pangea-aws 0.1.0

data/lib/pangea/resources/aws_sqs_queue_policy/resource.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_sqs_queue_policy/types'
+require 'pangea/resource_registry'
+require 'json'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS SQS Queue Policy with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] SQS queue policy attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_sqs_queue_policy(name, attributes = {})
+        # Validate attributes using dry-struct
+        policy_attrs = Types::SQSQueuePolicyAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_sqs_queue_policy, name) do
+          queue_url policy_attrs.queue_url
+          policy policy_attrs.policy
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_sqs_queue_policy',
+          name: name,
+          resource_attributes: policy_attrs.to_h,
+          outputs: {
+            id: "${aws_sqs_queue_policy.#{name}.id}",
+            queue_url: policy_attrs.queue_url
+          },
+          computed: {
+            statement_count: policy_attrs.statement_count,
+            allows_cross_account: policy_attrs.allows_cross_account?,
+            allows_public_access: policy_attrs.allows_public_access?,
+            allowed_actions: policy_attrs.allowed_actions,
+            denied_actions: policy_attrs.denied_actions
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_sqs_queue_policy/types.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+      # Type-safe attributes for AWS SQS Queue Policy resources
+      class SQSQueuePolicyAttributes < Pangea::Resources::BaseAttributes
+        transform_keys(&:to_sym)
+
+        # Queue URL to attach the policy to
+        attribute? :queue_url, Resources::Types::String.optional
+
+        # Policy document as JSON string
+        attribute? :policy, Resources::Types::String.optional
+
+        # Custom validation
+        def self.new(attributes = {})
+          attrs = super(attributes)
+
+          # Validate policy is valid JSON
+          begin
+            policy_doc = ::JSON.parse(attrs.policy)
+            
+            # Basic policy structure validation
+            unless policy_doc.is_a?(::Hash) && policy_doc['Statement'].is_a?(Array)
+              raise Dry::Struct::Error, "Policy must be a valid IAM policy document with Statement array"
+            end
+
+            # Validate each statement has required fields
+            policy_doc['Statement'].each_with_index do |statement, index|
+              unless statement['Effect'] && statement['Action']
+                raise Dry::Struct::Error, "Policy statement #{index} must have Effect and Action"
+              end
+              
+              unless %w[Allow Deny].include?(statement['Effect'])
+                raise Dry::Struct::Error, "Policy statement #{index} Effect must be Allow or Deny"
+              end
+            end
+          rescue ::JSON::ParserError => e
+            raise Dry::Struct::Error, "Policy must be valid JSON: #{e.message}"
+          end
+
+          attrs
+        end
+
+        # Helper methods
+        def policy_document
+          @policy_document ||= ::JSON.parse(policy)
+        end
+
+        def statement_count
+          policy_document['Statement'].size
+        end
+
+        def allows_cross_account?
+          policy_document['Statement'].any? do |statement|
+            principal = statement['Principal']
+            next false unless principal
+            
+            if principal.is_a?(::Hash) && principal['AWS']
+              aws_principals = Array(principal['AWS'])
+              aws_principals.any? { |p| p.include?(':root') && !p.include?('*') }
+            elsif principal.is_a?(String)
+              principal != '*' && principal.include?(':root')
+            else
+              false
+            end
+          end
+        end
+
+        def allows_public_access?
+          policy_document['Statement'].any? do |statement|
+            statement['Effect'] == 'Allow' && 
+            (statement['Principal'] == '*' || 
+             (statement['Principal'].is_a?(::Hash) && statement['Principal']['AWS'] == '*'))
+          end
+        end
+
+        def allowed_actions
+          policy_document['Statement']
+            .select { |s| s['Effect'] == 'Allow' }
+            .flat_map { |s| Array(s['Action']) }
+            .uniq
+        end
+
+        def denied_actions
+          policy_document['Statement']
+            .select { |s| s['Effect'] == 'Deny' }
+            .flat_map { |s| Array(s['Action']) }
+            .uniq
+        end
+      end
+    end
+      end
+    end
+  end

data/lib/pangea/resources/aws_ssm_document/resource.rb

@@ -0,0 +1,141 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_ssm_document/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS Systems Manager Document with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] SSM document attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_ssm_document(name, attributes = {})
+        # Validate attributes using dry-struct
+        document_attrs = Types::SsmDocumentAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_ssm_document, name) do
+          document_name document_attrs.name
+          document_type document_attrs.document_type
+          content document_attrs.content
+          document_format document_attrs.document_format
+
+          # Target type (for Command documents)
+          if document_attrs.target_type
+            target_type document_attrs.target_type
+          end
+
+          # Schema version
+          if document_attrs.schema_version
+            schema_version document_attrs.schema_version
+          end
+
+          # Version name
+          if document_attrs.version_name
+            version_name document_attrs.version_name
+          end
+
+          # Permissions
+          if document_attrs.is_shared?
+            permissions do
+              type document_attrs.permissions&.dig(:type)
+              account_ids document_attrs.permissions&.dig(:account_ids)
+              if document_attrs.permissions&.dig(:shared_document_version)
+                shared_document_version document_attrs.permissions&.dig(:shared_document_version)
+              end
+            end
+          end
+
+          # Dependencies (requires)
+          document_attrs.requires.each do |requirement|
+            requires do
+              name requirement[:name]
+              version requirement[:version] if requirement[:version]
+            end
+          end
+
+          # Attachments
+          document_attrs.attachments_source.each do |attachment|
+            attachments_source do
+              key attachment[:key]
+              values attachment[:values]
+              name attachment[:name] if attachment[:name]
+            end
+          end
+
+          # Apply tags if present
+          if document_attrs.tags&.any?
+            tags do
+              document_attrs.tags.each do |key, value|
+                public_send(key, value)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_ssm_document',
+          name: name,
+          resource_attributes: document_attrs.to_h,
+          outputs: {
+            name: "${aws_ssm_document.#{name}.name}",
+            arn: "${aws_ssm_document.#{name}.arn}",
+            created_date: "${aws_ssm_document.#{name}.created_date}",
+            default_version: "${aws_ssm_document.#{name}.default_version}",
+            description: "${aws_ssm_document.#{name}.description}",
+            document_format: "${aws_ssm_document.#{name}.document_format}",
+            document_type: "${aws_ssm_document.#{name}.document_type}",
+            document_version: "${aws_ssm_document.#{name}.document_version}",
+            hash: "${aws_ssm_document.#{name}.hash}",
+            hash_type: "${aws_ssm_document.#{name}.hash_type}",
+            latest_version: "${aws_ssm_document.#{name}.latest_version}",
+            owner: "${aws_ssm_document.#{name}.owner}",
+            parameter: "${aws_ssm_document.#{name}.parameter}",
+            platform_types: "${aws_ssm_document.#{name}.platform_types}",
+            schema_version: "${aws_ssm_document.#{name}.schema_version}",
+            status: "${aws_ssm_document.#{name}.status}",
+            tags_all: "${aws_ssm_document.#{name}.tags_all}"
+          },
+          computed_properties: {
+            is_command_document: document_attrs.is_command_document?,
+            is_automation_document: document_attrs.is_automation_document?,
+            is_policy_document: document_attrs.is_policy_document?,
+            is_session_document: document_attrs.is_session_document?,
+            uses_json_format: document_attrs.uses_json_format?,
+            uses_yaml_format: document_attrs.uses_yaml_format?,
+            has_target_type: document_attrs.has_target_type?,
+            has_schema_version: document_attrs.has_schema_version?,
+            has_version_name: document_attrs.has_version_name?,
+            is_shared: document_attrs.is_shared?,
+            is_private: document_attrs.is_private?,
+            has_dependencies: document_attrs.has_dependencies?,
+            has_attachments: document_attrs.has_attachments?,
+            shared_with_accounts: document_attrs.shared_with_accounts,
+            dependency_names: document_attrs.dependency_names,
+            document_steps: document_attrs.document_steps,
+            estimated_execution_time: document_attrs.estimated_execution_time
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ssm_document/types/attributes.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class SsmDocumentAttributes < Pangea::Resources::BaseAttributes
+          DOCUMENT_TYPES = %w[Command Policy Automation Session Package ApplicationConfiguration ApplicationConfigurationSchema DeploymentStrategy ChangeCalendar Composite ProblemAnalysis ProblemAnalysisTemplate CloudFormation ConformancePackTemplate QuickSetup].freeze
+
+          attribute? :name, Resources::Types::String.optional
+          attribute? :document_type, Resources::Types::String.enum(*DOCUMENT_TYPES).optional
+          attribute? :content, Resources::Types::String.optional
+          attribute :document_format, Resources::Types::String.constrained(included_in: ['YAML', 'JSON']).default('JSON')
+          attribute? :target_type, Resources::Types::String.optional
+          attribute? :schema_version, Resources::Types::String.optional
+          attribute? :version_name, Resources::Types::String.optional
+          attribute :permissions, Resources::Types::Hash.default({ type: 'Private' })
+          attribute :requires, Resources::Types::Array.of(Resources::Types::Hash).default([].freeze)
+          attribute :attachments_source, Resources::Types::Array.of(Resources::Types::Hash).default([].freeze)
+          attribute :tags, Resources::Types::AwsTags.default({}.freeze)
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            validate_content(attrs)
+            validate_name(attrs)
+            validate_target_type(attrs) if attrs.document_type == 'Command'
+            validate_schema_version(attrs) if attrs.schema_version
+            validate_permissions(attrs) if attrs.permissions&.dig(:type) == 'Share'
+            validate_version_name(attrs) if attrs.version_name
+            attrs
+          end
+
+          def self.validate_content(attrs)
+            attrs.document_format == 'JSON' ? ::JSON.parse(attrs.content) : ::YAML.safe_load(attrs.content)
+          rescue ::JSON::ParserError, Psych::SyntaxError => e
+            raise Dry::Struct::Error, "Invalid #{attrs.document_format} content: #{e.message}"
+          end
+
+          def self.validate_name(attrs)
+            raise Dry::Struct::Error, 'Document name must be 3-128 characters and contain only letters, numbers, hyphens, underscores, and periods' unless attrs.name.match?(/\A[a-zA-Z0-9_\-\.]{3,128}\z/)
+          end
+
+          def self.validate_target_type(attrs)
+            valid_targets = ['/AWS::EC2::Instance', '/AWS::IoT::Thing', '/AWS::SSM::ManagedInstance']
+            raise Dry::Struct::Error, "Invalid target_type for Command document. Must be one of: #{valid_targets.join(', ')}" if attrs.target_type && !valid_targets.include?(attrs.target_type)
+          end
+
+          def self.validate_schema_version(attrs)
+            raise Dry::Struct::Error, "Schema version must be in format 'major.minor'" unless attrs.schema_version.match?(/\A\d+\.\d+\z/)
+          end
+
+          def self.validate_permissions(attrs)
+            raise Dry::Struct::Error, 'account_ids is required when sharing document' unless attrs.permissions&.dig(:account_ids)&.any?
+            attrs.permissions&.dig(:account_ids).each do |id|
+              raise Dry::Struct::Error, "Invalid AWS account ID format: #{id}" unless id.match?(/\A\d{12}\z/)
+            end
+          end
+
+          def self.validate_version_name(attrs)
+            raise Dry::Struct::Error, 'Version name must be 1-128 characters' unless attrs.version_name.match?(/\A[a-zA-Z0-9_\-\.]{1,128}\z/)
+          end
+
+          def is_command_document? = document_type == 'Command'
+          def is_automation_document? = document_type == 'Automation'
+          def is_policy_document? = document_type == 'Policy'
+          def is_session_document? = document_type == 'Session'
+          def uses_json_format? = document_format == 'JSON'
+          def uses_yaml_format? = document_format == 'YAML'
+          def has_target_type? = !target_type.nil?
+          def has_schema_version? = !schema_version.nil?
+          def has_version_name? = !version_name.nil?
+          def is_shared? = permissions[:type] == 'Share'
+          def is_private? = permissions[:type] == 'Private'
+          def has_dependencies? = requires.any?
+          def has_attachments? = attachments_source.any?
+          def shared_with_accounts = is_shared? ? (permissions[:account_ids] || []) : []
+          def dependency_names = requires.map { |req| req[:name] }
+
+          def parsed_content
+            uses_json_format? ? ::JSON.parse(content) : ::YAML.safe_load(content)
+          rescue StandardError
+            nil
+          end
+
+          def document_steps
+            parsed = parsed_content
+            return [] unless parsed
+            %w[Command Automation].include?(document_type) ? (parsed.dig('mainSteps') || []) : []
+          end
+
+          def estimated_execution_time
+            steps = document_steps
+            steps.empty? ? 'Unknown' : "~#{steps.count * 2} minutes"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ssm_document/types/configs.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        module SsmDocumentConfigs
+          def self.command_document(name, commands, description: nil)
+            content = { schemaVersion: '2.2', description: description || 'Execute commands on instances',
+                        mainSteps: [{ action: 'aws:runShellScript', name: 'executeCommands',
+                                      inputs: { runCommand: Array(commands) } }] }
+            { name: name, document_type: 'Command', content: ::JSON.pretty_generate(content), document_format: 'JSON', target_type: '/AWS::EC2::Instance' }
+          end
+
+          def self.powershell_command_document(name, commands, description: nil)
+            content = { schemaVersion: '2.2', description: description || 'Execute PowerShell commands on Windows instances',
+                        mainSteps: [{ action: 'aws:runPowerShellScript', name: 'executePowerShell',
+                                      inputs: { runCommand: Array(commands) } }] }
+            { name: name, document_type: 'Command', content: ::JSON.pretty_generate(content), document_format: 'JSON', target_type: '/AWS::EC2::Instance' }
+          end
+
+          def self.automation_document(name, steps, description: nil)
+            content = { schemaVersion: '0.3', description: description || 'Automation document', assumeRole: '{{ AutomationAssumeRole }}',
+                        parameters: { AutomationAssumeRole: { type: 'String', description: 'IAM role for automation execution' } }, mainSteps: steps }
+            { name: name, document_type: 'Automation', content: ::JSON.pretty_generate(content), document_format: 'JSON' }
+          end
+
+          def self.session_document(name, shell_profile: {}, description: nil)
+            content = { schemaVersion: '1.0', description: description || 'Session Manager configuration', sessionType: 'Standard_Stream',
+                        inputs: { s3BucketName: '', s3KeyPrefix: '', s3EncryptionEnabled: true, cloudWatchLogGroupName: '',
+                                  cloudWatchEncryptionEnabled: true, kmsKeyId: '', shellProfile: shell_profile } }
+            { name: name, document_type: 'Session', content: ::JSON.pretty_generate(content), document_format: 'JSON' }
+          end
+
+          def self.package_install_document(name, package_name, version: 'latest', description: nil)
+            content = { schemaVersion: '2.2', description: description || 'Install package on instances',
+                        parameters: { PackageName: { type: 'String', default: package_name, description: 'Name of the package to install' },
+                                      PackageVersion: { type: 'String', default: version, description: 'Version of the package to install' } },
+                        mainSteps: [{ action: 'aws:runShellScript', name: 'installPackage',
+                                      inputs: { runCommand: ['#!/bin/bash', 'if command -v yum &> /dev/null; then', '  yum install -y {{ PackageName }}-{{ PackageVersion }}',
+                                                             'elif command -v apt-get &> /dev/null; then', '  apt-get update && apt-get install -y {{ PackageName }}={{ PackageVersion }}',
+                                                             'else', "  echo 'Package manager not supported'", '  exit 1', 'fi'] } }] }
+            { name: name, document_type: 'Command', content: ::JSON.pretty_generate(content), document_format: 'JSON', target_type: '/AWS::EC2::Instance' }
+          end
+
+          def self.shared_document(name, content, account_ids, version: nil)
+            { name: name, document_type: 'Command', content: content, document_format: 'JSON',
+              permissions: { type: 'Share', account_ids: account_ids, shared_document_version: version } }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ssm_document/types.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require 'pangea/resources/types'
+require_relative 'types/attributes'
+require_relative 'types/configs'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # SsmDocumentAttributes is defined in types/attributes.rb
+        # SsmDocumentConfigs is defined in types/configs.rb
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ssm_document/types.rbs

@@ -0,0 +1,49 @@
+# RBS type definitions for AWS SSM Document types
+
+module Pangea
+  module Resources
+    module AWS
+      class SsmDocumentAttributes < Dry::Struct
+        attr_reader name: String
+        attr_reader document_type: String
+        attr_reader content: String
+        attr_reader document_format: String
+        attr_reader target_type: String?
+        attr_reader schema_version: String?
+        attr_reader version_name: String?
+        attr_reader permissions: Hash[Symbol, untyped]
+        attr_reader requires: Array[Hash[Symbol, untyped]]
+        attr_reader attachments_source: Array[Hash[Symbol, untyped]]
+        attr_reader tags: Hash[Symbol, String]
+        
+        def is_command_document?: () -> bool
+        def is_automation_document?: () -> bool
+        def is_policy_document?: () -> bool
+        def is_session_document?: () -> bool
+        def uses_json_format?: () -> bool
+        def uses_yaml_format?: () -> bool
+        def has_target_type?: () -> bool
+        def has_schema_version?: () -> bool
+        def has_version_name?: () -> bool
+        def is_shared?: () -> bool
+        def is_private?: () -> bool
+        def has_dependencies?: () -> bool
+        def has_attachments?: () -> bool
+        def shared_with_accounts: () -> Array[String]
+        def dependency_names: () -> Array[String]
+        def parsed_content: () -> Hash[String, untyped]?
+        def document_steps: () -> Array[Hash[String, untyped]]
+        def estimated_execution_time: () -> String
+      end
+
+      module SsmDocumentConfigs
+        def self.command_document: (String, (Array[String] | String), ?description: String?) -> Hash[Symbol, untyped]
+        def self.powershell_command_document: (String, (Array[String] | String), ?description: String?) -> Hash[Symbol, untyped]
+        def self.automation_document: (String, Array[Hash[Symbol, untyped]], ?description: String?) -> Hash[Symbol, untyped]
+        def self.session_document: (String, ?shell_profile: Hash[Symbol, untyped], ?description: String?) -> Hash[Symbol, untyped]
+        def self.package_install_document: (String, String, ?version: String, ?description: String?) -> Hash[Symbol, untyped]
+        def self.shared_document: (String, String, Array[String], ?version: String?) -> Hash[Symbol, untyped]
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ssm_maintenance_window/resource.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_ssm_maintenance_window/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS Systems Manager Maintenance Window with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] SSM maintenance window attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_ssm_maintenance_window(name, attributes = {})
+        # Validate attributes using dry-struct
+        window_attrs = Types::SsmMaintenanceWindowAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_ssm_maintenance_window, name) do
+          maintenance_window_name window_attrs.name
+          schedule window_attrs.schedule
+          duration window_attrs.duration
+          cutoff window_attrs.cutoff
+          allow_unassociated_targets window_attrs.allow_unassociated_targets
+          enabled window_attrs.enabled
+
+          # Optional date range
+          if window_attrs.start_date
+            start_date window_attrs.start_date
+          end
+
+          if window_attrs.end_date
+            end_date window_attrs.end_date
+          end
+
+          # Schedule configuration
+          if window_attrs.schedule_timezone
+            schedule_timezone window_attrs.schedule_timezone
+          end
+
+          if window_attrs.schedule_offset
+            schedule_offset window_attrs.schedule_offset
+          end
+
+          # Description
+          if window_attrs.description
+            description window_attrs.description
+          end
+
+          # Apply tags if present
+          if window_attrs.tags&.any?
+            tags do
+              window_attrs.tags.each do |key, value|
+                public_send(key, value)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_ssm_maintenance_window',
+          name: name,
+          resource_attributes: window_attrs.to_h,
+          outputs: {
+            id: "${aws_ssm_maintenance_window.#{name}.id}",
+            name: "${aws_ssm_maintenance_window.#{name}.name}",
+            arn: "${aws_ssm_maintenance_window.#{name}.arn}",
+            created_date: "${aws_ssm_maintenance_window.#{name}.created_date}",
+            modified_date: "${aws_ssm_maintenance_window.#{name}.modified_date}",
+            enabled: "${aws_ssm_maintenance_window.#{name}.enabled}",
+            schedule: "${aws_ssm_maintenance_window.#{name}.schedule}",
+            schedule_timezone: "${aws_ssm_maintenance_window.#{name}.schedule_timezone}",
+            duration: "${aws_ssm_maintenance_window.#{name}.duration}",
+            cutoff: "${aws_ssm_maintenance_window.#{name}.cutoff}",
+            description: "${aws_ssm_maintenance_window.#{name}.description}",
+            tags_all: "${aws_ssm_maintenance_window.#{name}.tags_all}"
+          },
+          computed_properties: {
+            is_enabled: window_attrs.is_enabled?,
+            is_disabled: window_attrs.is_disabled?,
+            uses_cron_schedule: window_attrs.uses_cron_schedule?,
+            uses_rate_schedule: window_attrs.uses_rate_schedule?,
+            has_start_date: window_attrs.has_start_date?,
+            has_end_date: window_attrs.has_end_date?,
+            has_timezone: window_attrs.has_timezone?,
+            has_schedule_offset: window_attrs.has_schedule_offset?,
+            has_description: window_attrs.has_description?,
+            allows_unassociated_targets: window_attrs.allows_unassociated_targets?,
+            duration_hours: window_attrs.duration_hours,
+            cutoff_hours: window_attrs.cutoff_hours,
+            effective_execution_time_hours: window_attrs.effective_execution_time_hours,
+            schedule_type: window_attrs.schedule_type,
+            parsed_schedule_info: window_attrs.parsed_schedule_info,
+            estimated_monthly_executions: window_attrs.estimated_monthly_executions
+          }
+        )
+      end
+    end
+  end
+end