pangea-aws 0.1.0

data/lib/pangea/resources/aws_eip/types.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Type-safe attributes for AWS Elastic IP resources
+        class EipAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          # Domain for the EIP ("vpc" or "standard")
+          attribute :domain, Resources::Types::String.default("vpc").enum("vpc", "standard")
+          
+          # Associate EIP with instance (optional)
+          attribute? :instance, Resources::Types::String.optional
+          
+          # Associate EIP with network interface (optional)
+          attribute? :network_interface, Resources::Types::String.optional
+          
+          # Associate EIP with private IP (optional)
+          attribute? :associate_with_private_ip, Resources::Types::String.optional
+          
+          # Use a customer-owned IP pool (optional)
+          attribute? :customer_owned_ipv4_pool, Resources::Types::String.optional
+          
+          # Network border group (optional)
+          attribute? :network_border_group, Resources::Types::String.optional
+          
+          # Public IPv4 pool (optional)
+          attribute? :public_ipv4_pool, Resources::Types::String.optional
+          
+          # Tags to apply to the resource
+          attribute :tags, Resources::Types::AwsTags.default({}.freeze)
+
+          # Custom validation
+          def self.new(attributes = {})
+            attrs = super(attributes)
+            
+            # Cannot specify both instance and network_interface
+            if attrs.instance && attrs.network_interface
+              raise Dry::Struct::Error, "Cannot specify both 'instance' and 'network_interface'"
+            end
+            
+            # associate_with_private_ip requires network_interface
+            if attrs.associate_with_private_ip && !attrs.network_interface
+              raise Dry::Struct::Error, "'associate_with_private_ip' requires 'network_interface' to be specified"
+            end
+            
+            # customer_owned_ipv4_pool requires specific configuration
+            if attrs.customer_owned_ipv4_pool && attrs.public_ipv4_pool
+              raise Dry::Struct::Error, "Cannot specify both 'customer_owned_ipv4_pool' and 'public_ipv4_pool'"
+            end
+            
+            attrs
+          end
+
+          # Check if EIP is for VPC
+          def vpc?
+            domain == "vpc"
+          end
+          
+          # Check if EIP is associated
+          def associated?
+            !instance.nil? || !network_interface.nil?
+          end
+          
+          # Check if using customer-owned IP
+          def customer_owned?
+            !customer_owned_ipv4_pool.nil?
+          end
+          
+          # Determine the association type
+          def association_type
+            if instance
+              :instance
+            elsif network_interface
+              :network_interface
+            else
+              :unassociated
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_eip_association/resource.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_eip_association/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Provides an AWS EIP Association as a top level resource, to associate and disassociate Elastic IPs from AWS Instances and Network Interfaces.
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] Resource attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_eip_association(name, attributes = {})
+        # Validate attributes using dry-struct
+        attrs = Types::EipAssociationAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_eip_association, name) do
+          allocation_id attrs.allocation_id if attrs.allocation_id
+          allow_reassociation attrs.allow_reassociation if attrs.allow_reassociation
+          instance_id attrs.instance_id if attrs.instance_id
+          network_interface_id attrs.network_interface_id if attrs.network_interface_id
+          private_ip_address attrs.private_ip_address if attrs.private_ip_address
+          public_ip attrs.public_ip if attrs.public_ip
+          
+          # Apply tags if present
+          if attrs.tags&.any?
+            tags do
+              attrs.tags.each do |key, value|
+                public_send(key, value)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_eip_association',
+          name: name,
+          resource_attributes: attrs.to_h,
+          outputs: {
+            id: "${aws_eip_association.#{name}.id}",
+            allocation_id: "${aws_eip_association.#{name}.allocation_id}",
+            instance_id: "${aws_eip_association.#{name}.instance_id}",
+            network_interface_id: "${aws_eip_association.#{name}.network_interface_id}",
+            private_ip_address: "${aws_eip_association.#{name}.private_ip_address}",
+            public_ip: "${aws_eip_association.#{name}.public_ip}"
+          },
+          computed_properties: {
+            # Computed properties from type definitions
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_eip_association/types.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+      # Type-safe attributes for AwsEipAssociation resources
+      # Provides an AWS EIP Association as a top level resource, to associate and disassociate Elastic IPs from AWS Instances and Network Interfaces.
+      class EipAssociationAttributes < Pangea::Resources::BaseAttributes
+        attribute? :allocation_id, Resources::Types::String.optional
+        attribute? :allow_reassociation, Resources::Types::Bool.optional
+        attribute? :instance_id, Resources::Types::String.optional
+        attribute? :network_interface_id, Resources::Types::String.optional
+        attribute? :private_ip_address, Resources::Types::String.optional
+        attribute? :public_ip, Resources::Types::String.optional
+        
+        # Tags to apply to the resource
+        attribute :tags, Resources::Types::AwsTags.default({}.freeze)
+
+        # Custom validation
+        def self.new(attributes = {})
+          attrs = super(attributes)
+          
+          # Either allocation_id or public_ip must be specified
+          # Cannot specify both instance_id and network_interface_id
+          # private_ip_address requires network_interface_id
+          # Either allocation_id or public_ip must be specified
+if !attrs.allocation_id && !attrs.public_ip
+  raise Dry::Struct::Error, "Either 'allocation_id' or 'public_ip' must be specified"
+end
+
+# Cannot specify both instance_id and network_interface_id
+if attrs.instance_id && attrs.network_interface_id
+  raise Dry::Struct::Error, "Cannot specify both 'instance_id' and 'network_interface_id'"
+end
+
+# private_ip_address requires network_interface_id
+if attrs.private_ip_address && !attrs.network_interface_id
+  raise Dry::Struct::Error, "'private_ip_address' requires 'network_interface_id'"
+end
+
+          
+          attrs
+        end
+        
+        # Check if using VPC allocation
+def vpc_allocation?
+  !allocation_id.nil?
+end
+
+# Check if using EC2-Classic
+def ec2_classic?
+  !public_ip.nil? && allocation_id.nil?
+end
+
+# Determine association target
+def target_type
+  if instance_id
+    :instance
+  elsif network_interface_id
+    :network_interface
+  else
+    :none
+  end
+end
+
+      end
+    end
+      end
+    end
+  end

data/lib/pangea/resources/aws_eks_access_entry/resource.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_eks_access_entry/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS EKS Access Entry with type-safe attributes
+      #
+      # EKS Access Entries provide fine-grained access control for EKS clusters.
+      # They define which IAM principals can access the cluster and what Kubernetes
+      # groups they belong to, replacing the aws-auth ConfigMap for access management.
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] EKS access entry attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_eks_access_entry(name, attributes = {})
+        # Validate attributes using dry-struct
+        entry_attrs = EksAccessEntry::Types::EksAccessEntryAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_eks_access_entry, name) do
+          # Required attributes
+          cluster_name entry_attrs.cluster_name
+          principal_arn entry_attrs.principal_arn
+          
+          # Optional attributes
+          kubernetes_groups entry_attrs.kubernetes_groups if entry_attrs.kubernetes_groups
+          type entry_attrs.type if entry_attrs.type
+          user_name entry_attrs.user_name if entry_attrs.user_name
+          
+          # Apply tags
+          if entry_attrs.tags&.any?
+            tags do
+              entry_attrs.tags.each do |key, value|
+                public_send(key, value)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_eks_access_entry',
+          name: name,
+          resource_attributes: entry_attrs.to_h,
+          outputs: {
+            id: "${aws_eks_access_entry.#{name}.id}",
+            access_entry_arn: "${aws_eks_access_entry.#{name}.access_entry_arn}",
+            cluster_name: "${aws_eks_access_entry.#{name}.cluster_name}",
+            created_at: "${aws_eks_access_entry.#{name}.created_at}",
+            modified_at: "${aws_eks_access_entry.#{name}.modified_at}",
+            principal_arn: "${aws_eks_access_entry.#{name}.principal_arn}",
+            tags_all: "${aws_eks_access_entry.#{name}.tags_all}"
+          },
+          computed: {
+            principal_name: entry_attrs.principal_name,
+            principal_type: entry_attrs.principal_type,
+            account_id: entry_attrs.account_id,
+            has_kubernetes_groups: entry_attrs.has_kubernetes_groups?,
+            has_custom_username: entry_attrs.has_custom_username?,
+            standard_type: entry_attrs.standard_type?,
+            fargate_type: entry_attrs.fargate_type?,
+            ec2_linux_type: entry_attrs.ec2_linux_type?,
+            ec2_windows_type: entry_attrs.ec2_windows_type?,
+            kubernetes_groups_count: entry_attrs.kubernetes_groups_count
+          }
+        )
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_eks_access_entry/types.rb

@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+
+module Pangea
+  module Resources
+    module AWS
+      module EksAccessEntry
+        # Common types for EKS Access Entry configurations
+        module Types
+          # EKS Cluster Name constraint
+          ClusterName = Resources::Types::String.constrained(
+            min_size: 1,
+            max_size: 100,
+            format: /\A[a-zA-Z0-9\-_]+\z/
+          )
+          
+          # IAM Principal ARN constraint
+          PrincipalArn = Resources::Types::String.constrained(
+            format: /\Aarn:aws:iam::[0-9]{12}:(user|role)\/[a-zA-Z0-9+=,.@\-_\/]+\z/
+          )
+          
+          # Access entry type
+          AccessEntryType = Resources::Types::String.constrained(included_in: ['STANDARD', 'FARGATE_LINUX', 'EC2_LINUX', 'EC2_WINDOWS'])
+          
+          # Kubernetes groups
+          KubernetesGroup = Resources::Types::String.constrained(min_size: 1, max_size: 63)
+        end
+
+        # EKS Access Entry attributes with comprehensive validation
+        class EksAccessEntryAttributes < Pangea::Resources::BaseAttributes
+          # Required attributes
+          attribute? :cluster_name, Types::ClusterName.optional
+          attribute? :principal_arn, Types::PrincipalArn.optional
+          
+          # Optional attributes
+          attribute? :kubernetes_groups, Resources::Types::Array.of(Types::KubernetesGroup).optional
+          attribute? :type, Types::AccessEntryType.optional
+          attribute? :user_name, Resources::Types::String.optional
+          attribute? :tags, Resources::Types::Hash.map(Resources::Types::String, Resources::Types::String).default({}.freeze)
+          
+          # Computed properties
+          def principal_name
+            principal_arn.split('/')[-1]
+          end
+          
+          def principal_type
+            if principal_arn.include?('user/')
+              'user'
+            elsif principal_arn.include?('role/')
+              'role'
+            else
+              'unknown'
+            end
+          end
+          
+          def account_id
+            principal_arn.split(':')[4]
+          end
+          
+          def has_kubernetes_groups?
+            kubernetes_groups && kubernetes_groups.any?
+          end
+          
+          def has_custom_username?
+            !user_name.nil?
+          end
+          
+          def standard_type?
+            type == 'STANDARD' || type.nil?
+          end
+          
+          def fargate_type?
+            type == 'FARGATE_LINUX'
+          end
+          
+          def ec2_linux_type?
+            type == 'EC2_LINUX'
+          end
+          
+          def ec2_windows_type?
+            type == 'EC2_WINDOWS'
+          end
+          
+          def kubernetes_groups_count
+            kubernetes_groups&.length || 0
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_eks_addon/resource.rb

@@ -0,0 +1,150 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_eks_addon/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS EKS Add-on with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] EKS add-on attributes
+      # @option attributes [String] :cluster_name EKS cluster name (required)
+      # @option attributes [String] :addon_name Add-on name (required)
+      # @option attributes [String] :addon_version Specific add-on version
+      # @option attributes [String] :service_account_role_arn IAM role for service account
+      # @option attributes [String] :resolve_conflicts Conflict resolution strategy
+      # @option attributes [String] :resolve_conflicts_on_create Create-time conflict resolution
+      # @option attributes [String] :resolve_conflicts_on_update Update-time conflict resolution
+      # @option attributes [String] :configuration_values JSON configuration values
+      # @option attributes [Boolean] :preserve Preserve add-on on deletion
+      # @option attributes [Hash] :tags Resource tags
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      #
+      # @example Basic VPC CNI add-on
+      #   vpc_cni = aws_eks_addon(:vpc_cni, {
+      #     cluster_name: cluster.name,
+      #     addon_name: "vpc-cni",
+      #     addon_version: "v1.12.6-eksbuild.2"
+      #   })
+      #
+      # @example EBS CSI driver with IAM role
+      #   ebs_csi = aws_eks_addon(:ebs_csi, {
+      #     cluster_name: cluster.name,
+      #     addon_name: "aws-ebs-csi-driver",
+      #     addon_version: "v1.28.0-eksbuild.1",
+      #     service_account_role_arn: ebs_csi_role.arn,
+      #     resolve_conflicts_on_create: "OVERWRITE",
+      #     tags: {
+      #       Purpose: "persistent-storage"
+      #     }
+      #   })
+      #
+      # @example CoreDNS with custom configuration
+      #   coredns = aws_eks_addon(:coredns, {
+      #     cluster_name: cluster.name,
+      #     addon_name: "coredns",
+      #     configuration_values: ::JSON.generate({
+      #       computeType: "Fargate",
+      #       replicaCount: 3,
+      #       resources: {
+      #         limits: {
+      #           cpu: "100m",
+      #           memory: "150Mi"
+      #         }
+      #       }
+      #     })
+      #   })
+      #
+      # @example GuardDuty agent for security monitoring
+      #   guardduty = aws_eks_addon(:guardduty, {
+      #     cluster_name: cluster.name,
+      #     addon_name: "aws-guardduty-agent",
+      #     service_account_role_arn: guardduty_role.arn,
+      #     resolve_conflicts: "OVERWRITE",
+      #     preserve: false
+      #   })
+      def aws_eks_addon(name, attributes = {})
+        # Validate attributes using dry-struct
+        addon_attrs = Types::EksAddonAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_eks_addon, name) do
+          # Required attributes
+          cluster_name addon_attrs.cluster_name
+          addon_name addon_attrs.addon_name
+          
+          # Optional version
+          addon_version addon_attrs.addon_version if addon_attrs.addon_version
+          
+          # Service account IAM role
+          service_account_role_arn addon_attrs.service_account_role_arn if addon_attrs.service_account_role_arn
+          
+          # Conflict resolution strategy
+          if addon_attrs.resolve_conflicts_on_create || addon_attrs.resolve_conflicts_on_update
+            resolve_conflicts_on_create addon_attrs.resolve_conflicts_on_create if addon_attrs.resolve_conflicts_on_create
+            resolve_conflicts_on_update addon_attrs.resolve_conflicts_on_update if addon_attrs.resolve_conflicts_on_update
+          elsif addon_attrs.resolve_conflicts != 'NONE'
+            resolve_conflicts addon_attrs.resolve_conflicts
+          end
+          
+          # Configuration values
+          configuration_values addon_attrs.configuration_values if addon_attrs.configuration_values
+          
+          # Preservation setting
+          preserve addon_attrs.preserve if addon_attrs.preserve != true
+          
+          # Tags
+          tags addon_attrs.tags if addon_attrs.tags&.any?
+        end
+        
+        # Create resource reference
+        ref = ResourceReference.new(
+          type: 'aws_eks_addon',
+          name: name,
+          resource_attributes: addon_attrs.to_h,
+          outputs: {
+            id: "${aws_eks_addon.#{name}.id}",
+            arn: "${aws_eks_addon.#{name}.arn}",
+            addon_version: "${aws_eks_addon.#{name}.addon_version}",
+            created_at: "${aws_eks_addon.#{name}.created_at}",
+            modified_at: "${aws_eks_addon.#{name}.modified_at}",
+            status: "${aws_eks_addon.#{name}.status}",
+            configuration_values: "${aws_eks_addon.#{name}.configuration_values}",
+            tags_all: "${aws_eks_addon.#{name}.tags_all}"
+          }
+        )
+        
+        # Add computed properties via method delegation
+        ref.define_singleton_method(:addon_name) { addon_attrs.addon_name }
+        ref.define_singleton_method(:service_account) { addon_attrs.service_account_name }
+        ref.define_singleton_method(:namespace) { addon_attrs.namespace }
+        ref.define_singleton_method(:requires_iam_role?) { addon_attrs.requires_iam_role? }
+        ref.define_singleton_method(:is_compute_addon?) { addon_attrs.is_compute_addon? }
+        ref.define_singleton_method(:is_storage_addon?) { addon_attrs.is_storage_addon? }
+        ref.define_singleton_method(:is_networking_addon?) { addon_attrs.is_networking_addon? }
+        ref.define_singleton_method(:is_observability_addon?) { addon_attrs.is_observability_addon? }
+        ref.define_singleton_method(:addon_description) { addon_attrs.addon_info&.dig(:description) }
+        
+        ref
+      end
+    end
+  end
+end