pangea-aws 0.1.0

data/lib/pangea/resources/aws_ecs_task_definition/resource.rb

@@ -0,0 +1,205 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_ecs_task_definition/types'
+require 'pangea/resources/aws_ecs_task_definition/container_definitions'
+require 'pangea/resource_registry'
+require 'json'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS ECS Task Definition with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] ECS task definition attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_ecs_task_definition(name, attributes = {})
+        task_attrs = Types::EcsTaskDefinitionAttributes.new(attributes)
+
+        resource_attrs = {
+          family: task_attrs.family,
+          container_definitions: ::JSON.pretty_generate(
+            EcsTaskDefinition::ContainerDefinitions.build(task_attrs.container_definitions)
+          ),
+          network_mode: task_attrs.network_mode,
+          requires_compatibilities: task_attrs.requires_compatibilities
+        }
+
+        # Task roles
+        resource_attrs[:task_role_arn] = task_attrs.task_role_arn if task_attrs.task_role_arn
+        resource_attrs[:execution_role_arn] = task_attrs.execution_role_arn if task_attrs.execution_role_arn
+
+        # Compute
+        resource_attrs[:cpu] = task_attrs.cpu if task_attrs.cpu
+        resource_attrs[:memory] = task_attrs.memory if task_attrs.memory
+
+        # Volumes
+        if task_attrs.volumes.any?
+          resource_attrs[:volume] = task_attrs.volumes.map { |vol| build_volume(vol) }
+        end
+
+        # Placement constraints
+        if task_attrs.placement_constraints.any?
+          resource_attrs[:placement_constraints] = task_attrs.placement_constraints.map do |constraint|
+            pc = { type: constraint[:type] }
+            pc[:expression] = constraint[:expression] if constraint[:expression]
+            pc
+          end
+        end
+
+        # Process modes
+        resource_attrs[:ipc_mode] = task_attrs.ipc_mode if task_attrs.ipc_mode
+        resource_attrs[:pid_mode] = task_attrs.pid_mode if task_attrs.pid_mode
+
+        # Inference accelerators
+        if task_attrs.inference_accelerators.any?
+          resource_attrs[:inference_accelerator] = task_attrs.inference_accelerators.map do |acc|
+            { device_name: acc[:device_name], device_type: acc[:device_type] }
+          end
+        end
+
+        # Proxy configuration
+        if task_attrs.proxy_configuration
+          proxy = {
+            container_name: task_attrs.proxy_configuration[:container_name]
+          }
+          proxy[:type] = task_attrs.proxy_configuration[:type] if task_attrs.proxy_configuration[:type]
+          if task_attrs.proxy_configuration[:properties]
+            props = {}
+            task_attrs.proxy_configuration[:properties].each do |prop|
+              props[prop[:name]] = prop[:value]
+            end
+            proxy[:properties] = props
+          end
+          resource_attrs[:proxy_configuration] = proxy
+        end
+
+        # Runtime platform
+        if task_attrs.runtime_platform
+          rp = {}
+          rp[:operating_system_family] = task_attrs.runtime_platform[:operating_system_family] if task_attrs.runtime_platform[:operating_system_family]
+          rp[:cpu_architecture] = task_attrs.runtime_platform[:cpu_architecture] if task_attrs.runtime_platform[:cpu_architecture]
+          resource_attrs[:runtime_platform] = rp
+        end
+
+        # Ephemeral storage
+        if task_attrs.ephemeral_storage
+          resource_attrs[:ephemeral_storage] = {
+            size_in_gib: task_attrs.ephemeral_storage[:size_in_gib]
+          }
+        end
+
+        # Tags
+        resource_attrs[:tags] = task_attrs.tags if task_attrs.tags&.any?
+
+        # Write to manifest
+        if is_a?(AbstractSynthesizer)
+          translation[:manifest][:resource] ||= {}
+          translation[:manifest][:resource][:aws_ecs_task_definition] ||= {}
+          translation[:manifest][:resource][:aws_ecs_task_definition][name] = resource_attrs
+        else
+          resource(:aws_ecs_task_definition, name, resource_attrs)
+        end
+
+        create_resource_reference(name, task_attrs)
+      end
+
+      private
+
+      def build_volume(vol)
+        v = { name: vol[:name] }
+
+        if vol[:host]
+          host = {}
+          host[:source_path] = vol[:host][:source_path] if vol[:host][:source_path]
+          v[:host] = host
+        end
+
+        if vol[:docker_volume_configuration]
+          dvc = vol[:docker_volume_configuration]
+          docker = {}
+          docker[:scope] = dvc[:scope] if dvc[:scope]
+          docker[:autoprovision] = dvc[:autoprovision] unless dvc[:autoprovision].nil?
+          docker[:driver] = dvc[:driver] if dvc[:driver]
+          docker[:driver_opts] = dvc[:driver_opts] if dvc[:driver_opts]
+          docker[:labels] = dvc[:labels] if dvc[:labels]
+          v[:docker_volume_configuration] = docker
+        end
+
+        if vol[:efs_volume_configuration]
+          evc = vol[:efs_volume_configuration]
+          efs = { file_system_id: evc[:file_system_id] }
+          efs[:root_directory] = evc[:root_directory] if evc[:root_directory]
+          efs[:transit_encryption] = evc[:transit_encryption] if evc[:transit_encryption]
+          efs[:transit_encryption_port] = evc[:transit_encryption_port] if evc[:transit_encryption_port]
+          if evc[:authorization_config]
+            auth = {}
+            auth[:access_point_id] = evc[:authorization_config][:access_point_id] if evc[:authorization_config][:access_point_id]
+            auth[:iam] = evc[:authorization_config][:iam] if evc[:authorization_config][:iam]
+            efs[:authorization_config] = auth
+          end
+          v[:efs_volume_configuration] = efs
+        end
+
+        if vol[:fsx_windows_file_server_volume_configuration]
+          fsx = vol[:fsx_windows_file_server_volume_configuration]
+          fsx_config = {
+            file_system_id: fsx[:file_system_id],
+            root_directory: fsx[:root_directory],
+            authorization_config: {
+              credentials_parameter: fsx[:authorization_config][:credentials_parameter],
+              domain: fsx[:authorization_config][:domain]
+            }
+          }
+          v[:fsx_windows_file_server_volume_configuration] = fsx_config
+        end
+
+        v
+      end
+
+      def create_resource_reference(name, task_attrs)
+        ref = ResourceReference.new(
+          type: 'aws_ecs_task_definition',
+          name: name,
+          resource_attributes: task_attrs.to_h,
+          outputs: {
+            arn: "${aws_ecs_task_definition.#{name}.arn}",
+            arn_without_revision: "${aws_ecs_task_definition.#{name}.arn_without_revision}",
+            family: "${aws_ecs_task_definition.#{name}.family}",
+            revision: "${aws_ecs_task_definition.#{name}.revision}",
+            tags_all: "${aws_ecs_task_definition.#{name}.tags_all}",
+            id: "${aws_ecs_task_definition.#{name}.id}"
+          }
+        )
+
+        add_computed_methods(ref, task_attrs)
+        ref
+      end
+
+      def add_computed_methods(ref, task_attrs)
+        ref.define_singleton_method(:fargate_compatible?) { task_attrs.fargate_compatible? }
+        ref.define_singleton_method(:uses_efs?) { task_attrs.uses_efs? }
+        ref.define_singleton_method(:total_memory_mb) { task_attrs.total_memory_mb }
+        ref.define_singleton_method(:estimated_hourly_cost) { task_attrs.estimated_hourly_cost }
+        ref.define_singleton_method(:main_container_name) { task_attrs.main_container.name }
+        ref.define_singleton_method(:container_names) { task_attrs.container_definitions.map(&:name) }
+        ref.define_singleton_method(:essential_container_count) { task_attrs.container_definitions.count(&:is_essential?) }
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ecs_task_definition/types/container_definition.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class EcsContainerDefinition < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+
+          attribute? :name, Pangea::Resources::Types::String.optional
+          attribute? :image, Pangea::Resources::Types::String.optional
+          attribute? :cpu, Pangea::Resources::Types::Integer.optional
+          attribute? :memory, Pangea::Resources::Types::Integer.optional
+          attribute? :memory_reservation, Pangea::Resources::Types::Integer.optional
+
+          attribute? :port_mappings, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::Hash.schema(
+              container_port: Pangea::Resources::Types::Integer.constrained(gteq: 1, lteq: 65535),
+              host_port?: Pangea::Resources::Types::Integer.constrained(gteq: 1, lteq: 65535).optional,
+              protocol?: Pangea::Resources::Types::String.constrained(included_in: %w[tcp udp]).optional,
+              name?: Pangea::Resources::Types::String.optional,
+              app_protocol?: Pangea::Resources::Types::String.constrained(included_in: %w[http http2 grpc]).optional
+            ).lax
+          ).default([].freeze)
+
+          attribute? :environment, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::Hash.schema(name: Pangea::Resources::Types::String, value: Pangea::Resources::Types::String).lax
+          ).default([].freeze)
+
+          attribute? :secrets, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::Hash.schema(name: Pangea::Resources::Types::String, value_from: Pangea::Resources::Types::String).lax
+          ).default([].freeze)
+
+          attribute? :log_configuration, Pangea::Resources::Types::Hash.schema(
+            log_driver: Pangea::Resources::Types::String.constrained(included_in: %w[awslogs fluentd gelf json-file journald logentries splunk syslog awsfirelens]),
+            options?: Pangea::Resources::Types::Hash.optional,
+            secret_options?: Pangea::Resources::Types::Array.of(
+              Pangea::Resources::Types::Hash.schema(name: Pangea::Resources::Types::String, value_from: Pangea::Resources::Types::String).lax
+            ).optional
+          ).optional
+
+          attribute? :health_check, Pangea::Resources::Types::Hash.schema(
+            command: Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String),
+            interval?: Pangea::Resources::Types::Integer.constrained(gteq: 5, lteq: 300).optional,
+            timeout?: Pangea::Resources::Types::Integer.constrained(gteq: 2, lteq: 60).optional,
+            retries?: Pangea::Resources::Types::Integer.constrained(gteq: 1, lteq: 10).optional,
+            start_period?: Pangea::Resources::Types::Integer.constrained(gteq: 0, lteq: 300).optional
+          ).lax.optional
+
+          attribute :essential, Pangea::Resources::Types::Bool.default(true)
+          attribute :entry_point, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).default([].freeze)
+          attribute :command, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).default([].freeze)
+          attribute? :working_directory, Pangea::Resources::Types::String.optional
+          attribute :links, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).default([].freeze)
+
+          attribute? :mount_points, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::Hash.schema(
+              source_volume: Pangea::Resources::Types::String,
+              container_path: Pangea::Resources::Types::String,
+              read_only?: Pangea::Resources::Types::Bool.optional
+            ).lax
+          ).default([].freeze)
+
+          attribute? :volumes_from, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::Hash.schema(source_container: Pangea::Resources::Types::String, read_only?: Pangea::Resources::Types::Bool.optional).lax
+          ).default([].freeze)
+
+          attribute? :depends_on, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::Hash.schema(
+              container_name: Pangea::Resources::Types::String,
+              condition: Pangea::Resources::Types::String.constrained(included_in: %w[START COMPLETE SUCCESS HEALTHY])
+            ).lax
+          ).default([].freeze)
+
+          attribute? :linux_parameters, Pangea::Resources::Types::Hash.optional
+          attribute? :ulimits, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::Hash.schema(
+              name: Pangea::Resources::Types::String.constrained(included_in: %w[core cpu data fsize locks memlock msgqueue nice nofile nproc rss rtprio rttime sigpending stack]),
+              soft_limit: Pangea::Resources::Types::Integer, hard_limit: Pangea::Resources::Types::Integer
+            ).lax
+          ).default([].freeze)
+
+          attribute? :user, Pangea::Resources::Types::String.optional
+          attribute :privileged, Pangea::Resources::Types::Bool.default(false)
+          attribute :readonly_root_filesystem, Pangea::Resources::Types::Bool.default(false)
+          attribute :dns_servers, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).default([].freeze)
+          attribute :dns_search_domains, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).default([].freeze)
+
+          attribute? :extra_hosts, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::Hash.schema(hostname: Pangea::Resources::Types::String, ip_address: Pangea::Resources::Types::String).lax
+          ).default([].freeze)
+
+          attribute :docker_security_options, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).default([].freeze)
+          attribute :docker_labels, Pangea::Resources::Types::Hash.default({}.freeze)
+
+          attribute? :system_controls, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::Hash.schema(namespace: Pangea::Resources::Types::String, value: Pangea::Resources::Types::String).lax
+          ).default([].freeze)
+
+          attribute? :firelens_configuration, Pangea::Resources::Types::Hash.schema(
+            type: Pangea::Resources::Types::String.constrained(included_in: %w[fluentd fluentbit]),
+            options?: Pangea::Resources::Types::Hash.optional
+          ).lax.optional
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            raise Dry::Struct::Error, 'memory_reservation cannot be greater than memory' if attrs.memory_reservation && attrs.memory && attrs.memory_reservation > attrs.memory
+            raise Dry::Struct::Error, 'Invalid image URI format' unless attrs.image.match?(/^[\w\-\.\/\:]+$/)
+            attrs
+          end
+
+          def using_awslogs? = log_configuration && log_configuration&.dig(:log_driver) == 'awslogs'
+          def is_essential? = essential
+          def estimated_memory_mb = memory || memory_reservation || 512
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ecs_task_definition/types/task_definition.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require_relative 'container_definition'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        class EcsTaskDefinitionAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+
+          attribute? :family, Pangea::Resources::Types::String.optional
+          attribute? :container_definitions, Pangea::Resources::Types::Array.of(EcsContainerDefinition).constrained(min_size: 1).optional
+          attribute? :task_role_arn, Pangea::Resources::Types::String.optional
+          attribute? :execution_role_arn, Pangea::Resources::Types::String.optional
+          attribute :network_mode, Pangea::Resources::Types::String.constrained(included_in: %w[bridge host awsvpc none]).default('bridge')
+          attribute? :requires_compatibilities, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::String.constrained(included_in: %w[EC2 FARGATE EXTERNAL])
+          ).default(['EC2'].freeze)
+          attribute? :cpu, Pangea::Resources::Types::String.optional
+          attribute? :memory, Pangea::Resources::Types::String.optional
+
+          attribute :volumes, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::Hash).default([].freeze)
+          attribute? :placement_constraints, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::Hash.schema(type: Pangea::Resources::Types::String.constrained(included_in: ['memberOf']).lax, expression?: Pangea::Resources::Types::String.optional)
+          ).default([].freeze)
+
+          attribute? :ipc_mode, Pangea::Resources::Types::String.constrained(included_in: %w[host task none]).optional
+          attribute? :pid_mode, Pangea::Resources::Types::String.constrained(included_in: %w[host task]).optional
+          attribute? :inference_accelerators, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::Hash.schema(device_name: Pangea::Resources::Types::String, device_type: Pangea::Resources::Types::String).lax
+          ).default([].freeze)
+          attribute? :proxy_configuration, Pangea::Resources::Types::Hash.optional
+          attribute? :runtime_platform, Pangea::Resources::Types::Hash.optional
+          attribute? :ephemeral_storage, Pangea::Resources::Types::Hash.schema(size_in_gib: Pangea::Resources::Types::Integer.constrained(gteq: 21, lteq: 200).lax).optional
+          attribute :tags, Pangea::Resources::Types::AwsTags.default({}.freeze)
+
+          FARGATE_CPU_MEMORY = {
+            '256' => %w[512 1024 2048],
+            '512' => %w[1024 2048 3072 4096],
+            '1024' => %w[2048 3072 4096 5120 6144 7168 8192],
+            '2048' => (4096..16384).step(1024).map(&:to_s),
+            '4096' => (8192..30720).step(1024).map(&:to_s),
+            '8192' => (16_384..61_440).step(1024).map(&:to_s),
+            '16384' => (32_768..122_880).step(4096).map(&:to_s)
+          }.freeze
+
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            validate_fargate_requirements(attrs) if attrs.requires_compatibilities.include?('FARGATE')
+            validate_awsvpc_port_mappings(attrs) if attrs.network_mode == 'awsvpc'
+            raise Dry::Struct::Error, 'At least one container must be marked as essential' if attrs.container_definitions.count(&:is_essential?).zero?
+            validate_volume_references(attrs)
+            attrs
+          end
+
+          def self.validate_fargate_requirements(attrs)
+            raise Dry::Struct::Error, 'CPU and memory must be specified for Fargate compatibility' unless attrs.cpu && attrs.memory
+            raise Dry::Struct::Error, "Network mode must be 'awsvpc' for Fargate compatibility" unless attrs.network_mode == 'awsvpc'
+            raise Dry::Struct::Error, 'Execution role ARN is required for Fargate compatibility' unless attrs.execution_role_arn
+            return unless FARGATE_CPU_MEMORY[attrs.cpu] && !FARGATE_CPU_MEMORY[attrs.cpu].include?(attrs.memory)
+            raise Dry::Struct::Error, "Invalid CPU/memory combination for Fargate: #{attrs.cpu}/#{attrs.memory}"
+          end
+
+          def self.validate_awsvpc_port_mappings(attrs)
+            attrs.container_definitions.each do |container|
+              container.port_mappings.each do |pm|
+                next unless pm[:host_port] && pm[:host_port] != pm[:container_port]
+                raise Dry::Struct::Error, 'In awsvpc mode, host_port must equal container_port or be omitted'
+              end
+            end
+          end
+
+          def self.validate_volume_references(attrs)
+            volume_names = attrs.volumes.map { |v| v[:name] }
+            attrs.container_definitions.each do |container|
+              container.mount_points.each do |mp|
+                next if volume_names.include?(mp[:source_volume])
+                raise Dry::Struct::Error, "Container '#{container.name}' references undefined volume '#{mp[:source_volume]}'"
+              end
+            end
+          end
+
+          def fargate_compatible? = requires_compatibilities.include?('FARGATE')
+          def uses_efs? = volumes.any? { |v| v[:efs_volume_configuration] }
+          def total_memory_mb = memory&.to_i || container_definitions.sum(&:estimated_memory_mb)
+
+          def estimated_hourly_cost
+            return 0.0 unless fargate_compatible? && cpu && memory
+            (cpu.to_i * 0.00001406 + memory.to_i * 0.00000156) * 3600
+          end
+
+          def main_container = container_definitions.find(&:is_essential?) || container_definitions.first
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ecs_task_definition/types.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require 'pangea/resources/types'
+require_relative 'types/container_definition'
+require_relative 'types/task_definition'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # EcsContainerDefinition is defined in types/container_definition.rb
+        # EcsTaskDefinitionAttributes is defined in types/task_definition.rb
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_ecs_task_definition/volumes.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Resources
+    module AWS
+      module EcsTaskDefinition
+        # Configures volume blocks for ECS task definitions
+        module Volumes
+          extend self
+
+          # Configure volumes in the resource block context
+          # @param context [Object] The resource block context
+          # @param volumes [Array] Array of volume configurations
+          def configure(context, volumes)
+            volumes.each do |vol|
+              context.volume do |v|
+                v.name vol[:name]
+                configure_host_volume(v, vol)
+                configure_docker_volume(v, vol)
+                configure_efs_volume(v, vol)
+                configure_fsx_volume(v, vol)
+              end
+            end
+          end
+
+          private
+
+          def configure_host_volume(context, vol)
+            return unless vol[:host]
+
+            context.host do |h|
+              h.source_path vol[:host][:source_path] if vol[:host][:source_path]
+            end
+          end
+
+          def configure_docker_volume(context, vol)
+            dvc = vol[:docker_volume_configuration]
+            return unless dvc
+
+            context.docker_volume_configuration do |d|
+              d.scope dvc[:scope] if dvc[:scope]
+              d.autoprovision dvc[:autoprovision] unless dvc[:autoprovision].nil?
+              d.driver dvc[:driver] if dvc[:driver]
+              d.driver_opts dvc[:driver_opts] if dvc[:driver_opts]
+              d.labels dvc[:labels] if dvc[:labels]
+            end
+          end
+
+          def configure_efs_volume(context, vol)
+            evc = vol[:efs_volume_configuration]
+            return unless evc
+
+            context.efs_volume_configuration do |e|
+              e.file_system_id evc[:file_system_id]
+              e.root_directory evc[:root_directory] if evc[:root_directory]
+              e.transit_encryption evc[:transit_encryption] if evc[:transit_encryption]
+              e.transit_encryption_port evc[:transit_encryption_port] if evc[:transit_encryption_port]
+
+              configure_efs_authorization(e, evc)
+            end
+          end
+
+          def configure_efs_authorization(context, evc)
+            auth = evc[:authorization_config]
+            return unless auth
+
+            context.authorization_config do |a|
+              a.access_point_id auth[:access_point_id] if auth[:access_point_id]
+              a.iam auth[:iam] if auth[:iam]
+            end
+          end
+
+          def configure_fsx_volume(context, vol)
+            fsx = vol[:fsx_windows_file_server_volume_configuration]
+            return unless fsx
+
+            context.fsx_windows_file_server_volume_configuration do |f|
+              f.file_system_id fsx[:file_system_id]
+              f.root_directory fsx[:root_directory]
+
+              f.authorization_config do |a|
+                a.credentials_parameter fsx[:authorization_config][:credentials_parameter]
+                a.domain fsx[:authorization_config][:domain]
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_efs_access_point/resource.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/aws_efs_access_point/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Creates an AWS EFS Access Point for application-specific file system access
+      # 
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] Access point configuration
+      # @return [ResourceReference] Reference to the created access point
+      def aws_efs_access_point(name, attributes = {})
+        validated_attrs = Types::EfsAccessPointAttributes.new(attributes)
+        
+        resource_attributes = {
+          file_system_id: validated_attrs.file_system_id,
+          tags: validated_attrs.tags
+        }
+        
+        # Add POSIX user configuration if specified
+        if validated_attrs.posix_user
+          resource_attributes[:posix_user] = [validated_attrs.posix_user]
+        end
+        
+        # Add root directory configuration if specified
+        if validated_attrs.root_directory
+          root_dir = validated_attrs.root_directory.dup
+          
+          # Ensure path defaults to "/"
+          root_dir[:path] = "/" unless root_dir[:path]
+          
+          resource_attributes[:root_directory] = [root_dir]
+        end
+        
+        resource(:aws_efs_access_point, name, resource_attributes)
+        
+        ResourceReference.new(
+          type: :aws_efs_access_point,
+          name: name,
+          attributes: validated_attrs,
+          outputs: {
+            id: "${aws_efs_access_point.#{name}.id}",
+            arn: "${aws_efs_access_point.#{name}.arn}",
+            file_system_arn: "${aws_efs_access_point.#{name}.file_system_arn}",
+            file_system_id: "${aws_efs_access_point.#{name}.file_system_id}",
+            owner_id: "${aws_efs_access_point.#{name}.owner_id}",
+            root_directory_arn: "${aws_efs_access_point.#{name}.root_directory_arn}",
+            root_directory_path: "${aws_efs_access_point.#{name}.root_directory[0].path}",
+            posix_user_uid: "${aws_efs_access_point.#{name}.posix_user[0].uid}",
+            posix_user_gid: "${aws_efs_access_point.#{name}.posix_user[0].gid}",
+            tags_all: "${aws_efs_access_point.#{name}.tags_all}"
+          }
+        )
+      end
+    end
+  end
+end