pangea 0.0.45 → 0.0.46

data/lib/pangea/resources/aws_s3_access_point/CLAUDE.md

@@ -1,211 +0,0 @@
-# AWS S3 Access Point Resource
-
-## Overview
-
-Amazon S3 access points simplify managing data access at scale for shared datasets. Each access point has distinct permissions and network controls that Amazon S3 applies for any request made through that access point.
-
-## Features
-
-- **Type-Safe Attributes**: Comprehensive validation using dry-struct
-- **VPC Support**: Create VPC-restricted access points
-- **Public Access Control**: Fine-grained public access block configuration
-- **Cross-Account Access**: Support for cross-account bucket access
-- **Computed Properties**: Helper methods for access point characteristics
-
-## Basic Usage
-
-### Internet Access Point
-
-```ruby
-template :s3_access_point_example do
-  # Basic internet-accessible access point
-  access_point = aws_s3_access_point(:my_access_point, {
-    account_id: "123456789012",
-    bucket: "my-shared-bucket",
-    name: "my-access-point"
-  })
-  
-  # Access point ARN and domain available as outputs
-  output :access_point_arn do
-    value access_point.arn
-  end
-end
-```
-
-### VPC Access Point
-
-```ruby
-template :vpc_access_point_example do
-  # VPC-restricted access point
-  vpc_access_point = aws_s3_access_point(:vpc_access_point, {
-    account_id: "123456789012", 
-    bucket: "internal-data-bucket",
-    name: "internal-access-point",
-    vpc_configuration: {
-      vpc_id: "vpc-12345678"
-    },
-    public_access_block_configuration: {
-      block_public_acls: true,
-      block_public_policy: true,
-      ignore_public_acls: true,
-      restrict_public_buckets: true
-    }
-  })
-end
-```
-
-### Cross-Account Access Point
-
-```ruby
-template :cross_account_access_point do
-  # Access point for bucket in different account
-  cross_account_ap = aws_s3_access_point(:cross_account_ap, {
-    account_id: "123456789012",          # Your account
-    bucket_account_id: "210987654321",   # Bucket owner account
-    bucket: "shared-data-bucket",
-    name: "shared-access-point"
-  })
-end
-```
-
-## Advanced Configuration
-
-### Public Access Controls
-
-```ruby
-template :secured_access_point do
-  secure_ap = aws_s3_access_point(:secure_access_point, {
-    account_id: "123456789012",
-    bucket: "sensitive-data-bucket", 
-    name: "secure-ap",
-    public_access_block_configuration: {
-      block_public_acls: true,
-      block_public_policy: true,
-      ignore_public_acls: true,
-      restrict_public_buckets: true
-    }
-  })
-  
-  # Computed properties available
-  output :is_secured do
-    value secure_ap.computed[:has_public_access_block]
-  end
-end
-```
-
-### Access Point with Policy
-
-```ruby
-template :policy_access_point do
-  policy_ap = aws_s3_access_point(:policy_ap, {
-    account_id: "123456789012",
-    bucket: "policy-controlled-bucket",
-    name: "policy-ap",
-    policy: JSON.generate({
-      Version: "2012-10-17",
-      Statement: [
-        {
-          Sid: "AllowGetFromSpecificPrefix",
-          Effect: "Allow",
-          Principal: {
-            AWS: "arn:aws:iam::123456789012:user/DataAnalyst"
-          },
-          Action: [
-            "s3:GetObject"
-          ],
-          Resource: "arn:aws:s3:*:123456789012:accesspoint/policy-ap/object/reports/*"
-        }
-      ]
-    })
-  })
-end
-```
-
-## Output Values
-
-The `aws_s3_access_point` function returns a `ResourceReference` with these outputs:
-
-| Output | Description |
-|--------|-------------|
-| `id` | Access point ID |
-| `arn` | Access point ARN |
-| `alias` | Access point alias |
-| `domain_name` | Access point domain name |
-| `has_public_access_policy` | Whether access point has public access policy |
-| `network_origin` | Network origin (Internet or VPC) |
-| `endpoints` | Access point endpoints by region |
-
-## Computed Properties
-
-Additional computed properties for infrastructure logic:
-
-| Property | Description |
-|----------|-------------|
-| `vpc_access_point` | True if access point is VPC-restricted |
-| `internet_access_point` | True if access point allows internet access |
-| `has_public_access_block` | True if public access block is configured |
-| `cross_account_access` | True if accessing bucket in different account |
-
-## Validation Rules
-
-### Required Attributes
-- `account_id`: Must be valid 12-digit AWS account ID
-- `bucket`: S3 bucket name to create access point for
-- `name`: Access point name (3-63 chars, lowercase, alphanumeric and hyphens only)
-
-### Optional Attributes
-- `bucket_account_id`: Account ID of bucket owner (if different from access point owner)
-- `network_origin`: 'Internet' (default) or 'VPC'
-- `policy`: IAM policy document as JSON string
-- `vpc_configuration`: VPC settings for VPC access points
-- `public_access_block_configuration`: Public access controls
-
-## Best Practices
-
-1. **Use Descriptive Names**: Choose access point names that clearly indicate their purpose
-2. **Apply Public Access Blocks**: Always configure public access blocks for sensitive data
-3. **Least Privilege Policies**: Use IAM policies to restrict access to minimum required permissions
-4. **VPC Restriction**: Use VPC access points for internal applications
-5. **Monitor Access**: Use CloudTrail to monitor access point usage
-
-## Integration Examples
-
-### With S3 Bucket
-
-```ruby
-template :bucket_with_access_points do
-  # Create bucket first
-  data_bucket = aws_s3_bucket(:shared_data, {
-    bucket: "company-shared-data-bucket",
-    versioning: { enabled: true }
-  })
-  
-  # Create access point for analytics team
-  analytics_ap = aws_s3_access_point(:analytics_ap, {
-    account_id: "123456789012",
-    bucket: data_bucket.bucket,
-    name: "analytics-access-point",
-    policy: analytics_access_policy
-  })
-  
-  # Create VPC access point for internal services
-  internal_ap = aws_s3_access_point(:internal_ap, {
-    account_id: "123456789012", 
-    bucket: data_bucket.bucket,
-    name: "internal-services-ap",
-    vpc_configuration: {
-      vpc_id: "vpc-12345678"
-    }
-  })
-end
-```
-
-## Error Handling
-
-The resource function validates all parameters and will raise descriptive errors for:
-
-- Invalid AWS account ID format
-- Access point name validation failures
-- Missing required VPC configuration for VPC access points
-- Invalid network origin values
-- Malformed policy documents

data/lib/pangea/resources/aws_s3_access_point/resource.rb

@@ -1,102 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'pangea/resources/base'
-require 'pangea/resources/reference'
-require 'pangea/resources/aws_s3_access_point/types'
-require 'pangea/resource_registry'
-
-module Pangea
-  module Resources
-    module AWS
-      # Create an AWS S3 Access Point with type-safe attributes
-      #
-      # Access points simplify managing data access at scale for shared datasets in Amazon S3.
-      # Each access point has distinct permissions and network controls that S3 applies for any
-      # request made through that access point.
-      #
-      # @param name [Symbol] The resource name
-      # @param attributes [Hash] S3 access point attributes
-      # @return [ResourceReference] Reference object with outputs and computed properties
-      def aws_s3_access_point(name, attributes = {})
-        # Validate attributes using dry-struct
-        access_point_attrs = S3AccessPoint::Types::S3AccessPointAttributes.new(attributes)
-        
-        # Generate terraform resource block via terraform-synthesizer
-        resource(:aws_s3_access_point, name) do
-          # Required attributes
-          account_id access_point_attrs.account_id
-          bucket access_point_attrs.bucket
-          name access_point_attrs.name
-          
-          # Optional attributes
-          bucket_account_id access_point_attrs.bucket_account_id if access_point_attrs.bucket_account_id
-          policy access_point_attrs.policy if access_point_attrs.policy
-          
-          # VPC Configuration for VPC-based access points
-          if access_point_attrs.vpc_configuration
-            vpc_configuration do
-              vpc_id access_point_attrs.vpc_configuration[:vpc_id]
-            end
-          end
-          
-          # Public access block configuration
-          if access_point_attrs.public_access_block_configuration.any?
-            public_access_block_configuration do
-              if access_point_attrs.public_access_block_configuration.key?(:block_public_acls)
-                block_public_acls access_point_attrs.public_access_block_configuration[:block_public_acls]
-              end
-              if access_point_attrs.public_access_block_configuration.key?(:block_public_policy)
-                block_public_policy access_point_attrs.public_access_block_configuration[:block_public_policy]
-              end
-              if access_point_attrs.public_access_block_configuration.key?(:ignore_public_acls)
-                ignore_public_acls access_point_attrs.public_access_block_configuration[:ignore_public_acls]
-              end
-              if access_point_attrs.public_access_block_configuration.key?(:restrict_public_buckets)
-                restrict_public_buckets access_point_attrs.public_access_block_configuration[:restrict_public_buckets]
-              end
-            end
-          end
-        end
-        
-        # Return resource reference with available outputs
-        ResourceReference.new(
-          type: 'aws_s3_access_point',
-          name: name,
-          resource_attributes: access_point_attrs.to_h,
-          outputs: {
-            id: "${aws_s3_access_point.#{name}.id}",
-            arn: "${aws_s3_access_point.#{name}.arn}",
-            alias: "${aws_s3_access_point.#{name}.alias}",
-            domain_name: "${aws_s3_access_point.#{name}.domain_name}",
-            has_public_access_policy: "${aws_s3_access_point.#{name}.has_public_access_policy}",
-            network_origin: "${aws_s3_access_point.#{name}.network_origin}",
-            endpoints: "${aws_s3_access_point.#{name}.endpoints}"
-          },
-          computed: {
-            vpc_access_point: access_point_attrs.vpc_access_point?,
-            internet_access_point: access_point_attrs.internet_access_point?,
-            has_public_access_block: access_point_attrs.has_public_access_block?,
-            cross_account_access: access_point_attrs.cross_account_access?
-          }
-        )
-      end
-    end
-  end
-end
-
-# Auto-register this module when it's loaded
-Pangea::ResourceRegistry.register(:aws, Pangea::Resources::AWS)

data/lib/pangea/resources/aws_s3_access_point/types.rb

@@ -1,86 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'dry-struct'
-
-module Pangea
-  module Resources
-    module AWS
-      module S3AccessPoint
-        # Common types for S3 Access Point configurations
-        class Types < Dry::Types::Module
-          include Dry.Types()
-
-          # S3 Access Point Account Owner ID constraint
-          AccessPointAccountId = String.constrained(format: /\A\d{12}\z/)
-          
-          # S3 Access Point Name constraint  
-          AccessPointName = String.constrained(min_size: 3, max_size: 63, format: /\A[a-z0-9\-]+\z/)
-          
-          # S3 Access Point Network Origin
-          NetworkOrigin = String.enum('Internet', 'VPC')
-          
-          # VPC Configuration for Access Point
-          VpcConfiguration = Hash.schema({
-            vpc_id: String
-          })
-          
-          # Public Access Block Configuration
-          PublicAccessBlockConfiguration = Hash.schema({
-            block_public_acls?: Bool,
-            block_public_policy?: Bool,
-            ignore_public_acls?: Bool,
-            restrict_public_buckets?: Bool
-          })
-        end
-
-        # S3 Access Point attributes with comprehensive validation
-        class S3AccessPointAttributes < Dry::Struct
-          include Types[self]
-          
-          # Required attributes
-          attribute :account_id, AccessPointAccountId
-          attribute :bucket, String
-          attribute :name, AccessPointName
-          
-          # Optional attributes
-          attribute? :bucket_account_id, AccessPointAccountId
-          attribute? :network_origin, NetworkOrigin.default('Internet')
-          attribute? :policy, String.optional
-          attribute? :vpc_configuration, VpcConfiguration.optional
-          attribute? :public_access_block_configuration, PublicAccessBlockConfiguration.default({})
-          
-          # Computed properties
-          def vpc_access_point?
-            network_origin == 'VPC'
-          end
-          
-          def internet_access_point?
-            network_origin == 'Internet'
-          end
-          
-          def has_public_access_block?
-            public_access_block_configuration.any?
-          end
-          
-          def cross_account_access?
-            bucket_account_id && bucket_account_id != account_id
-          end
-        end
-      end
-    end
-  end
-end

data/lib/pangea/resources/aws_s3_access_point_policy/resource.rb

@@ -1,69 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'pangea/resources/base'
-require 'pangea/resources/reference'
-require 'pangea/resources/aws_s3_access_point_policy/types'
-require 'pangea/resource_registry'
-
-module Pangea
-  module Resources
-    module AWS
-      # Create an AWS S3 Access Point Policy with type-safe attributes
-      #
-      # Provides resource-based permissions for S3 access points to control access from
-      # applications and users. Access point policies work with bucket policies and IAM 
-      # user policies to control access to the underlying S3 bucket.
-      #
-      # @param name [Symbol] The resource name
-      # @param attributes [Hash] S3 access point policy attributes
-      # @return [ResourceReference] Reference object with outputs and computed properties
-      def aws_s3_access_point_policy(name, attributes = {})
-        # Validate attributes using dry-struct
-        policy_attrs = S3AccessPointPolicy::Types::S3AccessPointPolicyAttributes.new(attributes)
-        
-        # Generate terraform resource block via terraform-synthesizer
-        resource(:aws_s3_access_point_policy, name) do
-          # Required attributes
-          access_point_arn policy_attrs.access_point_arn
-          policy policy_attrs.policy
-        end
-        
-        # Return resource reference with available outputs
-        ResourceReference.new(
-          type: 'aws_s3_access_point_policy',
-          name: name,
-          resource_attributes: policy_attrs.to_h,
-          outputs: {
-            id: "${aws_s3_access_point_policy.#{name}.id}",
-            access_point_arn: "${aws_s3_access_point_policy.#{name}.access_point_arn}",
-            has_public_access_policy: "${aws_s3_access_point_policy.#{name}.has_public_access_policy}"
-          },
-          computed: {
-            has_valid_json: policy_attrs.has_valid_json?,
-            access_point_name: policy_attrs.access_point_name,
-            account_id: policy_attrs.account_id,
-            region: policy_attrs.region,
-            policy_document: policy_attrs.policy_document
-          }
-        )
-      end
-    end
-  end
-end
-
-# Auto-register this module when it's loaded
-Pangea::ResourceRegistry.register(:aws, Pangea::Resources::AWS)

data/lib/pangea/resources/aws_s3_access_point_policy/types.rb

@@ -1,65 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'dry-struct'
-
-module Pangea
-  module Resources
-    module AWS
-      module S3AccessPointPolicy
-        # Common types for S3 Access Point Policy configurations
-        class Types < Dry::Types::Module
-          include Dry.Types()
-
-          # S3 Access Point ARN constraint
-          AccessPointArn = String.constrained(
-            format: /\Aarn:aws:s3:[a-z0-9\-]*:[0-9]{12}:accesspoint\/[a-z0-9\-]+\z/
-          )
-        end
-
-        # S3 Access Point Policy attributes with comprehensive validation
-        class S3AccessPointPolicyAttributes < Dry::Struct
-          include Types[self]
-          
-          # Required attributes
-          attribute :access_point_arn, AccessPointArn
-          attribute :policy, String
-          
-          # Computed properties
-          def policy_document
-            JSON.parse(policy) rescue nil
-          end
-          
-          def has_valid_json?
-            !policy_document.nil?
-          end
-          
-          def access_point_name
-            access_point_arn.split('/')[-1]
-          end
-          
-          def account_id
-            access_point_arn.split(':')[4]
-          end
-          
-          def region
-            access_point_arn.split(':')[3]
-          end
-        end
-      end
-    end
-  end
-end

data/lib/pangea/resources/aws_s3_bucket/CLAUDE.md

@@ -1,140 +0,0 @@
-# AWS S3 Bucket Resource Implementation
-
-## Overview
-
-The `aws_s3_bucket` resource function provides a type-safe interface for creating and configuring AWS S3 buckets with comprehensive feature support including versioning, encryption, lifecycle management, CORS, website hosting, and access controls.
-
-## Implementation Details
-
-### Type Safety
-
-The implementation uses `dry-struct` for runtime validation and type safety:
-
-- **S3BucketAttributes**: Main attributes class with comprehensive S3 bucket configuration options
-- **Nested Schemas**: Complex configurations (encryption, lifecycle, CORS) use nested dry-struct schemas
-- **Enum Types**: String enums for ACL types, storage classes, encryption algorithms, etc.
-- **Custom Validation**: Business rule validation (e.g., KMS key required for KMS encryption)
-
-### Resource Function
-
-```ruby
-def aws_s3_bucket(name, attributes = {})
-  # 1. Validate attributes using dry-struct
-  bucket_attrs = S3BucketAttributes.new(attributes)
-  
-  # 2. Generate main bucket resource
-  resource(:aws_s3_bucket, name) do
-    # Configure all bucket properties
-  end
-  
-  # 3. Create public access block if configured (separate resource)
-  if bucket_attrs.public_access_block_configuration.any?
-    resource(:aws_s3_bucket_public_access_block, "#{name}_public_access_block") do
-      # Configure public access restrictions
-    end
-  end
-  
-  # 4. Return ResourceReference with outputs and computed properties
-end
-```
-
-### Key Features
-
-1. **Encryption Support**
-   - Default AES256 encryption
-   - KMS encryption with custom key support
-   - Bucket key optimization for KMS
-
-2. **Lifecycle Management**
-   - Transition rules to different storage classes
-   - Expiration rules for current and noncurrent versions
-   - Tag-based lifecycle rules
-
-3. **Access Control**
-   - ACL support (private by default)
-   - Bucket policies via JSON string
-   - Public access block configuration (separate resource)
-
-4. **Website Hosting**
-   - Static website configuration
-   - Index and error documents
-   - Redirect rules
-
-5. **Advanced Features**
-   - Versioning with MFA delete support
-   - Object lock for compliance
-   - CORS configuration
-   - Access logging to another bucket
-
-### Computed Properties
-
-The ResourceReference includes computed properties for easy access:
-
-- `encryption_enabled`: Whether encryption is configured
-- `kms_encrypted`: Whether using KMS encryption
-- `versioning_enabled`: Whether versioning is enabled
-- `website_enabled`: Whether website hosting is configured
-- `lifecycle_rules_count`: Number of lifecycle rules
-- `public_access_blocked`: Whether all public access is blocked
-
-### Validation Rules
-
-1. **KMS Encryption**: Requires `kms_master_key_id` when using `aws:kms` algorithm
-2. **Lifecycle Rules**: Must have at least one action (transition/expiration)
-3. **Object Lock**: Requires versioning to be enabled
-4. **Website Config**: Cannot specify both redirect and index/error documents
-5. **Subnet Count**: Validates CIDR block sizes for practical use
-
-### Design Decisions
-
-1. **Separate Public Access Block**: Created as a separate resource (`aws_s3_bucket_public_access_block`) to match Terraform's resource model
-2. **Default Encryption**: AES256 encryption enabled by default for security best practices
-3. **Flexible Lifecycle Rules**: Array of rules allows multiple lifecycle configurations
-4. **Policy as String**: Bucket policies are passed as JSON strings to maintain flexibility
-
-### Integration with Terraform Synthesizer
-
-The function uses terraform-synthesizer's DSL to generate proper Terraform JSON:
-
-```ruby
-resource(:aws_s3_bucket, name) do
-  # Properties are set using the DSL
-  bucket bucket_attrs.bucket if bucket_attrs.bucket
-  acl bucket_attrs.acl
-  
-  # Nested blocks for complex configurations
-  versioning do
-    enabled bucket_attrs.versioning[:enabled]
-  end
-end
-```
-
-### Error Handling
-
-- Type validation errors from dry-struct
-- Custom validation errors for business rules
-- Clear error messages indicating the specific issue
-
-### Testing Considerations
-
-When testing S3 bucket resources:
-
-1. Verify encryption is properly configured
-2. Test lifecycle rules generate correct Terraform
-3. Ensure public access block is created when configured
-4. Validate website endpoint outputs are available
-5. Check computed properties reflect actual configuration
-
-### Performance Notes
-
-- Validation happens once during attribute creation
-- Computed properties are calculated on-demand
-- No external API calls during resource creation
-
-### Security Best Practices
-
-1. Private ACL by default
-2. Encryption enabled by default (AES256)
-3. Public access block configuration available
-4. Support for bucket policies for fine-grained access control
-5. Object lock support for compliance requirements