pangea 0.0.42 → 0.0.45

data/lib/pangea/resources/aws/extended_resources_CLAUDE.md

@@ -0,0 +1,470 @@
+# AWS Extended Resources Implementation
+
+This document outlines the AWS Extended resources implementation across VPC, Load Balancing, Auto Scaling, and EC2 categories, focusing on advanced networking, load balancing, auto scaling, and compute optimization use cases.
+
+## Implementation Status
+
+### VPC Extended (15 resources) ✅ IMPLEMENTED
+
+Advanced VPC networking, endpoint management, and default resource control:
+
+1. **aws_vpc_endpoint_connection_notification** - Monitor VPC endpoint connection state changes
+   - Notification for endpoint connection events (Accept, Connect, Delete, Reject)
+   - Integration with SNS topics for automated monitoring
+   - Support for VPC endpoint service notifications
+
+2. **aws_vpc_endpoint_service_allowed_principal** - Control VPC endpoint service access
+   - Principal-based access control for endpoint services
+   - Support for AWS account, IAM role, and service principals
+   - Cross-account endpoint service sharing
+
+3. **aws_vpc_endpoint_connection_accepter** - Accept VPC endpoint connections
+   - Automated acceptance of endpoint connection requests
+   - Cross-account endpoint connection management
+   - Integration with connection approval workflows
+
+4. **aws_vpc_endpoint_route_table_association** - Route endpoint traffic through route tables
+   - Associate VPC endpoints with specific route tables
+   - Control traffic routing for gateway endpoints
+   - Support for S3 and DynamoDB gateway endpoints
+
+5. **aws_vpc_endpoint_subnet_association** - Subnet-level endpoint access control
+   - Associate interface endpoints with specific subnets
+   - Multi-AZ endpoint deployment strategies
+   - Subnet-specific endpoint policies
+
+6. **aws_vpc_peering_connection_options** - Customize VPC peering behavior
+   - DNS resolution options for peered VPCs
+   - Accept VPC peering connection options
+   - Cross-region peering configuration
+
+7. **aws_vpc_peering_connection_accepter** - Accept cross-account/region peering
+   - Automated peering connection acceptance
+   - Cross-account VPC peering workflows
+   - Cross-region peering connection management
+
+8. **aws_vpc_dhcp_options_association** - Link DHCP options to VPCs
+   - Custom DNS and NTP server configuration
+   - Domain name and search domain management
+   - NetBIOS configuration for Windows instances
+
+9. **aws_vpc_network_performance_metric_subscription** - Monitor network performance
+   - Network performance metrics collection
+   - Integration with CloudWatch metrics
+   - Performance monitoring for VPC endpoints
+
+10. **aws_vpc_security_group_egress_rule** - Granular outbound traffic control
+    - Individual egress rule management
+    - Enhanced security group rule organization
+    - Support for referenced security groups and prefix lists
+
+11. **aws_vpc_security_group_ingress_rule** - Granular inbound traffic control
+    - Individual ingress rule management
+    - IPv4 and IPv6 CIDR block support
+    - Port range and protocol specification
+
+12. **aws_default_vpc_dhcp_options** - Manage default VPC DHCP options
+    - Customize default network behavior
+    - Domain name and DNS server defaults
+    - NTP and NetBIOS configuration
+
+13. **aws_default_network_acl** - Control default subnet access rules
+    - Manage default network ACL rules
+    - Ingress and egress rule customization
+    - Subnet association management
+
+14. **aws_default_route_table** - Control default routing behavior
+    - Manage main route table for VPC
+    - Default route propagation settings
+    - Association with subnets
+
+15. **aws_default_security_group** - Control default instance access rules
+    - Customize default security group rules
+    - Remove default allow-all egress rules
+    - Implement least-privilege security defaults
+
+### Load Balancing Extended (12 resources) ✅ IMPLEMENTED
+
+Advanced load balancer configuration, trust stores, and Classic Load Balancer features:
+
+1. **aws_lb_trust_store** - SSL/TLS certificate validation stores
+   - CA certificate bundle management
+   - S3-based certificate storage
+   - SSL/TLS validation for load balancers
+
+2. **aws_lb_trust_store_revocation** - Certificate revocation lists
+   - Certificate revocation list (CRL) management
+   - Automated certificate validation
+   - Trust store revocation updates
+
+3. **aws_alb_target_group_attachment** - ALB target registration
+   - Application Load Balancer target management
+   - Instance and IP target registration
+   - Port and availability zone specification
+
+4. **aws_lb_target_group_attachment** - Load balancer target registration
+   - Network and Application Load Balancer targets
+   - Lambda function target registration
+   - Cross-zone load balancing support
+
+5. **aws_lb_ssl_negotiation_policy** - Classic ELB SSL configuration
+   - SSL cipher suite configuration
+   - Protocol version management
+   - Legacy SSL/TLS support
+
+6. **aws_lb_cookie_stickiness_policy** - Session affinity management
+   - Application-controlled session persistence
+   - Load balancer-generated cookie stickiness
+   - Session timeout configuration
+
+7. **aws_elb_attachment** - Classic ELB instance registration
+   - EC2 instance attachment to Classic Load Balancers
+   - Health check integration
+   - Multi-instance management
+
+8. **aws_elb_service_account** - ELB service account data source
+   - Regional ELB service account identification
+   - Access logging bucket policy configuration
+   - Cross-region service account management
+
+9. **aws_proxy_protocol_policy** - Proxy protocol support
+   - Enable proxy protocol for Classic Load Balancers
+   - Client IP address preservation
+   - Backend server proxy protocol configuration
+
+10. **aws_load_balancer_backend_server_policy** - Backend server policies
+    - Classic Load Balancer backend configuration
+    - Server-specific policy application
+    - Instance-level load balancer settings
+
+11. **aws_load_balancer_listener_policy** - Listener policy management
+    - Classic Load Balancer listener configuration
+    - SSL and proxy protocol policies
+    - Multi-policy listener management
+
+12. **aws_load_balancer_policy** - Custom load balancer policies
+    - Application and network-level policies
+    - Custom policy attribute configuration
+    - Policy type and attribute management
+
+### Auto Scaling Extended (10 resources) ✅ IMPLEMENTED
+
+Advanced auto scaling configuration, lifecycle management, and optimization:
+
+1. **aws_autoscaling_lifecycle_hook** - Custom scaling actions
+   - Instance launch and termination hooks
+   - Custom scripts during scaling events
+   - Integration with SNS and SQS for notifications
+
+2. **aws_autoscaling_notification** - Auto scaling event monitoring
+   - CloudWatch and SNS integration
+   - Scaling event notifications
+   - Multi-group notification management
+
+3. **aws_autoscaling_schedule** - Scheduled scaling actions
+   - Time-based capacity adjustments
+   - Recurring scaling schedules
+   - Predictive scaling for known patterns
+
+4. **aws_autoscaling_traffic_source_attachment** - Load balancer integration
+   - Target group and Classic Load Balancer attachment
+   - Health check integration
+   - Multi-load balancer support
+
+5. **aws_autoscaling_warm_pool** - Pre-initialized instance management
+   - Faster scaling with pre-warmed instances
+   - Instance state management (Stopped, Running, Hibernated)
+   - Cost optimization through instance reuse
+
+6. **aws_autoscaling_group_tag** - Resource tagging management
+   - Propagate tags to launched instances
+   - Dynamic tag management
+   - Cost allocation and resource organization
+
+7. **aws_launch_configuration** - Legacy instance templates (DEPRECATED)
+   - EC2 instance launch configuration
+   - AMI, instance type, and security group specification
+   - EBS block device mapping
+
+8. **aws_placement_group** - Instance placement strategies
+   - Cluster, partition, and spread placement
+   - High-performance computing optimization
+   - Low-latency networking requirements
+
+9. **aws_autoscaling_policy_step_adjustment** - Step scaling configuration
+   - Metric-based scaling with multiple thresholds
+   - Step-wise capacity adjustments
+   - CloudWatch alarm integration
+
+10. **aws_autoscaling_policy_target_tracking_scaling_policy** - Automatic target tracking
+    - Target value-based scaling
+    - CPU utilization, network, and custom metric tracking
+    - Automatic scale-out and scale-in decisions
+
+### EC2 Extended (18 resources) ✅ IMPLEMENTED
+
+Advanced compute management, capacity reservations, fleet management, and specialized features:
+
+1. **aws_ec2_availability_zone_group** - AZ group management
+   - Regional availability zone access control
+   - Local zone and wavelength zone management
+   - Zone group opt-in management
+
+2. **aws_ec2_capacity_reservation** - Guaranteed compute capacity
+   - On-Demand instance capacity reservation
+   - Instance type and availability zone specification
+   - Capacity matching and utilization preferences
+
+3. **aws_ec2_capacity_block_reservation** - HPC capacity blocks
+   - High-performance computing workload reservations
+   - GPU and compute-intensive instance reservations
+   - Duration-based capacity guarantees
+
+4. **aws_ec2_fleet** - Multi-instance type fleet management
+   - Diversified instance provisioning across types and AZs
+   - Spot and On-Demand instance mix strategies
+   - Launch template-based fleet configuration
+
+5. **aws_ec2_spot_fleet_request** - Cost-optimized spot instances
+   - Spot instance fleet with multiple instance types
+   - Bid price management and allocation strategies
+   - Target capacity and diversification options
+
+6. **aws_ec2_spot_datafeed_subscription** - Spot instance activity logging
+   - Spot instance usage and pricing data
+   - S3-based log delivery
+   - Historical spot instance analytics
+
+7. **aws_ec2_spot_instance_request** - Individual spot instance requests
+   - Single spot instance provisioning
+   - Bid price and duration specification
+   - Persistent and one-time spot requests
+
+8. **aws_ec2_dedicated_host** - Single-tenant hardware
+   - Physical server reservation for compliance
+   - BYOL (Bring Your Own License) support
+   - Host resource management and utilization
+
+9. **aws_ec2_host_resource_group_association** - Dedicated host management
+   - Host resource group organization
+   - License management integration
+   - Multi-host resource allocation
+
+10. **aws_ec2_instance_metadata_defaults** - Account-level metadata configuration
+    - Default Instance Metadata Service (IMDS) settings
+    - IMDSv2 enforcement across account
+    - Security best practices implementation
+
+11. **aws_ec2_serial_console_access** - Instance debugging access
+    - Serial console access for troubleshooting
+    - Out-of-band instance access
+    - Emergency access when SSH/RDP unavailable
+
+12. **aws_ec2_image_block_public_access** - AMI sharing control
+    - Prevent accidental public AMI sharing
+    - Account-level AMI access restrictions
+    - AMI sharing governance
+
+13. **aws_ec2_ami_launch_permission** - AMI access control
+    - Cross-account AMI sharing permissions
+    - Fine-grained AMI access management
+    - Launch permission delegation
+
+14. **aws_ec2_snapshot_block_public_access** - Snapshot sharing control
+    - Prevent accidental public snapshot sharing
+    - Account-level snapshot access restrictions
+    - Snapshot sharing governance
+
+15. **aws_ec2_tag** - Resource tagging management
+    - Individual resource tag management
+    - Dynamic tag updates
+    - Cost allocation and resource organization
+
+16. **aws_ec2_transit_gateway_multicast_domain** - Multicast traffic routing
+    - Transit Gateway multicast domain management
+    - Multicast group configuration
+    - Cross-VPC multicast communication
+
+17. **aws_ec2_transit_gateway_multicast_domain_association** - Subnet multicast association
+    - Associate subnets with multicast domains
+    - Multicast traffic routing configuration
+    - Multi-AZ multicast support
+
+18. **aws_ec2_transit_gateway_multicast_group_member** - Multicast group management
+    - Multicast group membership management
+    - Instance-level multicast participation
+    - Group communication control
+
+## Architecture Patterns Enabled
+
+### Advanced VPC Networking
+- **Private Endpoint Architecture**: Complete private connectivity without internet gateways
+- **Multi-Account VPC Strategy**: Cross-account peering with automated acceptance
+- **Zero-Trust Networking**: Granular security group rules with least privilege
+- **DNS and DHCP Customization**: Custom network services for enterprise requirements
+
+### High-Availability Load Balancing
+- **Multi-Tier Load Balancing**: Application and Network Load Balancer integration
+- **SSL/TLS Management**: Trust store-based certificate validation
+- **Session Management**: Advanced stickiness and session affinity
+- **Legacy Application Support**: Classic Load Balancer advanced features
+
+### Intelligent Auto Scaling
+- **Predictive Scaling**: Scheduled and lifecycle-driven capacity management
+- **Cost-Optimized Scaling**: Warm pools and traffic source integration
+- **Application-Aware Scaling**: Custom lifecycle hooks for application readiness
+- **Multi-Metric Scaling**: Target tracking with step adjustments
+
+### Enterprise Compute Management
+- **Capacity Assurance**: Reservations for guaranteed availability
+- **Cost Optimization**: Spot fleet management with diversification
+- **Compliance Support**: Dedicated hosts for licensing requirements
+- **Fleet Management**: Multi-instance type provisioning strategies
+
+## Type Safety and Validation
+
+All resources implement comprehensive type safety through:
+
+- **Dry::Struct Validation**: Runtime attribute validation with custom constraints
+- **RBS Type Definitions**: Compile-time type checking support
+- **Business Rule Validation**: Domain-specific validation beyond basic types
+- **Reference Management**: Type-safe cross-resource references
+
+## Integration Examples
+
+### Complete Web Application Infrastructure
+
+```ruby
+template :production_web_app do
+  # VPC with custom DHCP and advanced security
+  vpc = aws_vpc(:main, {
+    cidr_block: "10.0.0.0/16",
+    enable_dns_hostnames: true,
+    enable_dns_support: true
+  })
+
+  # Custom default security group with least privilege
+  aws_default_security_group(:default, {
+    vpc_id: vpc.id,
+    ingress: [],
+    egress: [
+      {
+        protocol: "tcp",
+        from_port: 443,
+        to_port: 443,
+        cidr_blocks: ["0.0.0.0/0"]
+      }
+    ]
+  })
+
+  # Capacity reservation for guaranteed availability
+  capacity = aws_ec2_capacity_reservation(:web_capacity, {
+    instance_type: "c5.xlarge",
+    instance_platform: "Linux/UNIX",
+    availability_zone: "us-east-1a",
+    instance_count: 2
+  })
+
+  # Launch configuration with advanced block device mapping
+  launch_config = aws_launch_configuration(:web_lc, {
+    name_prefix: "web-app-",
+    image_id: "ami-12345678",
+    instance_type: "c5.xlarge",
+    security_groups: [web_sg.id],
+    user_data: base64encode(file("user_data.sh")),
+    root_block_device: {
+      volume_type: "gp3",
+      volume_size: 20,
+      encrypted: true
+    }
+  })
+
+  # Auto scaling with lifecycle hooks and warm pool
+  asg = aws_autoscaling_group(:web_asg, {
+    name: "web-app-asg",
+    vpc_zone_identifier: [private_subnet.id],
+    launch_configuration: launch_config.name,
+    min_size: 2,
+    max_size: 10,
+    desired_capacity: 2
+  })
+
+  # Lifecycle hook for application readiness
+  aws_autoscaling_lifecycle_hook(:app_ready_hook, {
+    name: "app-readiness-check",
+    autoscaling_group_name: asg.name,
+    lifecycle_transition: "autoscaling:EC2_INSTANCE_LAUNCHING",
+    heartbeat_timeout: 300,
+    default_result: "CONTINUE"
+  })
+
+  # Warm pool for faster scaling
+  aws_autoscaling_warm_pool(:warm_instances, {
+    autoscaling_group_name: asg.name,
+    pool_state: "Stopped",
+    min_size: 1,
+    max_group_prepared_capacity: 5
+  })
+
+  # Application Load Balancer with trust store
+  trust_store = aws_lb_trust_store(:app_trust, {
+    name: "app-certificate-store",
+    ca_certificates_bundle_s3_bucket: "cert-bucket",
+    ca_certificates_bundle_s3_key: "ca-bundle.pem"
+  })
+
+  alb = aws_lb(:app_alb, {
+    name: "app-load-balancer",
+    load_balancer_type: "application",
+    subnets: [public_subnet_a.id, public_subnet_b.id],
+    security_groups: [alb_sg.id]
+  })
+
+  # Target group attachment with health checks
+  aws_lb_target_group_attachment(:web_targets, {
+    target_group_arn: app_tg.arn,
+    target_id: "${each.value}",
+    for_each: "${toset(data.aws_autoscaling_group.web_asg.instances)}"
+  })
+end
+```
+
+### Multi-Region Disaster Recovery
+
+```ruby
+template :disaster_recovery do
+  # Primary region capacity reservation
+  primary_capacity = aws_ec2_capacity_reservation(:primary, {
+    instance_type: "m5.large",
+    instance_platform: "Linux/UNIX",
+    availability_zone: "us-east-1a",
+    instance_count: 5,
+    tenancy: "default"
+  })
+
+  # Cross-region VPC peering
+  peering = aws_vpc_peering_connection(:dr_peering, {
+    vpc_id: primary_vpc.id,
+    peer_vpc_id: dr_vpc.id,
+    peer_region: "us-west-2"
+  })
+
+  # Auto-accept peering in DR region
+  aws_vpc_peering_connection_accepter(:dr_accepter, {
+    vpc_peering_connection_id: peering.id,
+    auto_accept: true
+  })
+
+  # Scheduled scaling for DR readiness
+  aws_autoscaling_schedule(:dr_warmup, {
+    scheduled_action_name: "disaster-recovery-warmup",
+    autoscaling_group_name: dr_asg.name,
+    min_size: 2,
+    max_size: 10,
+    desired_capacity: 2,
+    recurrence: "0 6 * * *"  # Daily at 6 AM
+  })
+end
+```
+
+This implementation provides comprehensive coverage of advanced AWS networking, load balancing, auto scaling, and compute optimization capabilities, enabling sophisticated infrastructure patterns while maintaining type safety and ease of use.