pangea-aws 0.1.0

data/lib/pangea/resources/aws_ec2_transit_gateway_vpc_attachment/types.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Transit Gateway VPC Attachment resource attributes with validation
+        class TransitGatewayVpcAttachmentAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          attribute? :transit_gateway_id, Resources::Types::String.optional
+          attribute? :vpc_id, Resources::Types::String.optional
+          attribute? :subnet_ids, Resources::Types::Array.of(Resources::Types::String).constrained(min_size: 1).optional
+          attribute? :appliance_mode_support, Resources::Types::TransitGatewayVpcAttachmentApplianceModeSupport
+          attribute? :dns_support, Resources::Types::TransitGatewayVpcAttachmentDnsSupport
+          attribute? :ipv6_support, Resources::Types::TransitGatewayVpcAttachmentIpv6Support
+          attribute? :transit_gateway_default_route_table_association, Resources::Types::Bool.optional
+          attribute? :transit_gateway_default_route_table_propagation, Resources::Types::Bool.optional
+          attribute? :tags, Resources::Types::AwsTags
+          
+          # Custom validation for VPC attachment configuration
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+            
+            # Validate subnet IDs format (basic validation)
+            if attrs[:subnet_ids]
+              attrs[:subnet_ids].each do |subnet_id|
+                unless subnet_id.match?(/\Asubnet-[0-9a-f]{8,17}\z/)
+                  raise Dry::Struct::Error, "Invalid subnet ID format: #{subnet_id}. Expected format: subnet-xxxxxxxx"
+                end
+              end
+            end
+            
+            # Validate VPC ID format
+            if attrs[:vpc_id] && !attrs[:vpc_id].match?(/\Avpc-[0-9a-f]{8,17}\z/)
+              raise Dry::Struct::Error, "Invalid VPC ID format: #{attrs[:vpc_id]}. Expected format: vpc-xxxxxxxx"
+            end
+            
+            # Validate Transit Gateway ID format
+            if attrs[:transit_gateway_id] && !attrs[:transit_gateway_id].match?(/\Atgw-[0-9a-f]{8,17}\z/)
+              raise Dry::Struct::Error, "Invalid Transit Gateway ID format: #{attrs[:transit_gateway_id]}. Expected format: tgw-xxxxxxxx"
+            end
+            
+            # Validate subnet count for high availability
+            if attrs[:subnet_ids] && attrs[:subnet_ids].length == 1
+              # Single subnet attachment - warn about availability
+              # This is allowed but not recommended for production
+            end
+            
+            super(attrs)
+          end
+          
+          # Computed properties
+          def is_highly_available?
+            # Multiple subnets provide high availability
+            subnet_ids.length > 1
+          end
+          
+          def supports_appliance_mode_inspection?
+            appliance_mode_support == 'enable'
+          end
+          
+          def estimated_monthly_cost
+            # VPC attachment cost: $36.50 per month per attachment
+            base_cost = 36.50
+            
+            {
+              monthly_attachment_cost: base_cost,
+              currency: 'USD',
+              note: 'Fixed monthly cost per VPC attachment. Data processing charges apply separately.'
+            }
+          end
+          
+          def availability_zones_count
+            # Estimate AZ count based on subnet count (assuming best practice deployment)
+            case subnet_ids.length
+            when 1 then 1
+            when 2 then 2
+            when 3 then 3
+            else subnet_ids.length # Could be more than 3 AZs
+            end
+          end
+          
+          def security_considerations
+            considerations = []
+            
+            unless is_highly_available?
+              considerations << "Single subnet attachment - no high availability. Consider adding subnets in additional AZs"
+            end
+            
+            if appliance_mode_support == 'enable'
+              considerations << "Appliance mode support is enabled - traffic will be directed to a single network appliance"
+            end
+            
+            if dns_support == 'disable'
+              considerations << "DNS support is disabled - DNS resolution across the Transit Gateway will not work"
+            end
+            
+            if transit_gateway_default_route_table_association == false
+              considerations << "Default route table association is disabled - ensure custom route table is associated"
+            end
+            
+            if transit_gateway_default_route_table_propagation == false
+              considerations << "Default route table propagation is disabled - routes will not be automatically propagated"
+            end
+            
+            considerations
+          end
+          
+          def routing_behavior
+            behavior = {
+              default_route_table_association: transit_gateway_default_route_table_association,
+              default_route_table_propagation: transit_gateway_default_route_table_propagation,
+              dns_resolution: dns_support == 'enable',
+              appliance_mode: appliance_mode_support == 'enable'
+            }
+            
+            # Determine routing pattern
+            if transit_gateway_default_route_table_association && transit_gateway_default_route_table_propagation
+              behavior[:pattern] = 'full_mesh'
+            elsif transit_gateway_default_route_table_association && !transit_gateway_default_route_table_propagation
+              behavior[:pattern] = 'hub_and_spoke_receiver'
+            elsif !transit_gateway_default_route_table_association && transit_gateway_default_route_table_propagation
+              behavior[:pattern] = 'hub_and_spoke_sender'
+            else
+              behavior[:pattern] = 'isolated'
+            end
+            
+            behavior
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ecr_lifecycle_policy/resource.rb

@@ -0,0 +1,161 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_ecr_lifecycle_policy/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS ECR Lifecycle Policy with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] ECR Lifecycle Policy attributes
+      # @option attributes [String] :repository The name of the repository
+      # @option attributes [String] :policy The lifecycle policy document as JSON string
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      #
+      # @example Age-based cleanup policy
+      #   age_cleanup = aws_ecr_lifecycle_policy(:age_cleanup, {
+      #     repository: ecr_repo.name,
+      #     policy: jsonencode({
+      #       rules: [
+      #         {
+      #           rulePriority: 1,
+      #           description: "Keep last 5 production images",
+      #           selection: {
+      #             tagStatus: "tagged",
+      #             tagPrefixList: ["prod"],
+      #             countType: "imageCountMoreThan",
+      #             countNumber: 5
+      #           },
+      #           action: {
+      #             type: "expire"
+      #           }
+      #         },
+      #         {
+      #           rulePriority: 2,
+      #           description: "Delete images older than 30 days",
+      #           selection: {
+      #             tagStatus: "untagged",
+      #             countType: "sinceImagePushed",
+      #             countUnit: "days",
+      #             countNumber: 30
+      #           },
+      #           action: {
+      #             type: "expire"
+      #           }
+      #         }
+      #       ]
+      #     })
+      #   })
+      #
+      # @example Count-based cleanup policy
+      #   count_cleanup = aws_ecr_lifecycle_policy(:count_cleanup, {
+      #     repository: ecr_repo.name,
+      #     policy: jsonencode({
+      #       rules: [
+      #         {
+      #           rulePriority: 1,
+      #           description: "Keep only 10 images",
+      #           selection: {
+      #             tagStatus: "any",
+      #             countType: "imageCountMoreThan",
+      #             countNumber: 10
+      #           },
+      #           action: {
+      #             type: "expire"
+      #           }
+      #         }
+      #       ]
+      #     })
+      #   })
+      #
+      # @example Tagged image retention policy
+      #   tagged_retention = aws_ecr_lifecycle_policy(:tagged_retention, {
+      #     repository: ecr_repo.name,
+      #     policy: jsonencode({
+      #       rules: [
+      #         {
+      #           rulePriority: 1,
+      #           description: "Keep latest 3 release images",
+      #           selection: {
+      #             tagStatus: "tagged",
+      #             tagPrefixList: ["release"],
+      #             countType: "imageCountMoreThan",
+      #             countNumber: 3
+      #           },
+      #           action: {
+      #             type: "expire"
+      #           }
+      #         },
+      #         {
+      #           rulePriority: 2,
+      #           description: "Delete old development images",
+      #           selection: {
+      #             tagStatus: "tagged",
+      #             tagPrefixList: ["dev", "feature"],
+      #             countType: "sinceImagePushed",
+      #             countUnit: "days",
+      #             countNumber: 7
+      #           },
+      #           action: {
+      #             type: "expire"
+      #           }
+      #         }
+      #       ]
+      #     })
+      #   })
+      def aws_ecr_lifecycle_policy(name, attributes = {})
+        # Validate attributes using dry-struct
+        policy_attrs = Types::ECRLifecyclePolicyAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_ecr_lifecycle_policy, name) do
+          # Repository reference
+          repository policy_attrs.repository
+          
+          # Lifecycle policy document
+          policy policy_attrs.policy
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_ecr_lifecycle_policy',
+          name: name,
+          resource_attributes: policy_attrs.to_h,
+          outputs: {
+            repository: "${aws_ecr_lifecycle_policy.#{name}.repository}",
+            policy: "${aws_ecr_lifecycle_policy.#{name}.policy}",
+            registry_id: "${aws_ecr_lifecycle_policy.#{name}.registry_id}"
+          },
+          computed_properties: {
+            rule_count: policy_attrs.rule_count,
+            rule_priorities: policy_attrs.rule_priorities,
+            has_tagged_image_rules: policy_attrs.has_tagged_image_rules?,
+            has_untagged_image_rules: policy_attrs.has_untagged_image_rules?,
+            has_count_based_rules: policy_attrs.has_count_based_rules?,
+            has_age_based_rules: policy_attrs.has_age_based_rules?,
+            estimated_retention_days: policy_attrs.estimated_retention_days,
+            is_terraform_reference: policy_attrs.is_terraform_reference?
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ecr_lifecycle_policy/types/computed.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'json'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class ECRLifecyclePolicyAttributes
+          # Computed properties for ECR lifecycle policy
+          module Computed
+            def lifecycle_policy_hash
+              return nil if is_terraform_reference?
+
+              begin
+                ::JSON.parse(policy)
+              rescue ::JSON::ParserError
+                nil
+              end
+            end
+
+            def rule_count
+              doc = lifecycle_policy_hash
+              return 0 unless doc && doc['rules']
+              doc['rules'].size
+            end
+
+            def rule_priorities
+              doc = lifecycle_policy_hash
+              return [] unless doc && doc['rules']
+              doc['rules'].map { |rule| rule['rulePriority'] }.compact.sort
+            end
+
+            def has_tagged_image_rules?
+              doc = lifecycle_policy_hash
+              return false unless doc && doc['rules']
+              doc['rules'].any? { |rule| rule.dig('selection', 'tagStatus') == 'tagged' }
+            end
+
+            def has_untagged_image_rules?
+              doc = lifecycle_policy_hash
+              return false unless doc && doc['rules']
+              doc['rules'].any? { |rule| rule.dig('selection', 'tagStatus') == 'untagged' }
+            end
+
+            def has_count_based_rules?
+              doc = lifecycle_policy_hash
+              return false unless doc && doc['rules']
+              doc['rules'].any? { |rule| rule.dig('selection', 'countType') == 'imageCountMoreThan' }
+            end
+
+            def has_age_based_rules?
+              doc = lifecycle_policy_hash
+              return false unless doc && doc['rules']
+              doc['rules'].any? { |rule| rule.dig('selection', 'countType') == 'sinceImagePushed' }
+            end
+
+            def estimated_retention_days
+              doc = lifecycle_policy_hash
+              return nil unless doc && doc['rules']
+
+              max_days = 0
+              doc['rules'].each do |rule|
+                if rule.dig('selection', 'countType') == 'sinceImagePushed'
+                  days = calculate_days_from_rule(rule)
+                  max_days = [max_days, days].max
+                end
+              end
+
+              max_days > 0 ? max_days : nil
+            end
+
+            def is_terraform_reference?
+              policy.match?(/^\$\{/) || policy.match?(/^jsonencode\(/)
+            end
+
+            private
+
+            def calculate_days_from_rule(rule)
+              unit = rule.dig('selection', 'countUnit')
+              number = rule.dig('selection', 'countNumber')
+              return 0 unless unit && number
+
+              case unit
+              when 'days' then number
+              when 'weeks' then number * 7
+              when 'months' then number * 30
+              else 0
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ecr_lifecycle_policy/types/validation.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class ECRLifecyclePolicyAttributes
+          # Validation methods for ECR lifecycle policy
+          module Validation
+            def self.validate_lifecycle_rule(rule, idx)
+              unless rule.is_a?(::Hash)
+                raise Dry::Struct::Error, "Rule[#{idx}] must be a hash"
+              end
+
+              unless rule['rulePriority'] && rule['rulePriority'].is_a?(Integer)
+                raise Dry::Struct::Error, "Rule[#{idx}] must have an integer rulePriority"
+              end
+
+              unless rule['selection']
+                raise Dry::Struct::Error, "Rule[#{idx}] must have a selection block"
+              end
+
+              unless rule['action']
+                raise Dry::Struct::Error, "Rule[#{idx}] must have an action block"
+              end
+
+              validate_selection(rule['selection'], idx)
+              validate_action(rule['action'], idx)
+            end
+
+            def self.validate_selection(selection, idx)
+              unless selection['tagStatus']
+                raise Dry::Struct::Error, "Rule[#{idx}] selection must specify tagStatus"
+              end
+
+              unless %w[tagged untagged any].include?(selection['tagStatus'])
+                raise Dry::Struct::Error, "Rule[#{idx}] tagStatus must be 'tagged', 'untagged', or 'any'"
+              end
+
+              if selection['countType'] && !%w[imageCountMoreThan sinceImagePushed].include?(selection['countType'])
+                raise Dry::Struct::Error, "Rule[#{idx}] countType must be 'imageCountMoreThan' or 'sinceImagePushed'"
+              end
+            end
+
+            def self.validate_action(action, idx)
+              unless action['type'] == 'expire'
+                raise Dry::Struct::Error, "Rule[#{idx}] action type must be 'expire'"
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ecr_lifecycle_policy/types.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+require 'json'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # ECR Lifecycle Policy resource attributes with validation
+        class ECRLifecyclePolicyAttributes < Pangea::Resources::BaseAttributes
+          require_relative 'types/validation'
+          require_relative 'types/computed'
+
+          include Computed
+
+          transform_keys(&:to_sym)
+
+          # Required attributes
+          attribute? :repository, Resources::Types::String.optional
+          attribute? :policy, Resources::Types::String.optional
+
+          # Validate attributes
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+
+            validate_repository(attrs[:repository]) if attrs[:repository]
+            validate_policy(attrs[:policy]) if attrs[:policy]
+
+            super(attrs)
+          end
+
+          def self.validate_repository(repo)
+            # Allow terraform references or valid repository names
+            unless repo.match?(/^\$\{/) || repo.match?(/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/)
+              raise Dry::Struct::Error, 'repository must be a valid repository name or terraform reference'
+            end
+          end
+
+          def self.validate_policy(policy_str)
+            # Skip validation if it's a terraform function call
+            return if policy_str.match?(/^\$\{/) || policy_str.match?(/^jsonencode\(/)
+
+            begin
+              policy_doc = ::JSON.parse(policy_str)
+              validate_policy_structure(policy_doc)
+            rescue ::JSON::ParserError => e
+              raise Dry::Struct::Error, "lifecycle policy must be valid JSON: #{e.message}"
+            end
+          end
+
+          def self.validate_policy_structure(policy_doc)
+            unless policy_doc.is_a?(::Hash) && policy_doc['rules']
+              raise Dry::Struct::Error, 'lifecycle policy must contain a rules array'
+            end
+
+            unless policy_doc['rules'].is_a?(Array)
+              raise Dry::Struct::Error, 'lifecycle policy rules must be an array'
+            end
+
+            if policy_doc['rules'].empty?
+              raise Dry::Struct::Error, 'lifecycle policy must contain at least one rule'
+            end
+
+            policy_doc['rules'].each_with_index do |rule, idx|
+              Validation.validate_lifecycle_rule(rule, idx)
+            end
+          end
+
+          def to_h
+            {
+              repository: repository,
+              policy: policy
+            }
+          end
+        end
+      end
+    end
+  end
+end