pangea 0.0.45 → 0.0.46

data/lib/pangea/resources/types.rb

@@ -1,1231 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'dry-struct'
-require 'dry-types'
-require 'json'
-require 'base64'
-
-module Pangea
-  module Resources
-    # Common types for resource definitions
-    module Types
-      include Dry.Types()
-      
-      # AWS-specific types
-      AwsRegion = String.enum(
-        'us-east-1', 'us-east-2', 'us-west-1', 'us-west-2',
-        'eu-west-1', 'eu-west-2', 'eu-central-1',
-        'ap-southeast-1', 'ap-southeast-2', 'ap-northeast-1'
-      )
-      
-      AwsAvailabilityZone = String.constrained(
-        format: /\A[a-z]{2}-[a-z]+-\d[a-z]\z/
-      )
-      
-      # CIDR block validation
-      CidrBlock = String.constrained(
-        format: /\A\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}\z/
-      )
-      
-      # EC2 instance types
-      Ec2InstanceType = String.enum(
-        # General purpose
-        't3.nano', 't3.micro', 't3.small', 't3.medium', 't3.large', 't3.xlarge', 't3.2xlarge',
-        't3a.nano', 't3a.micro', 't3a.small', 't3a.medium', 't3a.large', 't3a.xlarge', 't3a.2xlarge',
-        'm5.large', 'm5.xlarge', 'm5.2xlarge', 'm5.4xlarge', 'm5.8xlarge', 'm5.12xlarge', 'm5.16xlarge', 'm5.24xlarge',
-        'm5a.large', 'm5a.xlarge', 'm5a.2xlarge', 'm5a.4xlarge', 'm5a.8xlarge', 'm5a.12xlarge', 'm5a.16xlarge', 'm5a.24xlarge',
-        
-        # Compute optimized
-        'c5.large', 'c5.xlarge', 'c5.2xlarge', 'c5.4xlarge', 'c5.9xlarge', 'c5.12xlarge', 'c5.18xlarge', 'c5.24xlarge',
-        'c5n.large', 'c5n.xlarge', 'c5n.2xlarge', 'c5n.4xlarge', 'c5n.9xlarge', 'c5n.18xlarge',
-        
-        # Memory optimized  
-        'r5.large', 'r5.xlarge', 'r5.2xlarge', 'r5.4xlarge', 'r5.8xlarge', 'r5.12xlarge', 'r5.16xlarge', 'r5.24xlarge',
-        
-        # Storage optimized
-        'i3.large', 'i3.xlarge', 'i3.2xlarge', 'i3.4xlarge', 'i3.8xlarge', 'i3.16xlarge'
-      )
-      
-      # Common AWS resource attributes
-      AwsTags = Hash.map(Symbol, String).default({}.freeze)
-      
-      # Network protocols
-      IpProtocol = String.enum('tcp', 'udp', 'icmp', 'icmpv6', 'all', '-1')
-      
-      # Port ranges
-      Port = Integer.constrained(gteq: 0, lteq: 65535)
-      PortRange = Hash.schema(
-        from_port: Port,
-        to_port: Port
-      )
-      
-      # Security group rule
-      SecurityGroupRule = Hash.schema(
-        from_port: Port,
-        to_port: Port,
-        protocol: IpProtocol,
-        cidr_blocks?: Array.of(CidrBlock).default([].freeze),
-        security_groups?: Array.of(String).default([].freeze),
-        description?: String.optional
-      )
-      
-      # Instance tenancy
-      InstanceTenancy = String.default('default').enum('default', 'dedicated', 'host')
-      
-      # EBS volume types
-      EbsVolumeType = String.enum('gp2', 'gp3', 'io1', 'io2', 'st1', 'sc1', 'standard')
-      
-      # RDS engine types
-      RdsEngine = String.enum(
-        'mysql', 'postgres', 'mariadb', 'oracle-ee', 'oracle-se2', 
-        'oracle-se1', 'oracle-se', 'sqlserver-ee', 'sqlserver-se', 
-        'sqlserver-ex', 'sqlserver-web', 'aurora-mysql', 'aurora-postgresql'
-      )
-      
-      # RDS instance classes
-      RdsInstanceClass = String.enum(
-        'db.t3.micro', 'db.t3.small', 'db.t3.medium', 'db.t3.large', 'db.t3.xlarge', 'db.t3.2xlarge',
-        'db.t4g.micro', 'db.t4g.small', 'db.t4g.medium', 'db.t4g.large', 'db.t4g.xlarge', 'db.t4g.2xlarge',
-        'db.m5.large', 'db.m5.xlarge', 'db.m5.2xlarge', 'db.m5.4xlarge', 'db.m5.8xlarge', 'db.m5.12xlarge', 'db.m5.16xlarge', 'db.m5.24xlarge',
-        'db.r5.large', 'db.r5.xlarge', 'db.r5.2xlarge', 'db.r5.4xlarge', 'db.r5.8xlarge', 'db.r5.12xlarge', 'db.r5.16xlarge', 'db.r5.24xlarge'
-      )
-      
-      # S3 bucket versioning
-      S3Versioning = String.enum('Enabled', 'Suspended', 'Disabled')
-      
-      # Load balancer types
-      LoadBalancerType = String.default('application').enum('application', 'network', 'gateway')
-      
-      # Application load balancer target types
-      AlbTargetType = String.enum('instance', 'ip', 'lambda', 'alb')
-      
-      # Health check protocols
-      HealthCheckProtocol = String.enum('HTTP', 'HTTPS', 'TCP', 'TLS', 'UDP', 'TCP_UDP', 'GENEVE')
-      
-      # VPN-related types
-      VpnConnectionType = String.enum('ipsec.1')
-      VpnGatewayType = String.enum('ipsec.1')
-      VpnTunnelProtocol = String.enum('ikev1', 'ikev2')
-      
-      # BGP ASN validation (16-bit and 32-bit ASNs)
-      BgpAsn = Integer.constrained(
-        gteq: 1,
-        lteq: 4294967295
-      ).constructor { |value|
-        # AWS reserved ASNs: 7224, 9059, 10124, 17943
-        reserved_asns = [7224, 9059, 10124, 17943]
-        if reserved_asns.include?(value)
-          raise Dry::Types::ConstraintError, "ASN #{value} is reserved by AWS"
-        end
-        value
-      }
-      
-      # Customer Gateway IP address validation
-      PublicIpAddress = String.constrained(
-        format: /\A(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\z/
-      ).constructor { |value|
-        # Reject private IP ranges for customer gateway
-        ip_parts = value.split('.').map(&:to_i)
-        
-        # 10.0.0.0/8
-        if ip_parts[0] == 10
-          raise Dry::Types::ConstraintError, "Customer Gateway IP cannot be in private range 10.0.0.0/8"
-        end
-        
-        # 172.16.0.0/12
-        if ip_parts[0] == 172 && (16..31).include?(ip_parts[1])
-          raise Dry::Types::ConstraintError, "Customer Gateway IP cannot be in private range 172.16.0.0/12"
-        end
-        
-        # 192.168.0.0/16
-        if ip_parts[0] == 192 && ip_parts[1] == 168
-          raise Dry::Types::ConstraintError, "Customer Gateway IP cannot be in private range 192.168.0.0/16"
-        end
-        
-        value
-      }
-      
-      # EFS-specific types
-      EfsPerformanceMode = String.constrained(included_in: ['generalPurpose', 'maxIO'])
-      EfsThroughputMode = String.constrained(included_in: ['bursting', 'provisioned', 'elastic'])
-      
-      # EFS Lifecycle Policy configuration
-      EfsLifecyclePolicy = Hash.schema(
-        transition_to_ia?: String.constrained(included_in: ['AFTER_7_DAYS', 'AFTER_14_DAYS', 'AFTER_30_DAYS', 'AFTER_60_DAYS', 'AFTER_90_DAYS']).optional,
-        transition_to_primary_storage_class?: String.constrained(included_in: ['AFTER_1_ACCESS']).optional
-      ).constructor { |value|
-        # Ensure at least one transition is specified
-        if value.empty? || (!value[:transition_to_ia] && !value[:transition_to_primary_storage_class])
-          raise Dry::Types::ConstraintError, "EFS lifecycle policy must specify at least one transition"
-        end
-        value
-      }
-      
-      # EFS Access Point POSIX user
-      EfsPosixUser = Hash.schema(
-        uid: Integer.constrained(gteq: 0, lteq: 4294967295),
-        gid: Integer.constrained(gteq: 0, lteq: 4294967295),
-        secondary_gids?: Array.of(Integer.constrained(gteq: 0, lteq: 4294967295)).optional
-      )
-      
-      # EFS Access Point root directory creation info
-      EfsCreationInfo = Hash.schema(
-        owner_uid: Integer.constrained(gteq: 0, lteq: 4294967295),
-        owner_gid: Integer.constrained(gteq: 0, lteq: 4294967295),
-        permissions: String.constrained(format: /\A[0-7]{3,4}\z/)
-      )
-      
-      # EFS Access Point root directory
-      EfsRootDirectory = Hash.schema(
-        path?: String.constrained(format: /\A\/.*/).default("/"),
-        creation_info?: EfsCreationInfo.optional
-      )
-      
-      # POSIX permissions (octal format)
-      PosixPermissions = String.constrained(format: /\A[0-7]{3,4}\z/)
-      
-      # Unix User/Group IDs
-      UnixUserId = Integer.constrained(gteq: 0, lteq: 4294967295)
-      UnixGroupId = Integer.constrained(gteq: 0, lteq: 4294967295)
-      
-      # Lambda-specific types
-      LambdaRuntime = String.enum(
-        # Python runtimes
-        'python3.12', 'python3.11', 'python3.10', 'python3.9', 'python3.8',
-        # Node.js runtimes
-        'nodejs20.x', 'nodejs18.x', 'nodejs16.x',
-        # Java runtimes
-        'java21', 'java17', 'java11', 'java8.al2', 'java8',
-        # .NET runtimes
-        'dotnet8', 'dotnet6',
-        # Go runtime
-        'go1.x',
-        # Ruby runtime
-        'ruby3.2', 'ruby2.7',
-        # Custom runtime
-        'provided.al2023', 'provided.al2', 'provided'
-      )
-      
-      LambdaArchitecture = String.enum('x86_64', 'arm64')
-      
-      LambdaPackageType = String.enum('Zip', 'Image')
-      
-      LambdaTracingMode = String.enum('Active', 'PassThrough')
-      
-      # Lambda memory validation (128MB to 10240MB in 1MB increments)
-      LambdaMemory = Integer.constrained(gteq: 128, lteq: 10240).constructor { |value|
-        unless value >= 512 || value % 64 == 0
-          raise Dry::Types::ConstraintError, "Lambda memory must be in 64MB increments between 128-512MB, or 1MB increments above 512MB"
-        end
-        value
-      }
-      
-      # Lambda timeout validation (1s to 900s/15min)
-      LambdaTimeout = Integer.constrained(gteq: 1, lteq: 900)
-      
-      # Lambda reserved concurrent executions
-      LambdaReservedConcurrency = Integer.constrained(gteq: 0, lteq: 1000)
-      
-      # Lambda provisioned concurrent executions
-      LambdaProvisionedConcurrency = Integer.constrained(gteq: 1, lteq: 1000)
-      
-      # Lambda event source mapping
-      LambdaEventSourcePosition = String.enum('TRIM_HORIZON', 'LATEST', 'AT_TIMESTAMP')
-      
-      # Lambda dead letter queue config
-      LambdaDeadLetterConfig = Hash.schema(
-        target_arn: String.constrained(format: /\Aarn:aws:(sqs|sns):/)
-      )
-      
-      # Lambda VPC config
-      LambdaVpcConfig = Hash.schema(
-        subnet_ids: Array.of(String).constrained(min_size: 1),
-        security_group_ids: Array.of(String).constrained(min_size: 1)
-      )
-      
-      # Lambda environment variables
-      LambdaEnvironmentVariables = Hash.map(String.constrained(format: /\A[a-zA-Z_][a-zA-Z0-9_]*\z/), String)
-      
-      # Lambda file system config (EFS)
-      LambdaFileSystemConfig = Hash.schema(
-        arn: String.constrained(format: /\Aarn:aws:elasticfilesystem:/),
-        local_mount_path: String.constrained(format: /\A\/mnt\/[a-zA-Z0-9_-]+\z/)
-      )
-      
-      # Lambda ephemeral storage
-      LambdaEphemeralStorage = Hash.schema(
-        size: Integer.constrained(gteq: 512, lteq: 10240)
-      )
-      
-      # Lambda snap start
-      LambdaSnapStart = Hash.schema(
-        apply_on: String.default('None').enum('PublishedVersions', 'None')
-      )
-      
-      # Lambda image config
-      LambdaImageConfig = Hash.schema(
-        entry_point?: Array.of(String).optional,
-        command?: Array.of(String).optional,
-        working_directory?: String.optional
-      )
-      
-      # Lambda permission actions
-      LambdaPermissionAction = String.enum(
-        'lambda:InvokeFunction',
-        'lambda:GetFunction',
-        'lambda:GetFunctionConfiguration',
-        'lambda:UpdateFunctionConfiguration',
-        'lambda:UpdateFunctionCode',
-        'lambda:DeleteFunction',
-        'lambda:PublishVersion',
-        'lambda:CreateAlias',
-        'lambda:UpdateAlias',
-        'lambda:DeleteAlias',
-        'lambda:GetAlias',
-        'lambda:ListVersionsByFunction',
-        'lambda:GetPolicy',
-        'lambda:PutFunctionConcurrency',
-        'lambda:DeleteFunctionConcurrency',
-        'lambda:GetFunctionConcurrency',
-        'lambda:ListTags',
-        'lambda:TagResource',
-        'lambda:UntagResource'
-      )
-      
-      # Lambda event source types
-      LambdaEventSourceType = String.enum(
-        'kinesis',
-        'dynamodb',
-        'sqs',
-        'msk',
-        'self-managed-kafka',
-        'rabbitmq'
-      )
-      
-      # Lambda destination on failure
-      LambdaDestinationOnFailure = Hash.schema(
-        destination: String.constrained(format: /\Aarn:aws:(sqs|sns|lambda|events):/)
-      )
-      
-      # Lambda self managed event source
-      LambdaSelfManagedEventSource = Hash.schema(
-        endpoints: Hash.map(String.enum('KAFKA_BOOTSTRAP_SERVERS'), Array.of(String))
-      )
-      
-      # Lambda source access configuration
-      LambdaSourceAccessConfiguration = Hash.schema(
-        type: String.enum('BASIC_AUTH', 'VPC_SUBNET', 'VPC_SECURITY_GROUP', 'SASL_SCRAM_256_AUTH', 'SASL_SCRAM_512_AUTH'),
-        uri: String
-      )
-      
-      # ACM Certificate-specific types
-      AcmValidationMethod = String.enum('DNS', 'EMAIL')
-      AcmCertificateStatus = String.enum('PENDING_VALIDATION', 'ISSUED', 'INACTIVE', 'EXPIRED', 'VALIDATION_TIMED_OUT', 'REVOKED', 'FAILED')
-      AcmKeyAlgorithm = String.enum('RSA-2048', 'RSA-1024', 'RSA-4096', 'EC-prime256v1', 'EC-secp384r1', 'EC-secp521r1')
-      
-      # Domain name validation (basic - more detailed validation in resource types)
-      DomainName = String.constrained(
-        format: /\A(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\z/i
-      )
-      
-      # Wildcard domain name validation
-      WildcardDomainName = String.constrained(
-        format: /\A\*\.(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\z/i
-      )
-      
-      # Email address validation for ACM email validation
-      EmailAddress = String.constrained(
-        format: /\A[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}\z/
-      )
-      
-      # KMS key-specific types
-      KmsKeyUsage = String.enum('SIGN_VERIFY', 'ENCRYPT_DECRYPT')
-      KmsKeySpec = String.enum('SYMMETRIC_DEFAULT', 'RSA_2048', 'RSA_3072', 'RSA_4096', 'ECC_NIST_P256', 'ECC_NIST_P384', 'ECC_NIST_P521', 'ECC_SECG_P256K1')
-      KmsOrigin = String.enum('AWS_KMS', 'EXTERNAL', 'AWS_CLOUDHSM')
-      KmsMultiRegion = Bool.default(false)
-      
-      # KMS key policy document (simplified - actual policies are complex JSON)
-      KmsKeyPolicy = String.constrained(
-        format: /\A\{.*\}\z/
-      ).constructor { |value|
-        # Basic validation that it's JSON-like
-        begin
-          JSON.parse(value)
-          value
-        rescue JSON::ParserError
-          raise Dry::Types::ConstraintError, "KMS key policy must be valid JSON"
-        end
-      }
-      
-      # Secrets Manager-specific types
-      SecretsManagerSecretType = String.enum('SecureString', 'String', 'StringList')
-      SecretsManagerRecoveryWindowInDays = Integer.constrained(gteq: 7, lteq: 30).default(30)
-      
-      # Secret name validation (AWS Secrets Manager naming rules)
-      SecretName = String.constrained(
-        format: /\A[a-zA-Z0-9\/_+=.@-]{1,512}\z/
-      ).constructor { |value|
-        # Cannot start or end with a slash
-        if value.start_with?('/') || value.end_with?('/')
-          raise Dry::Types::ConstraintError, "Secret name cannot start or end with a slash"
-        end
-        
-        # Cannot contain consecutive slashes
-        if value.include?('//')
-          raise Dry::Types::ConstraintError, "Secret name cannot contain consecutive slashes"
-        end
-        
-        value
-      }
-      
-      # Secret ARN pattern validation
-      SecretArn = String.constrained(
-        format: /\Aarn:aws:secretsmanager:[a-z0-9-]+:\d{12}:secret:[a-zA-Z0-9\/_+=.@-]+-[a-zA-Z0-9]{6}\z/
-      )
-      
-      # Secret version stage names
-      SecretVersionStage = String.enum('AWSCURRENT', 'AWSPENDING').constructor { |value|
-        # Also allow custom stage names (alphanumeric, max 256 chars)
-        if !['AWSCURRENT', 'AWSPENDING'].include?(value)
-          unless value.match?(/\A[a-zA-Z0-9_]{1,256}\z/)
-            raise Dry::Types::ConstraintError, "Custom version stage must be alphanumeric with underscores, max 256 characters"
-          end
-        end
-        value
-      }
-      
-      # Certificate transparency logging preference
-      CertificateTransparencyLogging = String.default('ENABLED').enum('ENABLED', 'DISABLED')
-      
-      # ACM certificate validation options
-      AcmValidationOption = Hash.schema(
-        domain_name: DomainName,
-        validation_domain?: DomainName.optional
-      )
-      
-      # ACM domain validation option (for DNS validation)
-      AcmDomainValidationOption = Hash.schema(
-        domain_name: DomainName,
-        resource_record_name?: String.optional,
-        resource_record_type?: String.enum('CNAME', 'A', 'AAAA', 'TXT').optional,
-        resource_record_value?: String.optional
-      )
-      
-      # KMS key rotation - only valid for customer managed keys
-      KmsEnableKeyRotation = Bool.constructor { |value, attrs|
-        # This validation would need access to key attributes
-        # For now, just pass through - validation happens in resource
-        value
-      }
-      
-      # Secrets Manager replica region configuration
-      SecretsManagerReplicaRegion = Hash.schema(
-        region: AwsRegion,
-        kms_key_id?: String.optional
-      )
-      
-      # Secret value types (for secret versions)
-      SecretValue = String | Hash.map(String, String)
-      
-      # Secret binary value validation
-      SecretBinary = String.constructor { |value|
-        # Must be base64 encoded
-        unless value.match?(/\A[A-Za-z0-9+\/]*={0,2}\z/)
-          raise Dry::Types::ConstraintError, "Secret binary must be base64 encoded"
-        end
-        
-        # Decode to validate it's proper base64
-        begin
-          Base64.decode64(value)
-          value
-        rescue ArgumentError
-          raise Dry::Types::ConstraintError, "Secret binary must be valid base64"
-        end
-      }
-      
-      # Load Balancer Listener-specific types
-      ListenerProtocol = String.enum('HTTP', 'HTTPS', 'TCP', 'TLS', 'UDP', 'TCP_UDP', 'GENEVE')
-      
-      ListenerPort = Integer.constrained(gteq: 1, lteq: 65535)
-      
-      # SSL policies for HTTPS/TLS listeners
-      SslPolicy = String.enum(
-        'ELBSecurityPolicy-TLS-1-0-2015-04',
-        'ELBSecurityPolicy-TLS-1-1-2017-01',
-        'ELBSecurityPolicy-TLS-1-2-2017-01',
-        'ELBSecurityPolicy-TLS-1-2-Ext-2018-06',
-        'ELBSecurityPolicy-FS-2018-06',
-        'ELBSecurityPolicy-FS-1-1-2019-08',
-        'ELBSecurityPolicy-FS-1-2-2019-08',
-        'ELBSecurityPolicy-FS-1-2-Res-2019-08',
-        'ELBSecurityPolicy-FS-1-2-Res-2020-10',
-        'ELBSecurityPolicy-TLS-1-2-2017-01',
-        'ELBSecurityPolicy-2016-08'
-      )
-      
-      # Listener action types
-      ListenerActionType = String.enum(
-        'forward',
-        'redirect', 
-        'fixed-response',
-        'authenticate-cognito',
-        'authenticate-oidc'
-      )
-      
-      # Listener rule condition types  
-      ListenerConditionType = String.enum(
-        'host-header',
-        'path-pattern',
-        'http-method',
-        'query-string',
-        'http-header',
-        'source-ip'
-      )
-      
-      # HTTP methods for listener rules
-      HttpMethod = String.enum(
-        'GET', 'POST', 'PUT', 'DELETE', 'HEAD', 'OPTIONS', 'PATCH'
-      )
-      
-      # Listener action forward configuration
-      ListenerForwardAction = Hash.schema(
-        target_groups: Array.of(
-          Hash.schema(
-            arn: String,
-            weight?: Integer.constrained(gteq: 0, lteq: 999).default(100)
-          )
-        ).constrained(min_size: 1),
-        stickiness?: Hash.schema(
-          enabled: Bool,
-          duration?: Integer.constrained(gteq: 1, lteq: 604800).optional
-        ).optional
-      )
-      
-      # Listener action redirect configuration
-      ListenerRedirectAction = Hash.schema(
-        protocol?: String.enum('HTTP', 'HTTPS', '#{protocol}').optional,
-        port?: String.optional,
-        host?: String.optional,
-        path?: String.optional,
-        query?: String.optional,
-        status_code: String.enum('HTTP_301', 'HTTP_302')
-      )
-      
-      # Listener action fixed response configuration
-      ListenerFixedResponseAction = Hash.schema(
-        content_type?: String.enum('text/plain', 'text/css', 'text/html', 'application/javascript', 'application/json').optional,
-        message_body?: String.optional,
-        status_code: String.constrained(format: /\A[1-5][0-9]{2}\z/)
-      )
-      
-      # Listener action authenticate cognito configuration
-      ListenerAuthenticateCognitoAction = Hash.schema(
-        user_pool_arn: String.constrained(format: /\Aarn:aws:cognito-idp:/),
-        user_pool_client_id: String,
-        user_pool_domain: String,
-        authentication_request_extra_params?: Hash.map(String, String).optional,
-        on_unauthenticated_request?: String.enum('deny', 'allow', 'authenticate').optional,
-        scope?: String.optional,
-        session_cookie_name?: String.optional,
-        session_timeout?: Integer.constrained(gteq: 1, lteq: 604800).optional
-      )
-      
-      # Listener action authenticate OIDC configuration  
-      ListenerAuthenticateOidcAction = Hash.schema(
-        authorization_endpoint: String,
-        client_id: String,
-        client_secret: String,
-        issuer: String,
-        token_endpoint: String,
-        user_info_endpoint: String,
-        authentication_request_extra_params?: Hash.map(String, String).optional,
-        on_unauthenticated_request?: String.enum('deny', 'allow', 'authenticate').optional,
-        scope?: String.optional,
-        session_cookie_name?: String.optional,
-        session_timeout?: Integer.constrained(gteq: 1, lteq: 604800).optional
-      )
-      
-      # Listener rule condition configurations
-      ListenerConditionHostHeader = Hash.schema(
-        values: Array.of(String).constrained(min_size: 1)
-      )
-      
-      ListenerConditionPathPattern = Hash.schema(
-        values: Array.of(String).constrained(min_size: 1)
-      )
-      
-      ListenerConditionHttpMethod = Hash.schema(
-        values: Array.of(HttpMethod).constrained(min_size: 1)
-      )
-      
-      ListenerConditionQueryString = Hash.schema(
-        values: Array.of(
-          Hash.schema(
-            key?: String.optional,
-            value: String
-          )
-        ).constrained(min_size: 1)
-      )
-      
-      ListenerConditionHttpHeader = Hash.schema(
-        http_header_name: String,
-        values: Array.of(String).constrained(min_size: 1)
-      )
-      
-      ListenerConditionSourceIp = Hash.schema(
-        values: Array.of(CidrBlock).constrained(min_size: 1)
-      )
-      
-      # Target group attachment types
-      TargetAttachmentType = String.enum('instance', 'ip', 'lambda', 'alb')
-      
-      # Target availability zone (required for IP targets in different AZ than ALB)
-      TargetAvailabilityZone = AwsAvailabilityZone.optional
-      
-      # Transit Gateway-specific types
-      
-      # Transit Gateway ASN validation (16-bit: 64512-65534, 32-bit: 4200000000-4294967294)
-      TransitGatewayAsn = Integer.constructor { |value|
-        # Validate 16-bit ASN range
-        if (64512..65534).include?(value)
-          return value
-        end
-        
-        # Validate 32-bit ASN range
-        if (4200000000..4294967294).include?(value)
-          return value
-        end
-        
-        # AWS reserved ASNs
-        reserved_asns = [7224, 9059, 10124, 17943]
-        if reserved_asns.include?(value)
-          raise Dry::Types::ConstraintError, "ASN #{value} is reserved by AWS"
-        end
-        
-        raise Dry::Types::ConstraintError, "Transit Gateway ASN must be in range 64512-65534 (16-bit) or 4200000000-4294967294 (32-bit)"
-      }
-      
-      # Transit Gateway default route table association/propagation
-      TransitGatewayDefaultRouteTableAssociation = String.default('enable').enum('enable', 'disable')
-      TransitGatewayDefaultRouteTablePropagation = String.default('enable').enum('enable', 'disable')
-      
-      # Transit Gateway DNS support
-      TransitGatewayDnsSupport = String.default('enable').enum('enable', 'disable')
-      
-      # Transit Gateway multicast support
-      TransitGatewayMulticastSupport = String.default('disable').enum('enable', 'disable')
-      
-      # Transit Gateway VPN ECMP support
-      TransitGatewayVpnEcmpSupport = String.default('enable').enum('enable', 'disable')
-      
-      # Transit Gateway attachment types
-      TransitGatewayAttachmentResourceType = String.enum(
-        'vpc',
-        'vpn', 
-        'direct-connect-gateway',
-        'peering',
-        'tgw-peering'
-      )
-      
-      # Transit Gateway route table route types
-      TransitGatewayRouteType = String.enum('static', 'propagated')
-      
-      # Transit Gateway route state
-      TransitGatewayRouteState = String.enum('active', 'blackhole')
-      
-      # Transit Gateway VPC attachment DNS support
-      TransitGatewayVpcAttachmentDnsSupport = String.default('enable').enum('enable', 'disable')
-      
-      # Transit Gateway VPC attachment IPv6 support
-      TransitGatewayVpcAttachmentIpv6Support = String.default('disable').enum('enable', 'disable')
-      
-      # Transit Gateway VPC attachment appliance mode support
-      TransitGatewayVpcAttachmentApplianceModeSupport = String.default('disable').enum('enable', 'disable')
-      
-      # CIDR block validation for Transit Gateway routes
-      TransitGatewayCidrBlock = String.constructor { |value|
-        # Allow standard CIDR blocks
-        if value.match?(/\A\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2}\z/)
-          # Validate IP address components
-          ip, prefix = value.split('/')
-          ip_parts = ip.split('.').map(&:to_i)
-          prefix_int = prefix.to_i
-          
-          # Validate IP address octets
-          unless ip_parts.all? { |octet| (0..255).include?(octet) }
-            raise Dry::Types::ConstraintError, "Invalid IP address in CIDR block: #{value}"
-          end
-          
-          # Validate prefix length
-          unless (0..32).include?(prefix_int)
-            raise Dry::Types::ConstraintError, "Invalid prefix length in CIDR block: #{value}. Must be 0-32."
-          end
-          
-          return value
-        end
-        
-        # Allow default route
-        if value == '0.0.0.0/0'
-          return value
-        end
-        
-        raise Dry::Types::ConstraintError, "Transit Gateway CIDR block must be valid CIDR notation or '0.0.0.0/0'"
-      }
-      
-      # AWS Security Services Types
-      
-      # WAF v2 Scope types
-      WafV2Scope = String.enum('REGIONAL', 'CLOUDFRONT')
-      
-      # WAF v2 IP address version
-      WafV2IpAddressVersion = String.enum('IPV4', 'IPV6')
-      
-      # WAF v2 Default actions
-      WafV2DefaultAction = String.enum('ALLOW', 'BLOCK')
-      
-      # WAF v2 Rule action types
-      WafV2RuleActionType = String.enum('ALLOW', 'BLOCK', 'COUNT', 'CAPTCHA', 'CHALLENGE')
-      
-      # WAF v2 Statement types
-      WafV2StatementType = String.enum(
-        'ByteMatchStatement',
-        'SqliMatchStatement', 
-        'XssMatchStatement',
-        'SizeConstraintStatement',
-        'GeoMatchStatement',
-        'RuleGroupReferenceStatement',
-        'IPSetReferenceStatement',
-        'RegexPatternSetReferenceStatement',
-        'RateBasedStatement',
-        'AndStatement',
-        'OrStatement',
-        'NotStatement',
-        'ManagedRuleGroupStatement',
-        'LabelMatchStatement'
-      )
-      
-      # WAF v2 Text transformation types
-      WafV2TextTransformation = String.enum(
-        'NONE',
-        'COMPRESS_WHITE_SPACE',
-        'HTML_ENTITY_DECODE',
-        'LOWERCASE',
-        'CMD_LINE',
-        'URL_DECODE',
-        'BASE64_DECODE',
-        'HEX_DECODE',
-        'MD5',
-        'REPLACE_COMMENTS',
-        'ESCAPE_SEQ_DECODE',
-        'SQL_HEX_DECODE',
-        'CSS_DECODE',
-        'JS_DECODE',
-        'NORMALIZE_PATH',
-        'NORMALIZE_PATH_WIN',
-        'REMOVE_NULLS',
-        'REPLACE_NULLS',
-        'BASE64_DECODE_EXT',
-        'URL_DECODE_UNI',
-        'UTF8_TO_UNICODE'
-      )
-      
-      # WAF v2 Field to match types
-      WafV2FieldToMatch = String.enum(
-        'URI',
-        'QUERY_STRING',
-        'HEADER',
-        'METHOD',
-        'BODY',
-        'SINGLE_HEADER',
-        'SINGLE_QUERY_ARGUMENT',
-        'ALL_QUERY_ARGUMENTS',
-        'URI_PATH',
-        'JSON_BODY',
-        'HEADERS',
-        'COOKIES'
-      )
-      
-      # WAF v2 Compare operators
-      WafV2ComparisonOperator = String.enum('EQ', 'NE', 'LE', 'LT', 'GE', 'GT')
-      
-      # WAF v2 Position constraint for ByteMatchStatement
-      WafV2PositionalConstraint = String.enum('EXACTLY', 'STARTS_WITH', 'ENDS_WITH', 'CONTAINS', 'CONTAINS_WORD')
-      
-      # GuardDuty Finding Publishing Frequency
-      GuardDutyFindingPublishingFrequency = String.enum('FIFTEEN_MINUTES', 'ONE_HOUR', 'SIX_HOURS')
-      
-      # GuardDuty Detector Status
-      GuardDutyDetectorStatus = String.enum('ENABLED', 'DISABLED')
-      
-      # GuardDuty Data Source configurations
-      GuardDutyDataSourceStatus = String.enum('ENABLED', 'DISABLED')
-      
-      # GuardDuty Threat Intel Set format
-      GuardDutyThreatIntelSetFormat = String.enum('TXT', 'STIX', 'OTX_CSV', 'ALIEN_VAULT', 'PROOF_POINT', 'FIRE_EYE')
-      
-      # GuardDuty IP Set format  
-      GuardDutyIpSetFormat = String.enum('TXT', 'STIX', 'OTX_CSV', 'ALIEN_VAULT', 'PROOF_POINT', 'FIRE_EYE')
-      
-      # GuardDuty Member invitation status
-      GuardDutyMemberStatus = String.enum('CREATED', 'INVITED', 'DISABLED', 'ENABLED', 'REMOVED', 'RESIGNED')
-      
-      # Inspector v2 Resource types
-      InspectorV2ResourceType = String.enum('ECR', 'EC2')
-      
-      # Inspector v2 Scan types
-      InspectorV2ScanType = String.enum('NETWORK', 'PACKAGE')
-      
-      # Security Hub Standards
-      SecurityHubStandardsArn = String.constrained(
-        format: /\Aarn:aws:securityhub:[a-z0-9-]+::\w+\/\w+\/\w+\z/
-      )
-      
-      # Security Hub Control Status
-      SecurityHubControlStatus = String.enum('ENABLED', 'DISABLED')
-      
-      # Security Hub Compliance Status
-      SecurityHubComplianceStatus = String.enum('PASSED', 'WARNING', 'FAILED', 'NOT_AVAILABLE')
-      
-      # Security Hub Severity
-      SecurityHubSeverity = String.enum('INFORMATIONAL', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL')
-      
-      # Security Hub Record State
-      SecurityHubRecordState = String.enum('ACTIVE', 'ARCHIVED')
-      
-      # Security Hub Workflow Status  
-      SecurityHubWorkflowStatus = String.enum('NEW', 'NOTIFIED', 'RESOLVED', 'SUPPRESSED')
-      
-      # AWS Account ID validation
-      AwsAccountId = String.constrained(
-        format: /\A\d{12}\z/
-      ).constructor { |value|
-        unless value.length == 12 && value.match?(/\A\d+\z/)
-          raise Dry::Types::ConstraintError, "AWS Account ID must be exactly 12 digits"
-        end
-        value
-      }
-      
-      # Security service ARN patterns
-      GuardDutyDetectorArn = String.constrained(
-        format: /\Aarn:aws:guardduty:[a-z0-9-]+:\d{12}:detector\/[a-f0-9]{32}\z/
-      )
-      
-      SecurityHubArn = String.constrained(
-        format: /\Aarn:aws:securityhub:[a-z0-9-]+:\d{12}:hub\/default\z/
-      )
-      
-      WafV2WebAclArn = String.constrained(
-        format: /\Aarn:aws:wafv2:[a-z0-9-]+:\d{12}:(global|regional)\/webacl\/[a-zA-Z0-9_-]+\/[a-f0-9-]{36}\z/
-      )
-      
-      # Email validation for GuardDuty invitations
-      GuardDutyInvitationEmail = String.constrained(
-        format: /\A[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}\z/
-      ).constructor { |value|
-        # Additional business rule validation
-        if value.length > 320 # RFC 5321 limit
-          raise Dry::Types::ConstraintError, "Email address cannot exceed 320 characters"
-        end
-        value
-      }
-      
-      # WAF v2 Web ACL Capacity units validation
-      WafV2CapacityUnits = Integer.constrained(gteq: 1, lteq: 1500)
-      
-      # WAF v2 Rate limit for rate-based rules  
-      WafV2RateLimit = Integer.constrained(gteq: 100, lteq: 2000000000)
-      
-      # GuardDuty S3 bucket validation
-      S3BucketName = String.constrained(
-        format: /\A[a-z0-9][a-z0-9\-\.]{1,61}[a-z0-9]\z/
-      ).constructor { |value|
-        # Additional S3 bucket name rules
-        if value.include?('..')
-          raise Dry::Types::ConstraintError, "S3 bucket name cannot contain consecutive periods"
-        end
-        
-        if value.match?(/\A\d+\.\d+\.\d+\.\d+\z/)
-          raise Dry::Types::ConstraintError, "S3 bucket name cannot be formatted as IP address"
-        end
-        
-        if value.start_with?('xn--')
-          raise Dry::Types::ConstraintError, "S3 bucket name cannot start with 'xn--'"
-        end
-        
-        if value.end_with?('-s3alias')
-          raise Dry::Types::ConstraintError, "S3 bucket name cannot end with '-s3alias'"
-        end
-        
-        value
-      }
-      
-      # Inspector v2 scan status
-      InspectorV2ScanStatus = String.enum('ENABLED', 'DISABLED', 'SUSPENDED')
-      
-      # WAF v2 JSON body configuration
-      WafV2JsonBodyMatchPattern = Hash.schema(
-        all?: Hash.schema({}).optional,
-        included_paths?: Array.of(String).optional
-      ).constructor { |value|
-        # Must specify either 'all' or 'included_paths', but not both
-        has_all = value.key?(:all)
-        has_paths = value.key?(:included_paths) && value[:included_paths]&.any?
-        
-        if has_all && has_paths
-          raise Dry::Types::ConstraintError, "WAF v2 JSON body match pattern cannot specify both 'all' and 'included_paths'"
-        end
-        
-        if !has_all && !has_paths
-          raise Dry::Types::ConstraintError, "WAF v2 JSON body match pattern must specify either 'all' or 'included_paths'"
-        end
-        
-        value
-      }
-
-      # AWS IoT Core Types
-      
-      # IoT Thing name validation (1-128 characters, alphanumeric plus certain special chars)
-      IotThingName = String.constrained(
-        format: /\A[a-zA-Z0-9:_-]{1,128}\z/
-      ).constructor { |value|
-        # Cannot start with :, $, or #
-        if value.start_with?(':', '$', '#')
-          raise Dry::Types::ConstraintError, "IoT Thing name cannot start with ':', '$', or '#'"
-        end
-        value
-      }
-      
-      # IoT Thing Type name validation
-      IotThingTypeName = String.constrained(
-        format: /\A[a-zA-Z0-9:_-]{1,128}\z/
-      ).constructor { |value|
-        # Cannot start with :, $, or #
-        if value.start_with?(':', '$', '#')
-          raise Dry::Types::ConstraintError, "IoT Thing Type name cannot start with ':', '$', or '#'"
-        end
-        value
-      }
-      
-      # IoT Certificate status
-      IotCertificateStatus = String.enum('ACTIVE', 'INACTIVE', 'REVOKED', 'PENDING_TRANSFER', 'REGISTER_INACTIVE', 'PENDING_ACTIVATION')
-      
-      # IoT Certificate format
-      IotCertificateFormat = String.enum('PEM')
-      
-      # IoT Policy name validation (1-128 characters)
-      IotPolicyName = String.constrained(
-        format: /\A[a-zA-Z0-9:_-]{1,128}\z/
-      ).constructor { |value|
-        # Cannot start with :, $, or #
-        if value.start_with?(':', '$', '#')
-          raise Dry::Types::ConstraintError, "IoT Policy name cannot start with ':', '$', or '#'"
-        end
-        value
-      }
-      
-      # IoT Policy document (JSON format)
-      IotPolicyDocument = String.constructor { |value|
-        begin
-          parsed = JSON.parse(value)
-          # Basic structure validation for IoT policy
-          unless parsed.is_a?(Hash) && parsed['Version'] && parsed['Statement']
-            raise Dry::Types::ConstraintError, "IoT Policy document must have 'Version' and 'Statement' fields"
-          end
-          value
-        rescue JSON::ParserError
-          raise Dry::Types::ConstraintError, "IoT Policy document must be valid JSON"
-        end
-      }
-      
-      # IoT Topic Rule name validation (1-128 characters)
-      IotTopicRuleName = String.constrained(
-        format: /\A[a-zA-Z0-9_]{1,128}\z/
-      ).constructor { |value|
-        # Must start with letter or underscore
-        unless value.match?(/\A[a-zA-Z_]/)
-          raise Dry::Types::ConstraintError, "IoT Topic Rule name must start with a letter or underscore"
-        end
-        value
-      }
-      
-      # IoT SQL query string validation
-      IotSqlQuery = String.constructor { |value|
-        # Basic SQL validation - must start with SELECT
-        unless value.strip.upcase.start_with?('SELECT')
-          raise Dry::Types::ConstraintError, "IoT SQL query must start with SELECT"
-        end
-        
-        # Check for required FROM clause
-        unless value.upcase.include?('FROM')
-          raise Dry::Types::ConstraintError, "IoT SQL query must include FROM clause"
-        end
-        
-        value
-      }
-      
-      # IoT Topic Rule destination confirmation status
-      IotTopicRuleDestinationStatus = String.enum('ENABLED', 'DISABLED', 'IN_PROGRESS', 'ERROR')
-      
-      # IoT Topic Rule destination type
-      IotTopicRuleDestinationType = String.enum('VPC')
-      
-      # IoT Security Profile name validation
-      IotSecurityProfileName = String.constrained(
-        format: /\A[a-zA-Z0-9:_-]{1,128}\z/
-      ).constructor { |value|
-        # Cannot start with :, $, or #
-        if value.start_with?(':', '$', '#')
-          raise Dry::Types::ConstraintError, "IoT Security Profile name cannot start with ':', '$', or '#'"
-        end
-        value
-      }
-      
-      # IoT Device Defender behavior criteria types
-      IotBehaviorCriteriaType = String.enum(
-        'consecutive-datapoints-to-alarm',
-        'consecutive-datapoints-to-clear',
-        'statistical-threshold',
-        'ml-detection-config'
-      )
-      
-      # IoT Device Defender metric types
-      IotMetricType = String.enum(
-        'ip-count',
-        'tcp-port-count', 
-        'udp-port-count',
-        'source-ip-count',
-        'authorization-failure-count',
-        'connection-attempt-count',
-        'disconnection-count',
-        'data-size-in-bytes',
-        'message-count',
-        'number-of-authorization-failures'
-      )
-      
-      # IoT Device Defender statistical threshold
-      IotStatisticalThreshold = Hash.schema(
-        statistic?: String.optional
-      )
-      
-      # IoT Device Defender ML detection config
-      IotMlDetectionConfig = Hash.schema(
-        confidence_level: String.enum('LOW', 'MEDIUM', 'HIGH')
-      )
-      
-      # IoT Analytics Channel name validation (1-128 characters)
-      IotAnalyticsChannelName = String.constrained(
-        format: /\A[a-zA-Z0-9_]{1,128}\z/
-      ).constructor { |value|
-        # Must start with letter or underscore, cannot end with underscore
-        unless value.match?(/\A[a-zA-Z_]/) && !value.end_with?('_')
-          raise Dry::Types::ConstraintError, "IoT Analytics Channel name must start with letter or underscore and cannot end with underscore"
-        end
-        value
-      }
-      
-      # IoT Analytics Datastore name validation (1-128 characters)
-      IotAnalyticsDatastoreName = String.constrained(
-        format: /\A[a-zA-Z0-9_]{1,128}\z/
-      ).constructor { |value|
-        # Must start with letter or underscore, cannot end with underscore
-        unless value.match?(/\A[a-zA-Z_]/) && !value.end_with?('_')
-          raise Dry::Types::ConstraintError, "IoT Analytics Datastore name must start with letter or underscore and cannot end with underscore"
-        end
-        value
-      }
-      
-      # IoT Analytics retention period in days (1-2147483647)
-      IotAnalyticsRetentionPeriod = Integer.constrained(gteq: 1, lteq: 2147483647)
-      
-      # IoT Analytics file format type
-      IotAnalyticsFileFormatType = String.enum('JSON', 'PARQUET')
-      
-      # IoT Analytics dataset content type
-      IotAnalyticsDatasetContentType = String.enum('CSV', 'JSON')
-      
-      # IoT MQTT topic validation
-      IotMqttTopic = String.constructor { |value|
-        # MQTT topic validation rules
-        if value.length > 256
-          raise Dry::Types::ConstraintError, "MQTT topic cannot exceed 256 characters"
-        end
-        
-        # Cannot contain null character
-        if value.include?("\0")
-          raise Dry::Types::ConstraintError, "MQTT topic cannot contain null character"
-        end
-        
-        # Wildcard validation for subscriptions
-        if value.include?('+') || value.include?('#')
-          # + can only be used at level boundaries
-          if value.include?('+') && !value.match?(/\A([^+]*\+[^+]*\/)*[^+]*\+?[^+]*\z/)
-            raise Dry::Types::ConstraintError, "MQTT topic wildcard '+' must be at topic level boundaries"
-          end
-          
-          # # can only be at the end
-          if value.include?('#') && !value.end_with?('#') && !value.end_with?('/#')
-            raise Dry::Types::ConstraintError, "MQTT topic wildcard '#' must be at the end of topic"
-          end
-        end
-        
-        value
-      }
-      
-      # IoT Thing attributes (key-value pairs with restrictions)
-      IotThingAttributes = Hash.map(
-        String.constrained(format: /\A[a-zA-Z0-9_-]{1,128}\z/),
-        String.constrained(max_size: 800)
-      ).constructor { |value|
-        # Max 50 attributes per thing
-        if value.keys.length > 50
-          raise Dry::Types::ConstraintError, "IoT Thing cannot have more than 50 attributes"
-        end
-        
-        # Check for reserved attribute names
-        reserved_names = %w[thingName thingId thingTypeName]
-        reserved_found = value.keys.map(&:to_s) & reserved_names
-        unless reserved_found.empty?
-          raise Dry::Types::ConstraintError, "IoT Thing attributes cannot use reserved names: #{reserved_found.join(', ')}"
-        end
-        
-        value
-      }
-      
-      # IoT Thing Type properties
-      IotThingTypeProperties = Hash.schema(
-        description?: String.constrained(max_size: 2028).optional,
-        searchable_attributes?: Array.of(
-          String.constrained(format: /\A[a-zA-Z0-9_-]{1,128}\z/)
-        ).constrained(max_size: 3).optional
-      )
-      
-      # IoT Certificate ARN validation
-      IotCertificateArn = String.constrained(
-        format: /\Aarn:aws:iot:[a-z0-9-]+:\d{12}:cert\/[a-f0-9]{64}\z/
-      )
-      
-      # IoT Principal ARN (Certificate or Cognito Identity)
-      IotPrincipalArn = String.constructor { |value|
-        # Certificate ARN pattern
-        cert_pattern = /\Aarn:aws:iot:[a-z0-9-]+:\d{12}:cert\/[a-f0-9]{64}\z/
-        # Cognito Identity pattern
-        cognito_pattern = /\Aarn:aws:cognito-identity:[a-z0-9-]+:\d{12}:identitypool\/[a-z0-9-]+:[a-f0-9-]+\z/
-        
-        unless value.match?(cert_pattern) || value.match?(cognito_pattern)
-          raise Dry::Types::ConstraintError, "IoT Principal ARN must be a valid certificate or Cognito identity ARN"
-        end
-        
-        value
-      }
-      
-      # IoT Job execution status
-      IotJobExecutionStatus = String.enum(
-        'QUEUED', 'IN_PROGRESS', 'SUCCEEDED', 'FAILED', 'TIMED_OUT', 'REJECTED', 'REMOVED', 'CANCELED'
-      )
-      
-      # IoT Job target selection
-      IotJobTargetSelection = String.enum('CONTINUOUS', 'SNAPSHOT')
-      
-      # IoT OTA Update status
-      IotOtaUpdateStatus = String.enum(
-        'CREATE_PENDING', 'CREATE_IN_PROGRESS', 'CREATE_COMPLETE', 'CREATE_FAILED',
-        'DELETE_IN_PROGRESS', 'DELETE_FAILED'
-      )
-      
-      # IoT Fleet indexing configuration
-      IotIndexingConfiguration = Hash.schema(
-        thing_indexing_mode?: String.enum('OFF', 'REGISTRY', 'REGISTRY_AND_SHADOW').optional,
-        thing_connectivity_indexing_mode?: String.enum('OFF', 'STATUS').optional
-      )
-      
-      # IoT Logs level
-      IotLogsLevel = String.enum('DEBUG', 'INFO', 'ERROR', 'WARN', 'DISABLED')
-      
-      # IoT Logs target type
-      IotLogsTargetType = String.enum('DEFAULT', 'THING_GROUP')
-      
-      # IoT endpoint types
-      IotEndpointType = String.enum('iot:Data', 'iot:Data-ATS', 'iot:CredentialProvider', 'iot:Jobs')
-      
-      # IoT Device Shadow service data (JSON format)
-      IotShadowDocument = String.constructor { |value|
-        begin
-          parsed = JSON.parse(value)
-          # Shadow document must be an object
-          unless parsed.is_a?(Hash)
-            raise Dry::Types::ConstraintError, "IoT Shadow document must be a JSON object"
-          end
-          
-          # Check size limit (8KB for device shadow)
-          if value.bytesize > 8192
-            raise Dry::Types::ConstraintError, "IoT Shadow document cannot exceed 8KB"
-          end
-          
-          value
-        rescue JSON::ParserError
-          raise Dry::Types::ConstraintError, "IoT Shadow document must be valid JSON"
-        end
-      }
-      
-      # IoT Analytics S3 bucket configuration
-      IotAnalyticsS3Configuration = Hash.schema(
-        bucket: S3BucketName,
-        key?: String.optional,
-        role_arn: String.constrained(format: /\Aarn:aws:iam::\d{12}:role\//),
-        file_format_configuration?: Hash.schema(
-          json_configuration?: Hash.schema({}).optional,
-          parquet_configuration?: Hash.schema({}).optional
-        ).optional
-      )
-      
-      # IoT Analytics Lambda configuration
-      IotAnalyticsLambdaConfiguration = Hash.schema(
-        lambda_name: String.constrained(format: /\A[a-zA-Z0-9\-_]{1,64}\z/),
-        batch_size?: Integer.constrained(gteq: 1, lteq: 1000).optional
-      )
-      
-      # IoT Device Defender alert targets
-      IotAlertTargetType = String.enum('SNS')
-      
-      # IoT Device Defender alert target configuration
-      IotAlertTarget = Hash.schema(
-        alert_target_arn: String.constrained(format: /\Aarn:aws:sns:/),
-        role_arn: String.constrained(format: /\Aarn:aws:iam::\d{12}:role\//)
-      )
-      
-      # IoT Billing group properties
-      IotBillingGroupProperties = Hash.schema(
-        billing_group_description?: String.constrained(max_size: 2028).optional
-      )
-      
-      # IoT Dynamic group query string
-      IotDynamicGroupQueryString = String.constructor { |value|
-        # Must be a valid IoT fleet indexing query
-        if value.length > 500
-          raise Dry::Types::ConstraintError, "IoT Dynamic group query string cannot exceed 500 characters"
-        end
-        
-        # Basic validation - should contain searchable attributes
-        unless value.include?('attributes.') || value.include?('connectivity.') || value.include?('registry.')
-          raise Dry::Types::ConstraintError, "IoT Dynamic group query must reference searchable attributes"
-        end
-        
-        value
-      }
-    end
-  end
-end