pangea-aws 0.1.0

data/lib/pangea/resources/aws_acm_certificate/types.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # ACM Certificate resource attributes with validation
+
+        AcmCertificateLifecycle = Resources::Types::Hash.schema(
+          create_before_destroy?: Resources::Types::Bool.default(true),
+          prevent_destroy?: Resources::Types::Bool.default(false)
+        ).lax
+        class AcmCertificateAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          attribute? :domain_name, (Resources::Types::DomainName | Resources::Types::WildcardDomainName).optional
+          attribute :subject_alternative_names?, Resources::Types::Array.of(Resources::Types::DomainName | Resources::Types::WildcardDomainName).optional
+          attribute :validation_method, Resources::Types::AcmValidationMethod.default('DNS')
+          attribute :key_algorithm?, Resources::Types::AcmKeyAlgorithm.optional.default('RSA-2048')
+          attribute :certificate_transparency_logging_preference?, Resources::Types::CertificateTransparencyLogging.optional
+          attribute :validation_options?, Resources::Types::Array.of(Resources::Types::AcmValidationOption).optional
+          attribute :tags?, Resources::Types::AwsTags.optional
+          attribute :lifecycle?, AcmCertificateLifecycle.optional
+          
+          # Custom validation logic
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+            
+            # Validate domain name patterns
+            if attrs[:domain_name]
+              validate_domain_name(attrs[:domain_name])
+            end
+            
+            # Validate SAN entries
+            if attrs[:subject_alternative_names]
+              attrs[:subject_alternative_names].each do |san|
+                validate_domain_name(san)
+              end
+              
+              # Check for duplicate domains
+              all_domains = [attrs[:domain_name], *attrs[:subject_alternative_names]]
+              if all_domains.uniq.length != all_domains.length
+                raise Dry::Struct::Error, "Duplicate domains found in certificate request"
+              end
+              
+              # AWS limit: max 100 domain names per certificate
+              if all_domains.length > 100
+                raise Dry::Struct::Error, "ACM certificate supports maximum 100 domain names (including primary domain)"
+              end
+            end
+            
+            # Validate validation options match domains
+            if attrs[:validation_options]
+              domains = [attrs[:domain_name], *attrs[:subject_alternative_names]].compact
+              validation_domains = attrs[:validation_options].map { |vo| vo[:domain_name] }
+              
+              # Each validation option must match a requested domain
+              validation_domains.each do |vd|
+                unless domains.include?(vd)
+                  raise Dry::Struct::Error, "Validation option domain '#{vd}' not found in certificate domains"
+                end
+              end
+            end
+            
+            super(attrs)
+          end
+          
+          # Domain name validation helper
+          def self.validate_domain_name(domain)
+            # Check for valid wildcard usage
+            if domain.include?('*')
+              # Wildcard must be at start and only one level
+              unless domain.match?(/\A\*\.[a-z0-9.-]+\z/i)
+                raise Dry::Struct::Error, "Invalid wildcard domain: #{domain}. Wildcards must be at the start (*.example.com)"
+              end
+              
+              # Cannot have multiple wildcards
+              if domain.count('*') > 1
+                raise Dry::Struct::Error, "Domain cannot contain multiple wildcards: #{domain}"
+              end
+            end
+            
+            # Validate domain length (ACM limit: 64 characters per label, 253 total)
+            if domain.length > 253
+              raise Dry::Struct::Error, "Domain name too long: #{domain} (max 253 characters)"
+            end
+            
+            # Validate each label (between dots)
+            labels = domain.gsub(/^\*\./, '').split('.')
+            labels.each do |label|
+              if label.length > 64
+                raise Dry::Struct::Error, "Domain label too long: #{label} (max 64 characters)"
+              end
+            end
+          end
+          
+          # Computed properties
+          def is_wildcard_certificate?
+            domain_name.start_with?('*.')
+          end
+          
+          def total_domain_count
+            1 + (subject_alternative_names&.length || 0)
+          end
+          
+          def uses_dns_validation?
+            validation_method == 'DNS'
+          end
+          
+          def uses_email_validation?
+            validation_method == 'EMAIL'
+          end
+          
+          def estimated_validation_time
+            case validation_method
+            when 'DNS' then '5-10 minutes (after DNS records are created)'
+            when 'EMAIL' then '1-2 hours (after email confirmation)'
+            else 'Unknown'
+            end
+          end
+          
+          def certificate_scope
+            if is_wildcard_certificate?
+              "Wildcard certificate for #{domain_name}"
+            elsif subject_alternative_names&.any?
+              "Multi-domain certificate covering #{total_domain_count} domains"
+            else
+              "Single domain certificate"
+            end
+          end
+        end
+        
+        # ACM Certificate lifecycle configuration
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_acm_certificate_validation/resource.rb

@@ -0,0 +1,72 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_acm_certificate_validation/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS ACM Certificate Validation resource with type-safe attributes
+      #
+      # This resource waits for certificate validation to complete and is typically used
+      # after creating DNS validation records for ACM certificates.
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] Certificate validation attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_acm_certificate_validation(name, attributes = {})
+        # Validate attributes using dry-struct
+        validation_attrs = Types::AcmCertificateValidationAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_acm_certificate_validation, name) do
+          certificate_arn validation_attrs.certificate_arn
+          
+          # Add validation record FQDNs if provided (for DNS validation)
+          if validation_attrs.validation_record_fqdns&.any?
+            validation_record_fqdns validation_attrs.validation_record_fqdns
+          end
+          
+          # Configure timeouts if specified
+          if validation_attrs.timeouts
+            timeouts do
+              if validation_attrs.timeouts&.dig(:create)
+                create validation_attrs.timeouts&.dig(:create)
+              end
+              if validation_attrs.timeouts&.dig(:update)
+                update validation_attrs.timeouts&.dig(:update)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_acm_certificate_validation',
+          name: name,
+          resource_attributes: validation_attrs.to_h,
+          outputs: {
+            id: "${aws_acm_certificate_validation.#{name}.id}",
+            certificate_arn: "${aws_acm_certificate_validation.#{name}.certificate_arn}"
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_acm_certificate_validation/types.rb

@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # ACM Certificate Validation resource attributes with validation
+
+        AcmCertificateValidationTimeouts = Resources::Types::Hash.schema(
+          create?: Resources::Types::String.constrained(format: /\A\d+[smh]\z/).optional.default('5m'),
+          update?: Resources::Types::String.constrained(format: /\A\d+[smh]\z/).optional
+        ).constructor { |value|
+          # Validate timeout formats and provide reasonable defaults
+          if value[:create]
+            timeout_value = parse_timeout(value[:create])
+            if timeout_value > 600  # 10 minutes max for create
+              raise Dry::Types::ConstraintError, "Certificate validation timeout too long: #{value[:create]} (max 10m)"
+            end
+          end
+          
+          value
+        }
+
+        
+
+        CertificateArn = Resources::Types::String.constrained(
+          format: /\Aarn:aws:acm:[a-z0-9-]+:\d{12}:certificate\/[a-f0-9-]{36}\z/
+        )
+        class AcmCertificateValidationAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          attribute? :certificate_arn, CertificateArn.optional
+          attribute :validation_record_fqdns?, Resources::Types::Array.of(Resources::Types::String).optional
+          attribute :timeouts?, AcmCertificateValidationTimeouts.optional
+          
+          # Custom validation logic
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+            
+            # Validate certificate ARN format
+            if attrs[:certificate_arn]
+              validate_certificate_arn(attrs[:certificate_arn])
+            end
+            
+            # Validate FQDN format if provided
+            if attrs[:validation_record_fqdns]
+              attrs[:validation_record_fqdns].each do |fqdn|
+                validate_fqdn(fqdn)
+              end
+            end
+            
+            super(attrs)
+          end
+          
+          # Certificate ARN validation helper
+          def self.validate_certificate_arn(arn)
+            unless arn.match?(/\Aarn:aws:acm:[a-z0-9-]+:\d{12}:certificate\/[a-f0-9-]{36}\z/)
+              raise Dry::Struct::Error, "Invalid ACM certificate ARN format: #{arn}"
+            end
+          end
+          
+          # FQDN validation helper
+          def self.validate_fqdn(fqdn)
+            # Basic FQDN validation
+            unless fqdn.match?(/\A[a-zA-Z0-9_]([a-zA-Z0-9\-_]*[a-zA-Z0-9_])?(\.[a-zA-Z0-9_]([a-zA-Z0-9\-_]*[a-zA-Z0-9_])?)*\.?\z/)
+              raise Dry::Struct::Error, "Invalid FQDN format: #{fqdn}"
+            end
+            
+            # Check for reasonable length limits
+            if fqdn.length > 253
+              raise Dry::Struct::Error, "FQDN too long: #{fqdn} (max 253 characters)"
+            end
+          end
+          
+          # Computed properties
+          def validation_method
+            validation_record_fqdns&.any? ? 'DNS' : 'EMAIL'
+          end
+          
+          def validation_record_count
+            validation_record_fqdns&.length || 0
+          end
+          
+          def uses_dns_validation?
+            validation_method == 'DNS'
+          end
+          
+          def uses_email_validation?
+            validation_method == 'EMAIL'
+          end
+          
+          def estimated_validation_time
+            case validation_method
+            when 'DNS' then '5-10 minutes (after DNS records propagate)'
+            when 'EMAIL' then '1-2 hours (after email confirmation)'
+            else 'Unknown'
+            end
+          end
+          
+          def certificate_region
+            # Extract region from ARN
+            certificate_arn.split(':')[3]
+          end
+          
+          def certificate_account_id
+            # Extract account ID from ARN
+            certificate_arn.split(':')[4]
+          end
+        end
+        # Certificate ARN validation type
+        
+        # ACM Certificate Validation timeouts configuration
+        
+        private
+        
+        def self.parse_timeout(timeout_str)
+          # Parse timeout string like "5m", "300s", "1h" into seconds
+          if timeout_str.match?(/\A(\d+)s\z/)
+            timeout_str.to_i
+          elsif timeout_str.match?(/\A(\d+)m\z/)
+            timeout_str.to_i * 60
+          elsif timeout_str.match?(/\A(\d+)h\z/)
+            timeout_str.to_i * 3600
+          else
+            300  # Default 5 minutes
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_acmpca_certificate_authority/resource.rb

@@ -0,0 +1,126 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_acmpca_certificate_authority/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS ACM PCA Certificate Authority with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] ACM PCA certificate authority attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_acmpca_certificate_authority(name, attributes = {})
+        # Validate attributes using dry-struct
+        ca_attrs = Types::AcmPcaCertificateAuthorityAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_acmpca_certificate_authority, name) do
+          # Configure certificate authority
+          certificate_authority_configuration do
+            key_algorithm ca_attrs.certificate_authority_configuration&.dig(:key_algorithm)
+            signing_algorithm ca_attrs.certificate_authority_configuration&.dig(:signing_algorithm)
+            
+            subject do
+              ca_attrs.certificate_authority_configuration&.dig(:subject).each do |key, value|
+                public_send(key, value) if value
+              end
+            end
+          end
+          
+          type ca_attrs.type
+          status ca_attrs.status if ca_attrs.status
+          permanent_deletion_time_in_days ca_attrs.permanent_deletion_time_in_days
+          
+          # Configure revocation if specified
+          if ca_attrs.revocation_configuration
+            revocation_configuration do
+              if ca_attrs.revocation_configuration&.dig(:crl_configuration)
+                crl_configuration do
+                  enabled ca_attrs.revocation_configuration&.dig(:crl_configuration)[:enabled]
+                  expiration_in_days ca_attrs.revocation_configuration&.dig(:crl_configuration)[:expiration_in_days] if ca_attrs.revocation_configuration&.dig(:crl_configuration)[:expiration_in_days]
+                  custom_cname ca_attrs.revocation_configuration&.dig(:crl_configuration)[:custom_cname] if ca_attrs.revocation_configuration&.dig(:crl_configuration)[:custom_cname]
+                  s3_bucket_name ca_attrs.revocation_configuration&.dig(:crl_configuration)[:s3_bucket_name] if ca_attrs.revocation_configuration&.dig(:crl_configuration)[:s3_bucket_name]
+                  s3_object_acl ca_attrs.revocation_configuration&.dig(:crl_configuration)[:s3_object_acl] if ca_attrs.revocation_configuration&.dig(:crl_configuration)[:s3_object_acl]
+                end
+              end
+              
+              if ca_attrs.revocation_configuration&.dig(:ocsp_configuration)
+                ocsp_configuration do
+                  enabled ca_attrs.revocation_configuration&.dig(:ocsp_configuration)[:enabled]
+                  ocsp_custom_cname ca_attrs.revocation_configuration&.dig(:ocsp_configuration)[:ocsp_custom_cname] if ca_attrs.revocation_configuration&.dig(:ocsp_configuration)[:ocsp_custom_cname]
+                end
+              end
+            end
+          end
+          
+          # Set usage mode and security standard if specified
+          usage_mode ca_attrs.usage_mode if ca_attrs.usage_mode
+          key_storage_security_standard ca_attrs.key_storage_security_standard if ca_attrs.key_storage_security_standard
+          
+          # Apply tags if present
+          if ca_attrs.tags&.any?
+            tags do
+              ca_attrs.tags.each do |key, value|
+                public_send(key, value)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_acmpca_certificate_authority',
+          name: name,
+          resource_attributes: ca_attrs.to_h,
+          outputs: {
+            id: "${aws_acmpca_certificate_authority.#{name}.id}",
+            arn: "${aws_acmpca_certificate_authority.#{name}.arn}",
+            certificate: "${aws_acmpca_certificate_authority.#{name}.certificate}",
+            certificate_chain: "${aws_acmpca_certificate_authority.#{name}.certificate_chain}",
+            certificate_signing_request: "${aws_acmpca_certificate_authority.#{name}.certificate_signing_request}",
+            not_after: "${aws_acmpca_certificate_authority.#{name}.not_after}",
+            not_before: "${aws_acmpca_certificate_authority.#{name}.not_before}",
+            serial: "${aws_acmpca_certificate_authority.#{name}.serial}",
+            status: "${aws_acmpca_certificate_authority.#{name}.status}",
+            type: "${aws_acmpca_certificate_authority.#{name}.type}",
+            usage_mode: "${aws_acmpca_certificate_authority.#{name}.usage_mode}",
+            tags_all: "${aws_acmpca_certificate_authority.#{name}.tags_all}"
+          },
+          computed_properties: {
+            root_ca: ca_attrs.root_ca?,
+            subordinate_ca: ca_attrs.subordinate_ca?,
+            rsa_key: ca_attrs.rsa_key?,
+            ec_key: ca_attrs.ec_key?,
+            key_size: ca_attrs.key_size,
+            signing_strength: ca_attrs.signing_strength,
+            has_crl_distribution: ca_attrs.has_crl_distribution?,
+            has_ocsp: ca_attrs.has_ocsp?,
+            security_level: ca_attrs.security_level,
+            production_ready: ca_attrs.production_ready?,
+            hierarchy_level: ca_attrs.hierarchy_level,
+            configuration_warnings: ca_attrs.validate_configuration,
+            estimated_monthly_cost: ca_attrs.estimated_monthly_cost
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_acmpca_certificate_authority/types/attributes.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Type-safe attributes for AWS ACM PCA Certificate Authority resources
+        class AcmPcaCertificateAuthorityAttributes < Pangea::Resources::BaseAttributes
+          # Certificate authority configuration
+          attribute? :certificate_authority_configuration, Resources::Types::Hash.schema(
+            key_algorithm: Resources::Types::String.constrained(included_in: ['RSA_2048', 'RSA_4096', 'EC_prime256v1', 'EC_secp384r1']),
+            signing_algorithm: Resources::Types::String.constrained(included_in: ['SHA256WITHRSA', 'SHA384WITHRSA', 'SHA512WITHRSA',
+              'SHA256WITHECDSA', 'SHA384WITHECDSA', 'SHA512WITHECDSA']),
+            subject: Resources::Types::Hash.schema(
+              country?: Resources::Types::String.optional,
+              organization?: Resources::Types::String.optional,
+              organizational_unit?: Resources::Types::String.optional,
+              distinguished_name_qualifier?: Resources::Types::String.optional,
+              state?: Resources::Types::String.optional,
+              common_name?: Resources::Types::String.optional,
+              serial_number?: Resources::Types::String.optional,
+              locality?: Resources::Types::String.optional,
+              title?: Resources::Types::String.optional,
+              surname?: Resources::Types::String.optional,
+              given_name?: Resources::Types::String.optional,
+              initials?: Resources::Types::String.optional,
+              pseudonym?: Resources::Types::String.optional,
+              generation_qualifier?: Resources::Types::String.optional
+            ).lax
+          )
+
+          # Certificate authority type
+          attribute :type, Resources::Types::String.default('ROOT').enum('ROOT', 'SUBORDINATE')
+
+          # Certificate authority status
+          attribute? :status, Resources::Types::String.constrained(included_in: ['CREATING', 'PENDING_CERTIFICATE', 'ACTIVE', 'DELETED', 'DISABLED', 'EXPIRED', 'FAILED']).optional
+
+          # Permanent deletion time in days (7-30)
+          attribute? :permanent_deletion_time_in_days,
+                    Resources::Types::Integer.constrained(gteq: 7, lteq: 30).default(30)
+
+          # Revocation configuration
+          attribute? :revocation_configuration, Resources::Types::Hash.schema(
+            crl_configuration?: Resources::Types::Hash.schema(
+              enabled: Resources::Types::Bool,
+              expiration_in_days?: Resources::Types::Integer.optional,
+              custom_cname?: Resources::Types::String.optional,
+              s3_bucket_name?: Resources::Types::String.optional,
+              s3_object_acl?: Resources::Types::String.constrained(included_in: ['PUBLIC_READ', 'BUCKET_OWNER_FULL_CONTROL']).optional
+            ).lax.optional,
+            ocsp_configuration?: Resources::Types::Hash.schema(
+              enabled: Resources::Types::Bool,
+              ocsp_custom_cname?: Resources::Types::String.optional
+            ).lax.optional
+          ).optional
+
+          # Usage mode
+          attribute? :usage_mode, Resources::Types::String.constrained(included_in: ['GENERAL_PURPOSE', 'SHORT_LIVED_CERTIFICATE']).optional
+
+          # Key storage security standard
+          attribute? :key_storage_security_standard, Resources::Types::String.constrained(included_in: ['FIPS_140_2_LEVEL_2_OR_HIGHER', 'FIPS_140_2_LEVEL_3_OR_HIGHER']).optional
+
+          # Tags to apply to the certificate authority
+          attribute :tags, Resources::Types::AwsTags.default({}.freeze)
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_acmpca_certificate_authority/types/helpers.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+      end
+    end
+  end
+end