pangea 0.0.45 → 0.0.46

data/lib/pangea/resources/aws_iot_policy/CLAUDE.md

@@ -1,27 +0,0 @@
-# AWS IoT Policy Resource - Claude Documentation
-
-Provides type-safe IoT policy management with comprehensive security analysis, policy validation, and intelligent recommendations for device permission management.
-
-## Security Analysis Features
-
-- **Policy Statement Analysis**: Counts allow/deny statements and identifies security patterns
-- **Wildcard Detection**: Identifies overly broad permissions using wildcards
-- **Security Level Assessment**: Rates policies as high, medium, or low security
-- **IoT Action Analysis**: Categorizes common IoT actions (connect, publish, subscribe, shadow, jobs)
-- **Policy Recommendations**: Provides specific guidance for security improvements
-
-## Enterprise Integration Patterns
-
-### Principle of Least Privilege
-```ruby
-aws_iot_policy(:minimal_device_policy, {
-  name: "MinimalDeviceAccess",
-  policy: generate_minimal_policy({
-    device_id: "${iot:Connection.Thing.ThingName}",
-    allowed_topics: ["data", "status"],
-    shadow_access: false
-  })
-})
-```
-
-This resource enables enterprise-grade IoT policy management with automated security analysis and compliance recommendations.

data/lib/pangea/resources/aws_iot_policy/resource.rb

@@ -1,63 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'pangea/resources/base'
-require 'pangea/resources/reference'
-require 'pangea/resources/aws_iot_policy/types'
-require 'pangea/resource_registry'
-
-module Pangea
-  module Resources
-    module AWS
-      def aws_iot_policy(name, attributes = {})
-        policy_attrs = Types::IotPolicyAttributes.new(attributes)
-        
-        resource(:aws_iot_policy, name) do
-          name policy_attrs.name
-          policy policy_attrs.policy
-          
-          if policy_attrs.tags.any?
-            tags do
-              policy_attrs.tags.each { |k, v| public_send(k, v) }
-            end
-          end
-        end
-        
-        ResourceReference.new(
-          type: 'aws_iot_policy',
-          name: name,
-          resource_attributes: policy_attrs.to_h,
-          outputs: {
-            name: "${aws_iot_policy.#{name}.name}",
-            arn: "${aws_iot_policy.#{name}.arn}",
-            policy: "${aws_iot_policy.#{name}.policy}",
-            default_version_id: "${aws_iot_policy.#{name}.default_version_id}",
-            tags_all: "${aws_iot_policy.#{name}.tags_all}"
-          },
-          computed_properties: {
-            policy_version: policy_attrs.policy_version,
-            security_analysis: policy_attrs.security_analysis,
-            iot_actions_analysis: policy_attrs.iot_actions_analysis,
-            policy_recommendations: policy_attrs.policy_recommendations
-          }
-        )
-      end
-    end
-  end
-end
-
-# Auto-register this module when it's loaded
-Pangea::ResourceRegistry.register(:aws, Pangea::Resources::AWS)

data/lib/pangea/resources/aws_iot_policy/types.rb

@@ -1,136 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'pangea/resources/types'
-
-module Pangea
-  module Resources
-    module AWS
-      module Types
-      # Type-safe attributes for AWS IoT Policy resources
-      class IotPolicyAttributes < Dry::Struct
-        # Policy name (required)
-        attribute :name, Resources::Types::IotPolicyName
-        
-        # Policy document (required) 
-        attribute :policy, Resources::Types::IotPolicyDocument
-        
-        # Tags (optional)
-        attribute :tags, Resources::Types::AwsTags.default({})
-        
-        # Parse policy document for analysis
-        def parsed_policy
-          @parsed_policy ||= JSON.parse(policy)
-        end
-        
-        # Get policy version
-        def policy_version
-          parsed_policy['Version'] || '2012-10-17'
-        end
-        
-        # Get policy statements
-        def policy_statements
-          parsed_policy['Statement'] || []
-        end
-        
-        # Security analysis
-        def security_analysis
-          analysis = {
-            total_statements: policy_statements.length,
-            allows_count: 0,
-            denies_count: 0,
-            wildcard_actions: [],
-            broad_resources: [],
-            security_level: 'medium'
-          }
-          
-          policy_statements.each do |statement|
-            effect = statement['Effect']&.upcase
-            actions = Array(statement['Action'])
-            resources = Array(statement['Resource'])
-            
-            case effect
-            when 'ALLOW' then analysis[:allows_count] += 1
-            when 'DENY' then analysis[:denies_count] += 1
-            end
-            
-            # Check for wildcard actions
-            wildcard_actions = actions.select { |action| action.include?('*') }
-            analysis[:wildcard_actions].concat(wildcard_actions)
-            
-            # Check for broad resources
-            broad_resources = resources.select { |resource| resource.include?('*') }
-            analysis[:broad_resources].concat(broad_resources)
-          end
-          
-          # Determine security level
-          if analysis[:wildcard_actions].include?('*') || analysis[:broad_resources].include?('*')
-            analysis[:security_level] = 'low'
-          elsif analysis[:wildcard_actions].any? || analysis[:broad_resources].any?
-            analysis[:security_level] = 'medium'
-          else
-            analysis[:security_level] = 'high'
-          end
-          
-          analysis
-        end
-        
-        # Common IoT actions check
-        def iot_actions_analysis
-          all_actions = policy_statements.flat_map { |s| Array(s['Action']) }.uniq
-          
-          {
-            connect_actions: all_actions.grep(/iot:Connect/),
-            publish_actions: all_actions.grep(/iot:Publish/),
-            subscribe_actions: all_actions.grep(/iot:Subscribe/),
-            receive_actions: all_actions.grep(/iot:Receive/),
-            shadow_actions: all_actions.grep(/iot:.*Shadow/),
-            job_actions: all_actions.grep(/iot:.*Job/),
-            thing_actions: all_actions.grep(/iot:.*Thing/)
-          }
-        end
-        
-        # Policy recommendations
-        def policy_recommendations
-          recommendations = []
-          security = security_analysis
-          
-          if security[:security_level] == 'low'
-            recommendations << 'Consider reducing wildcard permissions (*) for better security'
-          end
-          
-          if security[:wildcard_actions].any?
-            recommendations << "Wildcard actions detected: #{security[:wildcard_actions].join(', ')}"
-          end
-          
-          if security[:broad_resources].any?
-            recommendations << "Broad resource permissions detected: #{security[:broad_resources].join(', ')}"
-          end
-          
-          if security[:denies_count] == 0
-            recommendations << 'Consider adding explicit deny statements for unused actions'
-          end
-          
-          recommendations << 'Follow principle of least privilege' if security[:security_level] != 'high'
-          
-          recommendations
-        end
-      end
-    end
-      end
-    end
-  end
-end

data/lib/pangea/resources/aws_iot_policy.rbs

@@ -1,18 +0,0 @@
-module Pangea
-  module Resources
-    module AWS
-      class IotPolicyAttributes < Dry::Struct
-        attr_reader name: String
-        attr_reader policy: String
-        attr_reader tags: Hash[Symbol, String]
-
-        def parsed_policy: () -> Hash[String, untyped]
-        def security_analysis: () -> Hash[Symbol, untyped]
-        def iot_actions_analysis: () -> Hash[Symbol, Array[String]]
-        def policy_recommendations: () -> Array[String]
-      end
-
-      def aws_iot_policy: (Symbol name, Hash[Symbol, untyped] attributes) -> ResourceReference
-    end
-  end
-end

data/lib/pangea/resources/aws_iot_policy_attachment/resource.rb

@@ -1,98 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require_relative 'types'
-require 'pangea/resources/base'
-
-module Pangea
-  module Resources
-    # AWS IoT Policy Attachment Resource
-    # 
-    # Attaches IoT policies to certificates or other principals, defining the permissions
-    # and access controls for IoT devices. This is critical for implementing security
-    # in IoT deployments by controlling what actions devices can perform.
-    #
-    # @example Attach policy to certificate
-    #   aws_iot_policy_attachment(:device_permissions, {
-    #     policy: "DeviceBasicPolicy",
-    #     target: "arn:aws:iot:us-east-1:123456789012:cert/abcd1234"
-    #   })
-    #
-    # @example Using policy and certificate references
-    #   device_policy = aws_iot_policy(:device_policy, {
-    #     name: "DeviceOperationsPolicy",
-    #     policy: policy_document
-    #   })
-    #   
-    #   device_cert = aws_iot_certificate(:device_cert, {
-    #     active: true
-    #   })
-    #   
-    #   aws_iot_policy_attachment(:secure_device, {
-    #     policy: device_policy.name,
-    #     target: device_cert.arn
-    #   })
-    #
-    # @example Multiple policies per certificate
-    #   # Basic connectivity policy
-    #   aws_iot_policy_attachment(:basic_connectivity, {
-    #     policy: "BasicConnectivityPolicy",
-    #     target: certificate_arn
-    #   })
-    #   
-    #   # Application-specific policy
-    #   aws_iot_policy_attachment(:app_permissions, {
-    #     policy: "SensorDataPolicy",
-    #     target: certificate_arn
-    #   })
-    #
-    # @example Policy attached to thing group
-    #   aws_iot_policy_attachment(:group_policy, {
-    #     policy: "ProductionDevicesPolicy",
-    #     target: "arn:aws:iot:us-east-1:123456789012:thinggroup/production-sensors"
-    #   })
-    module AwsIotPolicyAttachment
-      include AwsIotPolicyAttachmentTypes
-
-      # Creates an AWS IoT policy attachment
-      #
-      # @param name [Symbol] Logical name for the policy attachment resource
-      # @param attributes [Hash] Policy attachment configuration attributes
-      # @return [Reference] Resource reference for use in other resources
-      def aws_iot_policy_attachment(name, attributes = {})
-        validated_attributes = Attributes[attributes]
-        
-        resource :aws_iot_policy_attachment, name do
-          policy validated_attributes.policy
-          target validated_attributes.target
-        end
-
-        Reference.new(
-          type: :aws_iot_policy_attachment,
-          name: name,
-          attributes: Outputs.new(
-            id: "${aws_iot_policy_attachment.#{name}.id}",
-            policy: "${aws_iot_policy_attachment.#{name}.policy}",
-            target: "${aws_iot_policy_attachment.#{name}.target}"
-          )
-        )
-      end
-    end
-  end
-end
-
-# Auto-register this module when it's loaded
-Pangea::ResourceRegistry.register(:aws, Pangea::Resources::AWS)

data/lib/pangea/resources/aws_iot_policy_attachment/types.rb

@@ -1,54 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'dry-struct'
-require 'pangea/resources/types'
-
-module Pangea
-  module Resources
-    # AWS IoT Policy Attachment Types
-    # 
-    # Policy attachments bind IoT policies to principals (certificates) or other resources,
-    # defining what actions devices can perform when they connect to AWS IoT Core.
-    # This is essential for implementing principle of least privilege in IoT deployments.
-    module AwsIotPolicyAttachmentTypes
-      # Main attributes for IoT policy attachment resource
-      class Attributes < Dry::Struct
-        schema schema.strict
-
-        # Name of the IoT policy to attach
-        attribute :policy, Resources::Types::String
-
-        # ARN of the target (certificate, thing group, or other principal)
-        attribute :target, Resources::Types::String
-      end
-
-      # Output attributes from policy attachment resource
-      class Outputs < Dry::Struct
-        schema schema.strict
-
-        # The attachment ID (combination of policy and target)
-        attribute :id, Resources::Types::String
-
-        # The name of the attached policy
-        attribute :policy, Resources::Types::String
-
-        # The ARN of the target
-        attribute :target, Resources::Types::String
-      end
-    end
-  end
-end

data/lib/pangea/resources/aws_iot_provisioning_template/resource.rb

@@ -1,133 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require_relative 'types'
-require 'pangea/resources/base'
-
-module Pangea
-  module Resources
-    # AWS IoT Provisioning Template Resource
-    # 
-    # Provisioning templates automate device onboarding by defining how devices should be
-    # configured during registration. This enables consistent, scalable device provisioning
-    # with automated policy assignment, certificate creation, and resource allocation.
-    #
-    # @example Basic fleet provisioning template
-    #   template_body = JSON.generate({
-    #     "Parameters" => {
-    #       "ThingName" => { "Type" => "String" },
-    #       "SerialNumber" => { "Type" => "String" }
-    #     },
-    #     "Resources" => {
-    #       "thing" => {
-    #         "Type" => "AWS::IoT::Thing",
-    #         "Properties" => {
-    #           "ThingName" => { "Ref" => "ThingName" },
-    #           "AttributePayload" => {
-    #             "version" => "v1",
-    #             "serialNumber" => { "Ref" => "SerialNumber" }
-    #           }
-    #         }
-    #       },
-    #       "certificate" => {
-    #         "Type" => "AWS::IoT::Certificate",
-    #         "Properties" => {
-    #           "CertificateId" => { "Ref" => "AWS::IoT::Certificate::Id" },
-    #           "Status" => "ACTIVE"
-    #         }
-    #       }
-    #     }
-    #   })
-    #   
-    #   aws_iot_provisioning_template(:fleet_template, {
-    #     name: "FleetProvisioningTemplate",
-    #     template_body: template_body,
-    #     provisioning_role_arn: "arn:aws:iam::123456789012:role/IoTProvisioningRole",
-    #     enabled: true
-    #   })
-    #
-    # @example Template with pre-provisioning validation
-    #   aws_iot_provisioning_template(:validated_provisioning, {
-    #     name: "ValidatedDeviceProvisioning",
-    #     template_body: device_template_json,
-    #     provisioning_role_arn: provisioning_role.arn,
-    #     pre_provisioning_hook: {
-    #       target_arn: "arn:aws:lambda:us-east-1:123456789012:function:validate-device",
-    #       payload_version: "2020-04-01"
-    #     },
-    #     enabled: true,
-    #     description: "Device provisioning with validation hook"
-    #   })
-    #
-    # @example JITP (Just-in-Time Provisioning) template
-    #   aws_iot_provisioning_template(:jitp_template, {
-    #     name: "JustInTimeProvisioning", 
-    #     template_body: jitp_template_body,
-    #     provisioning_role_arn: jitp_role_arn,
-    #     type: "JITP",
-    #     description: "Automatic provisioning for CA-signed certificates",
-    #     tags: {
-    #       "ProvisioningType" => "JITP",
-    #       "Environment" => "Production"
-    #     }
-    #   })
-    module AwsIotProvisioningTemplate
-      include AwsIotProvisioningTemplateTypes
-
-      # Creates an AWS IoT provisioning template for automated device onboarding
-      #
-      # @param name [Symbol] Logical name for the provisioning template resource
-      # @param attributes [Hash] Provisioning template configuration attributes
-      # @return [Reference] Resource reference for use in other resources
-      def aws_iot_provisioning_template(name, attributes = {})
-        validated_attributes = Attributes[attributes]
-        
-        resource :aws_iot_provisioning_template, name do
-          name validated_attributes.name
-          template_body validated_attributes.template_body
-          description validated_attributes.description if validated_attributes.description
-          enabled validated_attributes.enabled if validated_attributes.enabled
-          type validated_attributes.type if validated_attributes.type
-          provisioning_role_arn validated_attributes.provisioning_role_arn
-
-          if validated_attributes.pre_provisioning_hook
-            pre_provisioning_hook do
-              target_arn validated_attributes.pre_provisioning_hook.target_arn
-              payload_version validated_attributes.pre_provisioning_hook.payload_version if validated_attributes.pre_provisioning_hook.payload_version
-            end
-          end
-
-          tags validated_attributes.tags if validated_attributes.tags
-        end
-
-        Reference.new(
-          type: :aws_iot_provisioning_template,
-          name: name,
-          attributes: Outputs.new(
-            arn: "${aws_iot_provisioning_template.#{name}.arn}",
-            name: "${aws_iot_provisioning_template.#{name}.name}",
-            default_version_id: "${aws_iot_provisioning_template.#{name}.default_version_id}",
-            id: "${aws_iot_provisioning_template.#{name}.id}",
-            type: "${aws_iot_provisioning_template.#{name}.type}"
-          )
-        )
-      end
-    end
-  end
-end
-
-# Auto-register this module when it's loaded
-Pangea::ResourceRegistry.register(:aws, Pangea::Resources::AWS)

data/lib/pangea/resources/aws_iot_provisioning_template/types.rb

@@ -1,89 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'dry-struct'
-require 'pangea/resources/types'
-
-module Pangea
-  module Resources
-    # AWS IoT Provisioning Template Types
-    # 
-    # Provisioning templates define how devices should be configured during the registration process.
-    # They enable automated device onboarding with consistent configuration, policies, and resources
-    # for fleet management at scale.
-    module AwsIotProvisioningTemplateTypes
-      # Pre-provisioning hook configuration for custom validation
-      class PreProvisioningHook < Dry::Struct
-        schema schema.strict
-
-        # ARN of Lambda function to call for pre-provisioning validation
-        attribute :target_arn, Resources::Types::String
-
-        # Optional payload template for the Lambda function
-        attribute :payload_version, Resources::Types::String.optional
-      end
-
-      # Main attributes for IoT provisioning template resource
-      class Attributes < Dry::Struct
-        schema schema.strict
-
-        # Name of the provisioning template
-        attribute :name, Resources::Types::String
-
-        # JSON template body defining device configuration
-        attribute :template_body, Resources::Types::String
-
-        # Description of the provisioning template
-        attribute :description, Resources::Types::String.optional
-
-        # Whether the template is enabled for provisioning
-        attribute :enabled, Resources::Types::Bool.optional
-
-        # Type of provisioning (FLEET_PROVISIONING or JITP)
-        attribute :type, Resources::Types::String.enum('FLEET_PROVISIONING', 'JITP').optional
-
-        # ARN of IAM role for provisioning operations
-        attribute :provisioning_role_arn, Resources::Types::String
-
-        # Pre-provisioning hook for custom validation
-        attribute? :pre_provisioning_hook, PreProvisioningHook.optional
-
-        # Resource tags for organization and billing
-        attribute :tags, Resources::Types::Hash.map(Types::String, Types::String).optional
-      end
-
-      # Output attributes from provisioning template resource
-      class Outputs < Dry::Struct
-        schema schema.strict
-
-        # The provisioning template ARN
-        attribute :arn, Resources::Types::String
-
-        # The provisioning template name
-        attribute :name, Resources::Types::String
-
-        # The default version ID of the template
-        attribute :default_version_id, Resources::Types::Integer
-
-        # The template ID
-        attribute :id, Resources::Types::String
-
-        # The type of provisioning template
-        attribute :type, Resources::Types::String
-      end
-    end
-  end
-end