pangea 0.0.45 → 0.0.46

data/lib/pangea/resources/aws_ec2_transit_gateway_route/types.rb

@@ -1,233 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'dry-struct'
-require 'pangea/resources/types'
-
-module Pangea
-  module Resources
-    module AWS
-      module Types
-        # Transit Gateway Route resource attributes with validation
-        class TransitGatewayRouteAttributes < Dry::Struct
-          transform_keys(&:to_sym)
-          
-          attribute :destination_cidr_block, Resources::Types::TransitGatewayCidrBlock
-          attribute :transit_gateway_route_table_id, Resources::Types::String
-          attribute? :blackhole, Resources::Types::Bool.default(false)
-          attribute? :transit_gateway_attachment_id, Resources::Types::String.optional
-          
-          # Custom validation for route configuration
-          def self.new(attributes)
-            attrs = attributes.is_a?(Hash) ? attributes : {}
-            
-            # Validate route table ID format
-            if attrs[:transit_gateway_route_table_id] && !attrs[:transit_gateway_route_table_id].match?(/\Atgw-rtb-[0-9a-f]{8,17}\z/)
-              raise Dry::Struct::Error, "Invalid Transit Gateway Route Table ID format: #{attrs[:transit_gateway_route_table_id]}. Expected format: tgw-rtb-xxxxxxxx"
-            end
-            
-            # Validate attachment ID format if provided
-            if attrs[:transit_gateway_attachment_id] && !attrs[:transit_gateway_attachment_id].match?(/\Atgw-attach-[0-9a-f]{8,17}\z/)
-              raise Dry::Struct::Error, "Invalid Transit Gateway Attachment ID format: #{attrs[:transit_gateway_attachment_id]}. Expected format: tgw-attach-xxxxxxxx"
-            end
-            
-            # Validate blackhole route logic
-            if attrs[:blackhole] == true && attrs[:transit_gateway_attachment_id]
-              raise Dry::Struct::Error, "Blackhole routes cannot specify a transit_gateway_attachment_id. Set blackhole: true without attachment_id for traffic drop."
-            end
-            
-            if attrs[:blackhole] != true && !attrs[:transit_gateway_attachment_id]
-              raise Dry::Struct::Error, "Non-blackhole routes must specify a transit_gateway_attachment_id for traffic forwarding."
-            end
-            
-            super(attrs)
-          end
-          
-          # Computed properties
-          def is_blackhole_route?
-            blackhole == true
-          end
-          
-          def is_default_route?
-            destination_cidr_block == '0.0.0.0/0'
-          end
-          
-          def route_specificity
-            # Calculate route specificity based on CIDR prefix length
-            prefix_length = destination_cidr_block.split('/')[1].to_i
-            
-            case prefix_length
-            when 0..8
-              'very_broad'      # /0 to /8 - very broad routes
-            when 9..16
-              'broad'          # /9 to /16 - broad network routes
-            when 17..24
-              'specific'       # /17 to /24 - specific subnet routes
-            when 25..32
-              'very_specific'  # /25 to /32 - host or very specific routes
-            end
-          end
-          
-          def network_analysis
-            ip, prefix = destination_cidr_block.split('/')
-            ip_parts = ip.split('.').map(&:to_i)
-            prefix_int = prefix.to_i
-            
-            analysis = {
-              ip_address: ip,
-              prefix_length: prefix_int,
-              network_size: 2**(32 - prefix_int),
-              is_rfc1918_private: is_rfc1918_private?,
-              is_default_route: is_default_route?,
-              specificity: route_specificity
-            }
-            
-            # Add network class information
-            if ip_parts[0] >= 1 && ip_parts[0] <= 126
-              analysis[:network_class] = 'A'
-            elsif ip_parts[0] >= 128 && ip_parts[0] <= 191
-              analysis[:network_class] = 'B'
-            elsif ip_parts[0] >= 192 && ip_parts[0] <= 223
-              analysis[:network_class] = 'C'
-            else
-              analysis[:network_class] = 'Special'
-            end
-            
-            analysis
-          end
-          
-          def is_rfc1918_private?
-            ip_parts = destination_cidr_block.split('/')[0].split('.').map(&:to_i)
-            
-            # 10.0.0.0/8
-            return true if ip_parts[0] == 10
-            
-            # 172.16.0.0/12
-            return true if ip_parts[0] == 172 && (16..31).include?(ip_parts[1])
-            
-            # 192.168.0.0/16
-            return true if ip_parts[0] == 192 && ip_parts[1] == 168
-            
-            false
-          end
-          
-          def security_implications
-            implications = []
-            
-            if is_default_route?
-              if is_blackhole_route?
-                implications << "Default route blackhole - all unmatched traffic will be dropped"
-              else
-                implications << "Default route - all unmatched traffic will be forwarded to specified attachment"
-                implications << "Default routes have security implications - ensure target attachment is properly secured"
-              end
-            end
-            
-            if is_blackhole_route?
-              implications << "Blackhole route - traffic to #{destination_cidr_block} will be silently dropped"
-              implications << "Blackhole routes are useful for security but may cause connectivity issues if misconfigured"
-            else
-              implications << "Forward route - traffic to #{destination_cidr_block} will be sent to attachment #{transit_gateway_attachment_id}"
-            end
-            
-            if is_rfc1918_private?
-              implications << "Route targets private address space (RFC 1918)"
-            else
-              implications << "Route targets public/special address space - verify this is intended"
-            end
-            
-            case route_specificity
-            when 'very_broad'
-              implications << "Very broad route (#{destination_cidr_block}) - affects large address ranges"
-            when 'very_specific'
-              implications << "Very specific route (#{destination_cidr_block}) - targets small address range or host"
-            end
-            
-            implications
-          end
-          
-          def route_purpose_analysis
-            purposes = []
-            
-            if is_default_route?
-              if is_blackhole_route?
-                purposes << 'default_deny'
-              else
-                purposes << 'default_gateway'
-              end
-            end
-            
-            if is_rfc1918_private?
-              purposes << 'private_network_routing'
-            else
-              purposes << 'public_network_routing'
-            end
-            
-            if is_blackhole_route?
-              purposes << 'traffic_blocking'
-            else
-              purposes << 'traffic_forwarding'
-            end
-            
-            case route_specificity
-            when 'very_specific'
-              purposes << 'host_routing'
-            when 'specific'
-              purposes << 'subnet_routing'
-            when 'broad'
-              purposes << 'network_routing'
-            when 'very_broad'
-              purposes << 'aggregate_routing'
-            end
-            
-            purposes
-          end
-          
-          def best_practices
-            practices = []
-            
-            if is_default_route?
-              practices << "Default routes should be carefully managed and documented"
-              practices << "Consider using specific routes instead of default when possible"
-              if !is_blackhole_route?
-                practices << "Ensure default route target can handle all unmatched traffic"
-              end
-            end
-            
-            if is_blackhole_route?
-              practices << "Document blackhole routes for operational clarity"
-              practices << "Monitor traffic that hits blackhole routes for troubleshooting"
-              practices << "Consider logging dropped traffic for security analysis"
-            end
-            
-            case route_specificity
-            when 'very_broad'
-              practices << "Very broad routes should be used sparingly and with careful consideration"
-            when 'very_specific'
-              practices << "Host-specific routes may indicate routing inefficiency or special requirements"
-            end
-            
-            practices << "Use descriptive resource names to indicate route purpose"
-            practices << "Document route dependencies and expected traffic patterns"
-            practices << "Implement route change management processes for production environments"
-            
-            practices
-          end
-        end
-      end
-    end
-  end
-end

data/lib/pangea/resources/aws_ec2_transit_gateway_route.rbs

@@ -1,27 +0,0 @@
-module Pangea
-  module Resources
-    module AWS
-      module Types
-        class TransitGatewayRouteAttributes < Dry::Struct
-          def self.new: (Hash[Symbol, untyped] attributes) -> TransitGatewayRouteAttributes
-          def is_blackhole_route?: () -> bool
-          def is_default_route?: () -> bool
-          def route_specificity: () -> String
-          def network_analysis: () -> Hash[Symbol, untyped]
-          def is_rfc1918_private?: () -> bool
-          def security_implications: () -> Array[String]
-          def route_purpose_analysis: () -> Array[String]
-          def best_practices: () -> Array[String]
-          def to_h: () -> Hash[Symbol, untyped]
-          
-          def destination_cidr_block: () -> String
-          def transit_gateway_route_table_id: () -> String
-          def blackhole: () -> bool
-          def transit_gateway_attachment_id: () -> String?
-        end
-      end
-      
-      def aws_ec2_transit_gateway_route: (Symbol name, ?Hash[Symbol, untyped] attributes) -> ResourceReference
-    end
-  end
-end

data/lib/pangea/resources/aws_ec2_transit_gateway_route_table/CLAUDE.md

@@ -1,384 +0,0 @@
-# AWS EC2 Transit Gateway Route Table Implementation
-
-## Resource Overview
-
-The `aws_ec2_transit_gateway_route_table` resource creates and manages custom route tables for AWS Transit Gateways. This implementation provides intelligent purpose analysis, security considerations, and best practices guidance based on naming conventions and tagging patterns.
-
-## Implementation Details
-
-### Type Safety and Validation
-
-The resource uses `TransitGatewayRouteTableAttributes` dry-struct for type safety:
-
-```ruby
-class TransitGatewayRouteTableAttributes < Dry::Struct
-  # Required Transit Gateway reference
-  attribute :transit_gateway_id, Resources::Types::String
-  
-  # Optional resource tagging
-  attribute? :tags, Resources::Types::AwsTags
-end
-```
-
-### AWS Resource ID Validation
-
-Transit Gateway ID format validation ensures proper AWS resource references:
-
-```ruby
-# Transit Gateway ID validation: tgw-xxxxxxxx
-unless transit_gateway_id.match?(/\Atgw-[0-9a-f]{8,17}\z/)
-  raise Dry::Struct::Error, "Invalid Transit Gateway ID format: #{transit_gateway_id}. Expected format: tgw-xxxxxxxx"
-end
-```
-
-This validation catches configuration errors early and provides clear error messages.
-
-### Intelligent Purpose Analysis
-
-The implementation analyzes naming patterns and tags to infer route table purposes:
-
-```ruby
-def route_table_purpose_analysis
-  tags_hash = tags.is_a?(Hash) ? tags : {}
-  name = tags_hash[:Name] || tags_hash[:name] || ''
-  purposes = []
-  
-  case name.downcase
-  when /prod|production/
-    purposes << 'production_workloads'
-  when /dev|development/
-    purposes << 'development_workloads'
-  when /test|staging/
-    purposes << 'testing_workloads'
-  when /shared|common/
-    purposes << 'shared_services'
-  when /security|firewall|inspection/
-    purposes << 'security_inspection'
-  when /egress|internet/
-    purposes << 'internet_egress'
-  when /hub/
-    purposes << 'hub_connectivity'
-  when /spoke/
-    purposes << 'spoke_connectivity'
-  when /isolated|private/
-    purposes << 'network_isolation'
-  end
-  
-  # Additional tag-based analysis
-  if tags_hash[:Environment]
-    purposes << "#{tags_hash[:Environment].downcase}_environment"
-  end
-  
-  purposes.empty? ? ['general_purpose'] : purposes
-end
-```
-
-This analysis enables:
-- Automated documentation generation
-- Security consideration recommendations
-- Best practices tailored to specific use cases
-- Operational insights for network management
-
-### Context-Aware Security Analysis
-
-Security considerations adapt based on inferred purpose:
-
-```ruby
-def security_considerations
-  considerations = [
-    "Custom route tables enable network segmentation and traffic isolation",
-    "Routes must be explicitly defined - no default connectivity",
-    "Association and propagation must be configured for each attachment"
-  ]
-  
-  # Production-specific considerations
-  if tags[:Environment] == 'production'
-    considerations << "Production route table - ensure strict route policies and monitoring"
-  end
-  
-  # Security inspection considerations
-  if route_table_purpose_analysis.include?('security_inspection')
-    considerations << "Security inspection route table - ensure all traffic flows through security appliances"
-  end
-  
-  considerations
-end
-```
-
-### Routing Capabilities Documentation
-
-Comprehensive routing capabilities with AWS limits:
-
-```ruby
-def routing_capabilities
-  {
-    supports_static_routes: true,
-    supports_propagated_routes: true,
-    supports_blackhole_routes: true,
-    supports_cross_account_attachments: true,
-    supports_vpn_attachments: true,
-    supports_dx_gateway_attachments: true,
-    supports_peering_attachments: true,
-    max_routes_per_table: 10000 # AWS documented limit
-  }
-end
-```
-
-### Dynamic Best Practices
-
-Best practices recommendations adapt to detected use cases:
-
-```ruby
-def best_practices
-  practices = [
-    "Use descriptive names and tags for route table identification",
-    "Implement least-privilege routing - only allow necessary routes",
-    "Monitor route table utilization and route count",
-    "Document route table purpose and associated attachments",
-    "Use consistent naming conventions across route tables"
-  ]
-  
-  # Context-specific practices
-  purposes = route_table_purpose_analysis
-  
-  if purposes.include?('production_workloads')
-    practices << "Production route table - implement change management processes"
-    practices << "Enable detailed monitoring and alerting for route changes"
-  end
-  
-  if purposes.include?('security_inspection')
-    practices << "Security route table - ensure redundant paths for high availability"
-    practices << "Regularly audit routes to security appliances"
-  end
-  
-  practices
-end
-```
-
-## Terraform Resource Synthesis
-
-Clean resource generation with minimal configuration:
-
-```ruby
-resource(:aws_ec2_transit_gateway_route_table, name) do
-  # Required Transit Gateway reference
-  transit_gateway_id route_table_attrs.transit_gateway_id
-  
-  # Optional tags
-  if route_table_attrs.tags.any?
-    tags do
-      route_table_attrs.tags.each do |key, value|
-        public_send(key, value)
-      end
-    end
-  end
-end
-```
-
-Route tables are intentionally simple resources - complexity comes from routes, associations, and propagation rules managed by separate resources.
-
-## Output References
-
-Standard AWS outputs for integration with other resources:
-
-```ruby
-outputs: {
-  id: "${aws_ec2_transit_gateway_route_table.#{name}.id}",                    # Route table ID (tgw-rtb-xxxxxx)
-  arn: "${aws_ec2_transit_gateway_route_table.#{name}.arn}",                  # Full ARN
-  default_association_route_table: "${aws_ec2_transit_gateway_route_table.#{name}.default_association_route_table}",
-  default_propagation_route_table: "${aws_ec2_transit_gateway_route_table.#{name}.default_propagation_route_table}",
-  tags_all: "${aws_ec2_transit_gateway_route_table.#{name}.tags_all}"
-}
-```
-
-The `id` output is the primary integration point for:
-- Route definitions (`aws_ec2_transit_gateway_route`)
-- Attachment associations (`aws_ec2_transit_gateway_route_table_association`)
-- Route propagation (`aws_ec2_transit_gateway_route_table_propagation`)
-
-## Architecture Pattern Recognition
-
-The implementation recognizes common architecture patterns through naming and tagging:
-
-### 1. Network Segmentation
-```ruby
-# Pattern: Environment-based isolation
-prod_rt = aws_ec2_transit_gateway_route_table(:production, {
-  tags: { 
-    Name: "production-route-table",
-    Environment: "production",
-    Segment: "production-workloads"
-  }
-})
-# Detected purposes: ["production_workloads", "production_environment", "production_segment"]
-```
-
-### 2. Shared Services
-```ruby
-# Pattern: Central service accessibility
-shared_rt = aws_ec2_transit_gateway_route_table(:shared, {
-  tags: { 
-    Name: "shared-services-route-table",
-    Purpose: "shared-services"
-  }
-})
-# Detected purposes: ["shared_services"]
-```
-
-### 3. Security Inspection
-```ruby
-# Pattern: Traffic inspection and filtering
-security_rt = aws_ec2_transit_gateway_route_table(:security, {
-  tags: { 
-    Name: "security-inspection-route-table",
-    Purpose: "security-inspection"
-  }
-})
-# Detected purposes: ["security_inspection"]
-```
-
-### 4. Hub and Spoke
-```ruby
-# Pattern: Centralized connectivity
-hub_rt = aws_ec2_transit_gateway_route_table(:hub, {
-  tags: { 
-    Name: "hub-route-table",
-    Role: "hub"
-  }
-})
-# Detected purposes: ["hub_connectivity"]
-```
-
-## Cost Analysis
-
-Route tables have no additional AWS costs beyond the base Transit Gateway:
-
-```ruby
-def estimated_monthly_cost
-  {
-    monthly_cost: 0.0,
-    currency: 'USD',
-    note: 'Route tables are included in Transit Gateway base cost. No additional charges.'
-  }
-end
-```
-
-Cost scaling factors:
-- Route table creation: No additional cost
-- Route management: No additional cost
-- Attachment associations: No additional cost  
-- Data processing: Charged at attachment level (~$0.02/GB)
-
-## Integration Patterns
-
-### Route Management Chain
-```ruby
-# 1. Create route table
-custom_rt = aws_ec2_transit_gateway_route_table(:custom, {
-  transit_gateway_id: tgw.id
-})
-
-# 2. Associate attachments
-aws_ec2_transit_gateway_route_table_association(:vpc_to_custom, {
-  transit_gateway_attachment_id: vpc_attachment.id,
-  transit_gateway_route_table_id: custom_rt.id
-})
-
-# 3. Add routes
-aws_ec2_transit_gateway_route(:to_shared_services, {
-  destination_cidr_block: "10.100.0.0/16",
-  transit_gateway_route_table_id: custom_rt.id,
-  transit_gateway_attachment_id: shared_services_attachment.id
-})
-```
-
-### Cross-Resource Dependencies
-- Route tables depend on Transit Gateways
-- Route table associations depend on route tables and attachments
-- Routes depend on route tables and target attachments
-- Propagation rules depend on route tables and source attachments
-
-## Validation Strategy
-
-### Static Validation
-- Transit Gateway ID format validation
-- Tag structure validation via dry-struct
-- Required attribute presence checking
-
-### Dynamic Validation  
-- AWS resource existence (handled by Terraform)
-- Route table limits (10,000 routes per table)
-- Transit Gateway capacity (5,000 route tables per Transit Gateway)
-
-### Best Practice Validation
-- Naming convention adherence through analysis
-- Security consideration flagging
-- Operational readiness assessment
-
-## Error Handling
-
-Clear error messages for common configuration issues:
-
-```ruby
-# Resource ID format errors
-raise Dry::Struct::Error, "Invalid Transit Gateway ID format: #{transit_gateway_id}. Expected format: tgw-xxxxxxxx"
-
-# Configuration guidance through computed attributes
-security_considerations: [
-  "Custom route tables enable network segmentation and traffic isolation",
-  "Routes must be explicitly defined - no default connectivity"
-]
-```
-
-## Testing Considerations
-
-### Unit Tests
-- Transit Gateway ID format validation
-- Purpose analysis logic with various naming patterns
-- Security consideration generation
-- Best practices recommendation accuracy
-
-### Integration Tests
-- Terraform resource synthesis validation
-- Cross-resource reference resolution
-- Multi-route table dependency management
-- AWS limit compliance testing
-
-## Performance Characteristics
-
-### Resource Creation
-- Fast creation (~30 seconds)
-- No AWS propagation delays
-- Immediate availability for associations and routes
-
-### State Management  
-- Simple Terraform state (minimal attributes)
-- Clean dependency resolution
-- Supports concurrent route table creation
-
-## Operational Insights
-
-### Monitoring Integration
-The computed attributes enable automated monitoring setup:
-
-```ruby
-# CloudWatch alarms based on route table purpose
-if purpose_analysis.include?('production_workloads')
-  # Create stricter monitoring for production route tables
-end
-
-if purpose_analysis.include?('security_inspection') 
-  # Monitor route health for security appliances
-end
-```
-
-### Documentation Generation
-Purpose analysis enables automated network documentation:
-
-```ruby
-route_table_purposes = route_tables.map(&:route_table_purpose_analysis)
-# Generate network diagrams based on detected patterns
-# Create operational runbooks for each purpose category
-```
-
-This implementation provides a robust foundation for Transit Gateway route table management with intelligent analysis, security guidance, and operational insights for complex networking scenarios.