pangea 0.0.45 → 0.0.46

data/lib/pangea/components/global_service_mesh/component.rb

@@ -1,1307 +0,0 @@
-# frozen_string_literal: true
-# Copyright 2025 The Pangea Authors
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-
-require 'pangea/components/base'
-require 'pangea/components/global_service_mesh/types'
-require 'pangea/resources/aws'
-require 'json'
-
-module Pangea
-  module Components
-    # Multi-region service mesh infrastructure for microservices communication
-    # Creates App Mesh, service discovery, cross-region connectivity, and observability
-    def global_service_mesh(name, attributes = {})
-      include Base
-      include Resources::AWS
-      
-      # Validate and set defaults
-      component_attrs = GlobalServiceMesh::GlobalServiceMeshAttributes.new(attributes)
-      component_attrs.validate!
-      
-      # Generate component-specific tags
-      component_tag_set = component_tags('GlobalServiceMesh', name, component_attrs.tags)
-      
-      resources = {}
-      
-      # Create the App Mesh
-      mesh_ref = aws_appmesh_mesh(
-        component_resource_name(name, :mesh),
-        {
-          name: component_attrs.mesh_name,
-          
-          spec: {
-            egress_filter: {
-              type: component_attrs.gateway.egress_gateway_enabled ? "ALLOW_ALL" : "DROP_ALL"
-            },
-            service_discovery: {
-              ip_preference: "IPv4_PREFERRED"
-            }
-          },
-          
-          tags: component_tag_set
-        }
-      )
-      resources[:mesh] = mesh_ref
-      
-      # Create Cloud Map namespace for service discovery
-      namespace_ref = aws_service_discovery_private_dns_namespace(
-        component_resource_name(name, :namespace),
-        {
-          name: component_attrs.service_discovery.namespace_name,
-          description: component_attrs.service_discovery.namespace_description,
-          vpc: "vpc-placeholder", # Would be dynamic based on region
-          tags: component_tag_set
-        }
-      )
-      resources[:namespace] = namespace_ref
-      
-      # Process each region
-      regional_resources = {}
-      
-      component_attrs.regions.each do |region|
-        region_resources = setup_regional_mesh(
-          name, region, component_attrs, mesh_ref, namespace_ref, component_tag_set
-        )
-        regional_resources[region.to_sym] = region_resources
-      end
-      
-      resources[:regional] = regional_resources
-      
-      # Create cross-region connectivity
-      if component_attrs.regions.length > 1 && component_attrs.cross_region.peering_enabled
-        connectivity_resources = create_cross_region_connectivity(
-          name, component_attrs, regional_resources, component_tag_set
-        )
-        resources[:connectivity] = connectivity_resources
-      end
-      
-      # Create service mesh components
-      mesh_components = create_mesh_components(
-        name, component_attrs, mesh_ref, regional_resources, component_tag_set
-      )
-      resources[:mesh_components] = mesh_components
-      
-      # Create gateways if enabled
-      if component_attrs.gateway.ingress_gateway_enabled || component_attrs.gateway.egress_gateway_enabled
-        gateway_resources = create_gateways(
-          name, component_attrs, mesh_ref, regional_resources, component_tag_set
-        )
-        resources[:gateways] = gateway_resources
-      end
-      
-      # Create observability infrastructure
-      if component_attrs.observability.xray_enabled || component_attrs.observability.cloudwatch_metrics_enabled
-        observability_resources = create_observability_infrastructure(
-          name, component_attrs, resources, component_tag_set
-        )
-        resources[:observability] = observability_resources
-      end
-      
-      # Create security resources
-      if component_attrs.security.mtls_enabled
-        security_resources = create_security_infrastructure(
-          name, component_attrs, mesh_ref, component_tag_set
-        )
-        resources[:security] = security_resources
-      end
-      
-      # Create resilience patterns
-      if component_attrs.resilience.chaos_testing_enabled
-        resilience_resources = create_resilience_infrastructure(
-          name, component_attrs, resources, component_tag_set
-        )
-        resources[:resilience] = resilience_resources
-      end
-      
-      # Calculate outputs
-      outputs = {
-        mesh_name: component_attrs.mesh_name,
-        mesh_arn: mesh_ref.arn,
-        
-        service_discovery_namespace: component_attrs.service_discovery.namespace_name,
-        
-        regions: component_attrs.regions,
-        services: component_attrs.services.map { |s| 
-          {
-            name: s.name,
-            region: s.region,
-            endpoint: "#{s.name}.#{component_attrs.service_discovery.namespace_name}",
-            port: s.port,
-            protocol: s.protocol
-          }
-        },
-        
-        connectivity_type: extract_connectivity_type(component_attrs),
-        
-        security_features: [
-          ("mTLS Enabled" if component_attrs.security.mtls_enabled),
-          ("Service Authentication" if component_attrs.security.service_auth_enabled),
-          ("RBAC Enabled" if component_attrs.security.rbac_enabled),
-          ("Encryption in Transit" if component_attrs.security.encryption_in_transit),
-          ("Secrets Manager Integration" if component_attrs.security.secrets_manager_integration)
-        ].compact,
-        
-        traffic_management_features: [
-          ("Circuit Breaker" if component_attrs.traffic_management.circuit_breaker_enabled),
-          ("Outlier Detection" if component_attrs.traffic_management.outlier_detection_enabled),
-          ("Canary Deployments" if component_attrs.traffic_management.canary_deployments_enabled),
-          ("Global Load Balancing" if component_attrs.enable_global_load_balancing),
-          ("Multi-cluster Routing" if component_attrs.enable_multi_cluster_routing)
-        ].compact,
-        
-        observability_features: [
-          ("X-Ray Distributed Tracing" if component_attrs.observability.xray_enabled),
-          ("CloudWatch Metrics" if component_attrs.observability.cloudwatch_metrics_enabled),
-          ("Access Logging" if component_attrs.observability.access_logging_enabled),
-          ("Envoy Stats" if component_attrs.observability.envoy_stats_enabled),
-          ("Custom Metrics" if component_attrs.observability.custom_metrics_enabled)
-        ].compact,
-        
-        resilience_features: [
-          ("Retry Policy" if component_attrs.resilience.retry_policy_enabled),
-          ("Bulkhead Pattern" if component_attrs.resilience.bulkhead_enabled),
-          ("Request Timeout" if component_attrs.resilience.timeout_enabled),
-          ("Chaos Testing" if component_attrs.resilience.chaos_testing_enabled)
-        ].compact,
-        
-        gateway_endpoints: extract_gateway_endpoints(resources[:gateways]),
-        
-        virtual_nodes: mesh_components[:virtual_nodes]&.keys || [],
-        virtual_services: mesh_components[:virtual_services]&.keys || [],
-        virtual_routers: mesh_components[:virtual_routers]&.keys || [],
-        
-        estimated_monthly_cost: estimate_service_mesh_cost(component_attrs, resources)
-      }
-      
-      create_component_reference(
-        'global_service_mesh',
-        name,
-        component_attrs.to_h,
-        resources,
-        outputs
-      )
-    end
-    
-    private
-    
-    def setup_regional_mesh(name, region, attrs, mesh_ref, namespace_ref, tags)
-      region_resources = {}
-      
-      # Get services for this region
-      region_services = attrs.services.select { |s| s.region == region }
-      
-      # Create VPC endpoints for App Mesh and Cloud Map
-      vpc_endpoints = {}
-      
-      # App Mesh VPC endpoint
-      appmesh_endpoint_ref = aws_vpc_endpoint(
-        component_resource_name(name, :appmesh_endpoint, region.to_sym),
-        {
-          vpc_id: "vpc-placeholder", # Would reference actual VPC
-          service_name: "com.amazonaws.#{region}.appmesh-envoy-management",
-          vpc_endpoint_type: "Interface",
-          subnet_ids: [], # Would reference private subnets
-          security_group_ids: [], # Would reference security groups
-          private_dns_enabled: true,
-          tags: tags.merge(Region: region)
-        }
-      )
-      vpc_endpoints[:appmesh] = appmesh_endpoint_ref
-      
-      # Cloud Map VPC endpoint
-      servicediscovery_endpoint_ref = aws_vpc_endpoint(
-        component_resource_name(name, :servicediscovery_endpoint, region.to_sym),
-        {
-          vpc_id: "vpc-placeholder",
-          service_name: "com.amazonaws.#{region}.servicediscovery",
-          vpc_endpoint_type: "Interface",
-          subnet_ids: [],
-          security_group_ids: [],
-          private_dns_enabled: true,
-          tags: tags.merge(Region: region)
-        }
-      )
-      vpc_endpoints[:servicediscovery] = servicediscovery_endpoint_ref
-      
-      region_resources[:vpc_endpoints] = vpc_endpoints
-      
-      # Create service-specific resources
-      services_resources = {}
-      
-      region_services.each do |service|
-        service_resources = {}
-        
-        # Create Cloud Map service
-        service_discovery_ref = aws_service_discovery_service(
-          component_resource_name(name, :service_discovery, service.name.to_sym),
-          {
-            name: service.name,
-            namespace_id: namespace_ref.id,
-            
-            dns_config: {
-              namespace_id: namespace_ref.id,
-              routing_policy: attrs.service_discovery.routing_policy,
-              
-              dns_records: [{
-                ttl: attrs.service_discovery.dns_ttl,
-                type: "A"
-              }]
-            },
-            
-            health_check_custom_config: attrs.service_discovery.health_check_custom_config_enabled ? {
-              failure_threshold: attrs.virtual_node_config.unhealthy_threshold
-            } : nil,
-            
-            tags: tags.merge(Service: service.name, Region: region)
-          }.compact
-        )
-        service_resources[:discovery] = service_discovery_ref
-        
-        # Create ECS task definition if not provided
-        if !service.task_definition_ref && service.cluster_ref
-          task_def_ref = aws_ecs_task_definition(
-            component_resource_name(name, :task_definition, service.name.to_sym),
-            {
-              family: "#{service.name}-task",
-              network_mode: "awsvpc",
-              requires_compatibilities: ["FARGATE"],
-              cpu: "256",
-              memory: "512",
-              
-              proxy_configuration: {
-                type: "APPMESH",
-                container_name: "envoy",
-                properties: {
-                  AppPorts: service.port.to_s,
-                  EgressIgnoredIPs: "169.254.170.2,169.254.169.254",
-                  IgnoredUID: "1337",
-                  ProxyEgressPort: 15001,
-                  ProxyIngressPort: 15000
-                }
-              },
-              
-              container_definitions: JSON.generate([
-                {
-                  name: service.name,
-                  image: "service-image:latest",
-                  portMappings: [{
-                    containerPort: service.port,
-                    protocol: "tcp"
-                  }],
-                  environment: [
-                    { name: "SERVICE_NAME", value: service.name },
-                    { name: "SERVICE_PORT", value: service.port.to_s }
-                  ],
-                  dependsOn: [{
-                    containerName: "envoy",
-                    condition: "HEALTHY"
-                  }]
-                },
-                {
-                  name: "envoy",
-                  image: "public.ecr.aws/appmesh/aws-appmesh-envoy:latest",
-                  memory: 128,
-                  user: "1337",
-                  essential: true,
-                  environment: [
-                    { name: "APPMESH_RESOURCE_ARN", value: "mesh/#{attrs.mesh_name}/virtualNode/#{service.name}" },
-                    { name: "ENABLE_ENVOY_XRAY_TRACING", value: attrs.observability.xray_enabled ? "1" : "0" }
-                  ],
-                  healthCheck: {
-                    command: ["CMD-SHELL", "curl -s http://localhost:9901/server_info | grep state | grep -q LIVE"],
-                    interval: 5,
-                    timeout: 2,
-                    retries: 3,
-                    startPeriod: 10
-                  }
-                }
-              ]),
-              
-              task_role_arn: "arn:aws:iam::ACCOUNT:role/ecsTaskRole",
-              execution_role_arn: "arn:aws:iam::ACCOUNT:role/ecsTaskExecutionRole",
-              
-              tags: tags.merge(Service: service.name)
-            }
-          )
-          service_resources[:task_definition] = task_def_ref
-        else
-          service_resources[:task_definition] = service.task_definition_ref
-        end
-        
-        services_resources[service.name.to_sym] = service_resources
-      end
-      
-      region_resources[:services] = services_resources
-      
-      # Create Transit Gateway if enabled for cross-region
-      if attrs.cross_region.transit_gateway_enabled && attrs.regions.length > 1
-        tgw_ref = aws_ec2_transit_gateway(
-          component_resource_name(name, :transit_gateway, region.to_sym),
-          {
-            description: "Transit Gateway for service mesh in #{region}",
-            amazon_side_asn: 64512,
-            default_route_table_association: "enable",
-            default_route_table_propagation: "enable",
-            dns_support: "enable",
-            vpn_ecmp_support: "enable",
-            tags: tags.merge(Region: region)
-          }
-        )
-        region_resources[:transit_gateway] = tgw_ref
-      end
-      
-      region_resources
-    end
-    
-    def create_cross_region_connectivity(name, attrs, regional_resources, tags)
-      connectivity_resources = {}
-      
-      # Create Transit Gateway peering attachments
-      if attrs.cross_region.transit_gateway_enabled
-        peering_attachments = {}
-        
-        attrs.regions.combination(2).each do |region1, region2|
-          tgw1 = regional_resources[region1.to_sym][:transit_gateway]
-          tgw2 = regional_resources[region2.to_sym][:transit_gateway]
-          
-          next unless tgw1 && tgw2
-          
-          peering_ref = aws_ec2_transit_gateway_peering_attachment(
-            component_resource_name(name, :tgw_peering, "#{region1}_#{region2}".to_sym),
-            {
-              transit_gateway_id: tgw1.id,
-              peer_transit_gateway_id: tgw2.id,
-              peer_account_id: "${AWS::AccountId}",
-              peer_region: region2,
-              tags: tags.merge(
-                ConnectionType: "ServiceMesh",
-                Region1: region1,
-                Region2: region2
-              )
-            }
-          )
-          peering_attachments["#{region1}_#{region2}".to_sym] = peering_ref
-        end
-        
-        connectivity_resources[:tgw_peering] = peering_attachments
-      end
-      
-      # Create PrivateLink connections if enabled
-      if attrs.cross_region.private_link_enabled
-        privatelink_connections = {}
-        
-        attrs.services.group_by(&:region).each do |provider_region, services|
-          services.each do |service|
-            # Create VPC endpoint service
-            endpoint_service_ref = aws_vpc_endpoint_service(
-              component_resource_name(name, :endpoint_service, service.name.to_sym),
-              {
-                acceptance_required: false,
-                network_load_balancer_arns: [], # Would reference NLBs
-                tags: tags.merge(Service: service.name, Region: provider_region)
-              }
-            )
-            
-            privatelink_connections["service_#{service.name}".to_sym] = endpoint_service_ref
-            
-            # Create VPC endpoints in consumer regions
-            consumer_regions = attrs.regions - [provider_region]
-            consumer_regions.each do |consumer_region|
-              endpoint_ref = aws_vpc_endpoint(
-                component_resource_name(name, :service_endpoint, "#{service.name}_#{consumer_region}".to_sym),
-                {
-                  vpc_id: "vpc-placeholder",
-                  service_name: endpoint_service_ref.service_name,
-                  vpc_endpoint_type: "Interface",
-                  subnet_ids: [],
-                  security_group_ids: [],
-                  tags: tags.merge(
-                    Service: service.name,
-                    ProviderRegion: provider_region,
-                    ConsumerRegion: consumer_region
-                  )
-                }
-              )
-              privatelink_connections["endpoint_#{service.name}_#{consumer_region}".to_sym] = endpoint_ref
-            end
-          end
-        end
-        
-        connectivity_resources[:privatelink] = privatelink_connections
-      end
-      
-      connectivity_resources
-    end
-    
-    def create_mesh_components(name, attrs, mesh_ref, regional_resources, tags)
-      mesh_components = {}
-      
-      # Create virtual nodes for each service
-      virtual_nodes = {}
-      attrs.services.each do |service|
-        virtual_node_ref = aws_appmesh_virtual_node(
-          component_resource_name(name, :virtual_node, service.name.to_sym),
-          {
-            name: service.name,
-            mesh_name: mesh_ref.name,
-            
-            spec: {
-              listener: [{
-                port_mapping: {
-                  port: service.port,
-                  protocol: service.protocol
-                },
-                
-                health_check: {
-                  healthy_threshold: attrs.virtual_node_config.healthy_threshold,
-                  interval_millis: attrs.virtual_node_config.health_check_interval_millis,
-                  path: service.health_check_path,
-                  port: service.port,
-                  protocol: service.protocol == 'GRPC' ? 'grpc' : 'http',
-                  timeout_millis: attrs.virtual_node_config.health_check_timeout_millis,
-                  unhealthy_threshold: attrs.virtual_node_config.unhealthy_threshold
-                },
-                
-                tls: attrs.security.mtls_enabled ? {
-                  mode: attrs.security.tls_mode,
-                  certificate: {
-                    acm: {
-                      certificate_arn: "arn:aws:acm:#{service.region}:ACCOUNT:certificate/cert"
-                    }
-                  },
-                  validation: {
-                    trust: {
-                      acm: {
-                        certificate_authority_arns: [attrs.security.certificate_authority_arn]
-                      }
-                    }
-                  }
-                } : nil,
-                
-                outlier_detection: attrs.traffic_management.outlier_detection_enabled ? {
-                  base_ejection_duration: {
-                    unit: "s",
-                    value: attrs.traffic_management.outlier_ejection_duration_seconds
-                  },
-                  interval: {
-                    unit: "s",
-                    value: 10
-                  },
-                  max_ejection_percent: attrs.traffic_management.max_ejection_percent,
-                  max_server_errors: attrs.traffic_management.circuit_breaker_threshold
-                } : nil,
-                
-                connection_pool: attrs.resilience.bulkhead_enabled ? {
-                  http: {
-                    max_connections: attrs.resilience.max_connections,
-                    max_pending_requests: attrs.resilience.max_pending_requests
-                  }
-                } : nil,
-                
-                timeout: attrs.resilience.timeout_enabled ? {
-                  http: {
-                    idle: {
-                      unit: "s",
-                      value: 300
-                    },
-                    per_request: {
-                      unit: "s",
-                      value: attrs.resilience.request_timeout_seconds
-                    }
-                  }
-                } : nil
-              }.compact],
-              
-              service_discovery: {
-                aws_cloud_map: {
-                  namespace_name: attrs.service_discovery.namespace_name,
-                  service_name: service.name
-                }
-              },
-              
-              backend: attrs.virtual_node_config.backends.any? ? 
-                attrs.virtual_node_config.backends.map do |backend|
-                  {
-                    virtual_service: {
-                      virtual_service_name: "#{backend}.#{attrs.service_discovery.namespace_name}"
-                    }
-                  }
-                end : nil,
-              
-              backend_defaults: attrs.resilience.retry_policy_enabled ? {
-                client_policy: {
-                  tls: attrs.security.mtls_enabled ? {
-                    enforce: true,
-                    validation: {
-                      trust: {
-                        acm: {
-                          certificate_authority_arns: [attrs.security.certificate_authority_arn]
-                        }
-                      }
-                    }
-                  } : nil
-                }
-              } : nil
-            }.compact,
-            
-            tags: tags.merge(Service: service.name, Region: service.region)
-          }
-        )
-        virtual_nodes[service.name.to_sym] = virtual_node_ref
-      end
-      mesh_components[:virtual_nodes] = virtual_nodes
-      
-      # Create virtual services
-      virtual_services = {}
-      attrs.services.each do |service|
-        virtual_service_ref = aws_appmesh_virtual_service(
-          component_resource_name(name, :virtual_service, service.name.to_sym),
-          {
-            name: "#{service.name}.#{attrs.service_discovery.namespace_name}",
-            mesh_name: mesh_ref.name,
-            
-            spec: {
-              provider: {
-                virtual_node: {
-                  virtual_node_name: service.name
-                }
-              }
-            },
-            
-            tags: tags.merge(Service: service.name)
-          }
-        )
-        virtual_services[service.name.to_sym] = virtual_service_ref
-      end
-      mesh_components[:virtual_services] = virtual_services
-      
-      # Create virtual routers for advanced routing
-      if attrs.traffic_management.canary_deployments_enabled || attrs.enable_multi_cluster_routing
-        virtual_routers = {}
-        
-        attrs.services.group_by(&:name).select { |_, svcs| svcs.length > 1 }.each do |service_name, service_versions|
-          virtual_router_ref = aws_appmesh_virtual_router(
-            component_resource_name(name, :virtual_router, service_name.to_sym),
-            {
-              name: "#{service_name}-router",
-              mesh_name: mesh_ref.name,
-              
-              spec: {
-                listener: [{
-                  port_mapping: {
-                    port: service_versions.first.port,
-                    protocol: service_versions.first.protocol
-                  }
-                }]
-              },
-              
-              tags: tags.merge(Service: service_name)
-            }
-          )
-          virtual_routers[service_name.to_sym] = virtual_router_ref
-          
-          # Create routes
-          route_ref = aws_appmesh_route(
-            component_resource_name(name, :route, service_name.to_sym),
-            {
-              name: "#{service_name}-route",
-              mesh_name: mesh_ref.name,
-              virtual_router_name: virtual_router_ref.name,
-              
-              spec: {
-                http_route: {
-                  match: {
-                    prefix: "/"
-                  },
-                  
-                  action: {
-                    weighted_target: service_versions.map do |version|
-                      {
-                        virtual_node: version.name,
-                        weight: version.weight
-                      }
-                    end
-                  },
-                  
-                  retry_policy: attrs.resilience.retry_policy_enabled ? {
-                    http_retry_events: ["server-error", "gateway-error"],
-                    max_retries: attrs.resilience.max_retries,
-                    per_retry_timeout: {
-                      unit: "s",
-                      value: attrs.resilience.retry_timeout_seconds
-                    }
-                  } : nil,
-                  
-                  timeout: {
-                    per_request: {
-                      unit: "s",
-                      value: service_versions.first.timeout_seconds
-                    }
-                  }
-                }.compact
-              },
-              
-              tags: tags.merge(Service: service_name)
-            }
-          )
-          mesh_components["route_#{service_name}".to_sym] = route_ref
-        end
-        
-        mesh_components[:virtual_routers] = virtual_routers
-      end
-      
-      mesh_components
-    end
-    
-    def create_gateways(name, attrs, mesh_ref, regional_resources, tags)
-      gateway_resources = {}
-      
-      # Create virtual gateway for ingress
-      if attrs.gateway.ingress_gateway_enabled
-        ingress_gateway_ref = aws_appmesh_virtual_gateway(
-          component_resource_name(name, :ingress_gateway),
-          {
-            name: "#{name}-ingress-gateway",
-            mesh_name: mesh_ref.name,
-            
-            spec: {
-              listener: [{
-                port_mapping: {
-                  port: attrs.gateway.gateway_port,
-                  protocol: attrs.gateway.gateway_protocol
-                },
-                
-                tls: attrs.gateway.gateway_protocol == 'HTTPS' ? {
-                  mode: attrs.security.tls_mode,
-                  certificate: {
-                    acm: {
-                      certificate_arn: "arn:aws:acm:REGION:ACCOUNT:certificate/gateway-cert"
-                    }
-                  }
-                } : nil,
-                
-                health_check: {
-                  healthy_threshold: 2,
-                  interval_millis: 30000,
-                  path: "/health",
-                  port: attrs.gateway.gateway_port,
-                  protocol: attrs.gateway.gateway_protocol == 'GRPC' ? 'grpc' : 'http',
-                  timeout_millis: 5000,
-                  unhealthy_threshold: 3
-                }
-              }.compact],
-              
-              logging: attrs.observability.access_logging_enabled ? {
-                access_log: {
-                  file: {
-                    path: "/dev/stdout"
-                  }
-                }
-              } : nil
-            }.compact,
-            
-            tags: tags.merge(Type: "Ingress")
-          }
-        )
-        gateway_resources[:ingress] = ingress_gateway_ref
-        
-        # Create gateway routes
-        gateway_routes = {}
-        attrs.services.each do |service|
-          gateway_route_ref = aws_appmesh_gateway_route(
-            component_resource_name(name, :gateway_route, service.name.to_sym),
-            {
-              name: "#{service.name}-route",
-              mesh_name: mesh_ref.name,
-              virtual_gateway_name: ingress_gateway_ref.name,
-              
-              spec: {
-                http_route: {
-                  match: {
-                    prefix: "/#{service.name}"
-                  },
-                  
-                  action: {
-                    target: {
-                      virtual_service: {
-                        virtual_service_name: "#{service.name}.#{attrs.service_discovery.namespace_name}"
-                      }
-                    }
-                  }
-                }
-              },
-              
-              tags: tags.merge(Service: service.name)
-            }
-          )
-          gateway_routes[service.name.to_sym] = gateway_route_ref
-        end
-        gateway_resources[:routes] = gateway_routes
-      end
-      
-      # Create egress gateway if enabled
-      if attrs.gateway.egress_gateway_enabled
-        egress_gateway_ref = aws_appmesh_virtual_gateway(
-          component_resource_name(name, :egress_gateway),
-          {
-            name: "#{name}-egress-gateway",
-            mesh_name: mesh_ref.name,
-            
-            spec: {
-              listener: [{
-                port_mapping: {
-                  port: 8080,
-                  protocol: "HTTP"
-                }
-              }],
-              
-              logging: attrs.observability.access_logging_enabled ? {
-                access_log: {
-                  file: {
-                    path: "/dev/stdout"
-                  }
-                }
-              } : nil
-            }.compact,
-            
-            tags: tags.merge(Type: "Egress")
-          }
-        )
-        gateway_resources[:egress] = egress_gateway_ref
-      end
-      
-      # Create NLB for gateway if custom domain enabled
-      if attrs.gateway.custom_domain_enabled
-        nlb_ref = aws_lb(
-          component_resource_name(name, :gateway_nlb),
-          {
-            name: "#{name}-gateway-nlb",
-            internal: false,
-            load_balancer_type: "network",
-            subnets: [], # Would reference public subnets
-            
-            enable_cross_zone_load_balancing: true,
-            enable_deletion_protection: true,
-            
-            tags: tags
-          }
-        )
-        gateway_resources[:nlb] = nlb_ref
-        
-        # Create target group
-        target_group_ref = aws_lb_target_group(
-          component_resource_name(name, :gateway_target_group),
-          {
-            name: "#{name}-gateway-tg",
-            port: attrs.gateway.gateway_port,
-            protocol: attrs.gateway.gateway_protocol == 'HTTPS' ? 'TLS' : 'TCP',
-            vpc_id: "vpc-placeholder",
-            target_type: "ip",
-            
-            health_check: {
-              enabled: true,
-              healthy_threshold: 2,
-              interval: 30,
-              port: attrs.gateway.gateway_port,
-              protocol: "TCP",
-              unhealthy_threshold: 2
-            },
-            
-            tags: tags
-          }
-        )
-        gateway_resources[:target_group] = target_group_ref
-        
-        # Create listener
-        listener_ref = aws_lb_listener(
-          component_resource_name(name, :gateway_listener),
-          {
-            load_balancer_arn: nlb_ref.arn,
-            port: attrs.gateway.gateway_port,
-            protocol: attrs.gateway.gateway_protocol == 'HTTPS' ? 'TLS' : 'TCP',
-            
-            certificate_arn: attrs.gateway.gateway_protocol == 'HTTPS' ? 
-              "arn:aws:acm:REGION:ACCOUNT:certificate/nlb-cert" : nil,
-            
-            default_action: [{
-              type: "forward",
-              target_group_arn: target_group_ref.arn
-            }]
-          }.compact
-        )
-        gateway_resources[:listener] = listener_ref
-      end
-      
-      gateway_resources
-    end
-    
-    def create_observability_infrastructure(name, attrs, resources, tags)
-      observability_resources = {}
-      
-      # Create X-Ray service map if enabled
-      if attrs.observability.xray_enabled
-        # Create X-Ray sampling rule
-        sampling_rule_ref = aws_xray_sampling_rule(
-          component_resource_name(name, :xray_sampling_rule),
-          {
-            rule_name: "#{name}-service-mesh-sampling",
-            priority: 9000,
-            version: 1,
-            reservoir_size: 1,
-            fixed_rate: attrs.observability.distributed_tracing_sampling_rate,
-            url_path: "*",
-            host: "*",
-            http_method: "*",
-            service_type: "*",
-            service_name: "*",
-            resource_arn: "*",
-            tags: tags
-          }
-        )
-        observability_resources[:sampling_rule] = sampling_rule_ref
-        
-        # Create X-Ray group
-        xray_group_ref = aws_xray_group(
-          component_resource_name(name, :xray_group),
-          {
-            group_name: attrs.mesh_name,
-            filter_expression: "service(\"*#{attrs.mesh_name}*\")",
-            tags: tags
-          }
-        )
-        observability_resources[:xray_group] = xray_group_ref
-      end
-      
-      # Create CloudWatch Log Groups
-      if attrs.observability.access_logging_enabled
-        log_groups = {}
-        
-        attrs.services.each do |service|
-          log_group_ref = aws_cloudwatch_log_group(
-            component_resource_name(name, :log_group, service.name.to_sym),
-            {
-              name: "/aws/appmesh/#{attrs.mesh_name}/#{service.name}",
-              retention_in_days: attrs.observability.log_retention_days,
-              tags: tags.merge(Service: service.name)
-            }
-          )
-          log_groups[service.name.to_sym] = log_group_ref
-        end
-        
-        observability_resources[:log_groups] = log_groups
-      end
-      
-      # Create CloudWatch Dashboard
-      dashboard_widgets = []
-      
-      # Service mesh overview widget
-      dashboard_widgets << {
-        type: "metric",
-        x: 0,
-        y: 0,
-        width: 24,
-        height: 6,
-        properties: {
-          title: "Service Mesh Overview",
-          metrics: attrs.services.map do |service|
-            ["AWS/AppMesh", "TargetResponseTime", { 
-              MeshName: attrs.mesh_name,
-              VirtualNodeName: service.name 
-            }]
-          end,
-          period: 300,
-          stat: "Average",
-          region: attrs.regions.first,
-          yAxis: { left: { label: "Response Time (ms)" } }
-        }
-      }
-      
-      # Request rate by service
-      dashboard_widgets << {
-        type: "metric",
-        x: 0,
-        y: 6,
-        width: 12,
-        height: 6,
-        properties: {
-          title: "Request Rate by Service",
-          metrics: attrs.services.map do |service|
-            ["AWS/AppMesh", "RequestCount", {
-              MeshName: attrs.mesh_name,
-              VirtualNodeName: service.name
-            }]
-          end,
-          period: 300,
-          stat: "Sum",
-          region: attrs.regions.first
-        }
-      }
-      
-      # Error rate by service
-      dashboard_widgets << {
-        type: "metric",
-        x: 12,
-        y: 6,
-        width: 12,
-        height: 6,
-        properties: {
-          title: "Error Rate by Service",
-          metrics: attrs.services.map do |service|
-            ["AWS/AppMesh", "TargetConnectionErrorCount", {
-              MeshName: attrs.mesh_name,
-              VirtualNodeName: service.name
-            }]
-          end,
-          period: 300,
-          stat: "Sum",
-          region: attrs.regions.first
-        }
-      }
-      
-      # Circuit breaker status
-      if attrs.traffic_management.circuit_breaker_enabled
-        dashboard_widgets << {
-          type: "metric",
-          x: 0,
-          y: 12,
-          width: 24,
-          height: 6,
-          properties: {
-            title: "Circuit Breaker Status",
-            metrics: attrs.services.map do |service|
-              ["AWS/AppMesh", "CircuitBreakerOpen", {
-                MeshName: attrs.mesh_name,
-                VirtualNodeName: service.name
-              }]
-            end,
-            period: 60,
-            stat: "Maximum",
-            region: attrs.regions.first,
-            yAxis: { left: { min: 0, max: 1 } }
-          }
-        }
-      end
-      
-      dashboard_ref = aws_cloudwatch_dashboard(
-        component_resource_name(name, :dashboard),
-        {
-          dashboard_name: "#{name}-service-mesh",
-          dashboard_body: JSON.generate({
-            widgets: dashboard_widgets,
-            periodOverride: "auto",
-            start: "-PT6H"
-          })
-        }
-      )
-      observability_resources[:dashboard] = dashboard_ref
-      
-      # Create alarms
-      alarms = {}
-      attrs.services.each do |service|
-        # High latency alarm
-        latency_alarm_ref = aws_cloudwatch_metric_alarm(
-          component_resource_name(name, :alarm_latency, service.name.to_sym),
-          {
-            alarm_name: "#{name}-#{service.name}-high-latency",
-            comparison_operator: "GreaterThanThreshold",
-            evaluation_periods: "2",
-            metric_name: "TargetResponseTime",
-            namespace: "AWS/AppMesh",
-            period: "300",
-            statistic: "Average",
-            threshold: (service.timeout_seconds * 1000 * 0.8).to_s,
-            alarm_description: "Service #{service.name} latency is high",
-            dimensions: {
-              MeshName: attrs.mesh_name,
-              VirtualNodeName: service.name
-            },
-            tags: tags
-          }
-        )
-        alarms["latency_#{service.name}".to_sym] = latency_alarm_ref
-        
-        # Connection error alarm
-        error_alarm_ref = aws_cloudwatch_metric_alarm(
-          component_resource_name(name, :alarm_errors, service.name.to_sym),
-          {
-            alarm_name: "#{name}-#{service.name}-connection-errors",
-            comparison_operator: "GreaterThanThreshold",
-            evaluation_periods: "2",
-            metric_name: "TargetConnectionErrorCount",
-            namespace: "AWS/AppMesh",
-            period: "300",
-            statistic: "Sum",
-            threshold: "10",
-            alarm_description: "Service #{service.name} connection errors",
-            dimensions: {
-              MeshName: attrs.mesh_name,
-              VirtualNodeName: service.name
-            },
-            tags: tags
-          }
-        )
-        alarms["errors_#{service.name}".to_sym] = error_alarm_ref
-      end
-      observability_resources[:alarms] = alarms
-      
-      observability_resources
-    end
-    
-    def create_security_infrastructure(name, attrs, mesh_ref, tags)
-      security_resources = {}
-      
-      # Create ACM Private CA if not provided
-      if attrs.security.mtls_enabled && !attrs.security.certificate_authority_arn
-        ca_ref = aws_acmpca_certificate_authority(
-          component_resource_name(name, :private_ca),
-          {
-            certificate_authority_configuration: {
-              key_algorithm: "RSA_4096",
-              signing_algorithm: "SHA512WITHRSA",
-              subject: {
-                common_name: "#{attrs.mesh_name}.ca"
-              }
-            },
-            type: "ROOT",
-            tags: tags
-          }
-        )
-        security_resources[:ca] = ca_ref
-      end
-      
-      # Create IAM roles for service authentication
-      if attrs.security.service_auth_enabled
-        service_roles = {}
-        
-        attrs.services.each do |service|
-          role_ref = aws_iam_role(
-            component_resource_name(name, :service_role, service.name.to_sym),
-            {
-              name: "#{name}-${service.name}-role",
-              assume_role_policy: JSON.generate({
-                Version: "2012-10-17",
-                Statement: [{
-                  Effect: "Allow",
-                  Principal: {
-                    Service: "ecs-tasks.amazonaws.com"
-                  },
-                  Action: "sts:AssumeRole",
-                  Condition: {
-                    StringEquals: {
-                      "sts:ExternalId": service.name
-                    }
-                  }
-                }]
-              }),
-              tags: tags.merge(Service: service.name)
-            }
-          )
-          service_roles[service.name.to_sym] = role_ref
-          
-          # Attach App Mesh policy
-          policy_attachment_ref = aws_iam_role_policy_attachment(
-            component_resource_name(name, :service_policy, service.name.to_sym),
-            {
-              role: role_ref.name,
-              policy_arn: "arn:aws:iam::aws:policy/AWSAppMeshEnvoyAccess"
-            }
-          )
-          security_resources["policy_#{service.name}".to_sym] = policy_attachment_ref
-        end
-        
-        security_resources[:service_roles] = service_roles
-      end
-      
-      # Create Secrets Manager secrets for sensitive data
-      if attrs.security.secrets_manager_integration
-        secrets = {}
-        
-        attrs.services.each do |service|
-          secret_ref = aws_secretsmanager_secret(
-            component_resource_name(name, :service_secret, service.name.to_sym),
-            {
-              name: "#{name}/#{service.name}/config",
-              description: "Configuration secrets for #{service.name}",
-              tags: tags.merge(Service: service.name)
-            }
-          )
-          secrets[service.name.to_sym] = secret_ref
-        end
-        
-        security_resources[:secrets] = secrets
-      end
-      
-      security_resources
-    end
-    
-    def create_resilience_infrastructure(name, attrs, resources, tags)
-      resilience_resources = {}
-      
-      # Create FIS experiment templates for chaos testing
-      if attrs.resilience.chaos_testing_enabled
-        # Create IAM role for FIS
-        fis_role_ref = aws_iam_role(
-          component_resource_name(name, :fis_role),
-          {
-            name: "#{name}-fis-role",
-            assume_role_policy: JSON.generate({
-              Version: "2012-10-17",
-              Statement: [{
-                Effect: "Allow",
-                Principal: { Service: "fis.amazonaws.com" },
-                Action: "sts:AssumeRole"
-              }]
-            }),
-            tags: tags
-          }
-        )
-        resilience_resources[:fis_role] = fis_role_ref
-        
-        # Create experiment template
-        experiment_ref = aws_fis_experiment_template(
-          component_resource_name(name, :chaos_experiment),
-          {
-            description: "Service mesh chaos testing",
-            role_arn: fis_role_ref.arn,
-            
-            stop_condition: [{
-              source: "aws:cloudwatch:alarm",
-              value: "arn:aws:cloudwatch:*:*:alarm:#{name}-*"
-            }],
-            
-            action: {
-              inject_latency: {
-                action_id: "aws:network:disrupt-connectivity",
-                description: "Inject network latency",
-                parameters: {
-                  duration: "PT5M",
-                  scope: "SOME",
-                  percentage: "50"
-                },
-                target: {
-                  key: "Targets",
-                  value: "service-instances"
-                }
-              }
-            },
-            
-            target: {
-              "service-instances": {
-                resource_type: "aws:ecs:task",
-                selection_mode: "PERCENT(25)",
-                resource_tag: {
-                  ServiceMesh: attrs.mesh_name
-                }
-              }
-            },
-            
-            tags: tags
-          }
-        )
-        resilience_resources[:experiment] = experiment_ref
-      end
-      
-      resilience_resources
-    end
-    
-    def extract_connectivity_type(attrs)
-      types = []
-      
-      types << "Transit Gateway" if attrs.cross_region.transit_gateway_enabled
-      types << "VPC Peering" if attrs.cross_region.peering_enabled
-      types << "PrivateLink" if attrs.cross_region.private_link_enabled
-      types << "Inter-region TLS" if attrs.cross_region.inter_region_tls_enabled
-      
-      types.join(", ")
-    end
-    
-    def extract_gateway_endpoints(gateway_resources)
-      return {} unless gateway_resources
-      
-      endpoints = {}
-      
-      if gateway_resources[:nlb]
-        endpoints[:load_balancer] = gateway_resources[:nlb].dns_name
-      end
-      
-      if gateway_resources[:ingress]
-        endpoints[:ingress_gateway] = "ingress-gateway.mesh"
-      end
-      
-      if gateway_resources[:egress]
-        endpoints[:egress_gateway] = "egress-gateway.mesh"
-      end
-      
-      endpoints
-    end
-    
-    def estimate_service_mesh_cost(attrs, resources)
-      cost = 0.0
-      
-      # App Mesh costs
-      # Virtual nodes
-      cost += attrs.services.length * 0.50  # $0.50 per virtual node per month
-      
-      # Virtual services
-      cost += attrs.services.length * 0.25  # $0.25 per virtual service per month
-      
-      # Data processing (estimate 1TB/month across all services)
-      cost += 0.005 * 1000  # $0.005 per GB
-      
-      # Cloud Map costs
-      cost += 1.00  # Namespace
-      cost += attrs.services.length * 0.50  # Service discovery registrations
-      
-      # Transit Gateway costs for multi-region
-      if attrs.cross_region.transit_gateway_enabled && attrs.regions.length > 1
-        cost += attrs.regions.length * 36  # $0.05 per hour per TGW
-        cost += attrs.regions.length * (attrs.regions.length - 1) * 20  # Attachments
-      end
-      
-      # VPC endpoints
-      cost += attrs.regions.length * 2 * 7.20  # App Mesh and Cloud Map endpoints
-      
-      # Observability costs
-      if attrs.observability.xray_enabled
-        # X-Ray traces (estimate 1M traces/month)
-        cost += 5.00  # First million traces
-      end
-      
-      if attrs.observability.cloudwatch_metrics_enabled
-        # Custom metrics
-        cost += attrs.services.length * 5 * 0.30  # 5 metrics per service
-      end
-      
-      if attrs.observability.access_logging_enabled
-        # Log ingestion and storage
-        cost += attrs.services.length * 10 * 0.50  # 10GB per service
-      end
-      
-      # Gateway costs (if using NLB)
-      if resources[:gateways] && resources[:gateways][:nlb]
-        cost += 22.50  # NLB cost
-      end
-      
-      # Certificate costs for mTLS
-      if attrs.security.mtls_enabled
-        cost += 400.00  # ACM Private CA
-        cost += attrs.services.length * 0.75  # Certificates
-      end
-      
-      cost.round(2)
-    end
-  end
-end