pangea-aws 0.1.0

data/lib/pangea/resources/aws_cloudwatch_log_group/resource.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_cloudwatch_log_group/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS CloudWatch Log Group with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] CloudWatch Log Group attributes
+      # @option attributes [String] :name The name of the log group
+      # @option attributes [Integer] :retention_in_days How long to keep log events in the log group
+      # @option attributes [String] :kms_key_id The ARN of the KMS key to use for encryption
+      # @option attributes [String] :log_group_class The log class of the log group
+      # @option attributes [Boolean] :skip_destroy Set to true if you do not wish the log group to be deleted at destroy time
+      # @option attributes [Hash] :tags A map of tags to assign to the resource
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      #
+      # @example Basic log group
+      #   log_group = aws_cloudwatch_log_group(:app_logs, {
+      #     name: "/aws/lambda/my-function",
+      #     retention_in_days: 14,
+      #     tags: {
+      #       Environment: "production",
+      #       Application: "web-app"
+      #     }
+      #   })
+      #
+      # @example Encrypted log group with Infrequent Access class
+      #   log_group = aws_cloudwatch_log_group(:audit_logs, {
+      #     name: "/audit/application-logs",
+      #     retention_in_days: 365,
+      #     kms_key_id: kms_key.arn,
+      #     log_group_class: "INFREQUENT_ACCESS",
+      #     tags: {
+      #       Environment: "production",
+      #       Type: "audit",
+      #       Compliance: "required"
+      #     }
+      #   })
+      #
+      # @example Application log group with custom retention
+      #   log_group = aws_cloudwatch_log_group(:api_logs, {
+      #     name: "/application/api/access",
+      #     retention_in_days: 30,
+      #     tags: {
+      #       Service: "api",
+      #       LogType: "access"
+      #     }
+      #   })
+      def aws_cloudwatch_log_group(name, attributes = {})
+        # Validate attributes using dry-struct
+        log_group_attrs = Types::CloudWatchLogGroupAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_cloudwatch_log_group, name) do
+          name log_group_attrs.name
+          retention_in_days log_group_attrs.retention_in_days if log_group_attrs.retention_in_days
+          kms_key_id log_group_attrs.kms_key_id if log_group_attrs.kms_key_id
+          log_group_class log_group_attrs.log_group_class if log_group_attrs.log_group_class
+          skip_destroy log_group_attrs.skip_destroy
+          
+          # Apply tags if present
+          if log_group_attrs.tags&.any?
+            tags do
+              log_group_attrs.tags.each do |key, value|
+                public_send(key, value)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ref = ResourceReference.new(
+          type: 'aws_cloudwatch_log_group',
+          name: name,
+          resource_attributes: log_group_attrs.to_h,
+          outputs: {
+            id: "${aws_cloudwatch_log_group.#{name}.id}",
+            arn: "${aws_cloudwatch_log_group.#{name}.arn}",
+            name: "${aws_cloudwatch_log_group.#{name}.name}",
+            retention_in_days: "${aws_cloudwatch_log_group.#{name}.retention_in_days}",
+            kms_key_id: "${aws_cloudwatch_log_group.#{name}.kms_key_id}",
+            log_group_class: "${aws_cloudwatch_log_group.#{name}.log_group_class}",
+            tags_all: "${aws_cloudwatch_log_group.#{name}.tags_all}"
+          }
+        )
+        
+        # Add computed properties via method delegation
+        ref.define_singleton_method(:has_retention?) { log_group_attrs.has_retention? }
+        ref.define_singleton_method(:has_encryption?) { log_group_attrs.has_encryption? }
+        ref.define_singleton_method(:is_infrequent_access?) { log_group_attrs.is_infrequent_access? }
+        ref.define_singleton_method(:estimated_monthly_cost_usd) { log_group_attrs.estimated_monthly_cost_usd }
+        
+        ref
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudwatch_log_group/types.rb

@@ -0,0 +1,137 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # CloudWatch Log Group resource attributes with validation
+        class CloudWatchLogGroupAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          # Required attributes
+          attribute? :name, Pangea::Resources::Types::String.optional
+          
+          # Optional attributes
+          attribute :retention_in_days?, Pangea::Resources::Types::Integer.optional.default(nil).constrained(
+            included_in: [1, 3, 5, 7, 14, 30, 60, 90, 120, 150, 180, 365, 400, 545, 731, 1827, 3653]
+          )
+          attribute :kms_key_id?, Pangea::Resources::Types::String.optional
+          attribute :log_group_class?, Pangea::Resources::Types::String.optional.default(nil).constrained(
+            included_in: ['STANDARD', 'INFREQUENT_ACCESS']
+          )
+          attribute :skip_destroy?, Pangea::Resources::Types::Bool.optional.default(false)
+          
+          # Tags
+          attribute :tags?, Pangea::Resources::Types::AwsTags.optional.default(proc { {} }.freeze)
+          
+          # Validate log group name pattern
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+            
+            if attrs[:name]
+              # CloudWatch log group name validation
+              name = attrs[:name]
+              
+              # Must not be empty
+              if name.empty?
+                raise Dry::Struct::Error, "Log group name cannot be empty"
+              end
+              
+              # Length constraints
+              if name.length > 512
+                raise Dry::Struct::Error, "Log group name cannot exceed 512 characters"
+              end
+              
+              # Character validation - allows letters, numbers, periods, underscores, hyphens, and forward slashes
+              unless name.match?(/\A[a-zA-Z0-9._\-\/]+\z/)
+                raise Dry::Struct::Error, "Log group name can only contain alphanumeric characters, periods, underscores, hyphens, and forward slashes"
+              end
+              
+              # Cannot start with aws/ (reserved for AWS services)
+              if name.start_with?('aws/')
+                raise Dry::Struct::Error, "Log group name cannot start with 'aws/' as it's reserved for AWS services"
+              end
+              
+              # Must not end with a forward slash unless it's a single slash
+              if name.length > 1 && name.end_with?('/')
+                raise Dry::Struct::Error, "Log group name cannot end with a forward slash"
+              end
+              
+              # Cannot contain consecutive forward slashes
+              if name.include?('//')
+                raise Dry::Struct::Error, "Log group name cannot contain consecutive forward slashes"
+              end
+            end
+            
+            super(attrs)
+          end
+          
+          # Computed properties
+          def has_retention?
+            !retention_in_days.nil?
+          end
+          
+          def has_encryption?
+            !kms_key_id.nil?
+          end
+          
+          def is_infrequent_access?
+            log_group_class == 'INFREQUENT_ACCESS'
+          end
+          
+          def estimated_monthly_cost_usd
+            # Base cost estimation for CloudWatch Logs
+            base_gb_per_month = 10.0 # Assume 10GB ingestion per month
+            
+            case log_group_class
+            when 'INFREQUENT_ACCESS'
+              # IA class: lower ingestion cost, higher query cost
+              ingestion_cost = base_gb_per_month * 0.25 # $0.25 per GB for IA
+              storage_cost = base_gb_per_month * 0.013  # $0.013 per GB/month for IA storage
+            else
+              # Standard class
+              ingestion_cost = base_gb_per_month * 0.50 # $0.50 per GB for standard
+              storage_cost = base_gb_per_month * 0.025  # $0.025 per GB/month for standard storage
+            end
+            
+            # Add KMS encryption cost if enabled
+            encryption_cost = has_encryption? ? 1.00 : 0.0 # $1 per month for KMS usage
+            
+            total_cost = ingestion_cost + storage_cost + encryption_cost
+            total_cost.round(2)
+          end
+          
+          def to_h
+            hash = {
+              name: name,
+              skip_destroy: skip_destroy,
+              tags: tags
+            }
+            
+            hash[:retention_in_days] = retention_in_days if retention_in_days
+            hash[:kms_key_id] = kms_key_id if kms_key_id
+            hash[:log_group_class] = log_group_class if log_group_class
+            
+            hash.compact
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudwatch_log_metric_filter/resource.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_cloudwatch_log_metric_filter/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS CloudWatch Log Metric Filter with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] CloudWatch Log Metric Filter attributes
+      # @option attributes [String] :name The name of the metric filter
+      # @option attributes [String] :log_group_name The log group to associate the filter with
+      # @option attributes [String] :pattern The filter pattern
+      # @option attributes [Hash] :metric_transformation The metric transformation configuration
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      #
+      # @example Count error occurrences
+      #   error_filter = aws_cloudwatch_log_metric_filter(:error_counter, {
+      #     name: "application-errors",
+      #     log_group_name: app_log_group.name,
+      #     pattern: "[time, request_id, event_type=ERROR, ...]",
+      #     metric_transformation: {
+      #       name: "ErrorCount",
+      #       namespace: "Application/Metrics",
+      #       value: "1",
+      #       default_value: 0
+      #     }
+      #   })
+      #
+      # @example Extract numeric values from logs
+      #   latency_filter = aws_cloudwatch_log_metric_filter(:latency_tracker, {
+      #     name: "api-latency",
+      #     log_group_name: "/aws/lambda/api-handler",
+      #     pattern: "[time, request_id, latency_ms, ...]",
+      #     metric_transformation: {
+      #       name: "APILatency",
+      #       namespace: "API/Performance",
+      #       value: "$latency_ms",
+      #       unit: "Milliseconds"
+      #     }
+      #   })
+      #
+      # @example JSON log parsing with dimensions
+      #   json_filter = aws_cloudwatch_log_metric_filter(:json_metrics, {
+      #     name: "user-activity-metrics",
+      #     log_group_name: ref(:aws_cloudwatch_log_group, :app_logs, :name),
+      #     pattern: '{ $.eventType = "USER_ACTION" }',
+      #     metric_transformation: {
+      #       name: "UserActions",
+      #       namespace: "Application/UserActivity",
+      #       value: "1",
+      #       default_value: 0,
+      #       dimensions: {
+      #         ActionType: "$.actionType",
+      #         UserRole: "$.userRole"
+      #       }
+      #     }
+      #   })
+      def aws_cloudwatch_log_metric_filter(name, attributes = {})
+        # Validate attributes using dry-struct
+        filter_attrs = Types::CloudWatchLogMetricFilterAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_cloudwatch_log_metric_filter, name) do
+          name filter_attrs.name
+          log_group_name filter_attrs.log_group_name
+          pattern filter_attrs.pattern
+          
+          # Metric transformation block
+          metric_transformation do
+            name filter_attrs.metric_transformation.name
+            namespace filter_attrs.metric_transformation.namespace
+            value filter_attrs.metric_transformation.value
+            
+            # Optional transformation attributes
+            default_value filter_attrs.metric_transformation.default_value if filter_attrs.metric_transformation.default_value
+            unit filter_attrs.metric_transformation.unit if filter_attrs.metric_transformation.unit
+            
+            # Dimensions if present
+            if filter_attrs.metric_transformation.dimensions.any?
+              dimensions filter_attrs.metric_transformation.dimensions
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_cloudwatch_log_metric_filter',
+          name: name,
+          resource_attributes: filter_attrs.to_h,
+          outputs: {
+            id: "${aws_cloudwatch_log_metric_filter.#{name}.id}",
+            name: "${aws_cloudwatch_log_metric_filter.#{name}.name}",
+            log_group_name: "${aws_cloudwatch_log_metric_filter.#{name}.log_group_name}",
+            pattern: "${aws_cloudwatch_log_metric_filter.#{name}.pattern}"
+          },
+          computed_properties: {
+            pattern_type: filter_attrs.pattern_type,
+            extracts_numeric_value: filter_attrs.extracts_numeric_value?,
+            has_dimensions: filter_attrs.has_dimensions?,
+            has_default_value: filter_attrs.has_default_value?,
+            metric_namespace: filter_attrs.metric_namespace,
+            metric_name: filter_attrs.metric_name
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudwatch_log_metric_filter/types.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Metric transformation configuration
+        class MetricTransformation < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          attribute? :name, Resources::Types::String.optional
+          attribute? :namespace, Resources::Types::String.optional
+          attribute? :value, Resources::Types::String.optional
+          attribute :default_value, Resources::Types::Float.optional.default(nil)
+          attribute :dimensions, Resources::Types::Hash.default({}.freeze)
+          attribute :unit, Resources::Types::String.optional.default(nil).enum(
+            'None', 'Seconds', 'Microseconds', 'Milliseconds', 'Bytes', 'Kilobytes', 
+            'Megabytes', 'Gigabytes', 'Terabytes', 'Bits', 'Kilobits', 'Megabits', 
+            'Gigabits', 'Terabits', 'Percent', 'Count', 'Bytes/Second', 
+            'Kilobytes/Second', 'Megabytes/Second', 'Gigabytes/Second', 
+            'Terabytes/Second', 'Bits/Second', 'Kilobits/Second', 'Megabits/Second', 
+            'Gigabits/Second', 'Terabits/Second', 'Count/Second', nil
+          )
+          
+          def to_h
+            hash = {
+              name: name,
+              namespace: namespace,
+              value: value
+            }
+            
+            hash[:default_value] = default_value if default_value
+            hash[:dimensions] = dimensions if dimensions.any?
+            hash[:unit] = unit if unit
+            
+            hash.compact
+          end
+        end
+        
+        # CloudWatch Log Metric Filter resource attributes with validation
+        class CloudWatchLogMetricFilterAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          # Required attributes
+          attribute? :name, Resources::Types::String.optional
+          attribute? :log_group_name, Resources::Types::String.optional
+          attribute? :pattern, Resources::Types::String.optional
+          attribute? :metric_transformation, MetricTransformation.optional
+          
+          # Validate filter pattern and metric configuration
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+            
+            # Validate name format
+            if attrs[:name] && !attrs[:name].match?(/^[\.\-_#A-Za-z0-9]+$/)
+              raise Dry::Struct::Error, "name must contain only alphanumeric characters, periods, hyphens, underscores, and hash"
+            end
+            
+            # Validate pattern is not empty
+            if attrs[:pattern] && attrs[:pattern].strip.empty?
+              raise Dry::Struct::Error, "pattern cannot be empty"
+            end
+            
+            # Convert metric_transformation to MetricTransformation if needed
+            if attrs[:metric_transformation] && !attrs[:metric_transformation].is_a?(MetricTransformation)
+              attrs[:metric_transformation] = MetricTransformation.new(attrs[:metric_transformation])
+            end
+            
+            # Validate metric value syntax
+            if attrs[:metric_transformation]
+              value = attrs[:metric_transformation][:value] || attrs[:metric_transformation].value
+              if value && !value.match?(/^\$?[\w\.\[\]]+$/)
+                raise Dry::Struct::Error, "metric_transformation.value must be a valid metric value expression"
+              end
+            end
+            
+            super(attrs)
+          end
+          
+          # Computed properties
+          def pattern_type
+            case pattern
+            when /^\[/ then :space_delimited
+            when /\{.*\}/ then :json
+            when /\w+\s*=\s*/ then :key_value
+            else :text
+            end
+          end
+          
+          def extracts_numeric_value?
+            metric_transformation.value.start_with?('$')
+          end
+          
+          def has_dimensions?
+            metric_transformation.dimensions.any?
+          end
+          
+          def has_default_value?
+            !metric_transformation.default_value.nil?
+          end
+          
+          def metric_namespace
+            metric_transformation.namespace
+          end
+          
+          def metric_name
+            metric_transformation.name
+          end
+          
+          def to_h
+            {
+              name: name,
+              log_group_name: log_group_name,
+              pattern: pattern,
+              metric_transformation: metric_transformation.to_h
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudwatch_log_resource_policy/resource.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+
+module Pangea
+  module Resources
+    module AWS
+      # Type-safe resource function for AWS CloudWatch Log Resource Policy
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] Resource attributes following AWS provider schema
+      # @return [Pangea::Resources::Reference] Resource reference for chaining
+      # 
+      # @see https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_resource_policy
+      #
+      # @example Basic log resource policy for cross-service access
+      #   aws_cloudwatch_log_resource_policy(:api_gateway_policy, {
+      #     policy_name: "ApiGatewayLogsResourcePolicy",
+      #     policy_document: jsonencode({
+      #       Version: "2012-10-17",
+      #       Statement: [{
+      #         Effect: "Allow",
+      #         Principal: { Service: "apigateway.amazonaws.com" },
+      #         Action: "logs:CreateLogStream",
+      #         Resource: "arn:aws:logs:*:*:*"
+      #       }]
+      #     })
+      #   })
+      #
+      # @example Route53 resolver query logging policy
+      #   aws_cloudwatch_log_resource_policy(:route53_resolver, {
+      #     policy_name: "Route53ResolverQueryLogging",
+      #     policy_document: policy_doc_ref.json
+      #   })
+      def aws_cloudwatch_log_resource_policy(name, attributes)
+        transformed = Base.transform_attributes(attributes, {
+          policy_name: {
+            description: "Name of the resource policy",
+            type: :string,
+            required: true
+          },
+          policy_document: {
+            description: "JSON policy document specifying permissions",
+            type: :string,
+            required: true
+          }
+        })
+
+        resource_block = resource(:aws_cloudwatch_log_resource_policy, name, transformed)
+        
+        Reference.new(
+          type: :aws_cloudwatch_log_resource_policy,
+          name: name,
+          attributes: {
+            id: "#{resource_block}.id",
+            policy_name: "#{resource_block}.policy_name",
+            policy_document: "#{resource_block}.policy_document"
+          },
+          resource: resource_block
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_cloudwatch_log_stream/resource.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_cloudwatch_log_stream/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS CloudWatch Log Stream with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] CloudWatch Log Stream attributes
+      # @option attributes [String] :name The name of the log stream
+      # @option attributes [String] :log_group_name The name of the log group
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      #
+      # @example Basic log stream
+      #   log_stream = aws_cloudwatch_log_stream(:app_stream, {
+      #     name: "application-instance-001",
+      #     log_group_name: log_group.name
+      #   })
+      #
+      # @example Lambda log stream
+      #   lambda_stream = aws_cloudwatch_log_stream(:lambda_stream, {
+      #     name: "2023/12/01/[$LATEST]abcd1234567890",
+      #     log_group_name: "/aws/lambda/my-function"
+      #   })
+      #
+      # @example ECS task log stream
+      #   ecs_stream = aws_cloudwatch_log_stream(:ecs_task_stream, {
+      #     name: "ecs/web-service/task-id-12345",
+      #     log_group_name: "/ecs/web-service"
+      #   })
+      #
+      # @example Application log stream with timestamp
+      #   app_stream = aws_cloudwatch_log_stream(:timestamped_stream, {
+      #     name: "server-01/#{Time.now.strftime('%Y/%m/%d')}/session-#{SecureRandom.hex(4)}",
+      #     log_group_name: "/application/web-servers"
+      #   })
+      def aws_cloudwatch_log_stream(name, attributes = {})
+        # Validate attributes using dry-struct
+        log_stream_attrs = Types::CloudWatchLogStreamAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_cloudwatch_log_stream, name) do
+          name log_stream_attrs.name
+          log_group_name log_stream_attrs.log_group_name
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_cloudwatch_log_stream',
+          name: name,
+          resource_attributes: log_stream_attrs.to_h,
+          outputs: {
+            arn: "${aws_cloudwatch_log_stream.#{name}.arn}",
+            name: "${aws_cloudwatch_log_stream.#{name}.name}",
+            log_group_name: "${aws_cloudwatch_log_stream.#{name}.log_group_name}"
+          },
+          computed_properties: {
+            is_lambda_stream: log_stream_attrs.is_lambda_stream?,
+            is_ecs_stream: log_stream_attrs.is_ecs_stream?,
+            is_application_stream: log_stream_attrs.is_application_stream?,
+            stream_type: log_stream_attrs.stream_type,
+            log_group_hierarchy: log_stream_attrs.log_group_hierarchy
+          }
+        )
+      end
+    end
+  end
+end