pangea 0.0.45 → 0.0.46

data/guides/advanced-patterns.md

@@ -1,1196 +0,0 @@
-# Advanced Patterns: Mastering Complex Infrastructure with Pangea
-
-This guide explores sophisticated infrastructure patterns using Pangea's component and architecture systems. Learn how to build enterprise-grade, scalable infrastructure solutions that leverage Pangea's unique capabilities for complex, real-world scenarios.
-
-## Architecture System Overview
-
-Pangea provides three levels of abstraction for building infrastructure:
-
-1. **Resource Functions**: Type-safe individual resources (aws_instance, aws_vpc)
-2. **Components**: Reusable infrastructure patterns (secure_vpc, web_application) 
-3. **Architectures**: Complete application solutions (web_application_architecture, microservices_platform)
-
-### The Abstraction Hierarchy
-
-```
-Architecture Functions    (Complete Solutions)
-    ↓ composes
-Component Functions      (Reusable Patterns)
-    ↓ uses  
-Resource Functions       (Individual Resources)
-    ↓ generates
-Terraform JSON          (Infrastructure as Code)
-```
-
-## Advanced Component Patterns
-
-### 1. Composable Security Components
-
-Build security-first components that can be composed together:
-
-```ruby
-# security-components.rb
-
-# Base security component with comprehensive controls
-def secure_vpc_component(name, config)
-  validated_config = SecureVpcConfig.new(config)
-  
-  # VPC with security defaults
-  vpc_ref = aws_vpc(name, {
-    cidr_block: validated_config.cidr_block,
-    enable_dns_hostnames: true,
-    enable_dns_support: true,
-    tags: {
-      Name: "#{name}-VPC",
-      SecurityLevel: validated_config.security_level,
-      ComplianceFramework: validated_config.compliance_framework
-    }
-  })
-  
-  # VPC Flow Logs for security monitoring
-  flow_logs_role = aws_iam_role(:"#{name}_flow_logs_role", {
-    assume_role_policy: jsonencode({
-      Version: "2012-10-17",
-      Statement: [
-        {
-          Action: "sts:AssumeRole",
-          Effect: "Allow",
-          Principal: { Service: "vpc-flow-logs.amazonaws.com" }
-        }
-      ]
-    })
-  })
-  
-  aws_iam_role_policy_attachment(:"#{name}_flow_logs_policy", {
-    role: flow_logs_role.name,
-    policy_arn: "arn:aws:iam::aws:policy/service-role/VPCFlowLogsDeliveryRolePolicy"
-  })
-  
-  flow_logs_ref = aws_flow_log(:"#{name}_flow_logs", {
-    iam_role_arn: flow_logs_role.arn,
-    log_destination_type: "cloud-watch-logs",
-    log_group_name: "/aws/vpc/flowlogs/#{name}",
-    resource_id: vpc_ref.id,
-    resource_type: "VPC",
-    traffic_type: "ALL",
-    
-    tags: {
-      Name: "#{name}-FlowLogs",
-      Purpose: "SecurityMonitoring"
-    }
-  })
-  
-  # Default security group with deny-all
-  default_sg = aws_security_group(:"#{name}_default", {
-    name_prefix: "#{name}-default-",
-    vpc_id: vpc_ref.id,
-    description: "Default security group - deny all traffic",
-    
-    # Explicit deny rules (override AWS default allow-all egress)
-    egress_rules: [
-      {
-        from_port: 0,
-        to_port: 65535,
-        protocol: "-1",
-        cidr_blocks: ["127.0.0.1/32"],  # Deny to localhost only
-        description: "Deny all traffic - explicit rule"
-      }
-    ],
-    
-    tags: {
-      Name: "#{name}-DefaultDenyAll",
-      Purpose: "SecurityBaseline"
-    }
-  })
-  
-  # Network ACL with restrictive rules
-  network_acl = aws_network_acl(:"#{name}_restrictive", {
-    vpc_id: vpc_ref.id,
-    
-    # Explicit ingress rules
-    ingress: [
-      {
-        protocol: "tcp",
-        rule_no: 100,
-        action: "allow",
-        cidr_block: validated_config.cidr_block,
-        from_port: 80,
-        to_port: 80
-      },
-      {
-        protocol: "tcp", 
-        rule_no: 110,
-        action: "allow",
-        cidr_block: validated_config.cidr_block,
-        from_port: 443,
-        to_port: 443
-      }
-    ],
-    
-    tags: {
-      Name: "#{name}-RestrictiveACL",
-      SecurityLevel: validated_config.security_level
-    }
-  })
-  
-  ComponentReference.new(
-    name: name,
-    type: 'secure_vpc',
-    resources: {
-      vpc: vpc_ref,
-      flow_logs: flow_logs_ref,
-      default_security_group: default_sg,
-      network_acl: network_acl
-    },
-    security_features: {
-      flow_logs_enabled: true,
-      default_deny_sg: true,
-      restrictive_nacl: true,
-      compliance_level: validated_config.compliance_framework
-    }
-  )
-end
-
-# Zero-trust network component
-def zero_trust_network_component(name, config)
-  validated_config = ZeroTrustConfig.new(config)
-  
-  # Build on secure VPC
-  base_vpc = secure_vpc_component(:"#{name}_base", {
-    cidr_block: validated_config.cidr_block,
-    security_level: "high",
-    compliance_framework: "SOC2"
-  })
-  
-  # Microsegmented subnets with separate security groups
-  trust_zones = validated_config.trust_zones
-  subnet_components = {}
-  
-  trust_zones.each_with_index do |zone, index|
-    # Create subnet for each trust zone
-    subnet_ref = aws_subnet(:"#{name}_#{zone[:name]}", {
-      vpc_id: base_vpc.resources[:vpc].id,
-      cidr_block: "#{validated_config.cidr_block.split('/')[0].split('.')[0..2].join('.')}.#{index + 10}.0/24",
-      availability_zone: zone[:availability_zone],
-      
-      tags: {
-        Name: "#{name}-#{zone[:name]}-Subnet",
-        TrustZone: zone[:trust_level],
-        ComplianceRequired: zone[:compliance_required].to_s
-      }
-    })
-    
-    # Zone-specific security group
-    zone_sg = aws_security_group(:"#{name}_#{zone[:name]}_sg", {
-      name_prefix: "#{name}-#{zone[:name]}-",
-      vpc_id: base_vpc.resources[:vpc].id,
-      description: "Security group for #{zone[:name]} trust zone",
-      
-      ingress_rules: zone[:allowed_ingress].map do |rule|
-        {
-          from_port: rule[:port],
-          to_port: rule[:port],
-          protocol: rule[:protocol],
-          source_security_group_id: rule[:source_zone] ? 
-            "${aws_security_group.#{name}_#{rule[:source_zone]}_sg.id}" : nil,
-          cidr_blocks: rule[:cidr_blocks] || nil
-        }
-      end,
-      
-      tags: {
-        Name: "#{name}-#{zone[:name]}-SG",
-        TrustZone: zone[:trust_level]
-      }
-    })
-    
-    subnet_components[zone[:name]] = {
-      subnet: subnet_ref,
-      security_group: zone_sg,
-      trust_level: zone[:trust_level]
-    }
-  end
-  
-  # WAF for application-level protection
-  waf_web_acl = aws_wafv2_web_acl(:"#{name}_waf", {
-    name: "#{name}-WebACL",
-    description: "WAF rules for zero-trust network",
-    scope: "REGIONAL",
-    
-    default_action: {
-      allow: {}
-    },
-    
-    rule: [
-      {
-        name: "RateLimitRule",
-        priority: 1,
-        action: { block: {} },
-        statement: {
-          rate_based_statement: {
-            limit: 2000,
-            aggregate_key_type: "IP"
-          }
-        },
-        visibility_config: {
-          sampled_requests_enabled: true,
-          cloudwatch_metrics_enabled: true,
-          metric_name: "RateLimitRule"
-        }
-      }
-    ],
-    
-    tags: {
-      Name: "#{name}-WAF",
-      Purpose: "ZeroTrustProtection"
-    }
-  })
-  
-  ComponentReference.new(
-    name: name,
-    type: 'zero_trust_network',
-    base_components: { secure_vpc: base_vpc },
-    resources: {
-      subnets: subnet_components,
-      waf: waf_web_acl
-    },
-    trust_zones: trust_zones.map { |z| z[:name] }
-  )
-end
-
-class SecureVpcConfig < Dry::Struct
-  attribute :cidr_block, Types::String.constrained(
-    format: /^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}$/
-  )
-  attribute :security_level, Types::String.constrained(
-    included_in: %w[standard high critical]
-  )
-  attribute :compliance_framework, Types::String.constrained(
-    included_in: %w[SOC2 HIPAA PCI FedRAMP]
-  )
-end
-
-class ZeroTrustConfig < Dry::Struct
-  attribute :cidr_block, Types::String
-  attribute :trust_zones, Types::Array.of(TrustZone)
-end
-
-class TrustZone < Dry::Struct
-  attribute :name, Types::String
-  attribute :trust_level, Types::String.constrained(
-    included_in: %w[public restricted confidential]
-  )
-  attribute :availability_zone, Types::String
-  attribute :compliance_required, Types::Bool
-  attribute :allowed_ingress, Types::Array.of(IngressRule)
-end
-
-class IngressRule < Dry::Struct
-  attribute :port, Types::Integer
-  attribute :protocol, Types::String
-  attribute :source_zone, Types::String.optional
-  attribute :cidr_blocks, Types::Array.of(Types::String).optional
-end
-```
-
-### 2. Multi-Cloud Component Abstraction
-
-Create components that can deploy to multiple cloud providers:
-
-```ruby
-# multi-cloud-components.rb
-
-def container_orchestration_component(name, config)
-  validated_config = ContainerConfig.new(config)
-  
-  case validated_config.provider
-  when 'aws'
-    deploy_ecs_cluster(name, validated_config)
-  when 'gcp'
-    deploy_gke_cluster(name, validated_config)
-  when 'azure'
-    deploy_aks_cluster(name, validated_config)
-  else
-    raise ArgumentError, "Unsupported provider: #{validated_config.provider}"
-  end
-end
-
-def deploy_ecs_cluster(name, config)
-  # ECS implementation
-  cluster_ref = aws_ecs_cluster(name, {
-    name: "#{name}-cluster",
-    capacity_providers: ["FARGATE", "FARGATE_SPOT"],
-    
-    default_capacity_provider_strategy: [
-      {
-        capacity_provider: "FARGATE",
-        weight: config.fargate_weight,
-        base: config.fargate_base
-      },
-      {
-        capacity_provider: "FARGATE_SPOT", 
-        weight: config.spot_weight
-      }
-    ],
-    
-    setting: [
-      {
-        name: "containerInsights",
-        value: config.monitoring_enabled ? "enabled" : "disabled"
-      }
-    ],
-    
-    tags: {
-      Name: "#{name}-ECS-Cluster",
-      Provider: "AWS",
-      OrchestrationEngine: "ECS"
-    }
-  })
-  
-  # Service discovery namespace
-  service_discovery = aws_service_discovery_private_dns_namespace(:"#{name}_sd", {
-    name: "#{config.domain_name}",
-    vpc: config.vpc_id,
-    
-    tags: {
-      Name: "#{name}-ServiceDiscovery"
-    }
-  })
-  
-  ComponentReference.new(
-    name: name,
-    type: 'container_orchestration',
-    provider: 'aws',
-    resources: {
-      cluster: cluster_ref,
-      service_discovery: service_discovery
-    },
-    capabilities: {
-      auto_scaling: true,
-      service_discovery: true,
-      spot_instances: config.spot_weight > 0
-    }
-  )
-end
-
-class ContainerConfig < Dry::Struct
-  attribute :provider, Types::String.constrained(
-    included_in: %w[aws gcp azure]
-  )
-  attribute :domain_name, Types::String
-  attribute :vpc_id, Types::String
-  attribute :fargate_weight, Types::Integer.constrained(gteq: 0, lteq: 100).default(70)
-  attribute :spot_weight, Types::Integer.constrained(gteq: 0, lteq: 100).default(30)
-  attribute :fargate_base, Types::Integer.constrained(gteq: 0).default(2)
-  attribute :monitoring_enabled, Types::Bool.default(true)
-end
-```
-
-## Complete Architecture Patterns
-
-### 1. Event-Driven Microservices Architecture
-
-```ruby
-# event-driven-architecture.rb
-
-def event_driven_microservices_architecture(name, config)
-  validated_config = EventDrivenConfig.new(config)
-  
-  # Foundation networking with zero-trust
-  networking = zero_trust_network_component(:"#{name}_network", {
-    cidr_block: validated_config.vpc_cidr,
-    trust_zones: [
-      {
-        name: "public",
-        trust_level: "public", 
-        availability_zone: "us-east-1a",
-        compliance_required: false,
-        allowed_ingress: [
-          { port: 80, protocol: "tcp", cidr_blocks: ["0.0.0.0/0"] },
-          { port: 443, protocol: "tcp", cidr_blocks: ["0.0.0.0/0"] }
-        ]
-      },
-      {
-        name: "application",
-        trust_level: "restricted",
-        availability_zone: "us-east-1b", 
-        compliance_required: true,
-        allowed_ingress: [
-          { port: 8080, protocol: "tcp", source_zone: "public" }
-        ]
-      },
-      {
-        name: "data",
-        trust_level: "confidential",
-        availability_zone: "us-east-1c",
-        compliance_required: true, 
-        allowed_ingress: [
-          { port: 5432, protocol: "tcp", source_zone: "application" }
-        ]
-      }
-    ]
-  })
-  
-  # Container orchestration platform
-  container_platform = container_orchestration_component(:"#{name}_containers", {
-    provider: "aws",
-    domain_name: "#{name}.internal",
-    vpc_id: networking.resources[:subnets][:application][:subnet].id
-  })
-  
-  # Event streaming infrastructure
-  event_streaming = create_event_streaming_infrastructure(name, {
-    vpc_id: networking.base_components[:secure_vpc].resources[:vpc].id,
-    subnets: [
-      networking.resources[:subnets][:application][:subnet].id,
-      networking.resources[:subnets][:data][:subnet].id
-    ]
-  })
-  
-  # API Gateway for external access
-  api_gateway = aws_api_gateway_rest_api(:"#{name}_api", {
-    name: "#{name}-API",
-    description: "API Gateway for event-driven microservices",
-    endpoint_configuration: {
-      types: ["REGIONAL"]
-    },
-    
-    tags: {
-      Name: "#{name}-APIGateway",
-      Architecture: "EventDriven"
-    }
-  })
-  
-  # Service mesh for inter-service communication
-  service_mesh = create_service_mesh(name, {
-    container_cluster: container_platform.resources[:cluster],
-    service_discovery: container_platform.resources[:service_discovery],
-    trust_zones: networking.trust_zones
-  })
-  
-  # Individual microservices
-  microservices = validated_config.services.map do |service_config|
-    create_microservice(
-      "#{name}_#{service_config[:name]}",
-      service_config.merge({
-        cluster_arn: container_platform.resources[:cluster].arn,
-        service_discovery_namespace: container_platform.resources[:service_discovery].id,
-        event_stream_arns: event_streaming[:streams].map { |s| s.arn },
-        service_mesh: service_mesh
-      })
-    )
-  end
-  
-  # Monitoring and observability
-  observability = create_observability_stack(name, {
-    vpc: networking.base_components[:secure_vpc].resources[:vpc],
-    services: microservices,
-    event_streams: event_streaming[:streams],
-    api_gateway: api_gateway
-  })
-  
-  ArchitectureReference.new(
-    name: name,
-    type: 'event_driven_microservices',
-    components: {
-      networking: networking,
-      container_platform: container_platform,
-      api_gateway: api_gateway,
-      service_mesh: service_mesh,
-      microservices: microservices,
-      observability: observability
-    },
-    architecture_attributes: {
-      event_driven: true,
-      microservices_count: microservices.length,
-      zero_trust_networking: true,
-      service_mesh_enabled: true,
-      multi_az_deployment: true
-    },
-    estimated_monthly_cost: calculate_architecture_cost(microservices, event_streaming, observability),
-    security_compliance_score: calculate_security_score(networking, service_mesh, observability)
-  )
-end
-
-def create_event_streaming_infrastructure(name, config)
-  # Kinesis streams for different event types
-  streams = {
-    user_events: aws_kinesis_stream(:"#{name}_user_events", {
-      name: "#{name}-user-events",
-      shard_count: 2,
-      retention_period: 168, # 7 days
-      encryption_type: "KMS",
-      kms_key_id: "alias/aws/kinesis",
-      
-      tags: {
-        Name: "#{name}-UserEvents",
-        EventType: "UserInteractions"
-      }
-    }),
-    
-    system_events: aws_kinesis_stream(:"#{name}_system_events", {
-      name: "#{name}-system-events", 
-      shard_count: 1,
-      retention_period: 24, # 1 day
-      encryption_type: "KMS",
-      
-      tags: {
-        Name: "#{name}-SystemEvents",
-        EventType: "SystemMetrics"
-      }
-    }),
-    
-    business_events: aws_kinesis_stream(:"#{name}_business_events", {
-      name: "#{name}-business-events",
-      shard_count: 3,
-      retention_period: 720, # 30 days 
-      encryption_type: "KMS",
-      
-      tags: {
-        Name: "#{name}-BusinessEvents",
-        EventType: "BusinessCritical"
-      }
-    })
-  }
-  
-  # Kinesis Analytics for real-time processing
-  analytics_app = aws_kinesis_analytics_application(:"#{name}_analytics", {
-    name: "#{name}-event-analytics",
-    description: "Real-time event analytics",
-    
-    inputs: {
-      name_prefix: "event_input",
-      kinesis_stream: {
-        resource_arn: streams[:user_events].arn,
-        role_arn: aws_iam_role(:"#{name}_analytics_role", {
-          assume_role_policy: jsonencode({
-            Version: "2012-10-17",
-            Statement: [{
-              Action: "sts:AssumeRole",
-              Effect: "Allow", 
-              Principal: { Service: "kinesisanalytics.amazonaws.com" }
-            }]
-          })
-        }).arn
-      },
-      
-      schema: {
-        record_columns: [
-          { name: "user_id", sql_type: "VARCHAR(64)" },
-          { name: "event_type", sql_type: "VARCHAR(32)" },
-          { name: "timestamp", sql_type: "TIMESTAMP" },
-          { name: "properties", sql_type: "VARCHAR(2048)" }
-        ],
-        record_format: {
-          record_format_type: "JSON"
-        }
-      }
-    },
-    
-    tags: {
-      Name: "#{name}-EventAnalytics"
-    }
-  })
-  
-  { streams: streams.values, analytics: analytics_app }
-end
-
-def create_microservice(name, config)
-  # ECS Task Definition
-  task_definition = aws_ecs_task_definition(name, {
-    family: name,
-    network_mode: "awsvpc",
-    requires_compatibilities: ["FARGATE"],
-    cpu: config[:cpu] || "256",
-    memory: config[:memory] || "512",
-    execution_role_arn: config[:execution_role_arn],
-    task_role_arn: config[:task_role_arn],
-    
-    container_definitions: jsonencode([
-      {
-        name: name,
-        image: config[:image],
-        portMappings: [
-          {
-            containerPort: config[:port] || 8080,
-            protocol: "tcp"
-          }
-        ],
-        environment: config[:environment_variables] || [],
-        secrets: config[:secrets] || [],
-        logConfiguration: {
-          logDriver: "awslogs",
-          options: {
-            "awslogs-group": "/ecs/#{name}",
-            "awslogs-region": "us-east-1",
-            "awslogs-stream-prefix": "ecs"
-          }
-        },
-        healthCheck: {
-          command: ["CMD-SHELL", config[:health_check_command] || "curl -f http://localhost:8080/health || exit 1"],
-          interval: 30,
-          timeout: 5,
-          retries: 3,
-          startPeriod: 60
-        }
-      }
-    ]),
-    
-    tags: {
-      Name: name,
-      ServiceType: config[:service_type] || "microservice"
-    }
-  })
-  
-  # ECS Service
-  ecs_service = aws_ecs_service(:"#{name}_service", {
-    name: "#{name}-service",
-    cluster: config[:cluster_arn],
-    task_definition: task_definition.arn,
-    desired_count: config[:desired_count] || 2,
-    launch_type: "FARGATE",
-    
-    network_configuration: {
-      subnets: config[:subnets],
-      security_groups: [config[:security_group_id]],
-      assign_public_ip: false
-    },
-    
-    service_registries: [
-      {
-        registry_arn: aws_service_discovery_service(:"#{name}_discovery", {
-          name: name,
-          dns_config: {
-            namespace_id: config[:service_discovery_namespace],
-            dns_records: [
-              {
-                ttl: 10,
-                type: "A"
-              }
-            ]
-          },
-          health_check_grace_period_seconds: 60
-        }).arn,
-        port: config[:port] || 8080
-      }
-    ],
-    
-    deployment_configuration: {
-      maximum_percent: 200,
-      minimum_healthy_percent: 100,
-      deployment_circuit_breaker: {
-        enable: true,
-        rollback: true
-      }
-    },
-    
-    tags: {
-      Name: "#{name}-Service",
-      MicroserviceType: config[:service_type]
-    }
-  })
-  
-  ComponentReference.new(
-    name: name,
-    type: 'microservice',
-    resources: {
-      task_definition: task_definition,
-      service: ecs_service
-    },
-    service_config: config
-  )
-end
-
-class EventDrivenConfig < Dry::Struct
-  attribute :vpc_cidr, Types::String
-  attribute :services, Types::Array.of(MicroserviceConfig)
-  attribute :enable_service_mesh, Types::Bool.default(true)
-  attribute :monitoring_level, Types::String.constrained(
-    included_in: %w[basic standard comprehensive]
-  ).default("standard")
-end
-
-class MicroserviceConfig < Dry::Struct
-  attribute :name, Types::String
-  attribute :image, Types::String
-  attribute :port, Types::Integer.default(8080)
-  attribute :cpu, Types::String.default("256")
-  attribute :memory, Types::String.default("512")
-  attribute :desired_count, Types::Integer.default(2)
-  attribute :service_type, Types::String.default("api")
-  attribute :environment_variables, Types::Array.of(EnvironmentVariable).default([])
-  attribute :health_check_command, Types::String.optional
-end
-
-class EnvironmentVariable < Dry::Struct
-  attribute :name, Types::String
-  attribute :value, Types::String
-end
-```
-
-### 2. ML/AI Platform Architecture
-
-```ruby
-# ml-platform-architecture.rb
-
-def ml_platform_architecture(name, config)
-  validated_config = MLPlatformConfig.new(config)
-  
-  # Data lake foundation
-  data_lake = create_data_lake_infrastructure(name, {
-    raw_data_retention_days: validated_config.data_retention.raw,
-    processed_data_retention_days: validated_config.data_retention.processed,
-    enable_data_catalog: true,
-    enable_cross_region_replication: validated_config.disaster_recovery_enabled
-  })
-  
-  # ML training infrastructure
-  training_infrastructure = create_ml_training_infrastructure(name, {
-    instance_types: validated_config.training_instance_types,
-    max_parallel_jobs: validated_config.max_parallel_training_jobs,
-    enable_spot_instances: validated_config.cost_optimization.use_spot_instances,
-    training_data_sources: data_lake[:processed_buckets]
-  })
-  
-  # Model serving infrastructure
-  serving_infrastructure = create_model_serving_infrastructure(name, {
-    auto_scaling_config: validated_config.serving_auto_scaling,
-    endpoint_types: validated_config.endpoint_types,
-    enable_multi_model_endpoints: validated_config.enable_multi_model_endpoints
-  })
-  
-  # ML pipelines and orchestration
-  ml_pipelines = create_ml_pipeline_infrastructure(name, {
-    data_sources: data_lake,
-    training_infrastructure: training_infrastructure,
-    serving_infrastructure: serving_infrastructure,
-    pipeline_schedule: validated_config.pipeline_schedule
-  })
-  
-  # Feature store
-  feature_store = create_feature_store(name, {
-    online_storage_config: validated_config.feature_store.online_storage,
-    offline_storage_config: validated_config.feature_store.offline_storage,
-    data_lake_integration: data_lake
-  })
-  
-  # ML monitoring and observability
-  ml_monitoring = create_ml_monitoring_infrastructure(name, {
-    model_endpoints: serving_infrastructure[:endpoints],
-    training_jobs: training_infrastructure[:training_cluster],
-    data_drift_detection: validated_config.monitoring.enable_data_drift_detection,
-    model_performance_monitoring: validated_config.monitoring.enable_model_performance_monitoring
-  })
-  
-  ArchitectureReference.new(
-    name: name,
-    type: 'ml_platform',
-    components: {
-      data_lake: data_lake,
-      training: training_infrastructure,
-      serving: serving_infrastructure,
-      pipelines: ml_pipelines,
-      feature_store: feature_store,
-      monitoring: ml_monitoring
-    },
-    architecture_attributes: {
-      supports_batch_training: true,
-      supports_real_time_inference: true,
-      auto_scaling_enabled: validated_config.serving_auto_scaling.enabled,
-      multi_model_serving: validated_config.enable_multi_model_endpoints,
-      feature_store_enabled: true,
-      ml_ops_pipeline: true
-    },
-    estimated_monthly_cost: calculate_ml_platform_cost(
-      training_infrastructure, 
-      serving_infrastructure, 
-      data_lake,
-      validated_config
-    )
-  )
-end
-
-def create_feature_store(name, config)
-  # DynamoDB for online features (low latency)
-  online_feature_store = aws_dynamodb_table(:"#{name}_online_features", {
-    name: "#{name}-online-features",
-    billing_mode: config[:online_storage_config][:billing_mode] || "PAY_PER_REQUEST",
-    
-    attribute: [
-      { name: "feature_group_name", type: "S" },
-      { name: "record_identifier", type: "S" },
-      { name: "event_time", type: "N" }
-    ],
-    
-    hash_key: "feature_group_name",
-    range_key: "record_identifier",
-    
-    global_secondary_index: [
-      {
-        name: "EventTimeIndex",
-        hash_key: "feature_group_name",
-        range_key: "event_time",
-        projection_type: "ALL"
-      }
-    ],
-    
-    ttl: {
-      attribute_name: "ttl",
-      enabled: true
-    },
-    
-    point_in_time_recovery: {
-      enabled: true
-    },
-    
-    stream_enabled: true,
-    stream_view_type: "NEW_AND_OLD_IMAGES",
-    
-    tags: {
-      Name: "#{name}-OnlineFeatureStore",
-      Purpose: "MLFeatureServing"
-    }
-  })
-  
-  # S3 for offline features (batch processing)
-  offline_feature_store = aws_s3_bucket(:"#{name}_offline_features", {
-    bucket_prefix: "#{name}-offline-features-",
-    
-    versioning: {
-      enabled: true
-    },
-    
-    lifecycle_configuration: {
-      rule: [
-        {
-          id: "feature_lifecycle",
-          enabled: true,
-          expiration: {
-            days: config[:offline_storage_config][:retention_days] || 365
-          },
-          noncurrent_version_expiration: {
-            days: 30
-          },
-          transition: [
-            {
-              days: 30,
-              storage_class: "STANDARD_IA"
-            },
-            {
-              days: 90,
-              storage_class: "GLACIER"
-            }
-          ]
-        }
-      ]
-    },
-    
-    server_side_encryption_configuration: {
-      rule: {
-        apply_server_side_encryption_by_default: {
-          sse_algorithm: "AES256"
-        }
-      }
-    },
-    
-    tags: {
-      Name: "#{name}-OfflineFeatureStore",
-      Purpose: "MLFeatureStorage"
-    }
-  })
-  
-  # SageMaker Feature Store feature groups
-  feature_groups = config[:feature_groups]&.map do |fg_config|
-    aws_sagemaker_feature_group(:"#{name}_#{fg_config[:name]}", {
-      feature_group_name: "#{name}-#{fg_config[:name]}",
-      record_identifier_feature_name: fg_config[:record_identifier] || "id",
-      event_time_feature_name: fg_config[:event_time_feature] || "event_time",
-      
-      feature_definition: fg_config[:features].map do |feature|
-        {
-          feature_name: feature[:name],
-          feature_type: feature[:type]
-        }
-      end,
-      
-      online_store_config: {
-        enable_online_store: true
-      },
-      
-      offline_store_config: {
-        s3_storage_config: {
-          s3_uri: "s3://#{offline_feature_store.id}/feature-groups/#{fg_config[:name]}/"
-        },
-        disable_glue_table_creation: false,
-        data_catalog_config: {
-          table_name: "#{name}_#{fg_config[:name]}_features",
-          catalog: "AwsDataCatalog",
-          database: "#{name}_feature_store_db"
-        }
-      },
-      
-      tags: {
-        Name: "#{name}-#{fg_config[:name]}-FeatureGroup",
-        FeatureGroupType: fg_config[:type] || "batch"
-      }
-    })
-  end || []
-  
-  {
-    online_store: online_feature_store,
-    offline_store: offline_feature_store,
-    feature_groups: feature_groups,
-    capabilities: {
-      real_time_features: true,
-      batch_features: true,
-      feature_versioning: true,
-      point_in_time_lookup: true
-    }
-  }
-end
-
-class MLPlatformConfig < Dry::Struct
-  attribute :data_retention, DataRetentionConfig
-  attribute :training_instance_types, Types::Array.of(Types::String).default(["ml.m5.large"])
-  attribute :max_parallel_training_jobs, Types::Integer.default(5)
-  attribute :cost_optimization, CostOptimizationConfig
-  attribute :serving_auto_scaling, AutoScalingConfig
-  attribute :endpoint_types, Types::Array.of(Types::String).default(["real_time"])
-  attribute :enable_multi_model_endpoints, Types::Bool.default(false)
-  attribute :pipeline_schedule, Types::String.default("daily")
-  attribute :feature_store, FeatureStoreConfig
-  attribute :monitoring, MLMonitoringConfig
-  attribute :disaster_recovery_enabled, Types::Bool.default(false)
-end
-
-class DataRetentionConfig < Dry::Struct
-  attribute :raw, Types::Integer.default(90)
-  attribute :processed, Types::Integer.default(365)
-end
-
-class CostOptimizationConfig < Dry::Struct
-  attribute :use_spot_instances, Types::Bool.default(true)
-  attribute :enable_auto_shutdown, Types::Bool.default(true)
-  attribute :reserved_instance_percentage, Types::Integer.default(50)
-end
-
-class AutoScalingConfig < Dry::Struct
-  attribute :enabled, Types::Bool.default(true)
-  attribute :min_instances, Types::Integer.default(1)
-  attribute :max_instances, Types::Integer.default(10)
-  attribute :target_cpu_utilization, Types::Integer.default(70)
-end
-
-class FeatureStoreConfig < Dry::Struct
-  attribute :online_storage, OnlineStorageConfig
-  attribute :offline_storage, OfflineStorageConfig
-  attribute :feature_groups, Types::Array.of(FeatureGroupConfig).default([])
-end
-
-class OnlineStorageConfig < Dry::Struct
-  attribute :billing_mode, Types::String.default("PAY_PER_REQUEST")
-  attribute :enable_ttl, Types::Bool.default(true)
-end
-
-class OfflineStorageConfig < Dry::Struct
-  attribute :retention_days, Types::Integer.default(365)
-  attribute :storage_class_transition, Types::Bool.default(true)
-end
-
-class FeatureGroupConfig < Dry::Struct
-  attribute :name, Types::String
-  attribute :type, Types::String.default("batch")
-  attribute :record_identifier, Types::String.default("id")
-  attribute :event_time_feature, Types::String.default("event_time")
-  attribute :features, Types::Array.of(FeatureDefinition)
-end
-
-class FeatureDefinition < Dry::Struct
-  attribute :name, Types::String
-  attribute :type, Types::String.constrained(
-    included_in: %w[Integral Fractional String]
-  )
-end
-
-class MLMonitoringConfig < Dry::Struct
-  attribute :enable_data_drift_detection, Types::Bool.default(true)
-  attribute :enable_model_performance_monitoring, Types::Bool.default(true)
-  attribute :alert_thresholds, AlertThresholdsConfig
-end
-
-class AlertThresholdsConfig < Dry::Struct
-  attribute :accuracy_degradation_threshold, Types::Float.default(0.05)
-  attribute :data_drift_threshold, Types::Float.default(0.1)
-  attribute :latency_threshold_ms, Types::Integer.default(500)
-end
-```
-
-## Usage Examples
-
-### Deploying Event-Driven Architecture
-
-```ruby
-template :complete_event_platform do
-  # Deploy comprehensive event-driven microservices platform
-  platform = event_driven_microservices_architecture(:ecommerce_platform, {
-    vpc_cidr: "10.0.0.0/16",
-    services: [
-      {
-        name: "user_service",
-        image: "myregistry/user-service:latest",
-        port: 8080,
-        service_type: "api",
-        desired_count: 3,
-        environment_variables: [
-          { name: "DB_HOST", value: "users.db.internal" },
-          { name: "LOG_LEVEL", value: "info" }
-        ]
-      },
-      {
-        name: "order_service", 
-        image: "myregistry/order-service:latest",
-        port: 8080,
-        service_type: "api",
-        desired_count: 5,
-        cpu: "512",
-        memory: "1024"
-      },
-      {
-        name: "inventory_service",
-        image: "myregistry/inventory-service:latest",
-        port: 8080,
-        service_type: "api",
-        desired_count: 2
-      },
-      {
-        name: "notification_service",
-        image: "myregistry/notification-service:latest",
-        port: 8080,
-        service_type: "worker",
-        desired_count: 2
-      }
-    ],
-    enable_service_mesh: true,
-    monitoring_level: "comprehensive"
-  })
-  
-  # Output key architecture endpoints
-  output :api_gateway_url do
-    value platform.components[:api_gateway].invoke_url
-    description "Main API Gateway endpoint"
-  end
-  
-  output :service_discovery_namespace do
-    value platform.components[:container_platform].resources[:service_discovery].name
-    description "Internal service discovery namespace"
-  end
-  
-  output :estimated_monthly_cost do
-    value platform.estimated_monthly_cost
-    description "Estimated monthly AWS cost in USD"
-  end
-end
-```
-
-### Deploying ML Platform
-
-```ruby
-template :ml_research_platform do
-  # Deploy comprehensive ML platform for research and production
-  ml_platform = ml_platform_architecture(:research_platform, {
-    data_retention: {
-      raw: 180,      # 6 months for raw data
-      processed: 730  # 2 years for processed data
-    },
-    training_instance_types: ["ml.p3.2xlarge", "ml.m5.4xlarge"],
-    max_parallel_training_jobs: 10,
-    cost_optimization: {
-      use_spot_instances: true,
-      enable_auto_shutdown: true,
-      reserved_instance_percentage: 30
-    },
-    serving_auto_scaling: {
-      enabled: true,
-      min_instances: 2,
-      max_instances: 20,
-      target_cpu_utilization: 60
-    },
-    endpoint_types: ["real_time", "batch_transform"],
-    enable_multi_model_endpoints: true,
-    pipeline_schedule: "hourly",
-    feature_store: {
-      online_storage: {
-        billing_mode: "PROVISIONED",
-        enable_ttl: true
-      },
-      offline_storage: {
-        retention_days: 730,
-        storage_class_transition: true
-      },
-      feature_groups: [
-        {
-          name: "user_features",
-          type: "real_time",
-          features: [
-            { name: "user_id", type: "String" },
-            { name: "age", type: "Integral" },
-            { name: "spending_score", type: "Fractional" },
-            { name: "last_purchase_days", type: "Integral" }
-          ]
-        },
-        {
-          name: "product_features",
-          type: "batch",
-          features: [
-            { name: "product_id", type: "String" },
-            { name: "category", type: "String" },
-            { name: "price", type: "Fractional" },
-            { name: "popularity_score", type: "Fractional" }
-          ]
-        }
-      ]
-    },
-    monitoring: {
-      enable_data_drift_detection: true,
-      enable_model_performance_monitoring: true,
-      alert_thresholds: {
-        accuracy_degradation_threshold: 0.03,
-        data_drift_threshold: 0.08,
-        latency_threshold_ms: 200
-      }
-    },
-    disaster_recovery_enabled: true
-  })
-  
-  # Output ML platform endpoints and information
-  output :feature_store_online_endpoint do
-    value ml_platform.components[:feature_store][:online_store].name
-    description "Online feature store endpoint"
-  end
-  
-  output :data_lake_buckets do
-    value ml_platform.components[:data_lake][:buckets].map { |b| b.id }
-    description "Data lake S3 bucket names"
-  end
-  
-  output :training_cluster_arn do
-    value ml_platform.components[:training][:training_cluster].arn
-    description "SageMaker training cluster ARN"
-  end
-end
-```
-
-## Summary
-
-Pangea's advanced patterns enable:
-
-1. **Component Composition**: Build complex infrastructure from reusable components
-2. **Architecture Abstractions**: Deploy complete application platforms with single functions
-3. **Multi-Cloud Support**: Abstract infrastructure patterns across cloud providers
-4. **Security-First Design**: Zero-trust networking and compliance-ready components
-5. **Enterprise Scalability**: ML platforms, event-driven architectures, and microservices
-
-These patterns demonstrate how Pangea scales from simple resource management to enterprise-grade infrastructure platforms while maintaining type safety, modularity, and automation-first design.
-
-<function_calls>
-<invoke name="TodoWrite">
-<parameter name="todos">[{"id": "1", "content": "Create guides directory structure", "status": "completed", "priority": "high"}, {"id": "2", "content": "Write getting started guide", "status": "completed", "priority": "high"}, {"id": "3", "content": "Write template isolation guide", "status": "completed", "priority": "high"}, {"id": "4", "content": "Write multi-environment management guide", "status": "completed", "priority": "high"}, {"id": "5", "content": "Write type-safe infrastructure guide", "status": "completed", "priority": "medium"}, {"id": "6", "content": "Write migration from Terraform guide", "status": "completed", "priority": "medium"}, {"id": "7", "content": "Write CI/CD integration guide", "status": "completed", "priority": "medium"}, {"id": "8", "content": "Write advanced patterns guide", "status": "completed", "priority": "low"}, {"id": "9", "content": "Create guides README index", "status": "in_progress", "priority": "low"}]