pangea 0.0.45 → 0.0.47

data/lib/pangea/resources/aws_ec2_transit_gateway_vpc_attachment/CLAUDE.md

@@ -1,326 +0,0 @@
-# AWS EC2 Transit Gateway VPC Attachment Implementation
-
-## Resource Overview
-
-The `aws_ec2_transit_gateway_vpc_attachment` resource creates and manages VPC attachments to AWS Transit Gateways. This implementation provides comprehensive validation, routing analysis, and high availability considerations for production deployments.
-
-## Implementation Details
-
-### Type Safety and Validation
-
-The resource uses `TransitGatewayVpcAttachmentAttributes` dry-struct for complete type safety:
-
-```ruby
-class TransitGatewayVpcAttachmentAttributes < Dry::Struct
-  # Required connectivity components
-  attribute :transit_gateway_id, Resources::Types::String
-  attribute :vpc_id, Resources::Types::String  
-  attribute :subnet_ids, Resources::Types::Array.of(Resources::Types::String).constrained(min_size: 1)
-  
-  # Optional feature toggles
-  attribute? :appliance_mode_support, Resources::Types::TransitGatewayVpcAttachmentApplianceModeSupport
-  attribute? :dns_support, Resources::Types::TransitGatewayVpcAttachmentDnsSupport
-  attribute? :ipv6_support, Resources::Types::TransitGatewayVpcAttachmentIpv6Support
-  
-  # Route table behavior control
-  attribute? :transit_gateway_default_route_table_association, Resources::Types::Bool.optional
-  attribute? :transit_gateway_default_route_table_propagation, Resources::Types::Bool.optional
-end
-```
-
-### AWS Resource ID Validation
-
-The implementation validates AWS resource ID formats:
-
-```ruby
-# VPC ID validation: vpc-xxxxxxxx
-unless vpc_id.match?(/\Avpc-[0-9a-f]{8,17}\z/)
-  raise Dry::Struct::Error, "Invalid VPC ID format: #{vpc_id}. Expected format: vpc-xxxxxxxx"
-end
-
-# Transit Gateway ID validation: tgw-xxxxxxxx  
-unless transit_gateway_id.match?(/\Atgw-[0-9a-f]{8,17}\z/)
-  raise Dry::Struct::Error, "Invalid Transit Gateway ID format: #{transit_gateway_id}. Expected format: tgw-xxxxxxxx"
-end
-
-# Subnet ID validation: subnet-xxxxxxxx
-subnet_ids.each do |subnet_id|
-  unless subnet_id.match?(/\Asubnet-[0-9a-f]{8,17}\z/)
-    raise Dry::Struct::Error, "Invalid subnet ID format: #{subnet_id}. Expected format: subnet-xxxxxxxx"
-  end
-end
-```
-
-### High Availability Analysis
-
-The resource provides sophisticated availability analysis:
-
-```ruby
-def is_highly_available?
-  # Multiple subnets provide high availability across AZs
-  subnet_ids.length > 1
-end
-
-def availability_zones_count
-  # Estimate AZ count based on subnet count (assuming best practices)
-  case subnet_ids.length
-  when 1 then 1  # Single AZ - no HA
-  when 2 then 2  # Dual AZ - basic HA  
-  when 3 then 3  # Triple AZ - full HA
-  else subnet_ids.length # More than 3 AZs possible in some regions
-  end
-end
-```
-
-### Routing Behavior Analysis
-
-The implementation provides detailed routing behavior analysis:
-
-```ruby
-def routing_behavior
-  behavior = {
-    default_route_table_association: transit_gateway_default_route_table_association,
-    default_route_table_propagation: transit_gateway_default_route_table_propagation,
-    dns_resolution: dns_support == 'enable',
-    appliance_mode: appliance_mode_support == 'enable'
-  }
-  
-  # Determine routing pattern based on configuration
-  if transit_gateway_default_route_table_association && transit_gateway_default_route_table_propagation
-    behavior[:pattern] = 'full_mesh'     # All-to-all connectivity
-  elsif transit_gateway_default_route_table_association && !transit_gateway_default_route_table_propagation
-    behavior[:pattern] = 'hub_and_spoke_receiver'  # Receives traffic, doesn't send routes
-  elsif !transit_gateway_default_route_table_association && transit_gateway_default_route_table_propagation
-    behavior[:pattern] = 'hub_and_spoke_sender'    # Sends routes, doesn't receive traffic
-  else
-    behavior[:pattern] = 'isolated'      # No default connectivity
-  end
-  
-  behavior
-end
-```
-
-### Security Analysis
-
-Comprehensive security considerations analysis:
-
-```ruby
-def security_considerations
-  considerations = []
-  
-  # High availability warnings
-  unless is_highly_available?
-    considerations << "Single subnet attachment - no high availability. Consider adding subnets in additional AZs"
-  end
-  
-  # Appliance mode implications
-  if appliance_mode_support == 'enable'
-    considerations << "Appliance mode support is enabled - traffic will be directed to a single network appliance"
-  end
-  
-  # DNS resolution impact
-  if dns_support == 'disable'
-    considerations << "DNS support is disabled - DNS resolution across the Transit Gateway will not work"
-  end
-  
-  # Route table management warnings
-  if transit_gateway_default_route_table_association == false
-    considerations << "Default route table association is disabled - ensure custom route table is associated"
-  end
-  
-  if transit_gateway_default_route_table_propagation == false
-    considerations << "Default route table propagation is disabled - routes will not be automatically propagated"
-  end
-  
-  considerations
-end
-```
-
-## Terraform Resource Synthesis
-
-The resource generates clean Terraform configuration with conditional attributes:
-
-```ruby
-resource(:aws_ec2_transit_gateway_vpc_attachment, name) do
-  # Always required
-  transit_gateway_id attachment_attrs.transit_gateway_id
-  vpc_id attachment_attrs.vpc_id
-  subnet_ids attachment_attrs.subnet_ids
-  
-  # Conditional optional attributes
-  if attachment_attrs.appliance_mode_support
-    appliance_mode_support attachment_attrs.appliance_mode_support
-  end
-  
-  if attachment_attrs.dns_support
-    dns_support attachment_attrs.dns_support
-  end
-  
-  # Boolean attributes with explicit nil checking
-  if !attachment_attrs.transit_gateway_default_route_table_association.nil?
-    transit_gateway_default_route_table_association attachment_attrs.transit_gateway_default_route_table_association
-  end
-  
-  # ... other optional attributes
-end
-```
-
-## Architecture Pattern Support
-
-### 1. Full Mesh Connectivity
-Default configuration with all attachments associated and propagating:
-```ruby
-transit_gateway_default_route_table_association: true,
-transit_gateway_default_route_table_propagation: true
-```
-
-### 2. Hub and Spoke Architecture
-- **Hub**: Receives traffic from spokes, doesn't propagate its routes
-- **Spoke**: Sends traffic to hub, propagates routes to hub
-
-```ruby
-# Hub configuration
-hub_attachment = aws_ec2_transit_gateway_vpc_attachment(:hub, {
-  transit_gateway_default_route_table_association: true,  # Receives traffic
-  transit_gateway_default_route_table_propagation: false  # Doesn't propagate
-})
-
-# Spoke configuration  
-spoke_attachment = aws_ec2_transit_gateway_vpc_attachment(:spoke, {
-  transit_gateway_default_route_table_association: true,  # Can reach hub
-  transit_gateway_default_route_table_propagation: true   # Advertises routes
-})
-```
-
-### 3. Network Segmentation
-Complete isolation with custom route table management:
-```ruby
-isolated_attachment = aws_ec2_transit_gateway_vpc_attachment(:isolated, {
-  transit_gateway_default_route_table_association: false,  # Custom route tables only
-  transit_gateway_default_route_table_propagation: false   # Manual route control
-})
-```
-
-### 4. Appliance Mode for Security Inspection
-Traffic flows through network security appliances:
-```ruby
-firewall_attachment = aws_ec2_transit_gateway_vpc_attachment(:firewall, {
-  appliance_mode_support: "enable",                       # Single appliance routing
-  transit_gateway_default_route_table_association: false, # Custom routing required
-  transit_gateway_default_route_table_propagation: false  # Manual control
-})
-```
-
-## Cost Analysis
-
-Detailed cost breakdown with operational insights:
-
-```ruby
-def estimated_monthly_cost
-  # VPC attachment base cost: $36.50 per month per attachment
-  base_cost = 36.50
-  
-  {
-    monthly_attachment_cost: base_cost,
-    currency: 'USD',
-    note: 'Fixed monthly cost per VPC attachment. Data processing charges apply separately.'
-  }
-end
-```
-
-Additional cost considerations:
-- Data processing: ~$0.02/GB for inter-AZ traffic through Transit Gateway
-- No additional cost for multiple subnets within same attachment
-- Cross-region data transfer charges apply for multi-region connectivity
-
-## Output References
-
-The resource provides standard AWS outputs plus computed insights:
-
-```ruby
-outputs: {
-  id: "${aws_ec2_transit_gateway_vpc_attachment.#{name}.id}",
-  vpc_owner_id: "${aws_ec2_transit_gateway_vpc_attachment.#{name}.vpc_owner_id}",
-  tags_all: "${aws_ec2_transit_gateway_vpc_attachment.#{name}.tags_all}"
-},
-computed_attributes: {
-  is_highly_available: attachment_attrs.is_highly_available?,
-  supports_appliance_mode_inspection: attachment_attrs.supports_appliance_mode_inspection?,
-  routing_behavior: attachment_attrs.routing_behavior,
-  security_considerations: attachment_attrs.security_considerations
-}
-```
-
-## Integration Patterns
-
-### VPC Resource Integration
-```ruby
-# Reference VPC and subnet resources
-vpc_attachment = aws_ec2_transit_gateway_vpc_attachment(:app_vpc, {
-  transit_gateway_id: tgw_ref.id,           # Reference from Transit Gateway resource
-  vpc_id: app_vpc_ref.id,                   # Reference from VPC resource
-  subnet_ids: [                             # References from subnet resources
-    private_subnet_1a_ref.id,
-    private_subnet_1b_ref.id,
-    private_subnet_1c_ref.id
-  ]
-})
-```
-
-### Route Table Integration
-The attachment can be referenced by route table associations:
-```ruby
-# Custom route table association (when default is disabled)
-route_table_association = aws_ec2_transit_gateway_route_table_association(:custom, {
-  transit_gateway_attachment_id: vpc_attachment.id,  # Reference attachment
-  transit_gateway_route_table_id: custom_rt_ref.id
-})
-```
-
-## Validation Strategy
-
-### Input Validation
-- AWS resource ID format validation using regex patterns
-- Subnet count minimum enforcement (at least 1 required)
-- Boolean attribute explicit handling (nil vs false distinction)
-
-### Configuration Validation
-- Appliance mode and routing configuration compatibility
-- IPv6 requirements validation
-- High availability best practice warnings
-
-### Runtime Validation
-- Cross-resource reference resolution
-- Subnet-to-VPC ownership validation (handled by AWS)
-- Transit Gateway capacity and limits (handled by AWS)
-
-## Error Handling
-
-Comprehensive error messages for common issues:
-
-```ruby
-# Resource ID format errors
-raise Dry::Struct::Error, "Invalid VPC ID format: #{vpc_id}. Expected format: vpc-xxxxxxxx"
-
-# Configuration dependency errors  
-raise Dry::Struct::Error, "Appliance mode requires custom route table configuration"
-
-# High availability warnings (not errors, but flagged in security_considerations)
-"Single subnet attachment - no high availability. Consider adding subnets in additional AZs"
-```
-
-## Testing Considerations
-
-### Unit Tests
-- AWS resource ID format validation
-- High availability detection logic
-- Routing behavior analysis
-- Security considerations generation
-
-### Integration Tests
-- Terraform resource generation validation
-- Cross-resource reference resolution
-- Multi-attachment routing behavior
-- Cost calculation accuracy
-
-This implementation provides a production-ready foundation for Transit Gateway VPC attachment management with comprehensive validation, security analysis, and operational insights for complex network architectures.

data/lib/pangea/resources/aws_ecr_lifecycle_policy/CLAUDE.md

@@ -1,56 +0,0 @@
-# ECR Lifecycle Policy Resource Implementation
-
-This resource implements AWS ECR Lifecycle Policy for automated container image cleanup with comprehensive rule validation and cost optimization analysis.
-
-## Key Features
-
-### Lifecycle Rule Management
-- **Rule Validation**: Complete validation of lifecycle policy rule structure and syntax
-- **Priority Management**: Automatic validation of rule priorities and execution order
-- **Selection Criteria**: Validation of image selection criteria (tags, age, count)
-- **Action Validation**: Ensures proper action specification for image expiration
-
-### Cost Optimization Patterns
-- **Age-Based Cleanup**: Automatic deletion of images based on push time
-- **Count-Based Retention**: Keep only specified number of most recent images
-- **Tag-Based Policies**: Different retention policies for different tag patterns
-- **Multi-Environment Support**: Separate policies for development, staging, and production
-
-### Policy Analysis
-- **Rule Categorization**: Automatic classification of rules by type (age, count, tag-based)
-- **Retention Estimation**: Calculate estimated maximum retention periods
-- **Coverage Analysis**: Identify whether policy covers tagged, untagged, or all images
-- **Priority Conflict Detection**: Validate rule priority assignments
-
-## Implementation Details
-
-### Rule Validation
-- Complete lifecycle policy JSON structure validation
-- Rule component validation (priority, selection, action)
-- Selection criteria validation (tagStatus, countType, countNumber)
-- Tag prefix validation for tagged image rules
-- Time unit validation for age-based rules
-
-### Policy Analysis
-- Automatic detection of rule types (count vs age-based)
-- Image tag status coverage analysis (tagged, untagged, any)
-- Estimated retention period calculation from age-based rules
-- Rule priority ordering and conflict detection
-
-### Computed Properties
-- Rule counting and categorization for policy complexity assessment
-- Retention period estimation for cost planning
-- Coverage flags for policy completeness validation
-- Terraform reference detection for dynamic policy handling
-
-## Container Image Lifecycle Architecture
-
-This resource enables sophisticated container image lifecycle management:
-
-1. **Cost Control**: Automated cleanup reduces storage costs through intelligent retention policies
-2. **Multi-Environment**: Different retention policies for different deployment environments
-3. **Development Workflow**: Branch-based cleanup aligns with development practices
-4. **Compliance**: Retention policies can support audit and compliance requirements
-5. **Performance**: Faster repository operations through reduced image count
-
-The resource supports both simple repository cleanup scenarios and complex multi-environment, multi-team container workflows with sophisticated retention requirements.

data/lib/pangea/resources/aws_ecr_replication_configuration/CLAUDE.md

@@ -1,55 +0,0 @@
-# ECR Replication Configuration Resource Implementation
-
-This resource implements AWS ECR Replication Configuration for automated container image replication across regions and accounts with comprehensive validation and architecture pattern support.
-
-## Key Features
-
-### Replication Management
-- **Multi-Region Support**: Automatic replication to multiple AWS regions for high availability
-- **Cross-Account Replication**: Secure image sharing across AWS accounts and organizational boundaries
-- **Rule-Based Configuration**: Multiple replication rules for different image distribution strategies
-- **Cost Analysis**: Automatic calculation of replication cost implications
-
-### Architecture Patterns
-- **High Availability**: Multi-region replication for disaster recovery and performance
-- **Multi-Environment**: Separate replication strategies for development, staging, and production
-- **Global Distribution**: Worldwide image distribution for global applications
-- **Compliance**: Replication to specific regions or accounts for regulatory requirements
-
-### Configuration Analysis
-- **Scope Detection**: Automatic categorization of replication scope (cross-region, cross-account, etc.)
-- **Destination Mapping**: Complete visibility into all replication destinations
-- **Cost Estimation**: Rough cost multiplier calculation based on destination count
-- **Validation**: Comprehensive validation of replication rules and destinations
-
-## Implementation Details
-
-### Rule Validation
-- Complete replication configuration structure validation
-- Rule-level validation ensuring proper destination specification
-- Region format validation for AWS region codes
-- Account ID validation for cross-account replication scenarios
-
-### Destination Analysis
-- Automatic detection of cross-region vs cross-account replication
-- Unique region and account identification across all rules
-- Replication scope categorization for architecture planning
-- Cost multiplier estimation for budget planning
-
-### Computed Properties
-- Rule and destination counting for configuration complexity assessment
-- Geographic and account distribution analysis
-- Replication pattern detection (same-account, cross-account, etc.)
-- Cost impact assessment based on destination multiplication
-
-## Container Registry Distribution Architecture
-
-This resource enables sophisticated container image distribution architectures:
-
-1. **Global Availability**: Images available in multiple regions for reduced latency
-2. **Disaster Recovery**: Automatic image backup across geographic boundaries
-3. **Multi-Account**: Secure image sharing across organizational boundaries
-4. **Performance Optimization**: Reduced container pull times through local replicas
-5. **Compliance**: Regional data residency and audit requirements support
-
-The resource supports both simple multi-region scenarios and complex multi-account, multi-rule architectures required for enterprise container distribution strategies.

data/lib/pangea/resources/aws_ecr_repository/CLAUDE.md

@@ -1,54 +0,0 @@
-# ECR Repository Resource Implementation
-
-This resource implements AWS ECR Repository for container image storage with comprehensive validation and container management patterns.
-
-## Key Features
-
-### Repository Configuration
-- **Name Validation**: Enforces AWS ECR naming rules (lowercase, length, character restrictions)
-- **Image Mutability**: Support for mutable and immutable tag policies
-- **Scanning Integration**: Built-in image vulnerability scanning configuration
-- **Encryption Options**: Support for AES256 and KMS encryption at rest
-
-### Container Management Patterns
-- **Multi-Environment**: Separate repositories for dev/staging/prod with appropriate policies
-- **Microservices**: Repository per service with consistent naming and tagging
-- **CI/CD Integration**: Repository URLs and credentials for automated pipelines
-- **Lifecycle Management**: Integration with ECR lifecycle policies for cost optimization
-
-### Security Features
-- **Image Scanning**: Automatic vulnerability scanning on image push
-- **Encryption at Rest**: KMS or AES256 encryption for stored images
-- **Access Control**: Foundation for repository-level access policies
-- **Immutable Tags**: Prevent tag overwrites for production stability
-
-## Implementation Details
-
-### Validation Logic
-- Repository name format validation (AWS ECR requirements)
-- Encryption configuration consistency checks
-- KMS key requirement validation for KMS encryption
-- Character set and length restrictions
-
-### Computed Properties
-- Repository URI templates for dynamic references
-- Boolean flags for configuration state queries
-- Encryption type detection for policy decisions
-- Force delete capability flags for environment-specific cleanup
-
-### Output Management
-- Complete set of ECR repository outputs (ARN, URL, registry ID)
-- Template-based URI generation for cross-resource references
-- Tag management including provider-applied tags
-
-## Container Registry Architecture
-
-This resource serves as the foundation for container-based application architectures:
-
-1. **Image Storage**: Secure, scalable container image registry
-2. **Multi-Region**: Can be replicated using ECR replication configuration
-3. **Access Control**: Integrates with repository policies for fine-grained access
-4. **Lifecycle Management**: Works with lifecycle policies for automated cleanup
-5. **CI/CD Pipeline**: Provides repository URLs for automated build and deploy processes
-
-The resource is designed to support both simple single-container applications and complex microservices architectures with multiple repositories and sophisticated access controls.

data/lib/pangea/resources/aws_ecr_repository_policy/CLAUDE.md

@@ -1,55 +0,0 @@
-# ECR Repository Policy Resource Implementation
-
-This resource implements AWS ECR Repository Policy for fine-grained access control to container repositories with comprehensive policy validation and access pattern analysis.
-
-## Key Features
-
-### Policy Management
-- **JSON Validation**: Comprehensive validation of IAM policy document structure
-- **Statement Analysis**: Automatic parsing of policy statements and permissions
-- **Access Pattern Detection**: Identification of common access patterns (pull, push, cross-account)
-- **Terraform Integration**: Support for data source references and dynamic policies
-
-### Access Control Patterns
-- **Cross-Account Access**: Secure sharing of container images between AWS accounts
-- **Service Integration**: Policies for ECS, Lambda, and other AWS services
-- **CI/CD Integration**: Policies for automated build and deployment pipelines
-- **Multi-Environment**: Different access levels for development, staging, and production
-
-### Security Analysis
-- **Permission Auditing**: Automatic categorization of allowed and denied actions
-- **Cross-Account Detection**: Identification of policies that grant external access
-- **Action Analysis**: Granular analysis of ECR permissions (pull vs push vs admin)
-- **Principal Validation**: Validation of principal formats and types
-
-## Implementation Details
-
-### Policy Validation
-- JSON syntax validation with detailed error messages
-- Policy structure validation (Version, Statement array)
-- Statement validation (Effect, Principal, Action requirements)
-- ECR-specific action validation and categorization
-
-### Access Pattern Analysis
-- Automatic detection of pull-only vs push-enabled policies
-- Cross-account access identification through principal analysis
-- Service principal detection for AWS service integration
-- Wildcard permission detection for security auditing
-
-### Computed Properties
-- Statement counting for policy complexity assessment
-- Action categorization for permission auditing
-- Access level determination (read-only, read-write, admin)
-- Terraform reference detection for dynamic policy handling
-
-## Container Registry Security Architecture
-
-This resource enables secure container registry architectures:
-
-1. **Access Control**: Fine-grained permissions for different principals and use cases
-2. **Multi-Account**: Secure sharing of container images across organizational boundaries
-3. **Service Integration**: Native integration with ECS, Lambda, and other container services
-4. **CI/CD Security**: Secure automation workflows with appropriate permission scoping
-5. **Audit Trail**: Complete visibility into repository access permissions and patterns
-
-The resource supports both simple single-account scenarios and complex multi-account, multi-service architectures with sophisticated access control requirements.