pangea-aws 0.1.0

data/lib/pangea/resources/aws_cloudwatch_insight_rule/resource.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+
+module Pangea
+  module Resources
+    module AWS
+      # Type-safe resource function for AWS CloudWatch Insight Rule
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] Resource attributes following AWS provider schema
+      # @return [Pangea::Resources::Reference] Resource reference for chaining
+      # 
+      # @see https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_insight_rule
+      #
+      # @example Application performance insight rule
+      #   aws_cloudwatch_insight_rule(:app_performance, {
+      #     name: "ApplicationPerformanceInsights",
+      #     rule_definition: jsonencode({
+      #       "Rules": [
+      #         {
+      #           "RuleName": "ApplicationLatency",
+      #           "RuleState": "ENABLED",
+      #           "Schema": "AWS/ApplicationELB",
+      #           "Fields": {
+      #             "TargetResponseTime": "TargetResponseTime"
+      #           }
+      #         }
+      #       ]
+      #     }),
+      #     rule_state: "ENABLED"
+      #   })
+      #
+      # @example Custom metric insight rule
+      #   aws_cloudwatch_insight_rule(:custom_insights, {
+      #     name: "CustomMetricInsights",
+      #     rule_definition: rule_definition_ref.json,
+      #     rule_state: "ENABLED",
+      #     tags: {
+      #       Environment: "production",
+      #       Team: "platform"
+      #     }
+      #   })
+      def aws_cloudwatch_insight_rule(name, attributes)
+        transformed = Base.transform_attributes(attributes, {
+          name: {
+            description: "Name of the insight rule",
+            type: :string,
+            required: true
+          },
+          rule_definition: {
+            description: "JSON definition of the insight rule",
+            type: :string,
+            required: true
+          },
+          rule_state: {
+            description: "State of the insight rule (ENABLED or DISABLED)",
+            type: :string,
+            default: "ENABLED"
+          },
+          tags: {
+            description: "Resource tags",
+            type: :map
+          }
+        })
+
+        resource_block = resource(:aws_cloudwatch_insight_rule, name, transformed)
+        
+        Reference.new(
+          type: :aws_cloudwatch_insight_rule,
+          name: name,
+          attributes: {
+            arn: "#{resource_block}.arn",
+            id: "#{resource_block}.id",
+            name: "#{resource_block}.name",
+            tags_all: "#{resource_block}.tags_all"
+          },
+          resource: resource_block
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudwatch_log_data_protection_policy/resource.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+
+module Pangea
+  module Resources
+    module AWS
+      # Type-safe resource function for AWS CloudWatch Log Data Protection Policy
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] Resource attributes following AWS provider schema
+      # @return [Pangea::Resources::Reference] Resource reference for chaining
+      # 
+      # @see https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_data_protection_policy
+      #
+      # @example PII detection and redaction policy
+      #   aws_cloudwatch_log_data_protection_policy(:pii_protection, {
+      #     log_group_name: log_group.name,
+      #     policy_document: jsonencode({
+      #       "Name": "PIIDetectionPolicy",
+      #       "Description": "Detect and redact PII data",
+      #       "Version": "2021-06-01",
+      #       "Statement": [
+      #         {
+      #           "Sid": "DetectPII",
+      #           "DataIdentifier": [
+      #             "arn:aws:dataprotection::aws:data-identifier/EmailAddress",
+      #             "arn:aws:dataprotection::aws:data-identifier/CreditCardNumber"
+      #           ],
+      #           "Operation": {
+      #             "Audit": {
+      #               "FindingsDestination": {
+      #                 "CloudWatchLogs": {
+      #                   "LogGroup": audit_log_group.name
+      #                 }
+      #               }
+      #             },
+      #             "Deidentify": {
+      #               "MaskConfig": {}
+      #             }
+      #           }
+      #         }
+      #       ]
+      #     })
+      #   })
+      #
+      # @example Custom data identifier protection
+      #   aws_cloudwatch_log_data_protection_policy(:custom_protection, {
+      #     log_group_name: "/aws/apigateway/access-logs",
+      #     policy_document: protection_policy_ref.json
+      #   })
+      def aws_cloudwatch_log_data_protection_policy(name, attributes)
+        transformed = Base.transform_attributes(attributes, {
+          log_group_name: {
+            description: "Name of the log group to apply policy to",
+            type: :string,
+            required: true
+          },
+          policy_document: {
+            description: "JSON policy document defining data protection rules",
+            type: :string,
+            required: true
+          }
+        })
+
+        resource_block = resource(:aws_cloudwatch_log_data_protection_policy, name, transformed)
+        
+        Reference.new(
+          type: :aws_cloudwatch_log_data_protection_policy,
+          name: name,
+          attributes: {
+            id: "#{resource_block}.id",
+            log_group_name: "#{resource_block}.log_group_name",
+            policy_document: "#{resource_block}.policy_document"
+          },
+          resource: resource_block
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudwatch_log_destination/resource.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_cloudwatch_log_destination/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS CloudWatch Log Destination with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] CloudWatch Log Destination attributes
+      # @option attributes [String] :name The name of the destination
+      # @option attributes [String] :role_arn IAM role ARN for the destination
+      # @option attributes [String] :target_arn ARN of the target AWS resource
+      # @option attributes [Hash] :tags Tags to apply to the destination
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      #
+      # @example Basic log destination for Kinesis
+      #   destination = aws_cloudwatch_log_destination(:central_logs, {
+      #     name: "central-log-aggregation",
+      #     role_arn: iam_role.arn,
+      #     target_arn: kinesis_stream.arn
+      #   })
+      #
+      # @example Cross-account log destination
+      #   destination = aws_cloudwatch_log_destination(:cross_account_logs, {
+      #     name: "cross-account-log-destination",
+      #     role_arn: ref(:aws_iam_role, :log_destination_role, :arn),
+      #     target_arn: ref(:aws_kinesis_stream, :central_log_stream, :arn),
+      #     tags: {
+      #       Purpose: "cross-account-aggregation",
+      #       ManagedBy: "platform-team"
+      #     }
+      #   })
+      #
+      # @example Multi-region log aggregation
+      #   destination = aws_cloudwatch_log_destination(:multi_region_logs, {
+      #     name: "multi-region-aggregation-destination",
+      #     role_arn: cross_region_role.arn,
+      #     target_arn: "arn:aws:kinesis:us-east-1:123456789012:stream/central-logs"
+      #   })
+      def aws_cloudwatch_log_destination(name, attributes = {})
+        # Validate attributes using dry-struct
+        destination_attrs = Types::CloudWatchLogDestinationAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_cloudwatch_logs_destination, name) do
+          name destination_attrs.name
+          role_arn destination_attrs.role_arn
+          target_arn destination_attrs.target_arn
+          
+          # Apply tags if present
+          if destination_attrs.tags&.any?
+            tags do
+              destination_attrs.tags.each do |key, value|
+                public_send(key, value)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_cloudwatch_logs_destination',
+          name: name,
+          resource_attributes: destination_attrs.to_h,
+          outputs: {
+            arn: "${aws_cloudwatch_logs_destination.#{name}.arn}",
+            name: "${aws_cloudwatch_logs_destination.#{name}.name}",
+            role_arn: "${aws_cloudwatch_logs_destination.#{name}.role_arn}",
+            target_arn: "${aws_cloudwatch_logs_destination.#{name}.target_arn}"
+          },
+          computed_properties: {
+            cross_account_capable: destination_attrs.cross_account_capable?,
+            target_service: destination_attrs.target_service,
+            region: destination_attrs.region,
+            account_id: destination_attrs.account_id
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudwatch_log_destination/types.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # CloudWatch Log Destination resource attributes with validation
+        class CloudWatchLogDestinationAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          # Required attributes
+          attribute? :name, Resources::Types::String.optional
+          attribute? :role_arn, Resources::Types::String.optional
+          attribute? :target_arn, Resources::Types::String.optional
+          
+          # Optional attributes
+          attribute? :tags, Resources::Types::AwsTags.optional
+          
+          # Validate ARN formats
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+            
+            # Validate role_arn format
+            if attrs[:role_arn] && !attrs[:role_arn].match?(/^arn:aws[a-z\-]*:iam::\d{12}:role\//)
+              raise Dry::Struct::Error, "role_arn must be a valid IAM role ARN"
+            end
+            
+            # Validate target_arn format (Kinesis stream)
+            if attrs[:target_arn] && !attrs[:target_arn].match?(/^arn:aws[a-z\-]*:kinesis:/)
+              raise Dry::Struct::Error, "target_arn must be a valid Kinesis stream ARN"
+            end
+            
+            # Validate name format (alphanumeric, hyphens, underscores, periods)
+            if attrs[:name] && !attrs[:name].match?(/^[\w\-\.]+$/)
+              raise Dry::Struct::Error, "name must contain only alphanumeric characters, hyphens, underscores, and periods"
+            end
+            
+            super(attrs)
+          end
+          
+          # Computed properties
+          def cross_account_capable?
+            true # Log destinations are designed for cross-account access
+          end
+          
+          def target_service
+            return nil unless target_arn
+            
+            if target_arn.include?(':kinesis:')
+              :kinesis
+            elsif target_arn.include?(':firehose:')
+              :firehose
+            elsif target_arn.include?(':lambda:')
+              :lambda
+            else
+              :unknown
+            end
+          end
+          
+          def region
+            return nil unless target_arn
+            parts = target_arn.split(':')
+            parts[3] if parts.length > 3
+          end
+          
+          def account_id
+            return nil unless role_arn
+            parts = role_arn.split(':')
+            parts[4] if parts.length > 4
+          end
+          
+          def to_h
+            hash = {
+              name: name,
+              role_arn: role_arn,
+              target_arn: target_arn,
+              tags: tags
+            }
+            
+            hash.compact
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudwatch_log_destination_policy/resource.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_cloudwatch_log_destination_policy/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS CloudWatch Log Destination Policy with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] CloudWatch Log Destination Policy attributes
+      # @option attributes [String] :destination_name The name of the destination
+      # @option attributes [String] :access_policy JSON policy document for access control
+      # @option attributes [Boolean] :force_update Force policy update even if it exists
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      #
+      # @example Allow specific account access
+      #   policy = aws_cloudwatch_log_destination_policy(:account_access, {
+      #     destination_name: destination.name,
+      #     access_policy: jsonencode({
+      #       Version: "2012-10-17",
+      #       Statement: [{
+      #         Effect: "Allow",
+      #         Principal: { AWS: "arn:aws:iam::123456789012:root" },
+      #         Action: "logs:PutSubscriptionFilter",
+      #         Resource: destination.arn
+      #       }]
+      #     })
+      #   })
+      #
+      # @example Allow organization-wide access
+      #   policy = aws_cloudwatch_log_destination_policy(:org_access, {
+      #     destination_name: "organization-log-destination",
+      #     access_policy: jsonencode({
+      #       Version: "2012-10-17",
+      #       Statement: [{
+      #         Effect: "Allow",
+      #         Principal: "*",
+      #         Action: "logs:PutSubscriptionFilter",
+      #         Resource: destination.arn,
+      #         Condition: {
+      #           StringEquals: {
+      #             "aws:PrincipalOrgID": organization.id
+      #           }
+      #         }
+      #       }]
+      #     })
+      #   })
+      #
+      # @example Multi-account access with conditions
+      #   policy = aws_cloudwatch_log_destination_policy(:multi_account, {
+      #     destination_name: log_destination.name,
+      #     access_policy: jsonencode({
+      #       Version: "2012-10-17",
+      #       Statement: [
+      #         {
+      #           Sid: "AllowProductionAccounts",
+      #           Effect: "Allow",
+      #           Principal: { 
+      #             AWS: [
+      #               "arn:aws:iam::111111111111:root",
+      #               "arn:aws:iam::222222222222:root"
+      #             ]
+      #           },
+      #           Action: "logs:PutSubscriptionFilter",
+      #           Resource: destination.arn
+      #         },
+      #         {
+      #           Sid: "DenyTestAccounts",
+      #           Effect: "Deny",
+      #           Principal: { AWS: "arn:aws:iam::999999999999:root" },
+      #           Action: "logs:PutSubscriptionFilter",
+      #           Resource: destination.arn
+      #         }
+      #       ]
+      #     }),
+      #     force_update: true
+      #   })
+      def aws_cloudwatch_log_destination_policy(name, attributes = {})
+        # Validate attributes using dry-struct
+        policy_attrs = Types::CloudWatchLogDestinationPolicyAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_cloudwatch_logs_destination_policy, name) do
+          destination_name policy_attrs.destination_name
+          access_policy policy_attrs.access_policy
+          force_update policy_attrs.force_update if policy_attrs.force_update
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_cloudwatch_logs_destination_policy',
+          name: name,
+          resource_attributes: policy_attrs.to_h,
+          outputs: {
+            id: "${aws_cloudwatch_logs_destination_policy.#{name}.id}",
+            destination_name: "${aws_cloudwatch_logs_destination_policy.#{name}.destination_name}",
+            access_policy: "${aws_cloudwatch_logs_destination_policy.#{name}.access_policy}"
+          },
+          computed_properties: {
+            policy_statements: policy_attrs.policy_statements,
+            allowed_principals: policy_attrs.allowed_principals,
+            denied_principals: policy_attrs.denied_principals,
+            allows_organization: policy_attrs.allows_organization?,
+            allows_all_accounts: policy_attrs.allows_all_accounts?,
+            allowed_account_ids: policy_attrs.allowed_account_ids
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudwatch_log_destination_policy/types.rb

@@ -0,0 +1,129 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+require 'json'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # CloudWatch Log Destination Policy resource attributes with validation
+        class CloudWatchLogDestinationPolicyAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          # Required attributes
+          attribute? :destination_name, Resources::Types::String.optional
+          attribute? :access_policy, Resources::Types::String.optional
+          attribute :force_update, Resources::Types::Bool.default(false)
+          
+          # Validate policy JSON and structure
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+            
+            # Validate destination_name format
+            if attrs[:destination_name] && !attrs[:destination_name].match?(/^[\w\-\.]+$/)
+              raise Dry::Struct::Error, "destination_name must contain only alphanumeric characters, hyphens, underscores, and periods"
+            end
+            
+            # Validate access_policy is valid JSON
+            if attrs[:access_policy]
+              begin
+                policy = ::JSON.parse(attrs[:access_policy])
+                
+                # Validate policy structure
+                unless policy.is_a?(::Hash) && policy['Statement'].is_a?(Array)
+                  raise Dry::Struct::Error, "access_policy must be a valid IAM policy document with Statement array"
+                end
+                
+                # Validate each statement
+                policy['Statement'].each_with_index do |statement, idx|
+                  unless statement['Effect'] && statement['Action'] && statement['Resource']
+                    raise Dry::Struct::Error, "Statement #{idx} must have Effect, Action, and Resource"
+                  end
+                  
+                  # Validate Effect
+                  unless %w[Allow Deny].include?(statement['Effect'])
+                    raise Dry::Struct::Error, "Statement #{idx} Effect must be 'Allow' or 'Deny'"
+                  end
+                  
+                  # Validate Action for log destinations
+                  actions = Array(statement['Action'])
+                  valid_actions = ['logs:PutSubscriptionFilter', 'logs:DeleteSubscriptionFilter']
+                  unless actions.all? { |a| valid_actions.include?(a) || a == 'logs:*' }
+                    raise Dry::Struct::Error, "Statement #{idx} contains invalid actions for log destination"
+                  end
+                end
+              rescue ::JSON::ParserError => e
+                raise Dry::Struct::Error, "access_policy must be valid JSON: #{e.message}"
+              end
+            end
+            
+            super(attrs)
+          end
+          
+          # Computed properties
+          def policy_statements
+            policy = ::JSON.parse(access_policy)
+            policy['Statement'] || []
+          rescue ::JSON::ParserError
+            []
+          end
+          
+          def allowed_principals
+            policy_statements.select { |s| s['Effect'] == 'Allow' }
+                           .flat_map { |s| Array(s['Principal']).values }
+                           .flatten
+                           .uniq
+          end
+          
+          def denied_principals
+            policy_statements.select { |s| s['Effect'] == 'Deny' }
+                           .flat_map { |s| Array(s['Principal']).values }
+                           .flatten
+                           .uniq
+          end
+          
+          def allows_organization?
+            policy_statements.any? do |statement|
+              statement['Condition'] &&
+              statement['Condition']['StringEquals'] &&
+              statement['Condition']['StringEquals']['aws:PrincipalOrgID']
+            end
+          end
+          
+          def allows_all_accounts?
+            allowed_principals.include?('*')
+          end
+          
+          def allowed_account_ids
+            allowed_principals.select { |p| p.match?(/^arn:aws:iam::\d{12}:root$/) }
+                             .map { |arn| arn.split(':')[4] }
+                             .uniq
+          end
+          
+          def to_h
+            {
+              destination_name: destination_name,
+              access_policy: access_policy,
+              force_update: force_update
+            }
+          end
+        end
+      end
+    end
+  end
+end