pangea 0.0.45 → 0.0.46

data/lib/pangea/components/secure_s3_bucket/types.rb

@@ -1,292 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'dry-struct'
-require 'pangea/resources/types'
-
-module Pangea
-  module Components
-    module SecureS3Bucket
-      # Lifecycle rule configuration
-      class LifecycleRule < Dry::Struct
-        transform_keys(&:to_sym)
-        
-        attribute :id, Types::String
-        attribute :status, Types::String.default("Enabled").enum('Enabled', 'Disabled')
-        attribute :filter, Types::Hash.optional
-        
-        # Transition rules
-        attribute :transitions, Types::Array.default([].freeze).constructor { |value|
-          # Validate transition storage classes and days
-          valid_storage_classes = [
-            'STANDARD_IA', 'ONEZONE_IA', 'INTELLIGENT_TIERING', 'GLACIER_IR',
-            'GLACIER', 'DEEP_ARCHIVE'
-          ]
-          
-          value.each do |transition|
-            unless valid_storage_classes.include?(transition[:storage_class])
-              raise Dry::Types::ConstraintError, "Invalid storage class: #{transition[:storage_class]}"
-            end
-            
-            unless transition[:days] && transition[:days] > 0
-              raise Dry::Types::ConstraintError, "Transition days must be positive"
-            end
-          end
-          
-          value
-        }
-        
-        # Expiration rules
-        attribute :expiration, Types::Hash.optional
-        attribute :noncurrent_version_expiration, Types::Hash.optional
-        attribute :noncurrent_version_transitions, Types::Array.default([].freeze)
-        attribute :abort_incomplete_multipart_upload, Types::Hash.optional
-      end
-      
-      # Versioning configuration
-      class VersioningConfig < Dry::Struct
-        transform_keys(&:to_sym)
-        
-        attribute :status, Types::S3Versioning.default("Enabled")
-        attribute :mfa_delete, Types::String.optional.enum('Enabled', 'Disabled')
-      end
-      
-      # Server-side encryption configuration
-      class EncryptionConfig < Dry::Struct
-        transform_keys(&:to_sym)
-        
-        attribute :sse_algorithm, Types::String.default("AES256").enum('AES256', 'aws:kms', 'aws:kms:dsse')
-        attribute :kms_key_id, Types::String.optional
-        attribute :bucket_key_enabled, Types::Bool.default(true)
-        attribute :enforce_ssl, Types::Bool.default(true)
-      end
-      
-      # Public access block configuration
-      class PublicAccessBlockConfig < Dry::Struct
-        transform_keys(&:to_sym)
-        
-        attribute :block_public_acls, Types::Bool.default(true)
-        attribute :block_public_policy, Types::Bool.default(true)
-        attribute :ignore_public_acls, Types::Bool.default(true)
-        attribute :restrict_public_buckets, Types::Bool.default(true)
-      end
-      
-      # Notification configuration for events
-      class NotificationConfig < Dry::Struct
-        transform_keys(&:to_sym)
-        
-        attribute :enabled, Types::Bool.default(false)
-        attribute :lambda_configurations, Types::Array.default([].freeze)
-        attribute :topic_configurations, Types::Array.default([].freeze)
-        attribute :queue_configurations, Types::Array.default([].freeze)
-      end
-      
-      # CORS configuration
-      class CorsConfig < Dry::Struct
-        transform_keys(&:to_sym)
-        
-        attribute :enabled, Types::Bool.default(false)
-        attribute :cors_rules, Types::Array.default([].freeze)
-      end
-      
-      # Replication configuration
-      class ReplicationConfig < Dry::Struct
-        transform_keys(&:to_sym)
-        
-        attribute :enabled, Types::Bool.default(false)
-        attribute :role_arn, Types::String.optional.constrained(format: /\Aarn:aws:iam::\d{12}:role\//)
-        attribute :rules, Types::Array.default([].freeze)
-      end
-      
-      # Logging configuration
-      class LoggingConfig < Dry::Struct
-        transform_keys(&:to_sym)
-        
-        attribute :enabled, Types::Bool.default(false)
-        attribute :target_bucket, Types::String.optional
-        attribute :target_prefix, Types::String.default("access-logs/")
-        attribute :target_object_key_format, Types::String.optional.enum('SimplePrefix', 'PartitionedPrefix')
-      end
-      
-      # Transfer acceleration configuration
-      class AccelerationConfig < Dry::Struct
-        transform_keys(&:to_sym)
-        
-        attribute :enabled, Types::Bool.default(false)
-        attribute :status, Types::String.optional.enum('Enabled', 'Suspended')
-      end
-      
-      # Analytics configuration
-      class AnalyticsConfig < Dry::Struct
-        transform_keys(&:to_sym)
-        
-        attribute :enabled, Types::Bool.default(false)
-        attribute :configurations, Types::Array.default([].freeze)
-      end
-      
-      # Inventory configuration
-      class InventoryConfig < Dry::Struct
-        transform_keys(&:to_sym)
-        
-        attribute :enabled, Types::Bool.default(false)
-        attribute :configurations, Types::Array.default([].freeze)
-      end
-      
-      # Metrics configuration for CloudWatch
-      class MetricsConfig < Dry::Struct
-        transform_keys(&:to_sym)
-        
-        attribute :enabled, Types::Bool.default(true)
-        attribute :request_metrics, Types::Array.default([].freeze)
-        attribute :enable_request_metrics, Types::Bool.default(true)
-        attribute :enable_data_events_logging, Types::Bool.default(false)
-      end
-      
-      # Main Secure S3 Bucket component attributes
-      class SecureS3BucketAttributes < Dry::Struct
-        transform_keys(&:to_sym)
-        
-        # Basic bucket configuration
-        attribute :bucket_name, Types::String.optional.constructor { |value|
-          next value unless value
-          
-          # S3 bucket naming validation
-          unless value.match?(/\A[a-z0-9][a-z0-9\-\.]{1,61}[a-z0-9]\z/)
-            raise Dry::Types::ConstraintError, "Invalid S3 bucket name format"
-          end
-          
-          # Additional validation
-          if value.include?('..')
-            raise Dry::Types::ConstraintError, "Bucket name cannot contain consecutive periods"
-          end
-          
-          if value.match?(/\A\d+\.\d+\.\d+\.\d+\z/)
-            raise Dry::Types::ConstraintError, "Bucket name cannot be formatted as IP address"
-          end
-          
-          value
-        }
-        
-        # Bucket configuration
-        attribute :force_destroy, Types::Bool.default(false)
-        attribute :object_lock_enabled, Types::Bool.default(false)
-        
-        # Versioning
-        attribute :versioning, VersioningConfig.default({})
-        
-        # Encryption
-        attribute :encryption, EncryptionConfig.default({})
-        
-        # Public access
-        attribute :public_access_block, PublicAccessBlockConfig.default({})
-        
-        # Lifecycle management
-        attribute :lifecycle_rules, Types::Array.of(LifecycleRule).default([
-          # Default intelligent tiering rule
-          LifecycleRule.new({
-            id: "intelligent-tiering",
-            status: "Enabled",
-            transitions: [{
-              days: 0,
-              storage_class: "INTELLIGENT_TIERING"
-            }]
-          })
-        ].freeze)
-        
-        # Cross-region replication
-        attribute :replication, ReplicationConfig.default({})
-        
-        # Notifications
-        attribute :notifications, NotificationConfig.default({})
-        
-        # CORS configuration
-        attribute :cors, CorsConfig.default({})
-        
-        # Access logging
-        attribute :logging, LoggingConfig.default({})
-        
-        # Transfer acceleration
-        attribute :acceleration, AccelerationConfig.default({})
-        
-        # Analytics
-        attribute :analytics, AnalyticsConfig.default({})
-        
-        # Inventory reporting
-        attribute :inventory, InventoryConfig.default({})
-        
-        # Metrics and monitoring
-        attribute :metrics, MetricsConfig.default({})
-        
-        # Object lock configuration
-        attribute :object_lock_configuration, Types::Hash.optional
-        
-        # Common tags
-        attribute :tags, Types::AwsTags.default({}.freeze)
-        
-        # Request payer configuration
-        attribute :request_payer, Types::String.default("BucketOwner").enum('BucketOwner', 'Requester')
-        
-        # Website configuration
-        attribute :website_configuration, Types::Hash.optional
-        
-        # Policy document (JSON string)
-        attribute :policy, Types::String.optional.constructor { |value|
-          next value unless value
-          
-          begin
-            JSON.parse(value)
-            value
-          rescue JSON::ParserError
-            raise Dry::Types::ConstraintError, "Bucket policy must be valid JSON"
-          end
-        }
-        
-        # Custom validation for conflicting configurations
-        def self.new(attributes = {})
-          attrs = super(attributes)
-          
-          # Validate object lock requires versioning
-          if attrs.object_lock_enabled && attrs.versioning.status != 'Enabled'
-            raise Dry::Types::ConstraintError, "Object Lock requires versioning to be enabled"
-          end
-          
-          # Validate KMS configuration
-          if attrs.encryption.sse_algorithm.start_with?('aws:kms') && !attrs.encryption.kms_key_id
-            raise Dry::Types::ConstraintError, "KMS key ID required for KMS encryption"
-          end
-          
-          # Validate replication requirements
-          if attrs.replication.enabled
-            unless attrs.replication.role_arn
-              raise Dry::Types::ConstraintError, "Replication role ARN required when replication is enabled"
-            end
-            
-            unless attrs.versioning.status == 'Enabled'
-              raise Dry::Types::ConstraintError, "Versioning must be enabled for replication"
-            end
-          end
-          
-          # Validate logging configuration
-          if attrs.logging.enabled && !attrs.logging.target_bucket
-            raise Dry::Types::ConstraintError, "Target bucket required when logging is enabled"
-          end
-          
-          attrs
-        end
-      end
-    end
-  end
-end

data/lib/pangea/components/secure_vpc/CLAUDE.md

@@ -1,366 +0,0 @@
-# Secure VPC Component
-
-## Overview
-
-The `secure_vpc` component creates an AWS VPC with enhanced security monitoring and best-practice defaults. It serves as the foundation for secure, compliant network architectures by providing DNS resolution, CloudWatch monitoring, and preparation for VPC Flow Logs.
-
-## Purpose
-
-This component addresses the common need for VPCs that meet security and compliance requirements out of the box. Rather than manually configuring security features for each VPC, the component provides a standardized, secure VPC configuration with monitoring and compliance features built-in.
-
-## Features
-
-### Core VPC Configuration
-- **DNS Resolution**: Enables both DNS hostnames and DNS support for proper name resolution
-- **Private CIDR Validation**: Ensures CIDR blocks follow RFC 1918 private addressing standards
-- **Instance Tenancy Control**: Configurable instance tenancy with secure defaults
-- **Security-First Defaults**: All security features enabled by default
-
-### Enhanced Monitoring
-- **CloudWatch Log Group**: Creates dedicated log group for VPC monitoring and flow logs
-- **Configurable Retention**: Log retention policies from 1 day to 10 years
-- **Compliance Tracking**: Automatic tagging for compliance and security auditing
-- **Security Level Assessment**: Automatic evaluation of security posture
-
-### Future-Ready Security
-- **Flow Logs Preparation**: Infrastructure ready for VPC Flow Logs when resource is implemented
-- **Multi-Destination Support**: Supports both CloudWatch Logs and S3 destinations
-- **Encryption Support**: Configuration for encryption at rest and in transit
-
-## Usage
-
-### Basic Secure VPC
-
-```ruby
-template :secure_infrastructure do
-  include Pangea::Resources::AWS
-  include Pangea::Components::SecureVpc
-  
-  # Create a secure VPC with default security features
-  network = secure_vpc(:main, {
-    cidr_block: "10.0.0.0/16",
-    availability_zones: ["us-east-1a", "us-east-1b", "us-east-1c"]
-  })
-  
-  # Access VPC resources
-  output :vpc_id do
-    value network.vpc_id
-  end
-  
-  output :security_features do
-    value network.compliance_features
-    description "Enabled security and compliance features"
-  end
-end
-```
-
-### Production VPC with Enhanced Security
-
-```ruby
-# High-security production VPC
-production_vpc = secure_vpc(:production, {
-  cidr_block: "10.0.0.0/16",
-  availability_zones: ["us-east-1a", "us-east-1b", "us-east-1c"],
-  enable_flow_logs: true,
-  flow_log_destination: "cloud-watch-logs",
-  instance_tenancy: "dedicated",
-  
-  security_config: {
-    enable_flow_logs: true,
-    flow_log_destination: "cloud-watch-logs",
-    restrict_default_sg: true,
-    encryption_at_rest: true,
-    encryption_in_transit: true
-  },
-  
-  monitoring_config: {
-    enable_cloudwatch: true,
-    enable_detailed_monitoring: true,
-    create_alarms: true,
-    log_retention_days: 90
-  },
-  
-  tags: {
-    Environment: "production",
-    SecurityLevel: "high",
-    Compliance: "required",
-    DataClassification: "confidential"
-  }
-})
-```
-
-### Development VPC with Cost Optimization
-
-```ruby
-# Cost-optimized development VPC
-dev_vpc = secure_vpc(:development, {
-  cidr_block: "10.1.0.0/16",
-  availability_zones: ["us-east-1a", "us-east-1b"],
-  instance_tenancy: "default",
-  
-  security_config: {
-    enable_flow_logs: false,  # Reduce costs in dev
-    encryption_at_rest: true
-  },
-  
-  monitoring_config: {
-    enable_cloudwatch: true,
-    enable_detailed_monitoring: false,
-    log_retention_days: 7
-  },
-  
-  tags: {
-    Environment: "development",
-    AutoShutdown: "true",
-    CostCenter: "engineering"
-  }
-})
-```
-
-## Attributes
-
-### Required Attributes
-
-| Attribute | Type | Description |
-|-----------|------|-------------|
-| `cidr_block` | String | VPC CIDR block (must be valid CIDR, /16 to /28) |
-| `availability_zones` | Array[String] | List of availability zones for the VPC (1-6 zones) |
-
-### Optional Attributes
-
-| Attribute | Type | Default | Description |
-|-----------|------|---------|-------------|
-| `enable_dns_hostnames` | Boolean | `true` | Enable DNS hostname resolution |
-| `enable_dns_support` | Boolean | `true` | Enable DNS support |
-| `enable_flow_logs` | Boolean | `true` | Enable VPC Flow Logs (preparation for future implementation) |
-| `flow_log_destination` | String | `'cloud-watch-logs'` | Flow log destination: `'cloud-watch-logs'` or `'s3'` |
-| `instance_tenancy` | String | `'default'` | Instance tenancy: `'default'`, `'dedicated'`, or `'host'` |
-| `tags` | Hash | `{}` | Additional tags for the VPC |
-| `security_config` | Hash | See below | Security configuration options |
-| `monitoring_config` | Hash | See below | Monitoring and logging configuration |
-
-### Security Configuration
-
-```ruby
-security_config: {
-  enable_flow_logs: true,           # Enable flow logs (Boolean)
-  flow_log_destination: 'cloud-watch-logs',  # Destination type (String)
-  restrict_default_sg: true,        # Restrict default security group (Boolean)
-  enable_nacl_logging: false,       # Enable NACL logging (Boolean) 
-  encryption_at_rest: true,         # Enable encryption at rest (Boolean)
-  encryption_in_transit: true       # Enable encryption in transit (Boolean)
-}
-```
-
-### Monitoring Configuration
-
-```ruby
-monitoring_config: {
-  enable_cloudwatch: true,          # Enable CloudWatch monitoring (Boolean)
-  enable_detailed_monitoring: false, # Enable detailed monitoring (Boolean)
-  create_alarms: true,              # Create CloudWatch alarms (Boolean)
-  log_retention_days: 30,           # Log retention period in days (Integer, 1-3653)
-  enable_xray: false                # Enable X-Ray tracing (Boolean)
-}
-```
-
-## Resources Created
-
-### Primary Resources
-
-1. **aws_vpc**: The main VPC resource with security-enhanced configuration
-   - DNS resolution enabled by default
-   - Compliance and security tags
-   - Configurable instance tenancy
-
-2. **aws_cloudwatch_log_group**: Dedicated log group for VPC monitoring
-   - Configurable retention policies
-   - Structured naming convention
-   - Ready for flow logs integration
-
-### Future Resources (When Implemented)
-
-1. **aws_flow_log**: VPC Flow Logs for network traffic monitoring
-   - All traffic types captured
-   - Multiple destination support
-   - Automatic log group integration
-
-## Outputs
-
-### VPC Information
-- `vpc_id`: VPC identifier
-- `vpc_arn`: VPC ARN
-- `vpc_cidr_block`: VPC CIDR block
-- `default_security_group_id`: Default security group ID
-- `default_route_table_id`: Default route table ID
-- `default_network_acl_id`: Default network ACL ID
-- `main_route_table_id`: Main route table ID
-
-### Security and Compliance
-- `is_private_cidr`: Whether CIDR block is RFC 1918 private
-- `security_level`: Assessed security level (`'basic'`, `'enhanced'`, `'maximum'`)
-- `compliance_features`: Array of enabled compliance features
-- `estimated_subnet_capacity`: Estimated number of /24 subnets that can fit
-
-### Geographic Information
-- `region`: AWS region derived from availability zones
-- `availability_zones`: List of configured availability zones
-
-### Monitoring Information
-- `log_group_name`: CloudWatch log group name
-- `log_group_arn`: CloudWatch log group ARN
-- `monitoring_enabled`: Whether CloudWatch monitoring is enabled
-
-## Component Reference Usage
-
-```ruby
-# Access VPC resource directly
-vpc_resource = network.vpc
-subnet_vpc_id = vpc_resource.id
-
-# Access computed outputs
-region = network.region
-security_level = network.security_level
-compliance_features = network.compliance_features
-
-# Check if monitoring is enabled
-if network.monitoring_enabled
-  puts "CloudWatch monitoring is active"
-  puts "Log group: #{network.log_group_name}"
-end
-
-# Use VPC ID in other resources
-web_subnet = aws_subnet(:web, {
-  vpc_id: network.vpc_id,
-  cidr_block: "10.0.1.0/24",
-  availability_zone: network.availability_zones.first
-})
-```
-
-## Validation and Constraints
-
-### CIDR Block Validation
-- Must be valid CIDR notation
-- Prefix must be between /16 and /28
-- Automatically validates RFC 1918 compliance
-- Estimates subnet capacity
-
-### Availability Zone Validation
-- All zones must be from the same region
-- Supports 1-6 availability zones
-- Validates zone format and existence
-
-### Configuration Validation
-- S3 flow log destination requires flow logs enabled
-- Detailed monitoring requires CloudWatch enabled
-- Log retention must be 1-3653 days
-
-## Security Features
-
-### Current Implementation
-- **DNS Resolution**: Proper hostname resolution for instances
-- **Private CIDR Validation**: Ensures use of private address space
-- **Security Tagging**: Automatic compliance and security tags
-- **CloudWatch Integration**: Monitoring and log aggregation
-
-### Future Implementation (Pending aws_flow_log)
-- **VPC Flow Logs**: Complete network traffic logging
-- **Multi-Destination Support**: CloudWatch Logs and S3 destinations
-- **Traffic Analysis**: All, accept, or reject traffic filtering
-- **Security Monitoring**: Integration with security tools
-
-## Best Practices
-
-### Security
-1. **Always use private CIDR blocks** for internal networks
-2. **Enable flow logs in production** environments
-3. **Use dedicated tenancy** for compliance-sensitive workloads
-4. **Apply comprehensive tagging** for compliance tracking
-
-### Cost Optimization
-1. **Adjust log retention** based on compliance requirements
-2. **Disable detailed monitoring** in development environments
-3. **Use default tenancy** unless compliance requires dedicated
-4. **Consider S3 destinations** for long-term log storage
-
-### Operational Excellence
-1. **Include environment tags** for resource management
-2. **Enable CloudWatch monitoring** for operational visibility
-3. **Plan subnet allocation** using estimated capacity
-4. **Document security configurations** for compliance audits
-
-## Integration with Other Components
-
-The secure_vpc component is designed to work seamlessly with other networking components:
-
-```ruby
-# Create secure VPC
-network = secure_vpc(:main, {
-  cidr_block: "10.0.0.0/16",
-  availability_zones: ["us-east-1a", "us-east-1b"]
-})
-
-# Add public/private subnets
-subnets = public_private_subnets(:web_tier, {
-  vpc_ref: network.vpc,
-  public_cidrs: ["10.0.1.0/24", "10.0.2.0/24"],
-  private_cidrs: ["10.0.10.0/24", "10.0.20.0/24"]
-})
-
-# Add web security group
-web_sg = web_security_group(:web_servers, {
-  vpc_ref: network.vpc,
-  description: "Security group for web servers"
-})
-```
-
-## Error Handling
-
-The component provides comprehensive error handling and validation:
-
-- **CIDR Validation**: Clear errors for invalid CIDR blocks
-- **Zone Validation**: Errors for mixed regions or invalid zones
-- **Configuration Validation**: Errors for incompatible option combinations
-- **Resource Creation**: Proper error propagation from underlying resources
-
-## Testing
-
-```ruby
-RSpec.describe Pangea::Components::SecureVpc do
-  describe "#secure_vpc" do
-    it "creates VPC with security enhancements" do
-      vpc = secure_vpc(:test, {
-        cidr_block: "10.0.0.0/16",
-        availability_zones: ["us-east-1a", "us-east-1b"]
-      })
-      
-      expect(vpc).to be_a(ComponentReference)
-      expect(vpc.type).to eq('secure_vpc')
-      expect(vpc.resources[:vpc]).to be_present
-      expect(vpc.resources[:log_group]).to be_present
-      expect(vpc.security_level).to eq('enhanced')
-      expect(vpc.is_private_cidr).to be true
-    end
-    
-    it "validates CIDR block constraints" do
-      expect {
-        secure_vpc(:test, {
-          cidr_block: "10.0.0.0/29",  # Too small
-          availability_zones: ["us-east-1a"]
-        })
-      }.to raise_error(Dry::Struct::Error, /too small/)
-    end
-    
-    it "validates availability zone regions" do
-      expect {
-        secure_vpc(:test, {
-          cidr_block: "10.0.0.0/16",
-          availability_zones: ["us-east-1a", "us-west-2a"]  # Different regions
-        })
-      }.to raise_error(Dry::Struct::Error, /same region/)
-    end
-  end
-end
-```
-
-This secure VPC component provides a robust foundation for secure AWS networking with comprehensive monitoring, validation, and future-ready architecture for enhanced security features.