pangea-aws 0.1.0

data/lib/pangea/resources/aws_ecs_service/resource.rb

@@ -0,0 +1,196 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_ecs_service/types'
+require 'pangea/resources/aws_ecs_service/dsl_builders'
+require 'pangea/resources/aws_ecs_service/reference_builder'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS ECS Service with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] ECS service attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_ecs_service(name, attributes = {})
+        # Validate attributes using dry-struct
+        service_attrs = Types::EcsServiceAttributes.new(attributes)
+
+        # Build resource attributes as a hash
+        resource_attrs = {
+          name: service_attrs.name,
+          cluster: service_attrs.cluster,
+          task_definition: service_attrs.task_definition
+        }
+
+        # Scheduling
+        resource_attrs[:desired_count] = service_attrs.desired_count unless service_attrs.scheduling_strategy == "DAEMON"
+        resource_attrs[:scheduling_strategy] = service_attrs.scheduling_strategy if service_attrs.scheduling_strategy != "REPLICA"
+
+        # Launch config
+        if service_attrs.launch_type
+          resource_attrs[:launch_type] = service_attrs.launch_type
+          resource_attrs[:platform_version] = service_attrs.platform_version if service_attrs.launch_type == "FARGATE"
+        end
+
+        # Capacity provider strategy
+        if service_attrs.capacity_provider_strategy.any?
+          resource_attrs[:capacity_provider_strategy] = service_attrs.capacity_provider_strategy.map { |s|
+            { capacity_provider: s.capacity_provider, weight: s.weight, base: s.base }
+          }
+        end
+
+        # Load balancers
+        if service_attrs.load_balancer.any?
+          resource_attrs[:load_balancer] = service_attrs.load_balancer.map { |lb|
+            { target_group_arn: lb.target_group_arn, container_name: lb.container_name, container_port: lb.container_port }
+          }
+        end
+
+        # Network configuration
+        if service_attrs.network_configuration
+          nc = service_attrs.network_configuration
+          net_hash = { subnets: nc.subnets, assign_public_ip: nc.assign_public_ip }
+          net_hash[:security_groups] = nc.security_groups if nc.security_groups
+          resource_attrs[:network_configuration] = net_hash
+        end
+
+        # Service registries
+        if service_attrs.service_registries.any?
+          resource_attrs[:service_registries] = service_attrs.service_registries.map { |reg|
+            rh = { registry_arn: reg.registry_arn }
+            rh[:port] = reg.port if reg.port
+            rh[:container_port] = reg.container_port if reg.container_port
+            rh[:container_name] = reg.container_name if reg.container_name
+            rh
+          }
+        end
+
+        # Deployment configuration
+        resource_attrs[:deployment_configuration] = {
+          deployment_circuit_breaker: {
+            enable: service_attrs.deployment_configuration.deployment_circuit_breaker[:enable],
+            rollback: service_attrs.deployment_configuration.deployment_circuit_breaker[:rollback]
+          },
+          maximum_percent: service_attrs.deployment_configuration.maximum_percent,
+          minimum_healthy_percent: service_attrs.deployment_configuration.minimum_healthy_percent
+        }
+
+        resource_attrs[:deployment_controller] = service_attrs.deployment_controller
+
+        # Placement constraints
+        if service_attrs.placement_constraints.any?
+          resource_attrs[:placement_constraints] = service_attrs.placement_constraints.map { |pc|
+            ph = { type: pc.type }
+            ph[:expression] = pc.expression if pc.expression
+            ph
+          }
+        end
+
+        # Placement strategy
+        if service_attrs.placement_strategy.any?
+          resource_attrs[:placement_strategy] = service_attrs.placement_strategy.map { |ps|
+            ph = { type: ps.type }
+            ph[:field] = ps.field if ps.field
+            ph
+          }
+        end
+
+        # Additional config
+        resource_attrs[:health_check_grace_period_seconds] = service_attrs.health_check_grace_period_seconds if service_attrs.health_check_grace_period_seconds
+        resource_attrs[:enable_ecs_managed_tags] = service_attrs.enable_ecs_managed_tags
+        resource_attrs[:enable_execute_command] = service_attrs.enable_execute_command
+        resource_attrs[:propagate_tags] = service_attrs.propagate_tags if service_attrs.propagate_tags != "NONE"
+
+        # Service Connect configuration
+        if service_attrs.service_connect_configuration
+          sc = service_attrs.service_connect_configuration
+          sc_hash = { enabled: sc[:enabled] }
+          sc_hash[:namespace] = sc[:namespace] if sc[:namespace]
+
+          if sc[:services]&.any?
+            sc_hash[:service] = sc[:services].map { |svc|
+              sh = { port_name: svc[:port_name] }
+              sh[:discovery_name] = svc[:discovery_name] if svc[:discovery_name]
+              sh[:ingress_port_override] = svc[:ingress_port_override] if svc[:ingress_port_override]
+
+              if svc[:client_aliases]&.any?
+                sh[:client_alias] = svc[:client_aliases].map { |ca|
+                  cah = { port: ca[:port] }
+                  cah[:dns_name] = ca[:dns_name] if ca[:dns_name]
+                  cah
+                }
+              end
+
+              if svc[:timeout]
+                th = {}
+                th[:idle_timeout_seconds] = svc[:timeout][:idle_timeout_seconds] if svc[:timeout][:idle_timeout_seconds]
+                th[:per_request_timeout_seconds] = svc[:timeout][:per_request_timeout_seconds] if svc[:timeout][:per_request_timeout_seconds]
+                sh[:timeout] = th
+              end
+
+              if svc[:tls]
+                tlsh = {}
+                if svc[:tls][:issuer_certificate_authority]
+                  tlsh[:issuer_certificate_authority] = { aws_pca_authority_arn: svc[:tls][:issuer_certificate_authority][:aws_pca_authority_arn] }
+                end
+                tlsh[:kms_key] = svc[:tls][:kms_key] if svc[:tls][:kms_key]
+                tlsh[:role_arn] = svc[:tls][:role_arn] if svc[:tls][:role_arn]
+                sh[:tls] = tlsh
+              end
+
+              sh
+            }
+          end
+
+          if sc[:log_configuration]
+            lc = sc[:log_configuration]
+            lch = { log_driver: lc[:log_driver] }
+            lch[:options] = lc[:options] if lc[:options]
+            if lc[:secret_options]&.any?
+              lch[:secret_option] = lc[:secret_options].map { |s| { name: s[:name], value_from: s[:value_from] } }
+            end
+            sc_hash[:log_configuration] = lch
+          end
+
+          resource_attrs[:service_connect_configuration] = sc_hash
+        end
+
+        # Lifecycle config
+        resource_attrs[:wait_for_steady_state] = service_attrs.wait_for_steady_state
+        resource_attrs[:force_new_deployment] = service_attrs.force_new_deployment
+
+        # Tags
+        resource_attrs[:tags] = service_attrs.tags if service_attrs.tags.any?
+
+        # Write to manifest: direct access for synthesizer, fall back to resource() for test mocks
+        if is_a?(AbstractSynthesizer)
+          translation[:manifest][:resource] ||= {}
+          translation[:manifest][:resource][:aws_ecs_service] ||= {}
+          translation[:manifest][:resource][:aws_ecs_service][name] = resource_attrs
+        else
+          resource(:aws_ecs_service, name, resource_attrs)
+        end
+
+        EcsServiceReferenceBuilder.build(name, service_attrs)
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ecs_service/types/attributes.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class EcsServiceAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+
+          attribute? :name, Pangea::Resources::Types::String.optional
+          attribute? :cluster, Pangea::Resources::Types::String.optional
+          attribute? :task_definition, Pangea::Resources::Types::String.optional
+          attribute :desired_count, Pangea::Resources::Types::Integer.constrained(gteq: 0).default(1)
+          attribute :scheduling_strategy, Pangea::Resources::Types::String.constrained(included_in: ["REPLICA", "DAEMON"]).default("REPLICA")
+          attribute? :launch_type, Pangea::Resources::Types::String.constrained(included_in: ["EC2", "FARGATE", "EXTERNAL"]).optional
+          attribute :capacity_provider_strategy, Pangea::Resources::Types::Array.of(EcsCapacityProviderStrategy).default([].freeze)
+          attribute :platform_version, Pangea::Resources::Types::String.default("LATEST")
+          attribute :load_balancer, Pangea::Resources::Types::Array.of(EcsLoadBalancer).default([].freeze)
+          attribute? :network_configuration, EcsNetworkConfiguration.optional
+          attribute :service_registries, Pangea::Resources::Types::Array.of(EcsServiceRegistries).default([].freeze)
+          attribute :deployment_configuration, EcsDeploymentConfiguration.default(EcsDeploymentConfiguration.new)
+          attribute :placement_constraints, Pangea::Resources::Types::Array.of(EcsPlacementConstraint).default([].freeze)
+          attribute :placement_strategy, Pangea::Resources::Types::Array.of(EcsPlacementStrategy).default([].freeze)
+          attribute? :health_check_grace_period_seconds, Pangea::Resources::Types::Integer.constrained(gteq: 0).optional
+          attribute :enable_ecs_managed_tags, Pangea::Resources::Types::Bool.default(true)
+          attribute :enable_execute_command, Pangea::Resources::Types::Bool.default(false)
+          attribute :propagate_tags, Pangea::Resources::Types::String.constrained(included_in: ["TASK_DEFINITION", "SERVICE", "NONE"]).default("NONE")
+          attribute :deployment_controller, Pangea::Resources::Types::Hash.schema(type: Pangea::Resources::Types::String.constrained(included_in: ["ECS", "CODE_DEPLOY", "EXTERNAL"]).lax).default({ type: "ECS" })
+          attribute? :service_connect_configuration, Pangea::Resources::Types::Hash.optional
+          attribute :tags, Pangea::Resources::Types::AwsTags.default({}.freeze)
+          attribute :wait_for_steady_state, Pangea::Resources::Types::Bool.default(false)
+          attribute :force_new_deployment, Pangea::Resources::Types::Bool.default(false)
+
+          def self.new(attributes = {})
+            raw_attrs = attributes.is_a?(::Hash) ? attributes : {}
+            attrs = super(attributes)
+            raise Dry::Struct::Error, "Invalid task definition format" unless attrs.task_definition.match?(/\A(arn:aws:ecs:.+|[\w-]+:\d+)\z/)
+            if attrs.scheduling_strategy == "DAEMON"
+              # Only reject if desired_count was explicitly provided and is non-zero
+              dc_explicitly_set = raw_attrs.key?(:desired_count) || raw_attrs.key?('desired_count')
+              if dc_explicitly_set && attrs.desired_count != 0
+                raise Dry::Struct::Error, "desired_count must be 0 or omitted for DAEMON scheduling"
+              end
+              raise Dry::Struct::Error, "placement_strategy cannot be used with DAEMON scheduling" if attrs.placement_strategy.any?
+            end
+            raise Dry::Struct::Error, "Cannot specify both launch_type and capacity_provider_strategy" if attrs.launch_type && attrs.capacity_provider_strategy.any?
+            raise Dry::Struct::Error, "health_check_grace_period_seconds requires load_balancer configuration" if attrs.health_check_grace_period_seconds && attrs.load_balancer.empty?
+            if attrs.service_connect_configuration&.dig(:enabled) && attrs.service_connect_configuration&.dig(:services).to_a.empty?
+              raise Dry::Struct::Error, "Service Connect requires at least one service configuration"
+            end
+            attrs
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ecs_service/types/helpers.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class EcsServiceAttributes
+          def using_fargate?
+            launch_type == "FARGATE" || capacity_provider_strategy.any? { |cp| cp.capacity_provider.include?("FARGATE") }
+          end
+
+          def load_balanced? = load_balancer.any?
+          def service_discovery_enabled? = service_registries.any?
+          def service_connect_enabled? = !!service_connect_configuration&.dig(:enabled)
+
+          def estimated_monthly_cost
+            cost = 0.0
+            cost += desired_count * 50.0 if using_fargate?
+            cost += 5.0 if service_connect_enabled?
+            cost += load_balancer.size * 8.0 if load_balanced?
+            cost
+          end
+
+          def deployment_safe?
+            deployment_configuration.deployment_circuit_breaker[:enable] &&
+              deployment_configuration.deployment_circuit_breaker[:rollback]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ecs_service/types/nested.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class EcsLoadBalancer < Pangea::Resources::BaseAttributes
+          attribute? :target_group_arn, Pangea::Resources::Types::String.optional
+          attribute? :container_name, Pangea::Resources::Types::String.optional
+          attribute? :container_port, Pangea::Resources::Types::Integer.constrained(gteq: 1, lteq: 65535).optional
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            raise Dry::Struct::Error, "Invalid target group ARN format" unless attrs.target_group_arn.match?(/^arn:aws/)
+            attrs
+          end
+        end
+
+        class EcsNetworkConfiguration < Pangea::Resources::BaseAttributes
+          attribute? :subnets, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).constrained(min_size: 1).optional
+          attribute? :security_groups, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).optional
+          attribute :assign_public_ip, Pangea::Resources::Types::Bool.default(false)
+        end
+
+        class EcsServiceRegistries < Pangea::Resources::BaseAttributes
+          attribute? :registry_arn, Pangea::Resources::Types::String.optional
+          attribute? :port, Pangea::Resources::Types::Integer.constrained(gteq: 1, lteq: 65535).optional
+          attribute? :container_port, Pangea::Resources::Types::Integer.constrained(gteq: 1, lteq: 65535).optional
+          attribute? :container_name, Pangea::Resources::Types::String.optional
+        end
+
+        class EcsDeploymentConfiguration < Pangea::Resources::BaseAttributes
+          attribute? :deployment_circuit_breaker, Pangea::Resources::Types::Hash.schema(
+            enable: Pangea::Resources::Types::Bool, rollback: Pangea::Resources::Types::Bool
+          ).lax.default({ enable: false, rollback: false })
+          attribute :maximum_percent, Pangea::Resources::Types::Integer.constrained(gteq: 100).default(200)
+          attribute :minimum_healthy_percent, Pangea::Resources::Types::Integer.constrained(gteq: 0, lteq: 100).default(100)
+        end
+
+        class EcsPlacementConstraint < Pangea::Resources::BaseAttributes
+          attribute? :type, Pangea::Resources::Types::String.constrained(included_in: ["distinctInstance", "memberOf"]).optional
+          attribute? :expression, Resources::Types::String.optional
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            raise Dry::Struct::Error, "Expression is required for memberOf constraint type" if attrs.type == "memberOf" && attrs.expression.nil?
+            attrs
+          end
+        end
+
+        class EcsPlacementStrategy < Pangea::Resources::BaseAttributes
+          attribute? :type, Pangea::Resources::Types::String.constrained(included_in: ["random", "spread", "binpack"]).optional
+          attribute? :field, Resources::Types::String.optional
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            raise Dry::Struct::Error, "Field is required for #{attrs.type} strategy" if attrs.type != "random" && attrs.field.nil?
+            attrs
+          end
+        end
+
+        unless const_defined?(:EcsCapacityProviderStrategy)
+        class EcsCapacityProviderStrategy < Pangea::Resources::BaseAttributes
+          attribute? :capacity_provider, Pangea::Resources::Types::String.optional
+          attribute :weight, Pangea::Resources::Types::Integer.constrained(gteq: 0, lteq: 1000).default(1)
+          attribute :base, Pangea::Resources::Types::Integer.constrained(gteq: 0, lteq: 100000).default(0)
+        end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ecs_service/types.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require_relative 'types/nested'
+require_relative 'types/attributes'
+require_relative 'types/helpers'

data/lib/pangea/resources/aws_ecs_task_definition/container_definitions.rb

@@ -0,0 +1,191 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module AWS
+      module EcsTaskDefinition
+        # Builds container definition JSON for ECS task definitions
+        module ContainerDefinitions
+          extend self
+
+          # Convert container definitions to JSON-compatible array
+          # @param containers [Array] Array of container definition objects
+          # @return [Array<Hash>] Array of container definition hashes
+          def build(containers)
+            containers.map { |container| build_container(container) }
+          end
+
+          private
+
+          def build_container(container)
+            hash = base_container_hash(container)
+            add_port_mappings(hash, container)
+            add_environment_config(hash, container)
+            add_logging_config(hash, container)
+            add_health_check(hash, container)
+            add_filesystem_config(hash, container)
+            add_linux_config(hash, container)
+            add_misc_config(hash, container)
+            hash
+          end
+
+          def base_container_hash(container)
+            hash = {
+              name: container.name,
+              image: container.image,
+              essential: container.essential
+            }
+            hash[:cpu] = container.cpu if container.cpu
+            hash[:memory] = container.memory if container.memory
+            hash[:memoryReservation] = container.memory_reservation if container.memory_reservation
+            hash
+          end
+
+          def add_port_mappings(hash, container)
+            return unless container.port_mappings.any?
+
+            hash[:portMappings] = container.port_mappings.map do |pm|
+              pm_hash = { containerPort: pm[:container_port] }
+              pm_hash[:hostPort] = pm[:host_port] if pm[:host_port]
+              pm_hash[:protocol] = pm[:protocol] if pm[:protocol]
+              pm_hash[:name] = pm[:name] if pm[:name]
+              pm_hash[:appProtocol] = pm[:app_protocol] if pm[:app_protocol]
+              pm_hash
+            end
+          end
+
+          def add_environment_config(hash, container)
+            hash[:environment] = container.environment if container.environment.any?
+            return unless container.secrets.any?
+
+            hash[:secrets] = container.secrets.map do |s|
+              { name: s[:name], valueFrom: s[:value_from] }
+            end
+          end
+
+          def add_logging_config(hash, container)
+            return unless container.log_configuration
+
+            log_config = { logDriver: container.log_configuration[:log_driver] }
+            log_config[:options] = container.log_configuration[:options] if container.log_configuration[:options]
+            log_config[:secretOptions] = container.log_configuration[:secret_options] if container.log_configuration[:secret_options]
+            hash[:logConfiguration] = log_config
+          end
+
+          def add_health_check(hash, container)
+            return unless container.health_check
+
+            hc = { command: container.health_check[:command] }
+            hc[:interval] = container.health_check[:interval] if container.health_check[:interval]
+            hc[:timeout] = container.health_check[:timeout] if container.health_check[:timeout]
+            hc[:retries] = container.health_check[:retries] if container.health_check[:retries]
+            hc[:startPeriod] = container.health_check[:start_period] if container.health_check[:start_period]
+            hash[:healthCheck] = hc
+          end
+
+          def add_filesystem_config(hash, container)
+            hash[:entryPoint] = container.entry_point if container.entry_point.any?
+            hash[:command] = container.command if container.command.any?
+            hash[:workingDirectory] = container.working_directory if container.working_directory
+            hash[:links] = container.links if container.links.any?
+
+            add_mount_points(hash, container)
+            add_volumes_from(hash, container)
+            add_depends_on(hash, container)
+          end
+
+          def add_mount_points(hash, container)
+            return unless container.mount_points.any?
+
+            hash[:mountPoints] = container.mount_points.map do |mp|
+              mp_hash = { sourceVolume: mp[:source_volume], containerPath: mp[:container_path] }
+              mp_hash[:readOnly] = mp[:read_only] unless mp[:read_only].nil?
+              mp_hash
+            end
+          end
+
+          def add_volumes_from(hash, container)
+            return unless container.volumes_from.any?
+
+            hash[:volumesFrom] = container.volumes_from.map do |vf|
+              vf_hash = { sourceContainer: vf[:source_container] }
+              vf_hash[:readOnly] = vf[:read_only] unless vf[:read_only].nil?
+              vf_hash
+            end
+          end
+
+          def add_depends_on(hash, container)
+            return unless container.depends_on.any?
+
+            hash[:dependsOn] = container.depends_on.map do |dep|
+              { containerName: dep[:container_name], condition: dep[:condition] }
+            end
+          end
+
+          def add_linux_config(hash, container)
+            return unless container.linux_parameters
+
+            lp = {}
+            lp[:capabilities] = container.linux_parameters[:capabilities] if container.linux_parameters[:capabilities]
+            lp[:devices] = container.linux_parameters[:devices] if container.linux_parameters[:devices]
+            lp[:initProcessEnabled] = container.linux_parameters[:init_process_enabled] unless container.linux_parameters[:init_process_enabled].nil?
+            lp[:maxSwap] = container.linux_parameters[:max_swap] if container.linux_parameters[:max_swap]
+            lp[:sharedMemorySize] = container.linux_parameters[:shared_memory_size] if container.linux_parameters[:shared_memory_size]
+            lp[:swappiness] = container.linux_parameters[:swappiness] if container.linux_parameters[:swappiness]
+            lp[:tmpfs] = container.linux_parameters[:tmpfs] if container.linux_parameters[:tmpfs]
+            hash[:linuxParameters] = lp
+          end
+
+          def add_misc_config(hash, container)
+            add_ulimits(hash, container)
+            add_container_attributes(hash, container)
+            add_firelens_config(hash, container)
+          end
+
+          def add_ulimits(hash, container)
+            return unless container.ulimits.any?
+
+            hash[:ulimits] = container.ulimits.map do |u|
+              { name: u[:name], softLimit: u[:soft_limit], hardLimit: u[:hard_limit] }
+            end
+          end
+
+          def add_container_attributes(hash, container)
+            hash[:user] = container.user if container.user
+            hash[:privileged] = container.privileged unless container.privileged.nil?
+            hash[:readonlyRootFilesystem] = container.readonly_root_filesystem unless container.readonly_root_filesystem.nil?
+            hash[:dnsServers] = container.dns_servers if container.dns_servers.any?
+            hash[:dnsSearchDomains] = container.dns_search_domains if container.dns_search_domains.any?
+            hash[:extraHosts] = container.extra_hosts.map { |eh| { hostname: eh[:hostname], ipAddress: eh[:ip_address] } } if container.extra_hosts.any?
+            hash[:dockerSecurityOptions] = container.docker_security_options if container.docker_security_options.any?
+            hash[:dockerLabels] = container.docker_labels if container.docker_labels.any?
+            hash[:systemControls] = container.system_controls if container.system_controls.any?
+          end
+
+          def add_firelens_config(hash, container)
+            return unless container.firelens_configuration
+
+            hash[:firelensConfiguration] = {
+              type: container.firelens_configuration[:type],
+              options: container.firelens_configuration[:options]
+            }.compact
+          end
+        end
+      end
+    end
+  end
+end