pangea 0.0.45 → 0.0.46

data/lib/pangea/resources/aws/extended_resources_CLAUDE.md

@@ -1,470 +0,0 @@
-# AWS Extended Resources Implementation
-
-This document outlines the AWS Extended resources implementation across VPC, Load Balancing, Auto Scaling, and EC2 categories, focusing on advanced networking, load balancing, auto scaling, and compute optimization use cases.
-
-## Implementation Status
-
-### VPC Extended (15 resources) ✅ IMPLEMENTED
-
-Advanced VPC networking, endpoint management, and default resource control:
-
-1. **aws_vpc_endpoint_connection_notification** - Monitor VPC endpoint connection state changes
-   - Notification for endpoint connection events (Accept, Connect, Delete, Reject)
-   - Integration with SNS topics for automated monitoring
-   - Support for VPC endpoint service notifications
-
-2. **aws_vpc_endpoint_service_allowed_principal** - Control VPC endpoint service access
-   - Principal-based access control for endpoint services
-   - Support for AWS account, IAM role, and service principals
-   - Cross-account endpoint service sharing
-
-3. **aws_vpc_endpoint_connection_accepter** - Accept VPC endpoint connections
-   - Automated acceptance of endpoint connection requests
-   - Cross-account endpoint connection management
-   - Integration with connection approval workflows
-
-4. **aws_vpc_endpoint_route_table_association** - Route endpoint traffic through route tables
-   - Associate VPC endpoints with specific route tables
-   - Control traffic routing for gateway endpoints
-   - Support for S3 and DynamoDB gateway endpoints
-
-5. **aws_vpc_endpoint_subnet_association** - Subnet-level endpoint access control
-   - Associate interface endpoints with specific subnets
-   - Multi-AZ endpoint deployment strategies
-   - Subnet-specific endpoint policies
-
-6. **aws_vpc_peering_connection_options** - Customize VPC peering behavior
-   - DNS resolution options for peered VPCs
-   - Accept VPC peering connection options
-   - Cross-region peering configuration
-
-7. **aws_vpc_peering_connection_accepter** - Accept cross-account/region peering
-   - Automated peering connection acceptance
-   - Cross-account VPC peering workflows
-   - Cross-region peering connection management
-
-8. **aws_vpc_dhcp_options_association** - Link DHCP options to VPCs
-   - Custom DNS and NTP server configuration
-   - Domain name and search domain management
-   - NetBIOS configuration for Windows instances
-
-9. **aws_vpc_network_performance_metric_subscription** - Monitor network performance
-   - Network performance metrics collection
-   - Integration with CloudWatch metrics
-   - Performance monitoring for VPC endpoints
-
-10. **aws_vpc_security_group_egress_rule** - Granular outbound traffic control
-    - Individual egress rule management
-    - Enhanced security group rule organization
-    - Support for referenced security groups and prefix lists
-
-11. **aws_vpc_security_group_ingress_rule** - Granular inbound traffic control
-    - Individual ingress rule management
-    - IPv4 and IPv6 CIDR block support
-    - Port range and protocol specification
-
-12. **aws_default_vpc_dhcp_options** - Manage default VPC DHCP options
-    - Customize default network behavior
-    - Domain name and DNS server defaults
-    - NTP and NetBIOS configuration
-
-13. **aws_default_network_acl** - Control default subnet access rules
-    - Manage default network ACL rules
-    - Ingress and egress rule customization
-    - Subnet association management
-
-14. **aws_default_route_table** - Control default routing behavior
-    - Manage main route table for VPC
-    - Default route propagation settings
-    - Association with subnets
-
-15. **aws_default_security_group** - Control default instance access rules
-    - Customize default security group rules
-    - Remove default allow-all egress rules
-    - Implement least-privilege security defaults
-
-### Load Balancing Extended (12 resources) ✅ IMPLEMENTED
-
-Advanced load balancer configuration, trust stores, and Classic Load Balancer features:
-
-1. **aws_lb_trust_store** - SSL/TLS certificate validation stores
-   - CA certificate bundle management
-   - S3-based certificate storage
-   - SSL/TLS validation for load balancers
-
-2. **aws_lb_trust_store_revocation** - Certificate revocation lists
-   - Certificate revocation list (CRL) management
-   - Automated certificate validation
-   - Trust store revocation updates
-
-3. **aws_alb_target_group_attachment** - ALB target registration
-   - Application Load Balancer target management
-   - Instance and IP target registration
-   - Port and availability zone specification
-
-4. **aws_lb_target_group_attachment** - Load balancer target registration
-   - Network and Application Load Balancer targets
-   - Lambda function target registration
-   - Cross-zone load balancing support
-
-5. **aws_lb_ssl_negotiation_policy** - Classic ELB SSL configuration
-   - SSL cipher suite configuration
-   - Protocol version management
-   - Legacy SSL/TLS support
-
-6. **aws_lb_cookie_stickiness_policy** - Session affinity management
-   - Application-controlled session persistence
-   - Load balancer-generated cookie stickiness
-   - Session timeout configuration
-
-7. **aws_elb_attachment** - Classic ELB instance registration
-   - EC2 instance attachment to Classic Load Balancers
-   - Health check integration
-   - Multi-instance management
-
-8. **aws_elb_service_account** - ELB service account data source
-   - Regional ELB service account identification
-   - Access logging bucket policy configuration
-   - Cross-region service account management
-
-9. **aws_proxy_protocol_policy** - Proxy protocol support
-   - Enable proxy protocol for Classic Load Balancers
-   - Client IP address preservation
-   - Backend server proxy protocol configuration
-
-10. **aws_load_balancer_backend_server_policy** - Backend server policies
-    - Classic Load Balancer backend configuration
-    - Server-specific policy application
-    - Instance-level load balancer settings
-
-11. **aws_load_balancer_listener_policy** - Listener policy management
-    - Classic Load Balancer listener configuration
-    - SSL and proxy protocol policies
-    - Multi-policy listener management
-
-12. **aws_load_balancer_policy** - Custom load balancer policies
-    - Application and network-level policies
-    - Custom policy attribute configuration
-    - Policy type and attribute management
-
-### Auto Scaling Extended (10 resources) ✅ IMPLEMENTED
-
-Advanced auto scaling configuration, lifecycle management, and optimization:
-
-1. **aws_autoscaling_lifecycle_hook** - Custom scaling actions
-   - Instance launch and termination hooks
-   - Custom scripts during scaling events
-   - Integration with SNS and SQS for notifications
-
-2. **aws_autoscaling_notification** - Auto scaling event monitoring
-   - CloudWatch and SNS integration
-   - Scaling event notifications
-   - Multi-group notification management
-
-3. **aws_autoscaling_schedule** - Scheduled scaling actions
-   - Time-based capacity adjustments
-   - Recurring scaling schedules
-   - Predictive scaling for known patterns
-
-4. **aws_autoscaling_traffic_source_attachment** - Load balancer integration
-   - Target group and Classic Load Balancer attachment
-   - Health check integration
-   - Multi-load balancer support
-
-5. **aws_autoscaling_warm_pool** - Pre-initialized instance management
-   - Faster scaling with pre-warmed instances
-   - Instance state management (Stopped, Running, Hibernated)
-   - Cost optimization through instance reuse
-
-6. **aws_autoscaling_group_tag** - Resource tagging management
-   - Propagate tags to launched instances
-   - Dynamic tag management
-   - Cost allocation and resource organization
-
-7. **aws_launch_configuration** - Legacy instance templates (DEPRECATED)
-   - EC2 instance launch configuration
-   - AMI, instance type, and security group specification
-   - EBS block device mapping
-
-8. **aws_placement_group** - Instance placement strategies
-   - Cluster, partition, and spread placement
-   - High-performance computing optimization
-   - Low-latency networking requirements
-
-9. **aws_autoscaling_policy_step_adjustment** - Step scaling configuration
-   - Metric-based scaling with multiple thresholds
-   - Step-wise capacity adjustments
-   - CloudWatch alarm integration
-
-10. **aws_autoscaling_policy_target_tracking_scaling_policy** - Automatic target tracking
-    - Target value-based scaling
-    - CPU utilization, network, and custom metric tracking
-    - Automatic scale-out and scale-in decisions
-
-### EC2 Extended (18 resources) ✅ IMPLEMENTED
-
-Advanced compute management, capacity reservations, fleet management, and specialized features:
-
-1. **aws_ec2_availability_zone_group** - AZ group management
-   - Regional availability zone access control
-   - Local zone and wavelength zone management
-   - Zone group opt-in management
-
-2. **aws_ec2_capacity_reservation** - Guaranteed compute capacity
-   - On-Demand instance capacity reservation
-   - Instance type and availability zone specification
-   - Capacity matching and utilization preferences
-
-3. **aws_ec2_capacity_block_reservation** - HPC capacity blocks
-   - High-performance computing workload reservations
-   - GPU and compute-intensive instance reservations
-   - Duration-based capacity guarantees
-
-4. **aws_ec2_fleet** - Multi-instance type fleet management
-   - Diversified instance provisioning across types and AZs
-   - Spot and On-Demand instance mix strategies
-   - Launch template-based fleet configuration
-
-5. **aws_ec2_spot_fleet_request** - Cost-optimized spot instances
-   - Spot instance fleet with multiple instance types
-   - Bid price management and allocation strategies
-   - Target capacity and diversification options
-
-6. **aws_ec2_spot_datafeed_subscription** - Spot instance activity logging
-   - Spot instance usage and pricing data
-   - S3-based log delivery
-   - Historical spot instance analytics
-
-7. **aws_ec2_spot_instance_request** - Individual spot instance requests
-   - Single spot instance provisioning
-   - Bid price and duration specification
-   - Persistent and one-time spot requests
-
-8. **aws_ec2_dedicated_host** - Single-tenant hardware
-   - Physical server reservation for compliance
-   - BYOL (Bring Your Own License) support
-   - Host resource management and utilization
-
-9. **aws_ec2_host_resource_group_association** - Dedicated host management
-   - Host resource group organization
-   - License management integration
-   - Multi-host resource allocation
-
-10. **aws_ec2_instance_metadata_defaults** - Account-level metadata configuration
-    - Default Instance Metadata Service (IMDS) settings
-    - IMDSv2 enforcement across account
-    - Security best practices implementation
-
-11. **aws_ec2_serial_console_access** - Instance debugging access
-    - Serial console access for troubleshooting
-    - Out-of-band instance access
-    - Emergency access when SSH/RDP unavailable
-
-12. **aws_ec2_image_block_public_access** - AMI sharing control
-    - Prevent accidental public AMI sharing
-    - Account-level AMI access restrictions
-    - AMI sharing governance
-
-13. **aws_ec2_ami_launch_permission** - AMI access control
-    - Cross-account AMI sharing permissions
-    - Fine-grained AMI access management
-    - Launch permission delegation
-
-14. **aws_ec2_snapshot_block_public_access** - Snapshot sharing control
-    - Prevent accidental public snapshot sharing
-    - Account-level snapshot access restrictions
-    - Snapshot sharing governance
-
-15. **aws_ec2_tag** - Resource tagging management
-    - Individual resource tag management
-    - Dynamic tag updates
-    - Cost allocation and resource organization
-
-16. **aws_ec2_transit_gateway_multicast_domain** - Multicast traffic routing
-    - Transit Gateway multicast domain management
-    - Multicast group configuration
-    - Cross-VPC multicast communication
-
-17. **aws_ec2_transit_gateway_multicast_domain_association** - Subnet multicast association
-    - Associate subnets with multicast domains
-    - Multicast traffic routing configuration
-    - Multi-AZ multicast support
-
-18. **aws_ec2_transit_gateway_multicast_group_member** - Multicast group management
-    - Multicast group membership management
-    - Instance-level multicast participation
-    - Group communication control
-
-## Architecture Patterns Enabled
-
-### Advanced VPC Networking
-- **Private Endpoint Architecture**: Complete private connectivity without internet gateways
-- **Multi-Account VPC Strategy**: Cross-account peering with automated acceptance
-- **Zero-Trust Networking**: Granular security group rules with least privilege
-- **DNS and DHCP Customization**: Custom network services for enterprise requirements
-
-### High-Availability Load Balancing
-- **Multi-Tier Load Balancing**: Application and Network Load Balancer integration
-- **SSL/TLS Management**: Trust store-based certificate validation
-- **Session Management**: Advanced stickiness and session affinity
-- **Legacy Application Support**: Classic Load Balancer advanced features
-
-### Intelligent Auto Scaling
-- **Predictive Scaling**: Scheduled and lifecycle-driven capacity management
-- **Cost-Optimized Scaling**: Warm pools and traffic source integration
-- **Application-Aware Scaling**: Custom lifecycle hooks for application readiness
-- **Multi-Metric Scaling**: Target tracking with step adjustments
-
-### Enterprise Compute Management
-- **Capacity Assurance**: Reservations for guaranteed availability
-- **Cost Optimization**: Spot fleet management with diversification
-- **Compliance Support**: Dedicated hosts for licensing requirements
-- **Fleet Management**: Multi-instance type provisioning strategies
-
-## Type Safety and Validation
-
-All resources implement comprehensive type safety through:
-
-- **Dry::Struct Validation**: Runtime attribute validation with custom constraints
-- **RBS Type Definitions**: Compile-time type checking support
-- **Business Rule Validation**: Domain-specific validation beyond basic types
-- **Reference Management**: Type-safe cross-resource references
-
-## Integration Examples
-
-### Complete Web Application Infrastructure
-
-```ruby
-template :production_web_app do
-  # VPC with custom DHCP and advanced security
-  vpc = aws_vpc(:main, {
-    cidr_block: "10.0.0.0/16",
-    enable_dns_hostnames: true,
-    enable_dns_support: true
-  })
-
-  # Custom default security group with least privilege
-  aws_default_security_group(:default, {
-    vpc_id: vpc.id,
-    ingress: [],
-    egress: [
-      {
-        protocol: "tcp",
-        from_port: 443,
-        to_port: 443,
-        cidr_blocks: ["0.0.0.0/0"]
-      }
-    ]
-  })
-
-  # Capacity reservation for guaranteed availability
-  capacity = aws_ec2_capacity_reservation(:web_capacity, {
-    instance_type: "c5.xlarge",
-    instance_platform: "Linux/UNIX",
-    availability_zone: "us-east-1a",
-    instance_count: 2
-  })
-
-  # Launch configuration with advanced block device mapping
-  launch_config = aws_launch_configuration(:web_lc, {
-    name_prefix: "web-app-",
-    image_id: "ami-12345678",
-    instance_type: "c5.xlarge",
-    security_groups: [web_sg.id],
-    user_data: base64encode(file("user_data.sh")),
-    root_block_device: {
-      volume_type: "gp3",
-      volume_size: 20,
-      encrypted: true
-    }
-  })
-
-  # Auto scaling with lifecycle hooks and warm pool
-  asg = aws_autoscaling_group(:web_asg, {
-    name: "web-app-asg",
-    vpc_zone_identifier: [private_subnet.id],
-    launch_configuration: launch_config.name,
-    min_size: 2,
-    max_size: 10,
-    desired_capacity: 2
-  })
-
-  # Lifecycle hook for application readiness
-  aws_autoscaling_lifecycle_hook(:app_ready_hook, {
-    name: "app-readiness-check",
-    autoscaling_group_name: asg.name,
-    lifecycle_transition: "autoscaling:EC2_INSTANCE_LAUNCHING",
-    heartbeat_timeout: 300,
-    default_result: "CONTINUE"
-  })
-
-  # Warm pool for faster scaling
-  aws_autoscaling_warm_pool(:warm_instances, {
-    autoscaling_group_name: asg.name,
-    pool_state: "Stopped",
-    min_size: 1,
-    max_group_prepared_capacity: 5
-  })
-
-  # Application Load Balancer with trust store
-  trust_store = aws_lb_trust_store(:app_trust, {
-    name: "app-certificate-store",
-    ca_certificates_bundle_s3_bucket: "cert-bucket",
-    ca_certificates_bundle_s3_key: "ca-bundle.pem"
-  })
-
-  alb = aws_lb(:app_alb, {
-    name: "app-load-balancer",
-    load_balancer_type: "application",
-    subnets: [public_subnet_a.id, public_subnet_b.id],
-    security_groups: [alb_sg.id]
-  })
-
-  # Target group attachment with health checks
-  aws_lb_target_group_attachment(:web_targets, {
-    target_group_arn: app_tg.arn,
-    target_id: "${each.value}",
-    for_each: "${toset(data.aws_autoscaling_group.web_asg.instances)}"
-  })
-end
-```
-
-### Multi-Region Disaster Recovery
-
-```ruby
-template :disaster_recovery do
-  # Primary region capacity reservation
-  primary_capacity = aws_ec2_capacity_reservation(:primary, {
-    instance_type: "m5.large",
-    instance_platform: "Linux/UNIX",
-    availability_zone: "us-east-1a",
-    instance_count: 5,
-    tenancy: "default"
-  })
-
-  # Cross-region VPC peering
-  peering = aws_vpc_peering_connection(:dr_peering, {
-    vpc_id: primary_vpc.id,
-    peer_vpc_id: dr_vpc.id,
-    peer_region: "us-west-2"
-  })
-
-  # Auto-accept peering in DR region
-  aws_vpc_peering_connection_accepter(:dr_accepter, {
-    vpc_peering_connection_id: peering.id,
-    auto_accept: true
-  })
-
-  # Scheduled scaling for DR readiness
-  aws_autoscaling_schedule(:dr_warmup, {
-    scheduled_action_name: "disaster-recovery-warmup",
-    autoscaling_group_name: dr_asg.name,
-    min_size: 2,
-    max_size: 10,
-    desired_capacity: 2,
-    recurrence: "0 6 * * *"  # Daily at 6 AM
-  })
-end
-```
-
-This implementation provides comprehensive coverage of advanced AWS networking, load balancing, auto scaling, and compute optimization capabilities, enabling sophisticated infrastructure patterns while maintaining type safety and ease of use.