pangea 0.0.45 → 0.0.47

data/lib/pangea/components/global_traffic_manager/modules/accelerator.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Components
+    module GlobalTrafficManager
+      # Global Accelerator resources
+      module Accelerator
+        def create_global_accelerator_resources(name, attrs, resources, tags)
+          return unless attrs.enable_global_accelerator
+
+          resources[:global_accelerator] = create_global_accelerator(name, attrs, tags)
+        end
+
+        private
+
+        def create_global_accelerator(name, attrs, tags)
+          ga_resources = {}
+
+          accelerator_ref = create_accelerator(name, attrs, tags)
+          ga_resources[:accelerator] = accelerator_ref
+
+          create_listeners_and_endpoint_groups(name, attrs, accelerator_ref, ga_resources)
+
+          ga_resources
+        end
+
+        def create_accelerator(name, attrs, tags)
+          aws_globalaccelerator_accelerator(
+            component_resource_name(name, :accelerator),
+            {
+              name: "#{name}-global-accelerator",
+              ip_address_type: 'IPV4',
+              enabled: true,
+              attributes: attrs.global_accelerator_attributes.merge({
+                flow_logs_enabled: attrs.performance.flow_logs_enabled,
+                flow_logs_s3_bucket: attrs.performance.flow_logs_s3_bucket,
+                flow_logs_s3_prefix: "#{attrs.performance.flow_logs_s3_prefix}global-accelerator/"
+              }).compact,
+              tags: tags
+            }
+          )
+        end
+
+        def create_listeners_and_endpoint_groups(name, attrs, accelerator_ref, ga_resources)
+          listener_configs = extract_listener_configs(attrs.endpoints)
+
+          listener_configs.each do |config|
+            listener_ref = create_listener(name, attrs, accelerator_ref, config)
+            ga_resources["listener_#{config[:protocol].downcase}".to_sym] = listener_ref
+
+            create_endpoint_groups_for_listener(name, attrs, listener_ref, config, ga_resources)
+          end
+        end
+
+        def create_listener(name, attrs, accelerator_ref, config)
+          aws_globalaccelerator_listener(
+            component_resource_name(name, :ga_listener, config[:protocol].downcase.to_sym),
+            {
+              accelerator_arn: accelerator_ref.arn,
+              client_affinity: attrs.advanced_routing.weighted_distribution.any? ? 'SOURCE_IP' : 'NONE',
+              protocol: config[:protocol],
+              port_ranges: config[:port_ranges]
+            }
+          )
+        end
+
+        def create_endpoint_groups_for_listener(name, attrs, listener_ref, config, ga_resources)
+          attrs.endpoints.group_by(&:region).each do |region, region_endpoints|
+            endpoint_group_ref = create_endpoint_group(name, attrs, listener_ref, config, region, region_endpoints)
+            ga_resources["endpoint_group_#{config[:protocol].downcase}_#{region}".to_sym] = endpoint_group_ref
+          end
+        end
+
+        def create_endpoint_group(name, attrs, listener_ref, config, region, region_endpoints)
+          aws_globalaccelerator_endpoint_group(
+            component_resource_name(name, :ga_endpoint_group, "#{config[:protocol].downcase}_#{region}".to_sym),
+            {
+              listener_arn: listener_ref.arn,
+              endpoint_group_region: region,
+              traffic_dial_percentage: attrs.advanced_routing.traffic_dials[region] || 100.0,
+              health_check_interval_seconds: 30,
+              health_check_path: attrs.traffic_policies.first&.health_check_path || '/health',
+              health_check_port: config[:port_ranges].first[:from_port],
+              health_check_protocol: config[:protocol],
+              threshold_count: 3,
+              endpoint_configuration: region_endpoints.map do |endpoint|
+                {
+                  endpoint_id: endpoint.endpoint_id,
+                  weight: endpoint.weight,
+                  client_ip_preservation_enabled: endpoint.client_ip_preservation
+                }
+              end
+            }
+          )
+        end
+      end
+    end
+  end
+end

data/lib/pangea/components/global_traffic_manager/modules/advanced_routing.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Components
+    module GlobalTrafficManager
+      # Advanced routing: canary and blue-green deployments
+      module AdvancedRouting
+        def create_advanced_routing_resources(name, attrs, resources, tags)
+          has_canary = attrs.advanced_routing.canary_deployment.any?
+          has_blue_green = attrs.advanced_routing.blue_green_deployment.any?
+          return unless has_canary || has_blue_green
+
+          routing_resources = {}
+          create_canary_routing(name, attrs, tags, routing_resources) if has_canary
+          create_blue_green_routing(name, attrs, resources, routing_resources) if has_blue_green
+          resources[:advanced_routing] = routing_resources
+        end
+
+        private
+
+        def create_canary_routing(name, attrs, tags, routing_resources)
+          canary_config = attrs.advanced_routing.canary_deployment
+
+          canary_lambda_ref = aws_lambda_function(
+            component_resource_name(name, :canary_router),
+            {
+              function_name: "#{name}-canary-router",
+              role: 'arn:aws:iam::ACCOUNT:role/LambdaEdgeRole',
+              handler: 'index.handler',
+              runtime: 'nodejs18.x',
+              timeout: 5,
+              memory_size: 128,
+              environment: {
+                variables: {
+                  CANARY_PERCENTAGE: canary_config[:percentage].to_s,
+                  CANARY_ENDPOINT: canary_config[:endpoint],
+                  STABLE_ENDPOINT: canary_config[:stable_endpoint]
+                }
+              },
+              code: { zip_file: generate_canary_router_code(canary_config) },
+              tags: tags
+            }
+          )
+          routing_resources[:canary_lambda] = canary_lambda_ref
+        end
+
+        def create_blue_green_routing(name, attrs, resources, routing_resources)
+          bg_config = attrs.advanced_routing.blue_green_deployment
+
+          %w[blue green].each do |color|
+            endpoint = attrs.endpoints.find { |e| e.metadata[:deployment] == color }
+            next unless endpoint
+
+            bg_record_ref = aws_route53_record(
+              component_resource_name(name, :bg_record, color.to_sym),
+              {
+                zone_id: resources[:hosted_zone].zone_id,
+                name: "#{color}.#{attrs.domain_name}",
+                type: 'A',
+                ttl: '60',
+                records: [endpoint.endpoint_id],
+                weighted_routing_policy: { weight: bg_config["#{color}_weight".to_sym] || 0 },
+                set_identifier: "bg-#{color}"
+              }
+            )
+            routing_resources["bg_#{color}".to_sym] = bg_record_ref
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/components/global_traffic_manager/modules/cloudfront.rb

@@ -0,0 +1,188 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Components
+    module GlobalTrafficManager
+      # CloudFront distribution resources
+      module Cloudfront
+        def create_cloudfront_resources(name, attrs, resources, tags)
+          return unless attrs.cloudfront.enabled
+
+          resources[:cloudfront] = create_cloudfront_distribution(name, attrs, tags)
+        end
+
+        private
+
+        def create_cloudfront_distribution(name, attrs, tags)
+          cf_resources = {}
+
+          oai_ref = aws_cloudfront_origin_access_identity(
+            component_resource_name(name, :cf_oai),
+            { comment: "OAI for #{attrs.manager_name}" }
+          )
+          cf_resources[:oai] = oai_ref
+
+          distribution_ref = aws_cloudfront_distribution(
+            component_resource_name(name, :cf_distribution),
+            build_distribution_config(name, attrs, tags)
+          )
+          cf_resources[:distribution] = distribution_ref
+
+          cf_resources
+        end
+
+        def build_distribution_config(name, attrs, tags)
+          {
+            comment: attrs.manager_description,
+            enabled: true,
+            is_ipv6_enabled: true,
+            price_class: attrs.cloudfront.price_class,
+            aliases: [attrs.domain_name],
+            viewer_certificate: build_viewer_certificate(attrs),
+            origin: build_origins(attrs),
+            default_cache_behavior: build_default_cache_behavior(name, attrs, tags),
+            ordered_cache_behavior: build_ordered_cache_behaviors(attrs),
+            restrictions: build_restrictions(attrs),
+            web_acl_id: attrs.security.waf_acl_ref&.arn,
+            logging_config: build_logging_config(attrs),
+            custom_error_response: build_custom_error_responses(attrs),
+            tags: tags
+          }.compact
+        end
+
+        def build_viewer_certificate(attrs)
+          if attrs.certificate_arn
+            {
+              acm_certificate_arn: attrs.certificate_arn,
+              ssl_support_method: 'sni-only',
+              minimum_protocol_version: 'TLSv1.2_2021'
+            }
+          else
+            { cloudfront_default_certificate: true }
+          end
+        end
+
+        def build_origins(attrs)
+          attrs.endpoints.map do |endpoint|
+            {
+              domain_name: endpoint.endpoint_id,
+              origin_id: "origin-#{endpoint.region}",
+              custom_origin_config: build_custom_origin_config(attrs, endpoint),
+              origin_shield: build_origin_shield(attrs, endpoint),
+              custom_header: build_custom_headers(attrs)
+            }.compact
+          end
+        end
+
+        def build_custom_origin_config(attrs, _endpoint)
+          {
+            http_port: 80,
+            https_port: 443,
+            origin_protocol_policy: 'https-only',
+            origin_ssl_protocols: ['TLSv1.2'],
+            origin_keepalive_timeout: attrs.performance.idle_timeout,
+            origin_read_timeout: 30
+          }
+        end
+
+        def build_origin_shield(attrs, endpoint)
+          return nil unless attrs.cloudfront.origin_shield_enabled
+
+          {
+            enabled: true,
+            origin_shield_region: attrs.cloudfront.origin_shield_region || endpoint.region
+          }
+        end
+
+        def build_custom_headers(attrs)
+          attrs.advanced_routing.custom_headers.map do |header|
+            { name: header[:name], value: header[:value] }
+          end
+        end
+
+        def build_default_cache_behavior(name, attrs, tags)
+          {
+            target_origin_id: "origin-#{attrs.endpoints.first.region}",
+            viewer_protocol_policy: attrs.cloudfront.viewer_protocol_policy,
+            allowed_methods: %w[GET HEAD OPTIONS PUT POST PATCH DELETE],
+            cached_methods: %w[GET HEAD OPTIONS],
+            forwarded_values: {
+              query_string: true,
+              headers: ['*'],
+              cookies: { forward: 'all' }
+            },
+            compress: attrs.cloudfront.compress,
+            min_ttl: 0,
+            default_ttl: 86_400,
+            max_ttl: 31_536_000,
+            lambda_function_association: create_edge_functions(name, attrs, tags)
+          }
+        end
+
+        def build_ordered_cache_behaviors(attrs)
+          attrs.cloudfront.cache_behaviors.map do |behavior|
+            {
+              path_pattern: behavior[:path_pattern],
+              target_origin_id: behavior[:origin_id] || "origin-#{attrs.endpoints.first.region}",
+              viewer_protocol_policy: behavior[:viewer_protocol_policy] || attrs.cloudfront.viewer_protocol_policy,
+              allowed_methods: behavior[:allowed_methods] || %w[GET HEAD],
+              cached_methods: behavior[:cached_methods] || %w[GET HEAD],
+              forwarded_values: {
+                query_string: behavior[:forward_query_string] || false,
+                headers: behavior[:forward_headers] || [],
+                cookies: { forward: behavior[:forward_cookies] || 'none' }
+              },
+              min_ttl: behavior[:min_ttl] || 0,
+              default_ttl: behavior[:default_ttl] || 300,
+              max_ttl: behavior[:max_ttl] || 86_400,
+              compress: behavior[:compress] || attrs.cloudfront.compress
+            }
+          end
+        end
+
+        def build_restrictions(attrs)
+          {
+            geo_restriction: {
+              restriction_type: attrs.security.blocked_countries.any? ? 'blacklist' : 'none',
+              locations: attrs.security.blocked_countries
+            }
+          }
+        end
+
+        def build_logging_config(attrs)
+          return nil unless attrs.observability.access_logs_enabled
+
+          {
+            bucket: "#{attrs.performance.flow_logs_s3_bucket}.s3.amazonaws.com",
+            prefix: "#{attrs.performance.flow_logs_s3_prefix}cloudfront/",
+            include_cookies: true
+          }
+        end
+
+        def build_custom_error_responses(attrs)
+          attrs.cloudfront.custom_error_responses.map do |error_response|
+            {
+              error_code: error_response[:error_code],
+              response_code: error_response[:response_code],
+              response_page_path: error_response[:response_page_path],
+              error_caching_min_ttl: error_response[:caching_min_ttl] || 300
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/components/global_traffic_manager/modules/edge_functions.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Components
+    module GlobalTrafficManager
+      # Edge function resources for CloudFront Lambda@Edge
+      module EdgeFunctions
+        def create_edge_functions(_name, attrs, _tags)
+          edge_functions = []
+
+          edge_functions << security_headers_function if security_headers_enabled?(attrs)
+          edge_functions << request_router_function if request_routing_enabled?(attrs)
+
+          edge_functions
+        end
+
+        private
+
+        def security_headers_enabled?(attrs)
+          attrs.security.ddos_protection || attrs.security.waf_enabled
+        end
+
+        def request_routing_enabled?(attrs)
+          attrs.advanced_routing.request_routing_rules.any?
+        end
+
+        def security_headers_function
+          {
+            event_type: 'origin-response',
+            lambda_arn: 'arn:aws:lambda:us-east-1:ACCOUNT:function:security-headers:1'
+          }
+        end
+
+        def request_router_function
+          {
+            event_type: 'viewer-request',
+            lambda_arn: 'arn:aws:lambda:us-east-1:ACCOUNT:function:request-router:1'
+          }
+        end
+      end
+    end
+  end
+end

data/lib/pangea/components/global_traffic_manager/modules/health_checks.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Components
+    module GlobalTrafficManager
+      # Endpoint health check resources
+      module HealthChecks
+        def create_health_check_resources(name, attrs, resources, tags)
+          health_checks = {}
+
+          attrs.endpoints.each do |endpoint|
+            next unless endpoint.health_check_enabled
+
+            health_check_ref = create_endpoint_health_check(name, endpoint, attrs, tags)
+            health_checks[endpoint.region.to_sym] = health_check_ref
+          end
+
+          resources[:health_checks] = health_checks
+        end
+
+        private
+
+        def create_endpoint_health_check(name, endpoint, attrs, tags)
+          policy = find_health_check_policy(attrs)
+
+          aws_route53_health_check(
+            component_resource_name(name, :health_check, endpoint.region.to_sym),
+            build_health_check_config(endpoint, policy, tags)
+          )
+        end
+
+        def find_health_check_policy(attrs)
+          attrs.traffic_policies.find { |p| p.policy_name == attrs.default_policy } ||
+            attrs.traffic_policies.first ||
+            GlobalTrafficManagerAttributes::TrafficPolicyConfig.new({ policy_name: 'default' })
+        end
+
+        def build_health_check_config(endpoint, policy, tags)
+          {
+            fqdn: endpoint.endpoint_id,
+            port: 443,
+            type: determine_health_check_type(policy),
+            resource_path: determine_resource_path(policy),
+            failure_threshold: policy.unhealthy_threshold.to_s,
+            request_interval: policy.health_check_interval.to_s,
+            measure_latency: true,
+            tags: tags.merge(
+              Region: endpoint.region,
+              EndpointType: endpoint.endpoint_type
+            )
+          }.compact
+        end
+
+        def determine_health_check_type(policy)
+          policy.health_check_protocol == 'TCP' ? 'TCP' : policy.health_check_protocol
+        end
+
+        def determine_resource_path(policy)
+          policy.health_check_protocol != 'TCP' ? policy.health_check_path : nil
+        end
+      end
+    end
+  end
+end

data/lib/pangea/components/global_traffic_manager/modules/helpers.rb

@@ -0,0 +1,164 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Components
+    module GlobalTrafficManager
+      # Shared helper methods for GlobalTrafficManager components
+      module Helpers
+        def extract_listener_configs(endpoints)
+          configs = []
+
+          endpoints.group_by { |e| [e.endpoint_type, e.metadata[:port] || 443] }.each do |(_, port), _|
+            protocol = 'TCP'
+            configs << {
+              protocol: protocol,
+              port_ranges: [{
+                from_port: port,
+                to_port: port
+              }]
+            }
+          end
+
+          configs.uniq
+        end
+
+        def get_endpoint_zone_id(endpoint)
+          case endpoint.endpoint_type
+          when 'ALB'
+            alb_zone_ids = {
+              'us-east-1' => 'Z35SXDOTRQ7X7K',
+              'us-west-2' => 'Z1H1FL5HABSF5',
+              'eu-west-1' => 'Z32O12XQLNTSW2',
+              'ap-southeast-1' => 'Z1LMS91P8CMLE5'
+            }
+            alb_zone_ids[endpoint.region] || 'Z35SXDOTRQ7X7K'
+          when 'NLB'
+            'Z26RNL4JYFTOTI'
+          else
+            'Z35SXDOTRQ7X7K'
+          end
+        end
+
+        def parse_geolocation(location)
+          if location.length == 2
+            { country_code: location }
+          elsif location.start_with?('US-')
+            { country_code: 'US', subdivision_code: location.split('-')[1] }
+          else
+            { continent_code: location }
+          end
+        end
+
+        def generate_canary_router_code(_config)
+          <<~JS
+            exports.handler = async (event) => {
+              const request = event.Records[0].cf.request;
+              const canaryPercentage = parseInt(process.env.CANARY_PERCENTAGE);
+              const random = Math.random() * 100;
+
+              if (random < canaryPercentage) {
+                request.origin = {
+                  custom: {
+                    domainName: process.env.CANARY_ENDPOINT,
+                    port: 443,
+                    protocol: 'https'
+                  }
+                };
+                request.headers['x-deployment-version'] = [{ key: 'X-Deployment-Version', value: 'canary' }];
+              } else {
+                request.headers['x-deployment-version'] = [{ key: 'X-Deployment-Version', value: 'stable' }];
+              }
+
+              return request;
+            };
+          JS
+        end
+
+        def extract_global_accelerator_ips(ga_resources)
+          return [] unless ga_resources&.dig(:accelerator)
+
+          ['192.0.2.1', '192.0.2.2']
+        end
+
+        def extract_routing_strategies(attrs)
+          strategies = []
+
+          strategies << attrs.default_policy.capitalize
+          strategies << 'Geo-routing' if attrs.geo_routing.enabled
+          strategies << 'Canary Deployment' if attrs.advanced_routing.canary_deployment.any?
+          strategies << 'Blue-Green' if attrs.advanced_routing.blue_green_deployment.any?
+          strategies << 'Weighted Distribution' if attrs.advanced_routing.weighted_distribution.any?
+
+          strategies
+        end
+
+        def estimate_traffic_manager_cost(attrs, _resources)
+          cost = 0.0
+
+          cost += calculate_global_accelerator_cost(attrs)
+          cost += calculate_cloudfront_cost(attrs)
+          cost += calculate_route53_cost(attrs)
+          cost += calculate_security_cost(attrs)
+          cost += calculate_monitoring_cost(attrs)
+
+          cost.round(2)
+        end
+
+        private
+
+        def calculate_global_accelerator_cost(attrs)
+          return 0.0 unless attrs.enable_global_accelerator
+
+          hourly_cost = 0.025 * 24 * 30
+          data_cost = 0.015 * 1000
+          hourly_cost + data_cost
+        end
+
+        def calculate_cloudfront_cost(attrs)
+          return 0.0 unless attrs.cloudfront.enabled
+
+          data_cost = case attrs.cloudfront.price_class
+                      when 'PriceClass_All' then 0.085 * 5000
+                      when 'PriceClass_200' then 0.080 * 5000
+                      when 'PriceClass_100' then 0.075 * 5000
+                      else 0.0
+                      end
+          request_cost = 0.0075 * 10
+          data_cost + request_cost
+        end
+
+        def calculate_route53_cost(attrs)
+          hosted_zone_cost = 0.50
+          health_check_cost = attrs.endpoints.count { |e| e.health_check_enabled } * 0.50
+          policy_cost = attrs.enable_route53_policies ? attrs.traffic_policies.length * 50.0 : 0.0
+          hosted_zone_cost + health_check_cost + policy_cost
+        end
+
+        def calculate_security_cost(attrs)
+          waf_cost = attrs.security.waf_enabled ? (5.00 + 1.00 + 0.60 * 10) : 0.0
+          shield_cost = attrs.security.ddos_protection ? 3000.0 : 0.0
+          waf_cost + shield_cost
+        end
+
+        def calculate_monitoring_cost(attrs)
+          cw_cost = attrs.observability.cloudwatch_enabled ? 10.0 : 0.0
+          synthetic_cost = attrs.observability.synthetic_checks.any? ? attrs.observability.synthetic_checks.length * 8.64 : 0.0
+          cw_cost + synthetic_cost
+        end
+      end
+    end
+  end
+end