pangea-aws 0.1.0

data/lib/pangea/resources/aws_eks_addon/types.rb

@@ -0,0 +1,198 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # EKS addon attributes with validation
+        class EksAddonAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          # Supported EKS add-ons and their configuration
+          SUPPORTED_ADDONS = {
+            'vpc-cni' => {
+              versions: ['v1.12.6-eksbuild.2', 'v1.12.5-eksbuild.2', 'v1.12.2-eksbuild.1', 'v1.11.4-eksbuild.1'],
+              service_account: 'aws-node',
+              namespace: 'kube-system',
+              description: 'Amazon VPC CNI plugin for Kubernetes'
+            },
+            'coredns' => {
+              versions: ['v1.10.1-eksbuild.7', 'v1.10.1-eksbuild.6', 'v1.10.1-eksbuild.4', 'v1.9.3-eksbuild.11'],
+              service_account: 'coredns',
+              namespace: 'kube-system',
+              description: 'CoreDNS DNS server for Kubernetes'
+            },
+            'kube-proxy' => {
+              versions: ['v1.29.0-eksbuild.3', 'v1.28.5-eksbuild.3', 'v1.27.9-eksbuild.3', 'v1.26.12-eksbuild.3'],
+              service_account: 'kube-proxy',
+              namespace: 'kube-system',
+              description: 'Kubernetes network proxy'
+            },
+            'aws-ebs-csi-driver' => {
+              versions: ['v1.28.0-eksbuild.1', 'v1.27.0-eksbuild.1', 'v1.26.1-eksbuild.1', 'v1.25.0-eksbuild.1'],
+              service_account: 'ebs-csi-controller-sa',
+              namespace: 'kube-system',
+              description: 'Amazon EBS CSI driver'
+            },
+            'aws-efs-csi-driver' => {
+              versions: ['v1.7.4-eksbuild.1', 'v1.7.1-eksbuild.1', 'v1.6.0-eksbuild.1', 'v1.5.9-eksbuild.1'],
+              service_account: 'efs-csi-controller-sa',
+              namespace: 'kube-system',
+              description: 'Amazon EFS CSI driver'
+            },
+            'aws-guardduty-agent' => {
+              versions: ['v1.4.0-eksbuild.1', 'v1.3.0-eksbuild.1', 'v1.2.0-eksbuild.1'],
+              service_account: 'aws-guardduty-agent',
+              namespace: 'amazon-guardduty',
+              description: 'AWS GuardDuty security monitoring agent'
+            },
+            'aws-mountpoint-s3-csi-driver' => {
+              versions: ['v1.0.0-eksbuild.1'],
+              service_account: 's3-csi-driver-sa',
+              namespace: 'kube-system',
+              description: 'Amazon S3 CSI driver using Mountpoint'
+            },
+            'snapshot-controller' => {
+              versions: ['v6.3.2-eksbuild.1', 'v6.2.2-eksbuild.1'],
+              service_account: 'snapshot-controller',
+              namespace: 'kube-system',
+              description: 'Kubernetes volume snapshot controller'
+            },
+            'adot' => {
+              versions: ['v0.90.0-eksbuild.1', 'v0.88.0-eksbuild.1'],
+              service_account: 'aws-otel-sa',
+              namespace: 'aws-otel-system',
+              description: 'AWS Distro for OpenTelemetry'
+            }
+          }.freeze
+          
+          RESOLVE_CONFLICTS_OPTIONS = %w[OVERWRITE NONE PRESERVE].freeze
+          
+          # Required attributes
+          attribute? :cluster_name, Pangea::Resources::Types::String.optional
+          attribute? :addon_name, Pangea::Resources::Types::String.constrained(included_in: SUPPORTED_ADDONS.keys).optional
+          
+          # Optional attributes
+          attribute :addon_version, Pangea::Resources::Types::String.optional.default(nil)
+          attribute :service_account_role_arn, Pangea::Resources::Types::String.optional.default(nil).constrained(
+            format: /\Aarn:aws:iam::\d{12}:role\/.+\z/
+          )
+          attribute :resolve_conflicts, Pangea::Resources::Types::String.constrained(included_in: RESOLVE_CONFLICTS_OPTIONS).default('NONE')
+          attribute :resolve_conflicts_on_create, Pangea::Resources::Types::String.optional.constrained(included_in: RESOLVE_CONFLICTS_OPTIONS).default(nil)
+          attribute :resolve_conflicts_on_update, Pangea::Resources::Types::String.optional.constrained(included_in: RESOLVE_CONFLICTS_OPTIONS).default(nil)
+          attribute :configuration_values, Pangea::Resources::Types::String.optional.default(nil)
+          attribute :preserve, Pangea::Resources::Types::Bool.default(true)
+          attribute :tags, Pangea::Resources::Types::Hash.default({}.freeze)
+          
+          # Validate version if specified
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+            
+            # Validate addon version if specified
+            if attrs[:addon_version] && attrs[:addon_name]
+              addon_info = SUPPORTED_ADDONS[attrs[:addon_name]]
+              if addon_info && !addon_info[:versions].include?(attrs[:addon_version])
+                raise Dry::Struct::Error, "Invalid version '#{attrs[:addon_version]}' for addon '#{attrs[:addon_name]}'. " \
+                  "Supported versions: #{addon_info[:versions].join(', ')}"
+              end
+            end
+            
+            # Validate configuration_values is valid JSON if provided
+            if attrs[:configuration_values]
+              begin
+                require 'json'
+                ::JSON.parse(attrs[:configuration_values])
+              rescue ::JSON::ParserError => e
+                raise Dry::Struct::Error, "configuration_values must be valid JSON: #{e.message}"
+              end
+            end
+            
+            # Validate resolve_conflicts options
+            if attrs[:resolve_conflicts_on_create] && attrs[:resolve_conflicts]
+              raise Dry::Struct::Error, "Cannot specify both resolve_conflicts and resolve_conflicts_on_create"
+            end
+            
+            if attrs[:resolve_conflicts_on_update] && attrs[:resolve_conflicts]
+              raise Dry::Struct::Error, "Cannot specify both resolve_conflicts and resolve_conflicts_on_update"
+            end
+            
+            super(attrs)
+          end
+          
+          # Computed properties
+          def addon_info
+            SUPPORTED_ADDONS[addon_name]
+          end
+          
+          def service_account_name
+            addon_info[:service_account]
+          end
+          
+          def namespace
+            addon_info[:namespace]
+          end
+          
+          def requires_iam_role?
+            %w[vpc-cni aws-ebs-csi-driver aws-efs-csi-driver aws-guardduty-agent aws-mountpoint-s3-csi-driver adot].include?(addon_name)
+          end
+          
+          def is_compute_addon?
+            %w[vpc-cni kube-proxy].include?(addon_name)
+          end
+          
+          def is_storage_addon?
+            %w[aws-ebs-csi-driver aws-efs-csi-driver aws-mountpoint-s3-csi-driver snapshot-controller].include?(addon_name)
+          end
+          
+          def is_networking_addon?
+            %w[vpc-cni coredns].include?(addon_name)
+          end
+          
+          def is_observability_addon?
+            %w[adot aws-guardduty-agent].include?(addon_name)
+          end
+          
+          def to_h
+            hash = {
+              cluster_name: cluster_name,
+              addon_name: addon_name,
+              preserve: preserve
+            }
+            
+            hash[:addon_version] = addon_version if addon_version
+            hash[:service_account_role_arn] = service_account_role_arn if service_account_role_arn
+            
+            # Handle resolve conflicts
+            if resolve_conflicts_on_create || resolve_conflicts_on_update
+              hash[:resolve_conflicts_on_create] = resolve_conflicts_on_create if resolve_conflicts_on_create
+              hash[:resolve_conflicts_on_update] = resolve_conflicts_on_update if resolve_conflicts_on_update
+            else
+              hash[:resolve_conflicts] = resolve_conflicts
+            end
+            
+            hash[:configuration_values] = configuration_values if configuration_values
+            hash[:tags] = tags if tags.any?
+            
+            hash
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_eks_cluster/resource.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_eks_cluster/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS EKS Cluster with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] EKS cluster attributes
+      # @option attributes [String] :name Custom cluster name (optional, defaults to resource name)
+      # @option attributes [String] :role_arn IAM role ARN for the cluster (required)
+      # @option attributes [Hash] :vpc_config VPC configuration (required)
+      # @option attributes [String] :version Kubernetes version (defaults to 1.28)
+      # @option attributes [Array<String>] :enabled_cluster_log_types Log types to enable
+      # @option attributes [Array<Hash>] :encryption_config Encryption configuration
+      # @option attributes [Hash] :kubernetes_network_config Kubernetes network config
+      # @option attributes [Hash] :tags Resource tags
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      #
+      # @example Basic EKS cluster
+      #   cluster = aws_eks_cluster(:main, {
+      #     role_arn: eks_cluster_role.arn,
+      #     version: "1.28",
+      #     vpc_config: {
+      #       subnet_ids: [subnet_a.id, subnet_b.id],
+      #       endpoint_private_access: true,
+      #       endpoint_public_access: true,
+      #       public_access_cidrs: ["10.0.0.0/8"]
+      #     }
+      #   })
+      #
+      # @example EKS cluster with logging and encryption
+      #   cluster = aws_eks_cluster(:production, {
+      #     role_arn: cluster_role.arn,
+      #     version: "1.29",
+      #     vpc_config: {
+      #       subnet_ids: private_subnet_ids,
+      #       security_group_ids: [cluster_sg.id],
+      #       endpoint_private_access: true,
+      #       endpoint_public_access: false
+      #     },
+      #     enabled_cluster_log_types: ["api", "audit", "authenticator"],
+      #     encryption_config: [{
+      #       resources: ["secrets"],
+      #       provider: { key_arn: kms_key.arn }
+      #     }],
+      #     kubernetes_network_config: {
+      #       service_ipv4_cidr: "172.20.0.0/16",
+      #       ip_family: "ipv4"
+      #     },
+      #     tags: {
+      #       Environment: "production",
+      #       ManagedBy: "terraform"
+      #     }
+      #   })
+      def aws_eks_cluster(name, attributes = {})
+        # Validate attributes using dry-struct
+        cluster_attrs = Types::EksClusterAttributes.new(attributes)
+        
+        # Build resource attributes as a hash
+        resource_attrs = {
+          role_arn: cluster_attrs.role_arn,
+          version: cluster_attrs.version,
+          vpc_config: cluster_attrs.vpc_config.to_h
+        }
+
+        resource_attrs[:name] = cluster_attrs.name if cluster_attrs.name
+        resource_attrs[:enabled_cluster_log_types] = cluster_attrs.enabled_cluster_log_types if cluster_attrs.enabled_cluster_log_types&.any?
+
+        if cluster_attrs.encryption_config&.any?
+          resource_attrs[:encryption_config] = cluster_attrs.encryption_config.map(&:to_h)
+        end
+
+        if cluster_attrs.kubernetes_network_config
+          resource_attrs[:kubernetes_network_config] = cluster_attrs.kubernetes_network_config.to_h
+        end
+
+        resource_attrs[:tags] = cluster_attrs.tags if cluster_attrs.tags&.any?
+
+        # Write to manifest: direct access for synthesizer (supports arrays/hashes),
+        # fall back to resource() for test mocks
+        if is_a?(AbstractSynthesizer)
+          translation[:manifest][:resource] ||= {}
+          translation[:manifest][:resource][:aws_eks_cluster] ||= {}
+          translation[:manifest][:resource][:aws_eks_cluster][name] = resource_attrs
+        else
+          resource(:aws_eks_cluster, name, resource_attrs)
+        end
+        
+        # Return resource reference with available outputs
+        # Create resource reference
+        ref = ResourceReference.new(
+          type: 'aws_eks_cluster',
+          name: name,
+          resource_attributes: cluster_attrs.to_h,
+          outputs: {
+            id: "${aws_eks_cluster.#{name}.id}",
+            arn: "${aws_eks_cluster.#{name}.arn}",
+            name: "${aws_eks_cluster.#{name}.name}",
+            endpoint: "${aws_eks_cluster.#{name}.endpoint}",
+            platform_version: "${aws_eks_cluster.#{name}.platform_version}",
+            version: "${aws_eks_cluster.#{name}.version}",
+            status: "${aws_eks_cluster.#{name}.status}",
+            role_arn: "${aws_eks_cluster.#{name}.role_arn}",
+            vpc_config: "${aws_eks_cluster.#{name}.vpc_config}",
+            identity: "${aws_eks_cluster.#{name}.identity}",
+            certificate_authority: "${aws_eks_cluster.#{name}.certificate_authority}",
+            certificate_authority_data: "${aws_eks_cluster.#{name}.certificate_authority[0].data}",
+            created_at: "${aws_eks_cluster.#{name}.created_at}"
+          }
+        )
+        
+        # Add computed properties via method delegation
+        ref.define_singleton_method(:encryption_enabled?) { cluster_attrs.encryption_enabled? }
+        ref.define_singleton_method(:logging_enabled?) { cluster_attrs.logging_enabled? }
+        ref.define_singleton_method(:private_endpoint?) { cluster_attrs.private_endpoint? }
+        ref.define_singleton_method(:public_endpoint?) { cluster_attrs.public_endpoint? }
+        ref.define_singleton_method(:log_types) { cluster_attrs.enabled_cluster_log_types }
+        
+        ref
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_eks_cluster/types.rb

@@ -0,0 +1,186 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # EKS cluster encryption configuration
+        class EncryptionConfig < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          attribute? :resources, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).constrained(
+            min_size: 1,
+            max_size: 1
+          ).default(['secrets'].freeze)
+          
+          # Provider configuration for encryption
+          class Provider < Pangea::Resources::BaseAttributes
+            transform_keys(&:to_sym)
+            
+            attribute? :key_arn, Pangea::Resources::Types::String
+            
+            def to_h
+              { key_arn: key_arn }
+            end
+          end
+          
+          attribute? :provider, Provider.optional
+          
+          def to_h
+            {
+              resources: resources,
+              provider: provider.to_h
+            }
+          end
+        end
+        
+        # VPC configuration for EKS cluster
+        class VpcConfig < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          attribute? :subnet_ids, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).constrained(
+            min_size: 2
+          )
+          attribute :security_group_ids, Pangea::Resources::Types::Array.of(Pangea::Resources::Types::String).default([].freeze)
+          attribute :endpoint_private_access, Pangea::Resources::Types::Bool.default(false)
+          attribute :endpoint_public_access, Pangea::Resources::Types::Bool.default(true)
+          attribute? :public_access_cidrs, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::String.constrained(format: /\A\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}\z/)
+          ).default(['0.0.0.0/0'].freeze)
+          
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+            
+            # Validate subnet count
+            if attrs[:subnet_ids] && attrs[:subnet_ids].size < 2
+              raise Dry::Struct::Error, "EKS cluster requires at least 2 subnets in different availability zones"
+            end
+            
+            # Validate public access configuration
+            if attrs[:endpoint_public_access] == false && attrs[:endpoint_private_access] == false
+              raise Dry::Struct::Error, "At least one of endpoint_public_access or endpoint_private_access must be true"
+            end
+            
+            super(attrs)
+          end
+          
+          def to_h
+            hash = {
+              subnet_ids: subnet_ids,
+              endpoint_private_access: endpoint_private_access,
+              endpoint_public_access: endpoint_public_access
+            }
+            
+            hash[:security_group_ids] = security_group_ids if security_group_ids.any?
+            hash[:public_access_cidrs] = public_access_cidrs if endpoint_public_access
+            
+            hash
+          end
+        end
+        
+        # Kubernetes network configuration
+        class KubernetesNetworkConfig < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          attribute :service_ipv4_cidr, Pangea::Resources::Types::String.optional.default(nil)
+          attribute :ip_family, Pangea::Resources::Types::String.default('ipv4').constrained(included_in: ['ipv4', 'ipv6'])
+          
+          def to_h
+            hash = { ip_family: ip_family }
+            hash[:service_ipv4_cidr] = service_ipv4_cidr if service_ipv4_cidr
+            hash
+          end
+        end
+        
+        # EKS cluster logging configuration
+        class ClusterLogging < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          VALID_LOG_TYPES = %w[api audit authenticator controllerManager scheduler].freeze
+          
+          attribute? :enabled_types, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::String.constrained(included_in: VALID_LOG_TYPES)
+          ).default([].freeze)
+          
+          def to_h
+            return {} if enabled_types.empty?
+            
+            {
+              enabled_cluster_log_types: enabled_types.map { |type| { types: [type], enabled: true } }
+            }
+          end
+        end
+        
+        # EKS cluster attributes with validation
+        class EksClusterAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          SUPPORTED_VERSIONS = %w[1.24 1.25 1.26 1.27 1.28 1.29].freeze
+          
+          # Required attributes
+          attribute :name, Pangea::Resources::Types::String.optional.default(nil)
+          attribute? :role_arn, Pangea::Resources::Types::String
+          attribute? :vpc_config, VpcConfig.optional
+          
+          # Optional attributes
+          attribute :version, Pangea::Resources::Types::String.constrained(included_in: SUPPORTED_VERSIONS).default('1.28')
+          attribute? :enabled_cluster_log_types, Pangea::Resources::Types::Array.of(
+            Pangea::Resources::Types::String.constrained(included_in: ClusterLogging::VALID_LOG_TYPES)
+          ).default([].freeze)
+          attribute :encryption_config, Pangea::Resources::Types::Array.of(EncryptionConfig).default([].freeze)
+          attribute :kubernetes_network_config, KubernetesNetworkConfig.optional.default(nil)
+          attribute :tags, Pangea::Resources::Types::Hash.default({}.freeze)
+          
+          # Computed properties
+          def encryption_enabled?
+            encryption_config.any?
+          end
+          
+          def logging_enabled?
+            enabled_cluster_log_types.any?
+          end
+          
+          def private_endpoint?
+            vpc_config.endpoint_private_access
+          end
+          
+          def public_endpoint?
+            vpc_config.endpoint_public_access
+          end
+          
+          def to_h
+            hash = {
+              role_arn: role_arn,
+              version: version,
+              vpc_config: vpc_config.to_h
+            }
+            
+            hash[:name] = name if name
+            hash[:enabled_cluster_log_types] = enabled_cluster_log_types if enabled_cluster_log_types.any?
+            hash[:encryption_config] = encryption_config.map(&:to_h) if encryption_config.any?
+            hash[:kubernetes_network_config] = kubernetes_network_config.to_h if kubernetes_network_config
+            hash[:tags] = tags if tags.any?
+            
+            hash
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_eks_fargate_profile/resource.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_eks_fargate_profile/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS EKS Fargate Profile with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] EKS Fargate profile attributes
+      # @option attributes [String] :cluster_name EKS cluster name (required)
+      # @option attributes [String] :fargate_profile_name Custom profile name
+      # @option attributes [String] :pod_execution_role_arn IAM role for pods (required)
+      # @option attributes [Array<Hash>] :selectors Pod selectors (required, 1-5 selectors)
+      # @option attributes [Array<String>] :subnet_ids Private subnet IDs
+      # @option attributes [Hash] :tags Resource tags
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      #
+      # @example Basic Fargate profile for default namespace
+      #   fargate_default = aws_eks_fargate_profile(:default, {
+      #     cluster_name: cluster.name,
+      #     pod_execution_role_arn: fargate_role.arn,
+      #     selectors: [{
+      #       namespace: "default"
+      #     }]
+      #   })
+      #
+      # @example Fargate profile with multiple selectors and labels
+      #   fargate_apps = aws_eks_fargate_profile(:apps, {
+      #     cluster_name: cluster.name,
+      #     pod_execution_role_arn: fargate_role.arn,
+      #     subnet_ids: private_subnet_ids,
+      #     selectors: [
+      #       {
+      #         namespace: "production",
+      #         labels: { compute: "fargate", tier: "web" }
+      #       },
+      #       {
+      #         namespace: "staging",
+      #         labels: { compute: "fargate" }
+      #       },
+      #       {
+      #         namespace: "kube-system",
+      #         labels: { k8s_app: "kube-dns" }
+      #       }
+      #     ],
+      #     tags: {
+      #       Environment: "production",
+      #       ManagedBy: "terraform"
+      #     }
+      #   })
+      #
+      # @example System workloads on Fargate
+      #   fargate_system = aws_eks_fargate_profile(:system, {
+      #     fargate_profile_name: "system-workloads",
+      #     cluster_name: cluster.name,
+      #     pod_execution_role_arn: fargate_role.arn,
+      #     selectors: [
+      #       { namespace: "kube-system", labels: { k8s_app: "kube-dns" } },
+      #       { namespace: "cert-manager" },
+      #       { namespace: "external-dns" }
+      #     ]
+      #   })
+      #
+      # @example Batch processing workloads
+      #   fargate_batch = aws_eks_fargate_profile(:batch, {
+      #     cluster_name: cluster.name,
+      #     pod_execution_role_arn: fargate_role.arn,
+      #     subnet_ids: private_subnet_ids,
+      #     selectors: [{
+      #       namespace: "batch-jobs",
+      #       labels: {
+      #         workload: "batch",
+      #         compute: "serverless"
+      #       }
+      #     }]
+      #   })
+      def aws_eks_fargate_profile(name, attributes = {})
+        # Validate attributes using dry-struct
+        profile_attrs = Types::EksFargateProfileAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_eks_fargate_profile, name) do
+          # Required attributes
+          cluster_name profile_attrs.cluster_name
+          pod_execution_role_arn profile_attrs.pod_execution_role_arn
+          
+          # Optional custom name
+          fargate_profile_name profile_attrs.fargate_profile_name if profile_attrs.fargate_profile_name
+          
+          # Subnet IDs (optional - uses cluster subnets if not specified)
+          subnet_ids profile_attrs.subnet_ids if profile_attrs.subnet_ids
+          
+          # Selectors - convert array of selectors to blocks
+          profile_attrs.selectors.each do |selector_config|
+            selector do
+              namespace selector_config.namespace
+              labels selector_config.labels if selector_config.labels.any?
+            end
+          end
+          
+          # Tags
+          tags profile_attrs.tags if profile_attrs.tags&.any?
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_eks_fargate_profile',
+          name: name,
+          resource_attributes: profile_attrs.to_h,
+          outputs: {
+            id: "${aws_eks_fargate_profile.#{name}.id}",
+            arn: "${aws_eks_fargate_profile.#{name}.arn}",
+            cluster_name: "${aws_eks_fargate_profile.#{name}.cluster_name}",
+            fargate_profile_name: "${aws_eks_fargate_profile.#{name}.fargate_profile_name}",
+            pod_execution_role_arn: "${aws_eks_fargate_profile.#{name}.pod_execution_role_arn}",
+            subnet_ids: "${aws_eks_fargate_profile.#{name}.subnet_ids}",
+            status: "${aws_eks_fargate_profile.#{name}.status}",
+            tags_all: "${aws_eks_fargate_profile.#{name}.tags_all}"
+          },
+          computed_properties: {
+            namespaces: profile_attrs.namespaces,
+            has_labels: profile_attrs.has_labels?,
+            selector_count: profile_attrs.selector_count,
+            selectors: profile_attrs.selectors.map(&:to_h)
+          }
+        )
+      end
+    end
+  end
+end