pangea 0.0.45 → 0.0.46

data/lib/pangea/resources/aws_config_configuration_recorder/resource.rb

@@ -1,139 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'pangea/resources/base'
-require 'pangea/resources/reference'
-require 'pangea/resources/aws_config_configuration_recorder/types'
-require 'pangea/resource_registry'
-
-module Pangea
-  module Resources
-    module AWS
-      # Create an AWS Config Configuration Recorder with type-safe attributes
-      #
-      # @param name [Symbol] The resource name
-      # @param attributes [Hash] Configuration Recorder attributes
-      # @option attributes [String] :name The name of the configuration recorder
-      # @option attributes [String] :role_arn The ARN of the IAM role that AWS Config uses to record configuration changes
-      # @option attributes [Hash] :recording_group The recording group configuration
-      # @option attributes [Hash] :tags A map of tags to assign to the resource
-      # @return [ResourceReference] Reference object with outputs and computed properties
-      #
-      # @example Basic configuration recorder
-      #   config_recorder = aws_config_configuration_recorder(:main_recorder, {
-      #     name: "main-config-recorder",
-      #     role_arn: config_role.arn,
-      #     tags: {
-      #       Environment: "production",
-      #       Purpose: "compliance"
-      #     }
-      #   })
-      #
-      # @example Configuration recorder with specific resource types
-      #   config_recorder = aws_config_configuration_recorder(:ec2_recorder, {
-      #     name: "ec2-resource-recorder",
-      #     role_arn: config_role.arn,
-      #     recording_group: {
-      #       all_supported: false,
-      #       include_global_resource_types: false,
-      #       resource_types: [
-      #         "AWS::EC2::Instance",
-      #         "AWS::EC2::SecurityGroup",
-      #         "AWS::EC2::Volume"
-      #       ]
-      #     },
-      #     tags: {
-      #       Environment: "production",
-      #       Scope: "ec2-only"
-      #     }
-      #   })
-      #
-      # @example Configuration recorder for all resources with global types
-      #   config_recorder = aws_config_configuration_recorder(:full_recorder, {
-      #     name: "full-compliance-recorder",
-      #     role_arn: config_role.arn,
-      #     recording_group: {
-      #       all_supported: true,
-      #       include_global_resource_types: true
-      #     },
-      #     tags: {
-      #       Environment: "production",
-      #       Compliance: "sox-pci",
-      #       Scope: "organization-wide"
-      #     }
-      #   })
-      def aws_config_configuration_recorder(name, attributes = {})
-        # Validate attributes using dry-struct
-        recorder_attrs = Types::Types::ConfigConfigurationRecorderAttributes.new(attributes)
-        
-        # Generate terraform resource block via terraform-synthesizer
-        resource(:aws_config_configuration_recorder, name) do
-          name recorder_attrs.name
-          role_arn recorder_attrs.role_arn
-          
-          # Add recording group configuration if specified
-          if recorder_attrs.has_recording_group?
-            recording_group do
-              if recorder_attrs.recording_group[:all_supported]
-                all_supported recorder_attrs.recording_group[:all_supported]
-              end
-              
-              if recorder_attrs.recording_group[:include_global_resource_types]
-                include_global_resource_types recorder_attrs.recording_group[:include_global_resource_types]
-              end
-              
-              if recorder_attrs.recording_group[:resource_types].is_a?(Array)
-                resource_types recorder_attrs.recording_group[:resource_types]
-              end
-            end
-          end
-          
-          # Apply tags if present
-          if recorder_attrs.tags.any?
-            tags do
-              recorder_attrs.tags.each do |key, value|
-                public_send(key, value)
-              end
-            end
-          end
-        end
-        
-        # Return resource reference with available outputs
-        ResourceReference.new(
-          type: 'aws_config_configuration_recorder',
-          name: name,
-          resource_attributes: recorder_attrs.to_h,
-          outputs: {
-            name: "${aws_config_configuration_recorder.#{name}.name}",
-            role_arn: "${aws_config_configuration_recorder.#{name}.role_arn}",
-            recording_group: "${aws_config_configuration_recorder.#{name}.recording_group}",
-            tags_all: "${aws_config_configuration_recorder.#{name}.tags_all}"
-          },
-          computed_properties: {
-            has_recording_group: recorder_attrs.has_recording_group?,
-            records_all_resources: recorder_attrs.records_all_resources?,
-            includes_global_resources: recorder_attrs.includes_global_resources?,
-            has_specific_resource_types: recorder_attrs.has_specific_resource_types?,
-            estimated_monthly_cost_usd: recorder_attrs.estimated_monthly_cost_usd
-          }
-        )
-      end
-    end
-  end
-end
-
-# Auto-register this module when it's loaded
-Pangea::ResourceRegistry.register(:aws, Pangea::Resources::AWS)

data/lib/pangea/resources/aws_config_configuration_recorder/types.rb

@@ -1,156 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'dry-struct'
-require 'pangea/resources/types'
-
-module Pangea
-  module Resources
-    module AWS
-      module Types
-        # AWS Config Configuration Recorder resource attributes with validation
-        class ConfigConfigurationRecorderAttributes < Dry::Struct
-          transform_keys(&:to_sym)
-          
-          # Required attributes
-          attribute :name, Resources::Types::String
-          attribute :role_arn, Resources::Types::String
-          
-          # Optional attributes
-          attribute :recording_group, Resources::Types::Hash.optional.default(nil)
-          
-          # Tags
-          attribute :tags, Resources::Types::AwsTags
-          
-          # Validate configuration recorder name and role ARN
-          def self.new(attributes)
-            attrs = attributes.is_a?(Hash) ? attributes : {}
-            
-            if attrs[:name]
-              name = attrs[:name]
-              
-              # Must not be empty
-              if name.empty?
-                raise Dry::Struct::Error, "Configuration recorder name cannot be empty"
-              end
-              
-              # Length constraints (AWS Config allows 1-256 characters)
-              if name.length > 256
-                raise Dry::Struct::Error, "Configuration recorder name cannot exceed 256 characters"
-              end
-              
-              # Character validation - alphanumeric, hyphens, underscores
-              unless name.match?(/\A[a-zA-Z0-9_-]+\z/)
-                raise Dry::Struct::Error, "Configuration recorder name can only contain alphanumeric characters, hyphens, and underscores"
-              end
-            end
-            
-            if attrs[:role_arn]
-              role_arn = attrs[:role_arn]
-              
-              # Must not be empty
-              if role_arn.empty?
-                raise Dry::Struct::Error, "Role ARN cannot be empty"
-              end
-              
-              # Basic ARN format validation
-              unless role_arn.match?(/\Aarn:aws:iam::\d{12}:role\//)
-                raise Dry::Struct::Error, "Role ARN must be a valid IAM role ARN format: arn:aws:iam::account:role/name"
-              end
-            end
-            
-            # Validate recording group if provided
-            if attrs[:recording_group].is_a?(Hash)
-              recording_group = attrs[:recording_group]
-              
-              # Validate boolean fields if present
-              if recording_group.key?(:all_supported) && ![true, false].include?(recording_group[:all_supported])
-                raise Dry::Struct::Error, "recording_group.all_supported must be true or false"
-              end
-              
-              if recording_group.key?(:include_global_resource_types) && ![true, false].include?(recording_group[:include_global_resource_types])
-                raise Dry::Struct::Error, "recording_group.include_global_resource_types must be true or false"
-              end
-              
-              # Validate resource types array if present
-              if recording_group.key?(:resource_types) && !recording_group[:resource_types].is_a?(Array)
-                raise Dry::Struct::Error, "recording_group.resource_types must be an array"
-              end
-            end
-            
-            super(attrs)
-          end
-          
-          # Computed properties
-          def has_recording_group?
-            !recording_group.nil? && !recording_group.empty?
-          end
-          
-          def records_all_resources?
-            has_recording_group? && recording_group[:all_supported] == true
-          end
-          
-          def includes_global_resources?
-            has_recording_group? && recording_group[:include_global_resource_types] == true
-          end
-          
-          def has_specific_resource_types?
-            has_recording_group? && recording_group[:resource_types].is_a?(Array) && !recording_group[:resource_types].empty?
-          end
-          
-          def estimated_monthly_cost_usd
-            # AWS Config pricing: $0.003 per configuration item recorded per month
-            # Estimate based on resource types being recorded
-            
-            base_resources = 50 # Conservative estimate of baseline resources
-            
-            if records_all_resources?
-              # Recording all supported resource types - higher cost
-              estimated_resources = base_resources * 3 # Assume 3x more resources
-            elsif has_specific_resource_types?
-              # Recording specific resource types
-              resource_count = recording_group[:resource_types].length
-              estimated_resources = base_resources * [resource_count / 10.0, 1.0].max
-            else
-              estimated_resources = base_resources
-            end
-            
-            # Configuration items cost
-            config_cost = estimated_resources * 0.003
-            
-            # Add cost for global resources if included
-            global_cost = includes_global_resources? ? 15.0 * 0.003 : 0.0
-            
-            total_cost = config_cost + global_cost
-            total_cost.round(2)
-          end
-          
-          def to_h
-            hash = {
-              name: name,
-              role_arn: role_arn,
-              tags: tags
-            }
-            
-            hash[:recording_group] = recording_group if has_recording_group?
-            
-            hash.compact
-          end
-        end
-      end
-    end
-  end
-end

data/lib/pangea/resources/aws_config_configuration_recorder.rbs

@@ -1,10 +0,0 @@
-# frozen_string_literal: true
-
-module Pangea
-  module Resources
-    module AWS
-      # Create AWS Config Configuration Recorder resource
-      def aws_config_configuration_recorder: (Symbol name, Hash[Symbol, untyped] attributes) -> ResourceReference
-    end
-  end
-end

data/lib/pangea/resources/aws_config_delivery_channel/CLAUDE.md

@@ -1,290 +0,0 @@
-# AWS Config Delivery Channel Implementation
-
-## Overview
-
-This implementation provides type-safe AWS Config Delivery Channel resources with comprehensive validation, cost estimation, and enterprise delivery patterns for configuration data.
-
-## Architecture
-
-### Type System
-- **`ConfigDeliveryChannelAttributes`**: dry-struct validation with AWS Config delivery-specific constraints
-- **Name Validation**: AWS Config delivery channel naming pattern enforcement
-- **S3 Bucket Validation**: S3 bucket name format validation
-- **ARN Validation**: KMS key ARN and SNS topic ARN format validation
-- **Delivery Properties Validation**: Snapshot delivery frequency validation
-- **Cost Estimation**: Built-in monthly cost estimation based on delivery frequency and features
-
-### Key Features
-
-#### 1. AWS-Compliant Name Validation
-- Enforces AWS Config delivery channel naming restrictions
-- Validates character sets (alphanumeric, periods, hyphens, underscores)
-- Length limits (1-256 characters)
-- Prevents empty names
-
-#### 2. S3 Integration Validation
-- S3 bucket name format validation
-- S3 key prefix support for organized storage
-- KMS encryption support with ARN validation
-- Comprehensive S3 bucket configuration requirements
-
-#### 3. SNS Notification Support
-- SNS topic ARN validation
-- Real-time notification capabilities
-- Integration with monitoring and alerting systems
-- Compliance alert workflows
-
-#### 4. Snapshot Delivery Configuration
-- Configurable delivery frequencies (hourly to daily)
-- Cost-aware frequency selection
-- Real-time vs. cost-optimized delivery modes
-- Enterprise compliance frequency patterns
-
-#### 5. Cost Optimization Features
-- Built-in cost estimation methodology
-- Frequency-based cost calculations
-- S3 storage and request cost modeling
-- Additional service cost considerations (SNS, KMS)
-
-## Implementation Details
-
-### Validation Logic
-
-#### Delivery Channel Name Validation
-```ruby
-# Pattern: alphanumeric, periods, hyphens, underscores
-name.match?(/\A[a-zA-Z0-9._-]+\z/)
-
-# Length validation
-name.length <= 256 && !name.empty?
-```
-
-#### S3 Bucket Name Validation
-```ruby
-# S3 bucket naming rules (basic validation)
-bucket_name.match?(/\A[a-z0-9.-]+\z/)
-
-# Length validation
-bucket_name.length >= 3 && bucket_name.length <= 63
-```
-
-#### ARN Format Validation
-```ruby
-# KMS key ARN validation
-kms_arn.match?(/\Aarn:aws:kms:[^:]+:\d{12}:key\//)
-
-# SNS topic ARN validation
-sns_arn.match?(/\Aarn:aws:sns:[^:]+:\d{12}:/)
-```
-
-#### Delivery Frequency Validation
-```ruby
-# Valid delivery frequencies
-valid_frequencies = [
-  'One_Hour', 'Three_Hours', 'Six_Hours', 
-  'Twelve_Hours', 'TwentyFour_Hours'
-]
-
-frequency.in?(valid_frequencies)
-```
-
-### Cost Estimation Algorithm
-
-```ruby
-def estimated_monthly_cost_usd
-  base_delivery_cost = 2.00 # Delivery channel operation
-  
-  # S3 storage cost estimate
-  estimated_config_items = 1000
-  config_item_size_kb = 5
-  total_storage_gb = (estimated_config_items * config_item_size_kb) / 1024.0 / 1024.0
-  s3_storage_cost = total_storage_gb * 0.023 # $0.023/GB/month
-  
-  # S3 request cost based on delivery frequency
-  requests_per_month = case delivery_frequency
-                      when 'One_Hour' then 30 * 24      # 720 requests
-                      when 'Three_Hours' then 30 * 8    # 240 requests
-                      when 'Six_Hours' then 30 * 4      # 120 requests
-                      when 'Twelve_Hours' then 30 * 2   # 60 requests
-                      else 30                            # 30 requests (daily)
-                      end
-  
-  s3_request_cost = (requests_per_month / 1000.0) * 0.005 # $0.005/1000 requests
-  
-  # Additional service costs
-  sns_cost = has_sns_notifications? ? 1.00 : 0.0
-  kms_cost = has_encryption? ? 1.00 : 0.0
-  
-  (base_delivery_cost + s3_storage_cost + s3_request_cost + sns_cost + kms_cost).round(2)
-end
-```
-
-### Computed Properties
-
-1. **`has_s3_key_prefix?`**: Boolean indicating S3 key prefix configuration
-2. **`has_encryption?`**: Boolean indicating KMS encryption enabled
-3. **`has_sns_notifications?`**: Boolean indicating SNS notifications configured
-4. **`has_snapshot_delivery_properties?`**: Boolean indicating custom delivery properties
-5. **`delivery_frequency`**: String with actual delivery frequency (default: TwentyFour_Hours)
-6. **`estimated_monthly_cost_usd`**: Float with comprehensive cost estimation
-
-### Terraform Resource Mapping
-
-```ruby
-resource(:aws_config_delivery_channel, name) do
-  name channel_attrs.name
-  s3_bucket_name channel_attrs.s3_bucket_name
-  
-  # Optional S3 configuration
-  s3_key_prefix channel_attrs.s3_key_prefix if channel_attrs.has_s3_key_prefix?
-  s3_kms_key_arn channel_attrs.s3_kms_key_arn if channel_attrs.has_encryption?
-  
-  # Optional SNS notifications
-  sns_topic_arn channel_attrs.sns_topic_arn if channel_attrs.has_sns_notifications?
-  
-  # Snapshot delivery properties block
-  if channel_attrs.has_snapshot_delivery_properties?
-    snapshot_delivery_properties do
-      if channel_attrs.snapshot_delivery_properties[:delivery_frequency]
-        delivery_frequency channel_attrs.snapshot_delivery_properties[:delivery_frequency]
-      end
-    end
-  end
-  
-  # Tags block
-  tags do
-    channel_attrs.tags.each do |key, value|
-      public_send(key, value)
-    end
-  end
-end
-```
-
-### Resource Reference Outputs
-
-```ruby
-outputs: {
-  id: "${aws_config_delivery_channel.#{name}.id}",
-  name: "${aws_config_delivery_channel.#{name}.name}",
-  s3_bucket_name: "${aws_config_delivery_channel.#{name}.s3_bucket_name}",
-  s3_key_prefix: "${aws_config_delivery_channel.#{name}.s3_key_prefix}",
-  s3_kms_key_arn: "${aws_config_delivery_channel.#{name}.s3_kms_key_arn}",
-  sns_topic_arn: "${aws_config_delivery_channel.#{name}.sns_topic_arn}",
-  snapshot_delivery_properties: "${aws_config_delivery_channel.#{name}.snapshot_delivery_properties}",
-  tags_all: "${aws_config_delivery_channel.#{name}.tags_all}"
-}
-```
-
-## Enterprise Patterns
-
-### 1. Multi-Environment Delivery
-- Environment-specific delivery channels with appropriate frequencies
-- Production: Higher frequency for real-time compliance
-- Development/Staging: Daily delivery for cost optimization
-- Environment-specific S3 buckets and key prefixes
-
-### 2. Compliance Framework Delivery
-- **Real-time Compliance**: Three_Hours or Six_Hours frequency
-- **Cost-Optimized**: TwentyFour_Hours frequency for baseline compliance
-- **Security Monitoring**: High-frequency delivery with SNS alerts
-- **Audit Trail**: Encrypted delivery with long-term S3 retention
-
-### 3. Multi-Region Delivery Architecture
-- Regional delivery channels for jurisdiction-specific compliance
-- Cross-region delivery to centralized compliance accounts
-- Regional KMS keys for data sovereignty
-- Region-specific SNS notification topics
-
-### 4. Integration Patterns
-- **With Configuration Recorder**: Delivery channel depends on recorder
-- **With Config Rules**: Rules consume delivered configuration data
-- **With CloudWatch**: Monitoring delivery channel health and performance
-- **With Organizations**: Cross-account delivery for centralized governance
-
-## Cost Optimization Strategies
-
-### Delivery Frequency Impact
-| Frequency | Monthly Requests | Request Cost Impact | Use Case |
-|-----------|-----------------|---------------------|----------|
-| One_Hour | 720 | Highest | Real-time compliance |
-| Three_Hours | 240 | High | Security monitoring |
-| Six_Hours | 120 | Medium | Standard compliance |
-| Twelve_Hours | 60 | Low | Cost-conscious compliance |
-| TwentyFour_Hours | 30 | Lowest | Basic compliance |
-
-### Cost Components
-1. **Base Delivery Cost**: Fixed ~$2/month per channel
-2. **S3 Storage Cost**: Variable based on configuration item volume
-3. **S3 Request Cost**: Directly proportional to delivery frequency
-4. **SNS Cost**: ~$1/month if notifications enabled
-5. **KMS Cost**: ~$1/month if encryption enabled
-
-### Optimization Recommendations
-- Use daily delivery for cost-sensitive environments
-- Implement hourly delivery only for critical compliance requirements
-- Consider S3 lifecycle policies for long-term cost management
-- Use SNS notifications selectively for high-priority alerts
-
-## Security Considerations
-
-### S3 Security Requirements
-- Proper bucket policies for AWS Config service access
-- KMS encryption for sensitive configuration data
-- S3 key prefixes for access control and organization
-- Cross-account access configuration for centralized delivery
-
-### IAM Permissions
-- AWS Config service must have S3 PutObject permissions
-- KMS key permissions for encryption if enabled
-- SNS topic permissions for notifications
-- Cross-account role assumptions for multi-account setups
-
-### Compliance Security
-- Encryption at rest with customer-managed KMS keys
-- Transit encryption for all delivery operations
-- Audit logging of delivery channel access and modifications
-- Network security for S3 bucket access
-
-## Validation Error Messages
-
-The implementation provides clear error messages for common validation failures:
-
-- Name format violations with character requirements
-- S3 bucket name validation with format examples
-- ARN format errors with proper ARN structure examples
-- Delivery frequency validation with supported values list
-- Length constraint violations with specific limits
-
-## Best Practices Encoded
-
-1. **Naming Conventions**: Environment and purpose-based naming
-2. **Delivery Frequency**: Balance between compliance needs and costs
-3. **Security**: Encryption for sensitive data, proper access controls
-4. **Monitoring**: SNS notifications for delivery failures and alerts
-5. **Organization**: S3 key prefixes for structured data storage
-6. **Cost Management**: Frequency selection based on compliance requirements
-
-## Testing Considerations
-
-The implementation supports testing through:
-- Deterministic cost calculations based on delivery frequency
-- Predictable computed properties for different configurations
-- Clear validation rules with comprehensive error messages
-- Type safety through dry-struct validation
-- Mock-friendly resource reference outputs
-
-## Performance Considerations
-
-### Delivery Performance
-- Higher frequencies provide more real-time data but increase costs
-- S3 storage organization affects query and retrieval performance
-- Regional delivery channels reduce latency for regional compliance
-- Parallel delivery channels for different compliance frameworks
-
-### Operational Efficiency
-- Single delivery channel per region recommended
-- Coordination with configuration recorder lifecycle
-- Integration with downstream compliance systems
-- Monitoring and alerting for delivery failures
-
-This implementation provides enterprise-grade AWS Config Delivery Channel management with built-in cost optimization, security best practices, and compliance framework support.