::Types::Hash.schema(destination_s3_uri: Resources::Types::String.constrained(format: /\As3:\/\//).lax, kms_key_id?: Resources::Types::String.optional).optional,
+          serverless_config?: Resources::Types::Hash.schema(memory_size_in_mb: Resources::Types::Integer.constrained(gteq: 1024, lteq: 6144).lax, max_concurrency: Resources::Types::Integer.constrained(gteq: 1, lteq: 200)).optional
+        ).constructor do |value|
+          if value[:serverless_config] && value[:instance_type]
+            unless %w[ml.m5.large ml.m5.xlarge ml.m5.2xlarge ml.m5.4xlarge ml.m5.12xlarge ml.m5.24xlarge].include?(value[:instance_type])
+              raise Dry::Types::ConstraintError, 'Serverless inference only supports specific M5 instance types'
+            end
+          end
+
+          if value[:accelerator_type] && value[:instance_type]
+            incompatible_types = %w[ml.t2 ml.t3 ml.m4 ml.c4 ml.c5]
+            if incompatible_types.any? { |type| value[:instance_type].start_with?(type) }
+              raise Dry::Types::ConstraintError, "Accelerator type #{value[:accelerator_type]} not compatible with #{value[:instance_type]}"
+            end
+          end
+
+          value
+        end
+
+        # SageMaker Endpoint Configuration data capture configuration
+        SageMakerDataCaptureConfig = Resources::Types::Hash.schema(
+          enable_capture: Resources::Types::Bool.default(false),
+          initial_sampling_percentage: Resources::Types::Integer.constrained(gteq: 0, lteq: 100),
+          destination_s3_uri: Resources::Types::String.constrained(format: /\As3:\/\//),
+          kms_key_id?: Resources::Types::String.optional,
+          capture_options: Resources::Types::Array.of(Resources::Types::Hash.schema(capture_mode: Resources::Types::String.constrained(included_in: ['Input', 'Output']).lax)).constrained(min_size: 1),
+          capture_content_type_header?: Resources::Types::Hash.schema(csv_content_types?: Resources::Types::Array.of(Resources::Types::String).lax.optional, json_content_types?: Resources::Types::Array.of(Resources::Types::String).optional).optional
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_sagemaker_endpoint_configuration/types.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require 'pangea/resources/types'
+require_relative 'types/variant_types'
+require_relative 'types/attributes'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # SageMakerInferenceInstanceType is defined in types/variant_types.rb
+        # SageMakerProductionVariant is defined in types/variant_types.rb
+        # SageMakerDataCaptureConfig is defined in types/variant_types.rb
+        # SageMakerEndpointConfigurationAttributes is defined in types/attributes.rb
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_sagemaker_feature_group/resource.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/aws_sagemaker_feature_group/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # SageMaker Feature Group resource for ML feature management
+      SageMakerFeatureGroup = Struct.new(:name, :attributes, keyword_init: true)
+      class SageMakerFeatureGroup
+        def self.resource_type
+          'aws_sagemaker_feature_group'
+        end
+        
+        def self.attribute_struct
+          Types::SageMakerFeatureGroupAttributes
+        end
+      end
+      
+      def aws_sagemaker_feature_group(name, attributes)
+        resource = SageMakerFeatureGroup.new(
+          name: name,
+          attributes: attributes
+        )
+        
+        add_resource(resource)
+        
+        ResourceReference.new(
+          name: name,
+          type: :aws_sagemaker_feature_group,
+          attributes: {
+            id: "${aws_sagemaker_feature_group.#{name}.id}",
+            arn: "${aws_sagemaker_feature_group.#{name}.arn}",
+            feature_group_name: "${aws_sagemaker_feature_group.#{name}.feature_group_name}",
+            feature_group_status: "${aws_sagemaker_feature_group.#{name}.feature_group_status}",
+            has_online_store: attributes.dig(:online_store_config, :enable_online_store) != false,
+            has_offline_store: !attributes[:offline_store_config].nil?,
+            feature_count: attributes[:feature_definitions]&.size || 0,
+            uses_ttl: !attributes.dig(:online_store_config, :ttl_duration).nil?,
+            table_format: attributes.dig(:offline_store_config, :table_format) || 'Glue'
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_sagemaker_feature_group/types.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # SageMaker Feature Group attributes with Feature Store validation
+        class SageMakerFeatureGroupAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          # Required attributes
+          attribute? :feature_group_name, Resources::Types::String.constrained(
+            min_size: 1,
+            max_size: 64,
+            format: /\A[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]\z/
+          )
+          attribute? :record_identifier_feature_name, Resources::Types::String.constrained(
+            min_size: 1,
+            max_size: 64,
+            format: /\A[a-zA-Z_][a-zA-Z0-9_]*\z/
+          )
+          attribute? :event_time_feature_name, Resources::Types::String.constrained(
+            min_size: 1,
+            max_size: 64,
+            format: /\A[a-zA-Z_][a-zA-Z0-9_]*\z/
+          )
+          attribute? :feature_definitions, Resources::Types::Array.of(
+            Resources::Types::Hash.schema(
+              feature_name: Resources::Types::String.constrained(
+                min_size: 1,
+                max_size: 64,
+                format: /\A[a-zA-Z_][a-zA-Z0-9_]*\z/
+              ),
+              feature_type: Resources::Types::String.constrained(included_in: ['Integral', 'Fractional', 'String'])
+            ).lax
+          ).constrained(min_size: 1, max_size: 2500)
+          
+          # Optional attributes
+          attribute? :description, Resources::Types::String.optional
+          attribute? :online_store_config, Resources::Types::Hash.schema(
+            enable_online_store?: Resources::Types::Bool.default(true),
+            security_config?: Resources::Types::Hash.schema(
+              kms_key_id?: Resources::Types::String.optional
+            ).lax.optional,
+            ttl_duration?: Resources::Types::Hash.schema(
+              unit: Resources::Types::String.constrained(included_in: ['Seconds', 'Minutes', 'Hours', 'Days', 'Weeks']),
+              value: Resources::Types::Integer.constrained(gteq: 1)
+            ).lax.optional
+          ).optional
+          attribute? :offline_store_config, Resources::Types::Hash.schema(
+            s3_storage_config: Resources::Types::Hash.schema(
+              s3_uri: Resources::Types::String.constrained(format: /\As3:\/\//),
+              kms_key_id?: Resources::Types::String.optional,
+              resolved_output_s3_uri?: Resources::Types::String.optional
+            ),
+            disable_glue_table_creation?: Resources::Types::Bool.default(false),
+            data_catalog_config?: Resources::Types::Hash.schema(
+              table_name?: Resources::Types::String.optional,
+              catalog?: Resources::Types::String.default('AwsDataCatalog'),
+              database?: Resources::Types::String.default('sagemaker_featurestore')
+            ).lax.optional,
+            table_format?: Resources::Types::String.constrained(included_in: ['Glue', 'Iceberg']).default('Glue')
+          ).optional
+          attribute? :role_arn, Resources::Types::String.constrained(
+            format: /\Aarn:aws:iam::\d{12}:role\/[a-zA-Z0-9_+=,.@-]+\z/
+          ).optional
+          attribute? :tags, Resources::Types::AwsTags.optional
+          
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+            
+            # Validate feature definitions have unique names
+            if attrs[:feature_definitions]
+              feature_names = attrs[:feature_definitions].map { |fd| fd[:feature_name] }
+              if feature_names.uniq.size != feature_names.size
+                raise Dry::Struct::Error, "Feature definition names must be unique"
+              end
+              
+              # Validate record identifier and event time are in feature definitions
+              record_identifier = attrs[:record_identifier_feature_name]
+              event_time = attrs[:event_time_feature_name]
+              
+              unless feature_names.include?(record_identifier)
+                raise Dry::Struct::Error, "record_identifier_feature_name must be included in feature_definitions"
+              end
+              
+              unless feature_names.include?(event_time)
+                raise Dry::Struct::Error, "event_time_feature_name must be included in feature_definitions"
+              end
+            end
+            
+            # Validate at least one store is configured
+            online_store = attrs[:online_store_config]
+            offline_store = attrs[:offline_store_config]
+            
+            if !online_store && !offline_store
+              raise Dry::Struct::Error, "At least one of online_store_config or offline_store_config must be specified"
+            end
+            
+            super(attrs)
+          end
+          
+          def estimated_feature_store_cost
+            online_cost = has_online_store? ? 50.0 : 0.0 # Estimated monthly cost
+            offline_cost = has_offline_store? ? 10.0 : 0.0 # S3 storage cost estimate
+            
+            online_cost + offline_cost
+          end
+          
+          def has_online_store?
+            online_store_config&.dig(:enable_online_store) != false
+          end
+          
+          def has_offline_store?
+            !offline_store_config.nil?
+          end
+          
+          def feature_count
+            feature_definitions.size
+          end
+          
+          def uses_ttl?
+            !online_store_config&.dig(:ttl_duration).nil?
+          end
+          
+          def uses_iceberg_format?
+            offline_store_config&.dig(:table_format) == 'Iceberg'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_sagemaker_model/resource.rb

@@ -0,0 +1,187 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/aws_sagemaker_model/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # SageMaker Model resource for defining ML models for inference
+      # 
+      # A model in SageMaker defines the inference code and model artifacts needed 
+      # to deploy machine learning models to endpoints. Models can be single-container
+      # or multi-container for ensemble inference scenarios.
+      #
+      # @example Basic single-container model
+      #   aws_sagemaker_model(:fraud_detection_model, {
+      #     model_name: "fraud-detection-v1",
+      #     execution_role_arn: model_role_ref.arn,
+      #     primary_container: {
+      #       image: "763104351884.dkr.ecr.us-east-1.amazonaws.com/sklearn-inference:0.23-1-cpu-py3",
+      #       model_data_url: "s3://#{model_bucket_ref.bucket}/fraud-model/model.tar.gz"
+      #     }
+      #   })
+      #
+      # @example Multi-container ensemble model
+      #   aws_sagemaker_model(:ensemble_model, {
+      #     model_name: "fraud-ensemble-v1", 
+      #     execution_role_arn: model_role_ref.arn,
+      #     containers: [
+      #       {
+      #         image: "763104351884.dkr.ecr.us-east-1.amazonaws.com/xgboost:1.3-1-cpu-py3",
+      #         model_data_url: "s3://#{model_bucket_ref.bucket}/xgboost-model/model.tar.gz",
+      #         container_hostname: "xgboost-container",
+      #         environment: {
+      #           MODEL_NAME: "xgboost",
+      #           SAGEMAKER_PROGRAM: "inference.py"
+      #         }
+      #       },
+      #       {
+      #         image: "763104351884.dkr.ecr.us-east-1.amazonaws.com/pytorch-inference:1.8.1-cpu-py3",
+      #         model_data_url: "s3://#{model_bucket_ref.bucket}/pytorch-model/model.tar.gz", 
+      #         container_hostname: "pytorch-container",
+      #         environment: {
+      #           MODEL_NAME: "pytorch",
+      #           SAGEMAKER_PROGRAM: "predict.py"
+      #         }
+      #       }
+      #     ],
+      #     inference_execution_config: {
+      #       mode: "Direct"
+      #     }
+      #   })
+      #
+      # @example Secure model with VPC configuration
+      #   aws_sagemaker_model(:secure_model, {
+      #     model_name: "secure-fraud-model",
+      #     execution_role_arn: model_role_ref.arn,
+      #     primary_container: {
+      #       image: "#{account_id}.dkr.ecr.#{region}.amazonaws.com/custom-fraud-detector:latest",
+      #       model_data_url: "s3://#{secure_bucket_ref.bucket}/encrypted-model/model.tar.gz",
+      #       environment: {
+      #         MODEL_SERVER_TIMEOUT: "120",
+      #         MODEL_SERVER_WORKERS: "4",
+      #         SAGEMAKER_PROGRAM: "inference.py",
+      #         SAGEMAKER_SUBMIT_DIRECTORY: "/opt/ml/code"
+      #       },
+      #       image_config: {
+      #         repository_access_mode: "Vpc",
+      #         repository_auth_config: {
+      #           repository_credentials_provider_arn: ecr_credentials_ref.arn
+      #         }
+      #       }
+      #     },
+      #     vpc_config: {
+      #       security_group_ids: [model_sg_ref.id],
+      #       subnets: [private_subnet_a_ref.id, private_subnet_b_ref.id]
+      #     },
+      #     enable_network_isolation: true,
+      #     tags: {
+      #       Environment: "production",
+      #       ModelType: "fraud-detection",
+      #       Security: "high",
+      #       Compliance: "pci-dss"
+      #     }
+      #   })
+      #
+      # @example Multi-model endpoint model
+      #   aws_sagemaker_model(:multi_model, {
+      #     model_name: "multi-model-endpoint",
+      #     execution_role_arn: model_role_ref.arn,
+      #     primary_container: {
+      #       image: "763104351884.dkr.ecr.us-east-1.amazonaws.com/sklearn-inference:0.23-1-cpu-py3",
+      #       model_data_url: "s3://#{model_bucket_ref.bucket}/multi-model/",
+      #       multi_model_config: {
+      #         model_cache_setting: "Enabled"
+      #       },
+      #       environment: {
+      #         SAGEMAKER_MULTI_MODEL: "true",
+      #         SAGEMAKER_PROGRAM: "inference.py"
+      #       }
+      #     }
+      #   })
+      SageMakerModel = Struct.new(:name, :attributes, keyword_init: true)
+      class SageMakerModel
+        def self.resource_type
+          'aws_sagemaker_model'
+        end
+        
+        def self.attribute_struct
+          Types::SageMakerModelAttributes
+        end
+      end
+      
+      # Resource function for aws_sagemaker_model
+      # 
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] The resource attributes
+      # @return [ResourceReference] Reference to the created resource
+      def aws_sagemaker_model(name, attributes)
+        resource = SageMakerModel.new(
+          name: name,
+          attributes: attributes
+        )
+        
+        add_resource(resource)
+        
+        # Return resource reference with computed attributes
+        ResourceReference.new(
+          name: name,
+          type: :aws_sagemaker_model,
+          attributes: {
+            # Direct attributes
+            id: "${aws_sagemaker_model.#{name}.id}",
+            arn: "${aws_sagemaker_model.#{name}.arn}",
+            name: "${aws_sagemaker_model.#{name}.name}",
+            model_name: "${aws_sagemaker_model.#{name}.name}",
+            execution_role_arn: "${aws_sagemaker_model.#{name}.execution_role_arn}",
+            
+            # Computed attributes 
+            creation_time: "${aws_sagemaker_model.#{name}.creation_time}",
+            
+            # Helper attributes for integration
+            is_multi_container: attributes[:containers]&.size.to_i > 1,
+            container_count: attributes[:containers]&.size || (attributes[:primary_container] ? 1 : 0),
+            has_vpc_config: !attributes[:vpc_config].nil?,
+            network_isolated: attributes[:enable_network_isolation] == true,
+            uses_multi_model_endpoint: attributes.dig(:primary_container, :multi_model_config, :model_cache_setting) == 'Enabled',
+            
+            # Model type classification
+            model_type: attributes[:containers]&.size.to_i > 1 ? 'multi-container' : 'single-container',
+            inference_mode: attributes.dig(:inference_execution_config, :mode) || (attributes[:containers]&.size.to_i > 1 ? 'Serial' : 'Direct'),
+            
+            # Security attributes
+            uses_custom_images: begin
+              all_containers = []
+              all_containers << attributes[:primary_container] if attributes[:primary_container]
+              all_containers.concat(attributes[:containers] || [])
+              all_containers.any? { |c| !c[:image].include?('763104351884.dkr.ecr') }
+            end,
+            
+            uses_model_packages: begin
+              all_containers = []
+              all_containers << attributes[:primary_container] if attributes[:primary_container]
+              all_containers.concat(attributes[:containers] || [])
+              all_containers.any? { |c| c[:model_package_name] }
+            end
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_sagemaker_model/types/attributes.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        SageMakerModelImage = Resources::Types::String.constrained(
+          format: /\A(\d{12}\.dkr\.ecr\.[a-z0-9-]+\.amazonaws\.com\/|763104351884\.dkr\.ecr\.[a-z0-9-]+\.amazonaws\.com\/|public\.ecr\.aws\/)/
+        )
+
+        SageMakerModelExecutionRole = Resources::Types::String.constrained(
+          format: /\Aarn:aws:iam::\d{12}:role\/[a-zA-Z0-9_+=,.@-]+\z/
+        )
+
+        SageMakerModelContainer = Resources::Types::Hash.schema(
+          image: SageMakerModelImage,
+          model_data_url?: Resources::Types::String.optional,
+          container_hostname?: Resources::Types::String.optional,
+          environment?: Resources::Types::Hash.map(Resources::Types::String, Resources::Types::String).optional,
+          model_package_name?: Resources::Types::String.optional,
+          inference_specification_name?: Resources::Types::String.optional,
+          image_config?: Resources::Types::Hash.optional,
+          multi_model_config?: Resources::Types::Hash.schema(model_cache_setting?: Resources::Types::String.constrained(included_in: ['Enabled', 'Disabled']).lax.optional).optional
+        )
+
+        SageMakerModelVpcConfig = Resources::Types::Hash.schema(
+          security_group_ids: Resources::Types::Array.of(Resources::Types::String).constrained(min_size: 1, max_size: 5),
+          subnets: Resources::Types::Array.of(Resources::Types::String).constrained(min_size: 1, max_size: 16)
+        ).lax
+
+        SageMakerModelInferenceExecutionConfig = Resources::Types::Hash.schema(mode: Resources::Types::String.constrained(included_in: ['Serial', 'Direct']).lax)
+
+        class SageMakerModelAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+
+          attribute? :model_name, Resources::Types::String.constrained(min_size: 1, max_size: 63, format: /\A[a-zA-Z0-9][a-zA-Z0-9\-]*[a-zA-Z0-9]\z/).optional
+          attribute? :execution_role_arn, SageMakerModelExecutionRole.optional
+          attribute? :primary_container, SageMakerModelContainer.optional
+          attribute :containers, Resources::Types::Array.of(SageMakerModelContainer).default([].freeze)
+          attribute? :vpc_config, SageMakerModelVpcConfig.optional
+          attribute :enable_network_isolation, Resources::Types::Bool.default(false)
+          attribute? :inference_execution_config, SageMakerModelInferenceExecutionConfig.optional
+          attribute? :tags, Resources::Types::AwsTags.optional
+
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+            Validators.validate_model_name(attrs)
+            Validators.validate_containers(attrs)
+            Validators.validate_vpc_isolation(attrs)
+            Validators.validate_inference_mode(attrs)
+            super(attrs)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_sagemaker_model/types/helpers.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require 'dry-struct'
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class SageMakerModelAttributes < Pangea::Resources::BaseAttributes
+          def estimated_monthly_cost
+            estimate_model_storage_cost + (uses_multi_model_endpoint? ? 10.0 : 0.0)
+          end
+
+          def estimate_model_storage_cost
+            count = 0
+            count += 1 if primary_container&.dig(:model_data_url)
+            count += containers&.count { |c| c[:model_data_url] } || 0
+            count * 0.023
+          end
+
+          def is_multi_container_model? = containers && containers.size > 1
+          def uses_multi_model_endpoint? = primary_container&.dig(:multi_model_config, :model_cache_setting) == 'Enabled'
+          def has_vpc_configuration? = !vpc_config.nil?
+          def uses_network_isolation? = enable_network_isolation
+          def container_count = primary_container ? 1 : (containers&.size || 0)
+
+          def all_containers = [primary_container, *(containers || [])].compact
+
+          def uses_model_packages? = all_containers.any? { |c| c[:model_package_name] }
+          def uses_custom_images? = all_containers.any? { |c| !c[:image].include?('763104351884.dkr.ecr') }
+          def has_environment_variables? = all_containers.any? { |c| c[:environment]&.any? }
+          def total_environment_variables = all_containers.sum { |c| c[:environment]&.size || 0 }
+
+          def inference_configuration
+            if is_multi_container_model?
+              { type: 'multi-container', container_count: container_count,
+                execution_mode: inference_execution_config&.dig(:mode) || 'Serial',
+                supports_direct_invocation: inference_execution_config&.dig(:mode) == 'Direct' }
+            else
+              { type: 'single-container', container_count: 1, multi_model_endpoint: uses_multi_model_endpoint? }
+            end
+          end
+
+          def security_score
+            score = 0
+            score += 20 if has_vpc_configuration?
+            score += 25 if uses_network_isolation?
+            score += 10 if uses_model_packages?
+            score += 15 unless uses_custom_images?
+            score += 10 if vpc_config && vpc_config[:security_group_ids].size >= 2
+            [score, 100].min
+          end
+
+          def compliance_status
+            issues = []
+            issues << "No VPC configuration" unless has_vpc_configuration?
+            issues << "Network isolation not enabled" unless uses_network_isolation?
+            issues << "Using custom images" if uses_custom_images?
+            issues << "Too many env vars (#{total_environment_variables})" if total_environment_variables > 20
+            { status: issues.empty? ? 'compliant' : 'needs_attention', issues: issues }
+          end
+
+          def model_summary
+            { model_name: model_name, model_type: is_multi_container_model? ? 'multi-container' : 'single-container',
+              container_count: container_count, uses_vpc: has_vpc_configuration?, network_isolated: uses_network_isolation?,
+              multi_model_endpoint: uses_multi_model_endpoint?, estimated_monthly_cost: estimated_monthly_cost,
+              security_score: security_score, inference_config: inference_configuration }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_sagemaker_model/types/validators.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'dry-struct'
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_sagemaker_model/types.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require_relative 'types/validators'
+require_relative 'types/attributes'
+require_relative 'types/helpers'