pangea 0.0.45 → 0.0.46

data/lib/pangea/resources/aws_ec2_transit_gateway_route_table/resource.rb

@@ -1,77 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'pangea/resources/base'
-require 'pangea/resources/reference'
-require 'pangea/resources/aws_ec2_transit_gateway_route_table/types'
-require 'pangea/resource_registry'
-
-module Pangea
-  module Resources
-    module AWS
-      # Create an AWS EC2 Transit Gateway Route Table with type-safe attributes
-      #
-      # @param name [Symbol] The resource name
-      # @param attributes [Hash] Transit Gateway Route Table attributes
-      # @return [ResourceReference] Reference object with outputs and computed properties
-      def aws_ec2_transit_gateway_route_table(name, attributes = {})
-        # Validate attributes using dry-struct
-        route_table_attrs = Types::TransitGatewayRouteTableAttributes.new(attributes)
-        
-        # Generate terraform resource block via terraform-synthesizer
-        resource(:aws_ec2_transit_gateway_route_table, name) do
-          # Required Transit Gateway ID
-          transit_gateway_id route_table_attrs.transit_gateway_id
-          
-          # Apply tags if present
-          if route_table_attrs.tags.any?
-            tags do
-              route_table_attrs.tags.each do |key, value|
-                public_send(key, value)
-              end
-            end
-          end
-        end
-        
-        # Return resource reference with available outputs
-        ResourceReference.new(
-          type: 'aws_ec2_transit_gateway_route_table',
-          name: name,
-          resource_attributes: route_table_attrs.to_h,
-          outputs: {
-            id: "${aws_ec2_transit_gateway_route_table.#{name}.id}",
-            arn: "${aws_ec2_transit_gateway_route_table.#{name}.arn}",
-            default_association_route_table: "${aws_ec2_transit_gateway_route_table.#{name}.default_association_route_table}",
-            default_propagation_route_table: "${aws_ec2_transit_gateway_route_table.#{name}.default_propagation_route_table}",
-            tags_all: "${aws_ec2_transit_gateway_route_table.#{name}.tags_all}"
-          },
-          computed_attributes: {
-            supports_route_propagation: route_table_attrs.supports_route_propagation?,
-            supports_route_association: route_table_attrs.supports_route_association?,
-            estimated_monthly_cost: route_table_attrs.estimated_monthly_cost,
-            route_table_purpose_analysis: route_table_attrs.route_table_purpose_analysis,
-            security_considerations: route_table_attrs.security_considerations,
-            routing_capabilities: route_table_attrs.routing_capabilities,
-            best_practices: route_table_attrs.best_practices
-          }
-        )
-      end
-    end
-  end
-end
-
-# Auto-register this module when it's loaded
-Pangea::ResourceRegistry.register(:aws, Pangea::Resources::AWS)

data/lib/pangea/resources/aws_ec2_transit_gateway_route_table/types.rb

@@ -1,171 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'dry-struct'
-require 'pangea/resources/types'
-
-module Pangea
-  module Resources
-    module AWS
-      module Types
-        # Transit Gateway Route Table resource attributes with validation
-        class TransitGatewayRouteTableAttributes < Dry::Struct
-          transform_keys(&:to_sym)
-          
-          attribute :transit_gateway_id, Resources::Types::String
-          attribute? :tags, Resources::Types::AwsTags
-          
-          # Custom validation for route table configuration
-          def self.new(attributes)
-            attrs = attributes.is_a?(Hash) ? attributes : {}
-            
-            # Validate Transit Gateway ID format
-            if attrs[:transit_gateway_id] && !attrs[:transit_gateway_id].match?(/\Atgw-[0-9a-f]{8,17}\z/)
-              raise Dry::Struct::Error, "Invalid Transit Gateway ID format: #{attrs[:transit_gateway_id]}. Expected format: tgw-xxxxxxxx"
-            end
-            
-            super(attrs)
-          end
-          
-          # Computed properties
-          def supports_route_propagation?
-            # All custom route tables support route propagation
-            true
-          end
-          
-          def supports_route_association?
-            # All route tables support attachment association
-            true
-          end
-          
-          def estimated_monthly_cost
-            # Route tables themselves don't have additional costs
-            # Cost is included in the Transit Gateway base cost
-            {
-              monthly_cost: 0.0,
-              currency: 'USD',
-              note: 'Route tables are included in Transit Gateway base cost. No additional charges.'
-            }
-          end
-          
-          def route_table_purpose_analysis
-            # Analyze common route table naming patterns to infer purpose
-            tags_hash = tags.is_a?(Hash) ? tags : {}
-            name = tags_hash[:Name] || tags_hash[:name] || ''
-            
-            purposes = []
-            
-            case name.downcase
-            when /prod|production/
-              purposes << 'production_workloads'
-            when /dev|development/
-              purposes << 'development_workloads'
-            when /test|staging/
-              purposes << 'testing_workloads'
-            when /shared|common/
-              purposes << 'shared_services'
-            when /security|firewall|inspection/
-              purposes << 'security_inspection'
-            when /egress|internet/
-              purposes << 'internet_egress'
-            when /hub/
-              purposes << 'hub_connectivity'
-            when /spoke/
-              purposes << 'spoke_connectivity'
-            when /isolated|private/
-              purposes << 'network_isolation'
-            end
-            
-            # Additional analysis based on other tags
-            if tags_hash[:Environment]
-              purposes << "#{tags_hash[:Environment].downcase}_environment"
-            end
-            
-            if tags_hash[:Segment] || tags_hash[:segment]
-              segment = (tags_hash[:Segment] || tags_hash[:segment]).downcase
-              purposes << "#{segment}_segment"
-            end
-            
-            purposes.empty? ? ['general_purpose'] : purposes
-          end
-          
-          def security_considerations
-            considerations = []
-            
-            # Route tables provide network segmentation
-            considerations << "Custom route tables enable network segmentation and traffic isolation"
-            considerations << "Routes must be explicitly defined - no default connectivity"
-            considerations << "Association and propagation must be configured for each attachment"
-            
-            # Analyze tags for security context
-            if tags[:Environment] == 'production' || tags[:environment] == 'production'
-              considerations << "Production route table - ensure strict route policies and monitoring"
-            end
-            
-            if route_table_purpose_analysis.include?('security_inspection')
-              considerations << "Security inspection route table - ensure all traffic flows through security appliances"
-            end
-            
-            considerations
-          end
-          
-          def routing_capabilities
-            {
-              supports_static_routes: true,
-              supports_propagated_routes: true,
-              supports_blackhole_routes: true,
-              supports_cross_account_attachments: true,
-              supports_vpn_attachments: true,
-              supports_dx_gateway_attachments: true,
-              supports_peering_attachments: true,
-              max_routes_per_table: 10000 # AWS limit
-            }
-          end
-          
-          def best_practices
-            practices = [
-              "Use descriptive names and tags for route table identification",
-              "Implement least-privilege routing - only allow necessary routes", 
-              "Monitor route table utilization and route count",
-              "Document route table purpose and associated attachments",
-              "Use consistent naming conventions across route tables"
-            ]
-            
-            # Add context-specific practices
-            purposes = route_table_purpose_analysis
-            
-            if purposes.include?('production_workloads')
-              practices << "Production route table - implement change management processes"
-              practices << "Enable detailed monitoring and alerting for route changes"
-            end
-            
-            if purposes.include?('security_inspection')
-              practices << "Security route table - ensure redundant paths for high availability"
-              practices << "Regularly audit routes to security appliances"
-            end
-            
-            if purposes.include?('shared_services')
-              practices << "Shared services route table - document all consuming applications"
-              practices << "Implement service-level routing policies"
-            end
-            
-            practices
-          end
-        end
-      end
-    end
-  end
-end

data/lib/pangea/resources/aws_ec2_transit_gateway_route_table.rbs

@@ -1,24 +0,0 @@
-module Pangea
-  module Resources
-    module AWS
-      module Types
-        class TransitGatewayRouteTableAttributes < Dry::Struct
-          def self.new: (Hash[Symbol, untyped] attributes) -> TransitGatewayRouteTableAttributes
-          def supports_route_propagation?: () -> bool
-          def supports_route_association?: () -> bool
-          def estimated_monthly_cost: () -> Hash[Symbol, untyped]
-          def route_table_purpose_analysis: () -> Array[String]
-          def security_considerations: () -> Array[String]
-          def routing_capabilities: () -> Hash[Symbol, untyped]
-          def best_practices: () -> Array[String]
-          def to_h: () -> Hash[Symbol, untyped]
-          
-          def transit_gateway_id: () -> String
-          def tags: () -> Hash[Symbol, String]
-        end
-      end
-      
-      def aws_ec2_transit_gateway_route_table: (Symbol name, ?Hash[Symbol, untyped] attributes) -> ResourceReference
-    end
-  end
-end

data/lib/pangea/resources/aws_ec2_transit_gateway_route_table_association/CLAUDE.md

@@ -1,409 +0,0 @@
-# AWS EC2 Transit Gateway Route Table Association Implementation
-
-## Resource Overview
-
-The `aws_ec2_transit_gateway_route_table_association` resource manages the critical relationship between Transit Gateway attachments and route tables. This implementation provides comprehensive operational guidance, change impact analysis, and troubleshooting support for complex routing scenarios.
-
-## Implementation Details
-
-### Type Safety and Validation
-
-The resource uses `TransitGatewayRouteTableAssociationAttributes` for complete validation:
-
-```ruby
-class TransitGatewayRouteTableAssociationAttributes < Dry::Struct
-  # Required relationship components
-  attribute :transit_gateway_attachment_id, Resources::Types::String
-  attribute :transit_gateway_route_table_id, Resources::Types::String
-  
-  # Optional replacement behavior
-  attribute? :replace_existing_association, Resources::Types::Bool.default(false)
-end
-```
-
-### AWS Resource ID Format Validation
-
-Comprehensive validation ensures proper AWS resource references:
-
-```ruby
-# Attachment ID validation: tgw-attach-xxxxxxxx
-unless transit_gateway_attachment_id.match?(/\Atgw-attach-[0-9a-f]{8,17}\z/)
-  raise Dry::Struct::Error, "Invalid Transit Gateway Attachment ID format: #{transit_gateway_attachment_id}"
-end
-
-# Route Table ID validation: tgw-rtb-xxxxxxxx  
-unless transit_gateway_route_table_id.match?(/\Atgw-rtb-[0-9a-f]{8,17}\z/)
-  raise Dry::Struct::Error, "Invalid Transit Gateway Route Table ID format: #{transit_gateway_route_table_id}"
-end
-```
-
-This validation prevents configuration errors and provides clear feedback for resource reference issues.
-
-### Association Purpose Analysis
-
-The implementation provides clear explanations of what each association accomplishes:
-
-```ruby
-def association_purpose
-  "Associates attachment #{transit_gateway_attachment_id} with route table #{transit_gateway_route_table_id} for outbound routing"
-end
-```
-
-This simple but crucial explanation helps operators understand the specific impact of each association.
-
-### Routing Implications Assessment
-
-Comprehensive analysis of routing behavior changes:
-
-```ruby
-def routing_implications
-  implications = {
-    outbound_routing: "Attachment will use associated route table for outbound traffic routing",
-    route_evaluation: "Routes in the associated route table will be evaluated for traffic from this attachment",
-    override_behavior: replace_existing_association? ? "Will replace existing association" : "Will fail if association already exists"
-  }
-  
-  if replace_existing_association?
-    implications[:warning] = "Replacing existing association may cause temporary traffic disruption"
-  end
-  
-  implications
-end
-```
-
-This analysis helps operators understand:
-- What traffic flows will change
-- How route evaluation works
-- What happens with existing associations
-- Potential disruption risks
-
-### Security Considerations Analysis
-
-Context-aware security implications:
-
-```ruby
-def security_considerations
-  considerations = []
-  
-  considerations << "Route table association controls outbound traffic flow from the attachment"
-  considerations << "Attachments can only be associated with one route table at a time"
-  considerations << "Association determines which routes are available for outbound traffic"
-  
-  if replace_existing_association?
-    considerations << "Replacing existing association may change traffic flows - ensure new routes are configured"
-    considerations << "Consider testing route changes in non-production environments first"
-  else
-    considerations << "Association will fail if attachment is already associated with another route table"
-    considerations << "Use replace_existing_association: true to override existing associations"
-  end
-  
-  considerations
-end
-```
-
-The security analysis adapts based on whether the association replaces existing ones, providing relevant warnings and guidance.
-
-### Operational Insights
-
-Comprehensive operational guidance:
-
-```ruby
-def operational_insights
-  insights = {
-    association_model: "one_to_one",        # One attachment to one route table
-    traffic_direction: "outbound_only",     # Association only affects outbound traffic
-    conflict_resolution: replace_existing_association? ? "replace_existing" : "fail_on_conflict"
-  }
-  
-  # Add change management guidance
-  if replace_existing_association?
-    insights[:change_management] = "Association change will be immediate - plan for potential traffic impact"
-  else
-    insights[:change_management] = "New association only - existing associations will cause failure"
-  end
-  
-  insights[:best_practice] = "Document which attachments are associated with which route tables for troubleshooting"
-  
-  insights
-end
-```
-
-### Troubleshooting Guide
-
-Comprehensive troubleshooting support:
-
-```ruby
-def troubleshooting_guide
-  guide = {
-    common_issues: [
-      "Association already exists: Use replace_existing_association: true or remove existing association first",
-      "Invalid resource IDs: Verify attachment and route table exist and IDs are correct", 
-      "Permission errors: Ensure proper IAM permissions for Transit Gateway management"
-    ],
-    verification_steps: [
-      "Check attachment state is 'available' before associating",
-      "Verify route table belongs to the same Transit Gateway as attachment",
-      "Confirm no conflicting associations exist if replace_existing_association is false"
-    ],
-    monitoring: [
-      "Monitor CloudWatch metrics for route table utilization",
-      "Track attachment association changes through CloudTrail",
-      "Use VPC Flow Logs to verify traffic is following expected routes"
-    ]
-  }
-  
-  if replace_existing_association?
-    guide[:replacement_specific] = [
-      "Previous association will be removed atomically",
-      "Brief traffic disruption may occur during association change",
-      "New routes take effect immediately after association"
-    ]
-  end
-  
-  guide
-end
-```
-
-This comprehensive guide addresses:
-- Common error scenarios and resolutions
-- Pre-flight verification steps
-- Monitoring and validation approaches
-- Replacement-specific considerations
-
-### Change Impact Assessment
-
-Sophisticated change impact analysis:
-
-```ruby
-def estimated_change_impact
-  impact = {
-    scope: "attachment_outbound_routing",
-    severity: replace_existing_association? ? "medium" : "low",
-    duration: "immediate",                # Association changes take effect immediately
-    rollback_complexity: "low"           # Can reassociate to previous route table
-  }
-  
-  if replace_existing_association?
-    impact[:warnings] = [
-      "Traffic flows from attachment will change immediately",
-      "Ensure new route table has appropriate routes configured", 
-      "Consider gradual migration for production workloads"
-    ]
-  else
-    impact[:warnings] = [
-      "New association only - no impact on existing traffic flows",
-      "Will fail if attachment already has an association"
-    ]
-  end
-  
-  impact
-end
-```
-
-The impact assessment helps with:
-- Risk evaluation before changes
-- Change planning and timing
-- Rollback strategy development
-- Warning identification
-
-## Terraform Resource Synthesis
-
-Clean resource generation with optional attributes:
-
-```ruby
-resource(:aws_ec2_transit_gateway_route_table_association, name) do
-  # Always required
-  transit_gateway_attachment_id association_attrs.transit_gateway_attachment_id
-  transit_gateway_route_table_id association_attrs.transit_gateway_route_table_id
-  
-  # Conditional replacement behavior
-  if association_attrs.replace_existing_association
-    replace_existing_association association_attrs.replace_existing_association
-  end
-end
-```
-
-The conditional logic ensures:
-- Default behavior doesn't include replacement flag
-- Replacement flag only added when explicitly requested
-- Clean Terraform configuration generation
-
-## Output Handling
-
-Route table associations have specific output characteristics:
-
-```ruby
-outputs: {
-  id: "${aws_ec2_transit_gateway_route_table_association.#{name}.id}",
-  resource_id: "${aws_ec2_transit_gateway_route_table_association.#{name}.resource_id}",      # Attachment ID
-  resource_type: "${aws_ec2_transit_gateway_route_table_association.#{name}.resource_type}"   # Attachment type
-}
-```
-
-These outputs enable:
-- Association tracking and management
-- Cross-resource reference validation
-- Automated documentation generation
-
-## Architecture Pattern Support
-
-### 1. Network Segmentation
-```ruby
-# Production isolation
-prod_association = aws_ec2_transit_gateway_route_table_association(:prod_isolation, {
-  transit_gateway_attachment_id: prod_vpc_attachment.id,
-  transit_gateway_route_table_id: production_only_route_table.id
-})
-
-# Development isolation  
-dev_association = aws_ec2_transit_gateway_route_table_association(:dev_isolation, {
-  transit_gateway_attachment_id: dev_vpc_attachment.id,
-  transit_gateway_route_table_id: development_only_route_table.id
-})
-```
-
-### 2. Hub and Spoke Connectivity
-```ruby
-# Hub association - can reach all spokes
-hub_association = aws_ec2_transit_gateway_route_table_association(:hub_central, {
-  transit_gateway_attachment_id: hub_vpc_attachment.id,
-  transit_gateway_route_table_id: hub_route_table.id  # Contains routes to all spokes
-})
-
-# Spoke associations - can only reach hub
-spoke_associations = spokes.map do |spoke|
-  aws_ec2_transit_gateway_route_table_association(:"spoke_#{spoke[:name]}", {
-    transit_gateway_attachment_id: spoke[:attachment].id,
-    transit_gateway_route_table_id: spoke_route_table.id  # Only contains route to hub
-  })
-end
-```
-
-### 3. Security Inspection Pipeline
-```ruby
-# Pre-inspection association
-pre_association = aws_ec2_transit_gateway_route_table_association(:pre_inspection, {
-  transit_gateway_attachment_id: workload_vpc_attachment.id,
-  transit_gateway_route_table_id: pre_inspection_route_table.id  # Routes to firewall
-})
-
-# Firewall association
-fw_association = aws_ec2_transit_gateway_route_table_association(:firewall_routing, {
-  transit_gateway_attachment_id: firewall_vpc_attachment.id,
-  transit_gateway_route_table_id: post_inspection_route_table.id  # Routes to destinations
-})
-```
-
-### 4. Migration and Replacement
-```ruby
-# Initial association
-initial = aws_ec2_transit_gateway_route_table_association(:initial_config, {
-  transit_gateway_attachment_id: vpc_attachment.id,
-  transit_gateway_route_table_id: old_route_table.id
-})
-
-# Migration to new configuration
-migration = aws_ec2_transit_gateway_route_table_association(:migrated_config, {
-  transit_gateway_attachment_id: vpc_attachment.id,
-  transit_gateway_route_table_id: new_route_table.id,
-  replace_existing_association: true  # Replace initial association
-})
-```
-
-## Integration Patterns
-
-### Resource Dependency Chain
-```ruby
-# 1. Transit Gateway
-tgw = aws_ec2_transit_gateway(:main)
-
-# 2. Attachments  
-attachment = aws_ec2_transit_gateway_vpc_attachment(:vpc, {
-  transit_gateway_id: tgw.id  # Dependency
-})
-
-# 3. Route Tables
-route_table = aws_ec2_transit_gateway_route_table(:custom, {
-  transit_gateway_id: tgw.id  # Dependency
-})
-
-# 4. Association (depends on attachment and route table)
-association = aws_ec2_transit_gateway_route_table_association(:custom_association, {
-  transit_gateway_attachment_id: attachment.id,        # Dependency
-  transit_gateway_route_table_id: route_table.id      # Dependency
-})
-
-# 5. Routes (depend on route table)
-routes = aws_ec2_transit_gateway_route(:to_destination, {
-  transit_gateway_route_table_id: route_table.id      # Dependency
-})
-```
-
-### Cross-Architecture Integration
-```ruby  
-# Hub-spoke with security inspection
-hub_vpc_attachment → security_route_table → routes_to_firewall
-spoke_vpc_attachment → spoke_route_table → routes_to_hub
-firewall_vpc_attachment → post_inspection_route_table → routes_to_destinations
-```
-
-## Validation Strategy
-
-### Static Validation
-- AWS resource ID format validation
-- Boolean attribute validation
-- Required attribute presence checking
-
-### Configuration Validation
-- Cross-resource compatibility (same Transit Gateway)
-- Association conflict detection
-- Replacement logic validation
-
-### Runtime Validation
-- Resource existence verification (handled by Terraform)
-- Permission validation (handled by AWS)
-- State consistency checking (handled by AWS)
-
-## Error Handling
-
-Comprehensive error handling with actionable guidance:
-
-```ruby
-# Resource ID format errors
-raise Dry::Struct::Error, "Invalid Transit Gateway Attachment ID format: #{transit_gateway_attachment_id}. Expected format: tgw-attach-xxxxxxxx"
-
-# Configuration guidance through computed attributes
-troubleshooting_guide: {
-  common_issues: [
-    "Association already exists: Use replace_existing_association: true or remove existing association first"
-  ]
-}
-```
-
-## Testing Considerations
-
-### Unit Tests
-- AWS resource ID format validation
-- Routing implications calculation
-- Security considerations generation  
-- Change impact assessment accuracy
-
-### Integration Tests
-- Terraform resource synthesis validation
-- Cross-resource dependency resolution
-- Association replacement behavior
-- Error condition handling
-
-## Performance Characteristics
-
-### Resource Management
-- Fast association creation (~10-30 seconds)
-- Immediate traffic impact once active
-- Atomic replacement operations
-
-### State Consistency  
-- Strong consistency for association state
-- Immediate route table switching
-- Clean rollback capabilities
-
-This implementation provides a production-ready foundation for Transit Gateway route table association management with comprehensive operational guidance, change impact analysis, and troubleshooting support for complex network architectures.