pangea-aws 0.1.0

data/lib/pangea/resources/aws_ec2_transit_gateway_route_table_association/types.rb

@@ -0,0 +1,170 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Transit Gateway Route Table Association resource attributes with validation
+        class TransitGatewayRouteTableAssociationAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          attribute? :transit_gateway_attachment_id, Resources::Types::String.optional
+          attribute? :transit_gateway_route_table_id, Resources::Types::String.optional
+          attribute? :replace_existing_association, Resources::Types::Bool.default(false)
+          
+          # Custom validation for association configuration
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+            
+            # Validate attachment ID format
+            if attrs[:transit_gateway_attachment_id] && !attrs[:transit_gateway_attachment_id].match?(/\Atgw-attach-[0-9a-f]{8,17}\z/)
+              raise Dry::Struct::Error, "Invalid Transit Gateway Attachment ID format: #{attrs[:transit_gateway_attachment_id]}. Expected format: tgw-attach-xxxxxxxx"
+            end
+            
+            # Validate route table ID format
+            if attrs[:transit_gateway_route_table_id] && !attrs[:transit_gateway_route_table_id].match?(/\Atgw-rtb-[0-9a-f]{8,17}\z/)
+              raise Dry::Struct::Error, "Invalid Transit Gateway Route Table ID format: #{attrs[:transit_gateway_route_table_id]}. Expected format: tgw-rtb-xxxxxxxx"
+            end
+            
+            super(attrs)
+          end
+          
+          # Computed properties
+          def replace_existing_association?
+            !!replace_existing_association
+          end
+
+          def association_purpose
+            # Associations control which route table an attachment uses for outbound traffic
+            "Associates attachment #{transit_gateway_attachment_id} with route table #{transit_gateway_route_table_id} for outbound routing"
+          end
+          
+          def replaces_default_association?
+            replace_existing_association == true
+          end
+          
+          def routing_implications
+            implications = {
+              outbound_routing: "Attachment will use associated route table for outbound traffic routing",
+              route_evaluation: "Routes in the associated route table will be evaluated for traffic from this attachment",
+              override_behavior: replace_existing_association? ? "Will replace existing association" : "Will fail if association already exists"
+            }
+            
+            if replace_existing_association?
+              implications[:warning] = "Replacing existing association may cause temporary traffic disruption"
+            end
+            
+            implications
+          end
+          
+          def security_considerations
+            considerations = []
+            
+            considerations << "Route table association controls outbound traffic flow from the attachment"
+            considerations << "Attachments can only be associated with one route table at a time"
+            considerations << "Association determines which routes are available for outbound traffic"
+            
+            if replace_existing_association?
+              considerations << "Replacing existing association may change traffic flows - ensure new routes are configured"
+              considerations << "Consider testing route changes in non-production environments first"
+            else
+              considerations << "Association will fail if attachment is already associated with another route table"
+              considerations << "Use replace_existing_association: true to override existing associations"
+            end
+            
+            considerations
+          end
+          
+          def operational_insights
+            insights = {
+              association_model: "one_to_one", # One attachment to one route table
+              traffic_direction: "outbound_only", # Association only affects outbound traffic
+              conflict_resolution: replace_existing_association? ? "replace_existing" : "fail_on_conflict"
+            }
+            
+            # Add guidance based on configuration
+            if replace_existing_association?
+              insights[:change_management] = "Association change will be immediate - plan for potential traffic impact"
+            else
+              insights[:change_management] = "New association only - existing associations will cause failure"
+            end
+            
+            insights[:best_practice] = "Document which attachments are associated with which route tables for troubleshooting"
+            
+            insights
+          end
+          
+          def troubleshooting_guide
+            guide = {
+              common_issues: [
+                "Association already exists: Use replace_existing_association: true or remove existing association first",
+                "Invalid resource IDs: Verify attachment and route table exist and IDs are correct",
+                "Permission errors: Ensure proper IAM permissions for Transit Gateway management"
+              ],
+              verification_steps: [
+                "Check attachment state is 'available' before associating",
+                "Verify route table belongs to the same Transit Gateway as attachment",
+                "Confirm no conflicting associations exist if replace_existing_association is false"
+              ],
+              monitoring: [
+                "Monitor CloudWatch metrics for route table utilization",
+                "Track attachment association changes through CloudTrail",
+                "Use VPC Flow Logs to verify traffic is following expected routes"
+              ]
+            }
+            
+            if replace_existing_association?
+              guide[:replacement_specific] = [
+                "Previous association will be removed atomically",
+                "Brief traffic disruption may occur during association change",
+                "New routes take effect immediately after association"
+              ]
+            end
+            
+            guide
+          end
+          
+          def estimated_change_impact
+            impact = {
+              scope: "attachment_outbound_routing",
+              severity: replace_existing_association? ? "medium" : "low",
+              duration: "immediate", # Association changes take effect immediately
+              rollback_complexity: "low" # Can reassociate to previous route table
+            }
+            
+            if replace_existing_association?
+              impact[:warnings] = [
+                "Traffic flows from attachment will change immediately",
+                "Ensure new route table has appropriate routes configured",
+                "Consider gradual migration for production workloads"
+              ]
+            else
+              impact[:warnings] = [
+                "New association only - no impact on existing traffic flows",
+                "Will fail if attachment already has an association"
+              ]
+            end
+            
+            impact
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ec2_transit_gateway_route_table_propagation/resource.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_ec2_transit_gateway_route_table_propagation/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS EC2 Transit Gateway Route Table Propagation with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] Transit Gateway Route Table Propagation attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_ec2_transit_gateway_route_table_propagation(name, attributes = {})
+        # Validate attributes using dry-struct
+        propagation_attrs = Types::TransitGatewayRouteTablePropagationAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_ec2_transit_gateway_route_table_propagation, name) do
+          # Required attachment ID (source of routes)
+          transit_gateway_attachment_id propagation_attrs.transit_gateway_attachment_id
+          
+          # Required route table ID (destination for routes)
+          transit_gateway_route_table_id propagation_attrs.transit_gateway_route_table_id
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_ec2_transit_gateway_route_table_propagation',
+          name: name,
+          resource_attributes: propagation_attrs.to_h,
+          outputs: {
+            id: "${aws_ec2_transit_gateway_route_table_propagation.#{name}.id}",
+            resource_id: "${aws_ec2_transit_gateway_route_table_propagation.#{name}.resource_id}",
+            resource_type: "${aws_ec2_transit_gateway_route_table_propagation.#{name}.resource_type}"
+          },
+          computed_attributes: {
+            propagation_purpose: propagation_attrs.propagation_purpose,
+            route_advertisement_behavior: propagation_attrs.route_advertisement_behavior,
+            propagation_implications: propagation_attrs.propagation_implications,
+            security_considerations: propagation_attrs.security_considerations,
+            operational_insights: propagation_attrs.operational_insights,
+            route_propagation_scenarios: propagation_attrs.route_propagation_scenarios,
+            troubleshooting_guide: propagation_attrs.troubleshooting_guide,
+            estimated_impact: propagation_attrs.estimated_impact
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ec2_transit_gateway_route_table_propagation/types/propagation_insights.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Propagation insights and scenario methods for Transit Gateway Route Table Propagation
+        module PropagationInsights
+          def propagation_implications
+            implications = {
+              route_creation: "Routes from the attachment will be automatically created in the route table",
+              route_management: "Propagated routes are managed automatically - do not create static routes for same CIDRs",
+              route_priority: "Static routes take precedence over propagated routes for the same destination",
+              dynamic_updates: "Route changes in source attachment are automatically reflected in route table"
+            }
+
+            implications[:traffic_flow] = "Other attachments associated with this route table will learn routes to the propagating attachment"
+            implications[:bidirectional_note] = "Propagation only advertises routes TO the attachment, not FROM it"
+
+            implications
+          end
+
+          def operational_insights
+            insights = {
+              automation_level: "fully_automatic",
+              route_lifecycle: "managed_by_aws",
+              troubleshooting_complexity: "medium",
+              change_detection: "cloudtrail_and_route_monitoring"
+            }
+
+            insights[:best_practices] = [
+              "Use route propagation for dynamic environments where routes change frequently",
+              "Combine with static routes for fine-grained control over specific destinations",
+              "Document propagation relationships for operational clarity",
+              "Monitor route table size to avoid hitting AWS limits"
+            ]
+
+            insights[:when_to_use] = [
+              "VPC attachments with changing subnets",
+              "VPN connections with dynamic routing",
+              "Direct Connect gateways with BGP",
+              "Peering connections between dynamic environments"
+            ]
+
+            insights[:when_not_to_use] = [
+              "High-security environments requiring manual route control",
+              "Static environments where routes never change",
+              "Situations requiring asymmetric routing policies"
+            ]
+
+            insights
+          end
+
+          def route_propagation_scenarios
+            {
+              vpc_attachment: {
+                description: "VPC subnets are propagated as routes",
+                route_source: "VPC CIDR and associated subnets",
+                update_trigger: "Subnet creation/deletion in VPC",
+                typical_use_case: "Dynamic subnet management"
+              },
+              vpn_attachment: {
+                description: "Customer network routes learned via BGP",
+                route_source: "BGP advertisements from customer gateway",
+                update_trigger: "BGP route updates from on-premises",
+                typical_use_case: "Dynamic on-premises connectivity"
+              },
+              dx_gateway_attachment: {
+                description: "Direct Connect virtual interface routes",
+                route_source: "BGP advertisements from Direct Connect",
+                update_trigger: "BGP updates from Direct Connect partner",
+                typical_use_case: "Enterprise network integration"
+              },
+              peering_attachment: {
+                description: "Routes from peered Transit Gateway",
+                route_source: "Routes from remote Transit Gateway",
+                update_trigger: "Route changes in remote Transit Gateway",
+                typical_use_case: "Cross-region or cross-account connectivity"
+              }
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ec2_transit_gateway_route_table_propagation/types/security_concerns.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Security considerations and impact assessment for Transit Gateway Route Table Propagation
+        module SecurityConcerns
+          def security_considerations
+            considerations = []
+
+            considerations << "Route propagation automatically advertises attachment's routes to the route table"
+            considerations << "All attachments associated with the route table will learn propagated routes"
+            considerations << "Propagated routes can be overridden by static routes for security policies"
+            considerations << "Route propagation enables dynamic connectivity that may bypass static security controls"
+
+            considerations << "Consider whether automatic route propagation aligns with security segmentation requirements"
+            considerations << "Monitor propagated routes to ensure they don't create unintended connectivity paths"
+            considerations << "Document which attachments propagate to which route tables for security reviews"
+
+            considerations
+          end
+
+          def estimated_impact
+            impact = {
+              scope: "route_table_route_population",
+              automation_level: "high",
+              change_frequency: "dynamic",
+              reversibility: "easy",
+              monitoring_requirements: "medium"
+            }
+
+            impact[:benefits] = [
+              "Automatic route management reduces operational overhead",
+              "Dynamic environments stay connected as routes change",
+              "BGP integration enables enterprise-grade networking",
+              "Reduces risk of manual route configuration errors"
+            ]
+
+            impact[:risks] = [
+              "Automatic routes may create unintended connectivity",
+              "Route limits can be reached more quickly with propagation",
+              "Troubleshooting is more complex with dynamic routes",
+              "Security policies may be bypassed by propagated routes"
+            ]
+
+            impact
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ec2_transit_gateway_route_table_propagation/types/troubleshooting_support.rb

@@ -0,0 +1,68 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Troubleshooting and route advertisement support for Transit Gateway Route Table Propagation
+        module TroubleshootingSupport
+          def propagation_purpose
+            "Propagates routes from attachment #{transit_gateway_attachment_id} to route table #{transit_gateway_route_table_id}"
+          end
+
+          def route_advertisement_behavior
+            {
+              direction: "inbound_to_route_table",
+              mechanism: "automatic_route_propagation",
+              route_type: "propagated_routes",
+              override_capability: "static_routes_override_propagated"
+            }
+          end
+
+          def troubleshooting_guide
+            {
+              common_issues: [
+                "Propagated routes not appearing: Check attachment state and route table association",
+                "Route conflicts: Static routes override propagated routes for same destination",
+                "Unexpected connectivity: Propagated routes may create paths not anticipated",
+                "Route limits exceeded: Monitor route table size, AWS limits at 10,000 routes per table"
+              ],
+              verification_steps: [
+                "Verify attachment is in 'available' state",
+                "Check that source attachment has routes to propagate",
+                "Confirm route table association exists for destination attachments",
+                "Validate no static routes conflict with propagated routes"
+              ],
+              monitoring_approaches: [
+                "Use CloudWatch metrics for route table route count",
+                "Monitor Transit Gateway route table via AWS Console",
+                "Track propagation changes through CloudTrail events",
+                "Use VPC Flow Logs to verify traffic follows propagated routes"
+              ],
+              debugging_techniques: [
+                "Compare route table contents before/after propagation",
+                "Use traceroute to verify traffic path through propagated routes",
+                "Check BGP status for VPN/Direct Connect attachments",
+                "Validate attachment association and propagation configuration"
+              ]
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ec2_transit_gateway_route_table_propagation/types.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+require_relative 'types/propagation_insights'
+require_relative 'types/security_concerns'
+require_relative 'types/troubleshooting_support'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Transit Gateway Route Table Propagation resource attributes with validation
+        class TransitGatewayRouteTablePropagationAttributes < Pangea::Resources::BaseAttributes
+          include PropagationInsights
+          include SecurityConcerns
+          include TroubleshootingSupport
+
+          transform_keys(&:to_sym)
+
+          attribute? :transit_gateway_attachment_id, Resources::Types::String.optional
+          attribute? :transit_gateway_route_table_id, Resources::Types::String.optional
+
+          # Custom validation for propagation configuration
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+
+            # Validate attachment ID format
+            if attrs[:transit_gateway_attachment_id] && !attrs[:transit_gateway_attachment_id].match?(/\Atgw-attach-[0-9a-f]{8,17}\z/)
+              raise Dry::Struct::Error, "Invalid Transit Gateway Attachment ID format: #{attrs[:transit_gateway_attachment_id]}. Expected format: tgw-attach-xxxxxxxx"
+            end
+
+            # Validate route table ID format
+            if attrs[:transit_gateway_route_table_id] && !attrs[:transit_gateway_route_table_id].match?(/\Atgw-rtb-[0-9a-f]{8,17}\z/)
+              raise Dry::Struct::Error, "Invalid Transit Gateway Route Table ID format: #{attrs[:transit_gateway_route_table_id]}. Expected format: tgw-rtb-xxxxxxxx"
+            end
+
+            super(attrs)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ec2_transit_gateway_vpc_attachment/resource.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_ec2_transit_gateway_vpc_attachment/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS EC2 Transit Gateway VPC Attachment with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] Transit Gateway VPC Attachment attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_ec2_transit_gateway_vpc_attachment(name, attributes = {})
+        # Validate attributes using dry-struct
+        attachment_attrs = Types::TransitGatewayVpcAttachmentAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_ec2_transit_gateway_vpc_attachment, name) do
+          # Required attributes
+          transit_gateway_id attachment_attrs.transit_gateway_id
+          vpc_id attachment_attrs.vpc_id
+          subnet_ids attachment_attrs.subnet_ids
+          
+          # Optional appliance mode support
+          if attachment_attrs.appliance_mode_support
+            appliance_mode_support attachment_attrs.appliance_mode_support
+          end
+          
+          # Optional DNS support
+          if attachment_attrs.dns_support
+            dns_support attachment_attrs.dns_support
+          end
+          
+          # Optional IPv6 support
+          if attachment_attrs.ipv6_support
+            ipv6_support attachment_attrs.ipv6_support
+          end
+          
+          # Optional default route table association
+          if !attachment_attrs.transit_gateway_default_route_table_association.nil?
+            transit_gateway_default_route_table_association attachment_attrs.transit_gateway_default_route_table_association
+          end
+          
+          # Optional default route table propagation
+          if !attachment_attrs.transit_gateway_default_route_table_propagation.nil?
+            transit_gateway_default_route_table_propagation attachment_attrs.transit_gateway_default_route_table_propagation
+          end
+          
+          # Apply tags if present
+          if attachment_attrs.tags&.any?
+            tags do
+              attachment_attrs.tags.each do |key, value|
+                public_send(key, value)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_ec2_transit_gateway_vpc_attachment',
+          name: name,
+          resource_attributes: attachment_attrs.to_h,
+          outputs: {
+            id: "${aws_ec2_transit_gateway_vpc_attachment.#{name}.id}",
+            vpc_owner_id: "${aws_ec2_transit_gateway_vpc_attachment.#{name}.vpc_owner_id}",
+            tags_all: "${aws_ec2_transit_gateway_vpc_attachment.#{name}.tags_all}"
+          },
+          computed_attributes: {
+            is_highly_available: attachment_attrs.is_highly_available?,
+            supports_appliance_mode_inspection: attachment_attrs.supports_appliance_mode_inspection?,
+            estimated_monthly_cost: attachment_attrs.estimated_monthly_cost,
+            availability_zones_count: attachment_attrs.availability_zones_count,
+            security_considerations: attachment_attrs.security_considerations,
+            routing_behavior: attachment_attrs.routing_behavior
+          }
+        )
+      end
+    end
+  end
+end