pangea-aws 0.1.0

data/lib/pangea/resources/aws_guardduty_member/types.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # GuardDuty Member attributes with validation
+        class GuardDutyMemberAttributes < Pangea::Resources::BaseAttributes
+          transform_keys(&:to_sym)
+          
+          attribute? :account_id, Resources::Types::AwsAccountId.optional
+          attribute? :detector_id, Resources::Types::String.optional
+          attribute? :email, Resources::Types::GuardDutyInvitationEmail.optional
+          attribute :invite, Resources::Types::Bool.default(true)
+          attribute? :invitation_message, Resources::Types::String.constrained(max_size: 1000).optional
+          attribute :disable_email_notification, Resources::Types::Bool.default(false)
+          
+          # Custom validation
+          def self.new(attributes)
+            attrs = attributes.is_a?(::Hash) ? attributes : {}
+            
+            # If not inviting, email notification settings don't matter
+            if attrs[:invite] == false && attrs[:disable_email_notification] == true
+              # This is redundant but valid
+            end
+            
+            super(attrs)
+          end
+          
+          # Computed properties  
+          def will_send_invitation?
+            invite && !disable_email_notification
+          end
+          
+          def invitation_enabled?
+            invite
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_iam_group/resource.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_iam_group/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS IAM Group with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] IAM group attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_iam_group(name, attributes = {})
+        # Validate attributes using dry-struct
+        group_attrs = Types::IamGroupAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_iam_group, name) do
+          name group_attrs.name
+          path group_attrs.path
+        end
+        
+        # Return resource reference with available outputs
+        ref = ResourceReference.new(
+          type: 'aws_iam_group',
+          name: name,
+          resource_attributes: group_attrs.to_h,
+          outputs: {
+            id: "${aws_iam_group.#{name}.id}",
+            arn: "${aws_iam_group.#{name}.arn}",
+            name: "${aws_iam_group.#{name}.name}",
+            path: "${aws_iam_group.#{name}.path}",
+            unique_id: "${aws_iam_group.#{name}.unique_id}"
+          }
+        )
+        
+        # Add computed properties via method delegation
+        ref.define_singleton_method(:administrative_group?) { group_attrs.administrative_group? }
+        ref.define_singleton_method(:developer_group?) { group_attrs.developer_group? }
+        ref.define_singleton_method(:operations_group?) { group_attrs.operations_group? }
+        ref.define_singleton_method(:readonly_group?) { group_attrs.readonly_group? }
+        ref.define_singleton_method(:department_group?) { group_attrs.department_group? }
+        ref.define_singleton_method(:environment_group?) { group_attrs.environment_group? }
+        ref.define_singleton_method(:organizational_path?) { group_attrs.organizational_path? }
+        ref.define_singleton_method(:organizational_unit) { group_attrs.organizational_unit }
+        ref.define_singleton_method(:group_category) { group_attrs.group_category }
+        ref.define_singleton_method(:security_risk_level) { group_attrs.security_risk_level }
+        ref.define_singleton_method(:suggested_access_level) { group_attrs.suggested_access_level }
+        ref.define_singleton_method(:follows_naming_convention?) { group_attrs.follows_naming_convention? }
+        ref.define_singleton_method(:naming_convention_score) { group_attrs.naming_convention_score }
+        ref.define_singleton_method(:extract_environment_from_name) { group_attrs.extract_environment_from_name }
+        ref.define_singleton_method(:extract_department_from_name) { group_attrs.extract_department_from_name }
+        
+        ref
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_iam_group/types/access_patterns.rb

@@ -0,0 +1,82 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Common access patterns for different types of groups
+        module GroupAccessPatterns
+          # Developer access levels
+          DEVELOPER_FULL = :developer_full_access
+          DEVELOPER_LIMITED = :developer_limited_access
+          DEVELOPER_READONLY = :developer_readonly_access
+
+          # Operations access levels
+          OPERATIONS_FULL = :operations_full_access
+          OPERATIONS_INFRASTRUCTURE = :operations_infrastructure_access
+          OPERATIONS_MONITORING = :operations_monitoring_access
+
+          # Department access levels
+          DEPARTMENT_STANDARD = :department_standard_access
+          DEPARTMENT_ELEVATED = :department_elevated_access
+          DEPARTMENT_READONLY = :department_readonly_access
+
+          # Environment access levels
+          ENVIRONMENT_ADMIN = :environment_admin_access
+          ENVIRONMENT_DEPLOY = :environment_deploy_access
+          ENVIRONMENT_READONLY = :environment_readonly_access
+
+          # Service access levels
+          SERVICE_OWNER = :service_owner_access
+          SERVICE_OPERATOR = :service_operator_access
+          SERVICE_VIEWER = :service_viewer_access
+
+          # Cross-functional access levels
+          CROSS_FUNCTIONAL_LEAD = :cross_functional_lead_access
+          CROSS_FUNCTIONAL_MEMBER = :cross_functional_member_access
+          CROSS_FUNCTIONAL_OBSERVER = :cross_functional_observer_access
+
+          def self.access_pattern_for_group_category(category)
+            case category
+            when :developer
+              [DEVELOPER_LIMITED, DEVELOPER_READONLY]
+            when :operations
+              [OPERATIONS_INFRASTRUCTURE, OPERATIONS_MONITORING]
+            when :administrative
+              [:full_admin_access]
+            when :readonly
+              [DEPARTMENT_READONLY, ENVIRONMENT_READONLY, SERVICE_VIEWER]
+            when :department
+              [DEPARTMENT_STANDARD, DEPARTMENT_READONLY]
+            when :environment
+              [ENVIRONMENT_DEPLOY, ENVIRONMENT_READONLY]
+            else
+              [:custom_access]
+            end
+          end
+
+          def self.recommended_policies_for_pattern(pattern)
+            case pattern
+            when DEVELOPER_READONLY
+              ["ReadOnlyAccess", "DeveloperToolsReadOnly"]
+            when DEVELOPER_LIMITED
+              ["PowerUserAccess", "DeveloperToolsAccess"]
+            when OPERATIONS_MONITORING
+              ["CloudWatchReadOnlyAccess", "SystemsManagerReadOnly"]
+            when OPERATIONS_INFRASTRUCTURE
+              ["EC2FullAccess", "VPCFullAccess", "CloudWatchFullAccess"]
+            when ENVIRONMENT_READONLY
+              ["ReadOnlyAccess"]
+            when ENVIRONMENT_DEPLOY
+              ["CodeDeployAccess", "CodeBuildAccess", "S3DeploymentAccess"]
+            else
+              []
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_iam_group/types/attributes.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require_relative 'group_classification'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Type-safe attributes for AWS IAM Group resources
+        class IamGroupAttributes < Pangea::Resources::BaseAttributes
+          include GroupClassification
+
+          transform_keys(&:to_sym)
+
+          # Group name (required)
+          attribute? :name, Resources::Types::String.optional
+
+          # Path for the group (default: "/")
+          attribute :path, Resources::Types::String.default("/")
+
+          # Custom validation
+          def self.new(attributes = {})
+            attrs = super(attributes)
+
+            # Validate group name meets IAM requirements
+            unless attrs.name.match?(/\A[a-zA-Z0-9+=,.@_-]+\z/)
+              raise Dry::Struct::Error, "Group name must contain only alphanumeric characters and +=,.@_-"
+            end
+
+            if attrs.name.length > 128
+              raise Dry::Struct::Error, "Group name cannot exceed 128 characters"
+            end
+
+            # Validate path format
+            unless attrs.path.match?(/\A\/[\w+=,.@\/-]*\z/)
+              raise Dry::Struct::Error, "Path must start with '/' and contain only valid characters"
+            end
+
+            if attrs.path.length > 512
+              raise Dry::Struct::Error, "Path cannot exceed 512 characters"
+            end
+
+            # Validate group security
+            attrs.validate_group_security!
+
+            attrs
+          end
+
+          # Check if group is in organizational path
+          def organizational_path?
+            path != "/" && path.include?("/")
+          end
+
+          # Extract organizational unit from path
+          def organizational_unit
+            return nil unless organizational_path?
+            path.split('/').reject(&:empty?).first
+          end
+
+          # Generate group ARN
+          def group_arn(account_id = "123456789012")
+            "arn:aws:iam::#{account_id}:group#{path}#{name}"
+          end
+
+          # Validate group for security best practices
+          def validate_group_security!
+            warnings = []
+
+            # Check for overly broad group names
+            broad_names = ['users', 'all', 'everyone', 'default']
+            if broad_names.any? { |broad| name.downcase.include?(broad) }
+              warnings << "Group name '#{name}' is very broad - consider more specific grouping"
+            end
+
+            # Check for admin groups without organizational structure
+            if administrative_group? && path == "/"
+              warnings << "Administrative group '#{name}' should be in organized path structure"
+            end
+
+            # Check for environment groups without proper paths
+            if environment_group? && !path.include?(extract_environment_from_name)
+              warnings << "Environment group '#{name}' should be in environment-specific path"
+            end
+
+            # Log warnings but don't fail validation
+            unless warnings.empty?
+              puts "IAM Group Security Warnings for '#{name}':"
+              warnings.each { |warning| puts "  - #{warning}" }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_iam_group/types/group_classification.rb

@@ -0,0 +1,136 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Group classification methods for IAM groups
+        # Include this module in classes that have `name` and `path` attributes
+        module GroupClassification
+          # Check if group name suggests administrative access
+          def administrative_group?
+            name.downcase.include?('admin') ||
+            name.downcase.include?('root') ||
+            name.downcase.include?('super') ||
+            name.downcase.include?('power')
+          end
+
+          # Check if group is for developers
+          def developer_group?
+            name.downcase.include?('dev') ||
+            name.downcase.include?('engineer') ||
+            name.downcase.include?('programmer')
+          end
+
+          # Check if group is for operations
+          def operations_group?
+            name.downcase.include?('ops') ||
+            name.downcase.include?('sre') ||
+            name.downcase.include?('infrastructure') ||
+            name.downcase.include?('platform')
+          end
+
+          # Check if group is for read-only access
+          def readonly_group?
+            name.downcase.include?('read') ||
+            name.downcase.include?('view') ||
+            name.downcase.include?('audit') ||
+            name.downcase.include?('monitor')
+          end
+
+          # Check if group is department-specific
+          def department_group?
+            departments = ['engineering', 'finance', 'hr', 'marketing', 'sales', 'legal', 'security']
+            departments.any? { |dept| name.downcase.include?(dept) }
+          end
+
+          # Check if group is environment-specific
+          def environment_group?
+            environments = ['development', 'production', 'staging', 'test']
+            tokens = name.downcase.split(/[-_.]/)
+            environments.any? { |env| tokens.include?(env) } ||
+              tokens.include?('prod') || tokens.include?('dev') ||
+              tokens.include?('stage')
+          end
+
+          # Categorize group by purpose
+          def group_category
+            if administrative_group?
+              :administrative
+            elsif readonly_group?
+              :readonly
+            elsif developer_group?
+              :developer
+            elsif operations_group?
+              :operations
+            elsif department_group?
+              :department
+            elsif environment_group?
+              :environment
+            else
+              :functional
+            end
+          end
+
+          # Assess security risk level for group
+          def security_risk_level
+            case group_category
+            when :administrative then :high
+            when :operations then :high
+            when :developer then :medium
+            when :department then :medium
+            when :environment then :medium
+            when :readonly then :low
+            else :medium
+            end
+          end
+
+          # Get suggested access level for group
+          def suggested_access_level
+            case group_category
+            when :administrative then :full_admin
+            when :operations then :infrastructure_admin
+            when :developer then :development_access
+            when :readonly then :read_only
+            when :department then :department_specific
+            when :environment then :environment_specific
+            else :custom
+            end
+          end
+
+          # Extract environment name from group name
+          def extract_environment_from_name
+            environments = ['development', 'dev', 'testing', 'test', 'staging', 'stage', 'production', 'prod']
+            environments.find { |env| name.downcase.include?(env) }
+          end
+
+          # Extract department name from group name
+          def extract_department_from_name
+            departments = ['engineering', 'finance', 'hr', 'marketing', 'sales', 'legal', 'security']
+            departments.find { |dept| name.downcase.include?(dept) }
+          end
+
+          # Check if group name follows naming conventions
+          def follows_naming_convention?
+            # Expect format like: Department-Role-Environment or Role-Environment
+            name.include?('-') && !name.start_with?('-') && !name.end_with?('-')
+          end
+
+          # Get naming convention score (0-100)
+          def naming_convention_score
+            score = 0
+            score += 20 if environment_group?
+            # Only score function/department if the name has multiple segments
+            score += 20 if follows_naming_convention? && (department_group? || developer_group? || operations_group?)
+            score += 20 if follows_naming_convention?
+            score += 20 if name.length.between?(5, 64)
+            score += 20 if department_group? && environment_group?
+            score
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_iam_group/types/patterns.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # Group patterns for common organizational structures
+        module GroupPatterns
+          # Development teams
+          def self.development_team_group(team_name, department = "engineering")
+            {
+              name: "#{department}-#{team_name}-developers",
+              path: "/teams/#{department}/#{team_name}/"
+            }
+          end
+
+          # Environment-based access groups
+          def self.environment_access_group(environment, access_level = "deploy")
+            {
+              name: "#{environment}-#{access_level}",
+              path: "/environments/#{environment}/"
+            }
+          end
+
+          # Department-based groups
+          def self.department_group(department, access_level = "standard")
+            {
+              name: "#{department}-#{access_level}",
+              path: "/departments/#{department}/"
+            }
+          end
+
+          # Administrative groups
+          def self.admin_group(scope = "infrastructure", department = "platform")
+            {
+              name: "#{department}-#{scope}-admins",
+              path: "/admins/#{department}/"
+            }
+          end
+
+          # Read-only access groups
+          def self.readonly_group(scope, purpose = "monitoring")
+            {
+              name: "#{scope}-readonly-#{purpose}",
+              path: "/readonly/"
+            }
+          end
+
+          # Service-specific groups
+          def self.service_group(service_name, access_level = "operator")
+            {
+              name: "#{service_name}-#{access_level}",
+              path: "/services/#{service_name}/"
+            }
+          end
+
+          # Cross-functional groups
+          def self.cross_functional_group(function, stakeholders = nil)
+            path_suffix = stakeholders ? "/#{stakeholders.join('-')}/" : "/"
+            {
+              name: "#{function}-cross-functional",
+              path: "/cross-functional#{path_suffix}"
+            }
+          end
+
+          # Compliance and audit groups
+          def self.compliance_group(framework, access_level = "auditor")
+            {
+              name: "#{framework}-#{access_level}",
+              path: "/compliance/#{framework}/"
+            }
+          end
+
+          # CI/CD groups
+          def self.cicd_group(pipeline_scope, environment = nil)
+            env_suffix = environment ? "-#{environment}" : ""
+            {
+              name: "cicd-#{pipeline_scope}#{env_suffix}",
+              path: "/cicd/"
+            }
+          end
+
+          # Emergency access groups
+          def self.emergency_group(scope = "breakglass")
+            {
+              name: "emergency-#{scope}",
+              path: "/emergency/"
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_iam_group/types.rb

@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require 'pangea/resources/types'
+require_relative 'types/group_classification'
+require_relative 'types/attributes'
+require_relative 'types/patterns'
+require_relative 'types/access_patterns'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # GroupClassification is defined in types/group_classification.rb
+        # IamGroupAttributes is defined in types/attributes.rb
+        # GroupPatterns is defined in types/patterns.rb
+        # GroupAccessPatterns is defined in types/access_patterns.rb
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_iam_policy/resource.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_iam_policy/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS IAM Policy with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] IAM policy attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_iam_policy(name, attributes = {})
+        # Validate attributes using dry-struct
+        policy_attrs = Types::IamPolicyAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_iam_policy, name) do
+          name policy_attrs.name
+          path policy_attrs.path
+          description policy_attrs.description if policy_attrs.description
+          
+          # Policy document (required)
+          policy ::JSON.pretty_generate(policy_attrs.policy)
+          
+          # Apply tags if present
+          if policy_attrs.tags&.any?
+            tags do
+              policy_attrs.tags.each do |key, value|
+                public_send(key, value)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ref = ResourceReference.new(
+          type: 'aws_iam_policy',
+          name: name,
+          resource_attributes: policy_attrs.to_h,
+          outputs: {
+            id: "${aws_iam_policy.#{name}.id}",
+            arn: "${aws_iam_policy.#{name}.arn}",
+            name: "${aws_iam_policy.#{name}.name}",
+            path: "${aws_iam_policy.#{name}.path}",
+            policy: "${aws_iam_policy.#{name}.policy}",
+            policy_id: "${aws_iam_policy.#{name}.policy_id}",
+            tags_all: "${aws_iam_policy.#{name}.tags_all}"
+          }
+        )
+        
+        # Add computed properties via method delegation
+        ref.define_singleton_method(:all_actions) { policy_attrs.all_actions }
+        ref.define_singleton_method(:all_resources) { policy_attrs.all_resources }
+        ref.define_singleton_method(:security_level) { policy_attrs.security_level }
+        ref.define_singleton_method(:complexity_score) { policy_attrs.complexity_score }
+        ref.define_singleton_method(:has_wildcard_permissions?) { policy_attrs.has_wildcard_permissions? }
+        ref.define_singleton_method(:uses_reserved_name?) { policy_attrs.uses_reserved_name? }
+        ref.define_singleton_method(:service_role_policy?) { policy_attrs.service_role_policy? }
+        ref.define_singleton_method(:allows_action?) { |action| policy_attrs.allows_action?(action) }
+        
+        ref
+      end
+    end
+  end
+end