pangea 0.0.46 → 0.0.47

data/lib/pangea/resources/aws_eip_association/types.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+      # Type-safe attributes for AwsEipAssociation resources
+      # Provides an AWS EIP Association as a top level resource, to associate and disassociate Elastic IPs from AWS Instances and Network Interfaces.
+      class EipAssociationAttributes < Dry::Struct
+        attribute :allocation_id, Resources::Types::String.optional
+        attribute :allow_reassociation, Resources::Types::Bool.optional
+        attribute :instance_id, Resources::Types::String.optional
+        attribute :network_interface_id, Resources::Types::String.optional
+        attribute :private_ip_address, Resources::Types::String.optional
+        attribute :public_ip, Resources::Types::String.optional
+        
+        # Tags to apply to the resource
+        attribute :tags, Resources::Types::AwsTags.default({}.freeze)
+
+        # Custom validation
+        def self.new(attributes = {})
+          attrs = super(attributes)
+          
+          # Either allocation_id or public_ip must be specified
+          # Cannot specify both instance_id and network_interface_id
+          # private_ip_address requires network_interface_id
+          # Either allocation_id or public_ip must be specified
+if !attrs.allocation_id && !attrs.public_ip
+  raise Dry::Struct::Error, "Either 'allocation_id' or 'public_ip' must be specified"
+end
+
+# Cannot specify both instance_id and network_interface_id
+if attrs.instance_id && attrs.network_interface_id
+  raise Dry::Struct::Error, "Cannot specify both 'instance_id' and 'network_interface_id'"
+end
+
+# private_ip_address requires network_interface_id
+if attrs.private_ip_address && !attrs.network_interface_id
+  raise Dry::Struct::Error, "'private_ip_address' requires 'network_interface_id'"
+end
+
+          
+          attrs
+        end
+        
+        # Check if using VPC allocation
+def vpc_allocation?
+  !allocation_id.nil?
+end
+
+# Check if using EC2-Classic
+def ec2_classic?
+  !public_ip.nil? && allocation_id.nil?
+end
+
+# Determine association target
+def target_type
+  if instance_id
+    :instance
+  elsif network_interface_id
+    :network_interface
+  else
+    :none
+  end
+end
+
+      end
+    end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_eks_access_entry/resource.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_eks_access_entry/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS EKS Access Entry with type-safe attributes
+      #
+      # EKS Access Entries provide fine-grained access control for EKS clusters.
+      # They define which IAM principals can access the cluster and what Kubernetes
+      # groups they belong to, replacing the aws-auth ConfigMap for access management.
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] EKS access entry attributes
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      def aws_eks_access_entry(name, attributes = {})
+        # Validate attributes using dry-struct
+        entry_attrs = EksAccessEntry::Types::EksAccessEntryAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_eks_access_entry, name) do
+          # Required attributes
+          cluster_name entry_attrs.cluster_name
+          principal_arn entry_attrs.principal_arn
+          
+          # Optional attributes
+          kubernetes_groups entry_attrs.kubernetes_groups if entry_attrs.kubernetes_groups
+          type entry_attrs.type if entry_attrs.type
+          user_name entry_attrs.user_name if entry_attrs.user_name
+          
+          # Apply tags
+          if entry_attrs.tags.any?
+            tags do
+              entry_attrs.tags.each do |key, value|
+                public_send(key, value)
+              end
+            end
+          end
+        end
+        
+        # Return resource reference with available outputs
+        ResourceReference.new(
+          type: 'aws_eks_access_entry',
+          name: name,
+          resource_attributes: entry_attrs.to_h,
+          outputs: {
+            id: "${aws_eks_access_entry.#{name}.id}",
+            access_entry_arn: "${aws_eks_access_entry.#{name}.access_entry_arn}",
+            cluster_name: "${aws_eks_access_entry.#{name}.cluster_name}",
+            created_at: "${aws_eks_access_entry.#{name}.created_at}",
+            modified_at: "${aws_eks_access_entry.#{name}.modified_at}",
+            principal_arn: "${aws_eks_access_entry.#{name}.principal_arn}",
+            tags_all: "${aws_eks_access_entry.#{name}.tags_all}"
+          },
+          computed: {
+            principal_name: entry_attrs.principal_name,
+            principal_type: entry_attrs.principal_type,
+            account_id: entry_attrs.account_id,
+            has_kubernetes_groups: entry_attrs.has_kubernetes_groups?,
+            has_custom_username: entry_attrs.has_custom_username?,
+            standard_type: entry_attrs.standard_type?,
+            fargate_type: entry_attrs.fargate_type?,
+            ec2_linux_type: entry_attrs.ec2_linux_type?,
+            ec2_windows_type: entry_attrs.ec2_windows_type?,
+            kubernetes_groups_count: entry_attrs.kubernetes_groups_count
+          }
+        )
+      end
+    end
+  end
+end
+
+# Auto-register this module when it's loaded
+Pangea::ResourceRegistry.register(:aws, Pangea::Resources::AWS)

data/lib/pangea/resources/aws_eks_access_entry/types.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'dry-struct'
+
+module Pangea
+  module Resources
+    module AWS
+      module EksAccessEntry
+        # Common types for EKS Access Entry configurations
+        class Types < Dry::Types::Module
+          include Dry.Types()
+
+          # EKS Cluster Name constraint
+          ClusterName = String.constrained(
+            min_size: 1,
+            max_size: 100,
+            format: /\A[a-zA-Z0-9\-_]+\z/
+          )
+          
+          # IAM Principal ARN constraint
+          PrincipalArn = String.constrained(
+            format: /\Aarn:aws:iam::[0-9]{12}:(user|role)\/[a-zA-Z0-9+=,.@\-_\/]+\z/
+          )
+          
+          # Access entry type
+          AccessEntryType = String.enum('STANDARD', 'FARGATE_LINUX', 'EC2_LINUX', 'EC2_WINDOWS')
+          
+          # Kubernetes groups
+          KubernetesGroup = String.constrained(min_size: 1, max_size: 63)
+        end
+
+        # EKS Access Entry attributes with comprehensive validation
+        class EksAccessEntryAttributes < Dry::Struct
+          include Types[self]
+          
+          # Required attributes
+          attribute :cluster_name, ClusterName
+          attribute :principal_arn, PrincipalArn
+          
+          # Optional attributes
+          attribute? :kubernetes_groups, Array.of(KubernetesGroup).optional
+          attribute? :type, AccessEntryType.optional
+          attribute? :user_name, String.optional
+          attribute? :tags, Hash.map(String, String).default({}.freeze)
+          
+          # Computed properties
+          def principal_name
+            principal_arn.split('/')[-1]
+          end
+          
+          def principal_type
+            if principal_arn.include?('user/')
+              'user'
+            elsif principal_arn.include?('role/')
+              'role'
+            else
+              'unknown'
+            end
+          end
+          
+          def account_id
+            principal_arn.split(':')[4]
+          end
+          
+          def has_kubernetes_groups?
+            kubernetes_groups && kubernetes_groups.any?
+          end
+          
+          def has_custom_username?
+            !user_name.nil?
+          end
+          
+          def standard_type?
+            type == 'STANDARD' || type.nil?
+          end
+          
+          def fargate_type?
+            type == 'FARGATE_LINUX'
+          end
+          
+          def ec2_linux_type?
+            type == 'EC2_LINUX'
+          end
+          
+          def ec2_windows_type?
+            type == 'EC2_WINDOWS'
+          end
+          
+          def kubernetes_groups_count
+            kubernetes_groups&.length || 0
+          end
+        end
+      end
+    end
+  end
+end

data/lib/pangea/resources/aws_eks_addon/resource.rb

@@ -0,0 +1,153 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'pangea/resources/base'
+require 'pangea/resources/reference'
+require 'pangea/resources/aws_eks_addon/types'
+require 'pangea/resource_registry'
+
+module Pangea
+  module Resources
+    module AWS
+      # Create an AWS EKS Add-on with type-safe attributes
+      #
+      # @param name [Symbol] The resource name
+      # @param attributes [Hash] EKS add-on attributes
+      # @option attributes [String] :cluster_name EKS cluster name (required)
+      # @option attributes [String] :addon_name Add-on name (required)
+      # @option attributes [String] :addon_version Specific add-on version
+      # @option attributes [String] :service_account_role_arn IAM role for service account
+      # @option attributes [String] :resolve_conflicts Conflict resolution strategy
+      # @option attributes [String] :resolve_conflicts_on_create Create-time conflict resolution
+      # @option attributes [String] :resolve_conflicts_on_update Update-time conflict resolution
+      # @option attributes [String] :configuration_values JSON configuration values
+      # @option attributes [Boolean] :preserve Preserve add-on on deletion
+      # @option attributes [Hash] :tags Resource tags
+      # @return [ResourceReference] Reference object with outputs and computed properties
+      #
+      # @example Basic VPC CNI add-on
+      #   vpc_cni = aws_eks_addon(:vpc_cni, {
+      #     cluster_name: cluster.name,
+      #     addon_name: "vpc-cni",
+      #     addon_version: "v1.12.6-eksbuild.2"
+      #   })
+      #
+      # @example EBS CSI driver with IAM role
+      #   ebs_csi = aws_eks_addon(:ebs_csi, {
+      #     cluster_name: cluster.name,
+      #     addon_name: "aws-ebs-csi-driver",
+      #     addon_version: "v1.28.0-eksbuild.1",
+      #     service_account_role_arn: ebs_csi_role.arn,
+      #     resolve_conflicts_on_create: "OVERWRITE",
+      #     tags: {
+      #       Purpose: "persistent-storage"
+      #     }
+      #   })
+      #
+      # @example CoreDNS with custom configuration
+      #   coredns = aws_eks_addon(:coredns, {
+      #     cluster_name: cluster.name,
+      #     addon_name: "coredns",
+      #     configuration_values: JSON.generate({
+      #       computeType: "Fargate",
+      #       replicaCount: 3,
+      #       resources: {
+      #         limits: {
+      #           cpu: "100m",
+      #           memory: "150Mi"
+      #         }
+      #       }
+      #     })
+      #   })
+      #
+      # @example GuardDuty agent for security monitoring
+      #   guardduty = aws_eks_addon(:guardduty, {
+      #     cluster_name: cluster.name,
+      #     addon_name: "aws-guardduty-agent",
+      #     service_account_role_arn: guardduty_role.arn,
+      #     resolve_conflicts: "OVERWRITE",
+      #     preserve: false
+      #   })
+      def aws_eks_addon(name, attributes = {})
+        # Validate attributes using dry-struct
+        addon_attrs = AWS::Types::Types::EksAddonAttributes.new(attributes)
+        
+        # Generate terraform resource block via terraform-synthesizer
+        resource(:aws_eks_addon, name) do
+          # Required attributes
+          cluster_name addon_attrs.cluster_name
+          addon_name addon_attrs.addon_name
+          
+          # Optional version
+          addon_version addon_attrs.addon_version if addon_attrs.addon_version
+          
+          # Service account IAM role
+          service_account_role_arn addon_attrs.service_account_role_arn if addon_attrs.service_account_role_arn
+          
+          # Conflict resolution strategy
+          if addon_attrs.resolve_conflicts_on_create || addon_attrs.resolve_conflicts_on_update
+            resolve_conflicts_on_create addon_attrs.resolve_conflicts_on_create if addon_attrs.resolve_conflicts_on_create
+            resolve_conflicts_on_update addon_attrs.resolve_conflicts_on_update if addon_attrs.resolve_conflicts_on_update
+          elsif addon_attrs.resolve_conflicts != 'NONE'
+            resolve_conflicts addon_attrs.resolve_conflicts
+          end
+          
+          # Configuration values
+          configuration_values addon_attrs.configuration_values if addon_attrs.configuration_values
+          
+          # Preservation setting
+          preserve addon_attrs.preserve if addon_attrs.preserve != true
+          
+          # Tags
+          tags addon_attrs.tags if addon_attrs.tags.any?
+        end
+        
+        # Create resource reference
+        ref = ResourceReference.new(
+          type: 'aws_eks_addon',
+          name: name,
+          resource_attributes: addon_attrs.to_h,
+          outputs: {
+            id: "${aws_eks_addon.#{name}.id}",
+            arn: "${aws_eks_addon.#{name}.arn}",
+            addon_version: "${aws_eks_addon.#{name}.addon_version}",
+            created_at: "${aws_eks_addon.#{name}.created_at}",
+            modified_at: "${aws_eks_addon.#{name}.modified_at}",
+            status: "${aws_eks_addon.#{name}.status}",
+            configuration_values: "${aws_eks_addon.#{name}.configuration_values}",
+            tags_all: "${aws_eks_addon.#{name}.tags_all}"
+          }
+        )
+        
+        # Add computed properties via method delegation
+        ref.define_singleton_method(:addon_name) { addon_attrs.addon_name }
+        ref.define_singleton_method(:service_account) { addon_attrs.service_account_name }
+        ref.define_singleton_method(:namespace) { addon_attrs.namespace }
+        ref.define_singleton_method(:requires_iam_role?) { addon_attrs.requires_iam_role? }
+        ref.define_singleton_method(:is_compute_addon?) { addon_attrs.is_compute_addon? }
+        ref.define_singleton_method(:is_storage_addon?) { addon_attrs.is_storage_addon? }
+        ref.define_singleton_method(:is_networking_addon?) { addon_attrs.is_networking_addon? }
+        ref.define_singleton_method(:is_observability_addon?) { addon_attrs.is_observability_addon? }
+        ref.define_singleton_method(:addon_description) { addon_attrs.addon_info[:description] }
+        
+        ref
+      end
+    end
+  end
+end
+
+# Auto-register this module when it's loaded
+Pangea::ResourceRegistry.register(:aws, Pangea::Resources::AWS)

data/lib/pangea/resources/aws_eks_addon/types.rb

@@ -0,0 +1,199 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Resources
+    module AWS
+      module Types
+        # EKS addon attributes with validation
+        class EksAddonAttributes < Dry::Struct
+          transform_keys(&:to_sym)
+          
+          # Supported EKS add-ons and their configuration
+          SUPPORTED_ADDONS = {
+            'vpc-cni' => {
+              versions: ['v1.12.6-eksbuild.2', 'v1.12.5-eksbuild.2', 'v1.12.2-eksbuild.1', 'v1.11.4-eksbuild.1'],
+              service_account: 'aws-node',
+              namespace: 'kube-system',
+              description: 'Amazon VPC CNI plugin for Kubernetes'
+            },
+            'coredns' => {
+              versions: ['v1.10.1-eksbuild.7', 'v1.10.1-eksbuild.6', 'v1.10.1-eksbuild.4', 'v1.9.3-eksbuild.11'],
+              service_account: 'coredns',
+              namespace: 'kube-system',
+              description: 'CoreDNS DNS server for Kubernetes'
+            },
+            'kube-proxy' => {
+              versions: ['v1.29.0-eksbuild.3', 'v1.28.5-eksbuild.3', 'v1.27.9-eksbuild.3', 'v1.26.12-eksbuild.3'],
+              service_account: 'kube-proxy',
+              namespace: 'kube-system',
+              description: 'Kubernetes network proxy'
+            },
+            'aws-ebs-csi-driver' => {
+              versions: ['v1.28.0-eksbuild.1', 'v1.27.0-eksbuild.1', 'v1.26.1-eksbuild.1', 'v1.25.0-eksbuild.1'],
+              service_account: 'ebs-csi-controller-sa',
+              namespace: 'kube-system',
+              description: 'Amazon EBS CSI driver'
+            },
+            'aws-efs-csi-driver' => {
+              versions: ['v1.7.4-eksbuild.1', 'v1.7.1-eksbuild.1', 'v1.6.0-eksbuild.1', 'v1.5.9-eksbuild.1'],
+              service_account: 'efs-csi-controller-sa',
+              namespace: 'kube-system',
+              description: 'Amazon EFS CSI driver'
+            },
+            'aws-guardduty-agent' => {
+              versions: ['v1.4.0-eksbuild.1', 'v1.3.0-eksbuild.1', 'v1.2.0-eksbuild.1'],
+              service_account: 'aws-guardduty-agent',
+              namespace: 'amazon-guardduty',
+              description: 'AWS GuardDuty security monitoring agent'
+            },
+            'aws-mountpoint-s3-csi-driver' => {
+              versions: ['v1.0.0-eksbuild.1'],
+              service_account: 's3-csi-driver-sa',
+              namespace: 'kube-system',
+              description: 'Amazon S3 CSI driver using Mountpoint'
+            },
+            'snapshot-controller' => {
+              versions: ['v6.3.2-eksbuild.1', 'v6.2.2-eksbuild.1'],
+              service_account: 'snapshot-controller',
+              namespace: 'kube-system',
+              description: 'Kubernetes volume snapshot controller'
+            },
+            'adot' => {
+              versions: ['v0.90.0-eksbuild.1', 'v0.88.0-eksbuild.1'],
+              service_account: 'aws-otel-sa',
+              namespace: 'aws-otel-system',
+              description: 'AWS Distro for OpenTelemetry'
+            }
+          }.freeze
+          
+          RESOLVE_CONFLICTS_OPTIONS = %w[OVERWRITE NONE PRESERVE].freeze
+          
+          # Required attributes
+          attribute :cluster_name, Pangea::Resources::Types::String
+          attribute :addon_name, Pangea::Resources::Types::String.constrained(included_in: SUPPORTED_ADDONS.keys)
+          
+          # Optional attributes
+          attribute :addon_version, Pangea::Resources::Types::String.optional.default(nil)
+          attribute :service_account_role_arn, Pangea::Resources::Types::String.optional.default(nil).constrained(
+            format: /\Aarn:aws:iam::\d{12}:role\/.+\z/
+          )
+          attribute :resolve_conflicts, Pangea::Resources::Types::String.constrained(included_in: RESOLVE_CONFLICTS_OPTIONS).default('NONE')
+          attribute :resolve_conflicts_on_create, Pangea::Resources::Types::String.optional.constrained(included_in: RESOLVE_CONFLICTS_OPTIONS).default(nil)
+          attribute :resolve_conflicts_on_update, Pangea::Resources::Types::String.optional.constrained(included_in: RESOLVE_CONFLICTS_OPTIONS).default(nil)
+          attribute :configuration_values, Pangea::Resources::Types::String.optional.default(nil)
+          attribute :preserve, Pangea::Resources::Types::Bool.default(true)
+          attribute :tags, Pangea::Resources::Types::Hash.default({}.freeze)
+          
+          # Validate version if specified
+          def self.new(attributes)
+            attrs = attributes.is_a?(Hash) ? attributes : {}
+            
+            # Validate addon version if specified
+            if attrs[:addon_version] && attrs[:addon_name]
+              addon_info = SUPPORTED_ADDONS[attrs[:addon_name]]
+              if addon_info && !addon_info[:versions].include?(attrs[:addon_version])
+                raise Dry::Struct::Error, "Invalid version '#{attrs[:addon_version]}' for addon '#{attrs[:addon_name]}'. " \
+                  "Supported versions: #{addon_info[:versions].join(', ')}"
+              end
+            end
+            
+            # Validate configuration_values is valid JSON if provided
+            if attrs[:configuration_values]
+              begin
+                require 'json'
+                JSON.parse(attrs[:configuration_values])
+              rescue JSON::ParserError => e
+                raise Dry::Struct::Error, "configuration_values must be valid JSON: #{e.message}"
+              end
+            end
+            
+            # Validate resolve_conflicts options
+            if attrs[:resolve_conflicts_on_create] && attrs[:resolve_conflicts]
+              raise Dry::Struct::Error, "Cannot specify both resolve_conflicts and resolve_conflicts_on_create"
+            end
+            
+            if attrs[:resolve_conflicts_on_update] && attrs[:resolve_conflicts]
+              raise Dry::Struct::Error, "Cannot specify both resolve_conflicts and resolve_conflicts_on_update"
+            end
+            
+            super(attrs)
+          end
+          
+          # Computed properties
+          def addon_info
+            SUPPORTED_ADDONS[addon_name]
+          end
+          
+          def service_account_name
+            addon_info[:service_account]
+          end
+          
+          def namespace
+            addon_info[:namespace]
+          end
+          
+          def requires_iam_role?
+            %w[vpc-cni aws-ebs-csi-driver aws-efs-csi-driver aws-guardduty-agent aws-mountpoint-s3-csi-driver adot].include?(addon_name)
+          end
+          
+          def is_compute_addon?
+            %w[vpc-cni kube-proxy].include?(addon_name)
+          end
+          
+          def is_storage_addon?
+            %w[aws-ebs-csi-driver aws-efs-csi-driver aws-mountpoint-s3-csi-driver snapshot-controller].include?(addon_name)
+          end
+          
+          def is_networking_addon?
+            %w[vpc-cni coredns].include?(addon_name)
+          end
+          
+          def is_observability_addon?
+            %w[adot aws-guardduty-agent].include?(addon_name)
+          end
+          
+          def to_h
+            hash = {
+              cluster_name: cluster_name,
+              addon_name: addon_name,
+              preserve: preserve
+            }
+            
+            hash[:addon_version] = addon_version if addon_version
+            hash[:service_account_role_arn] = service_account_role_arn if service_account_role_arn
+            
+            # Handle resolve conflicts
+            if resolve_conflicts_on_create || resolve_conflicts_on_update
+              hash[:resolve_conflicts_on_create] = resolve_conflicts_on_create if resolve_conflicts_on_create
+              hash[:resolve_conflicts_on_update] = resolve_conflicts_on_update if resolve_conflicts_on_update
+            else
+              hash[:resolve_conflicts] = resolve_conflicts
+            end
+            
+            hash[:configuration_values] = configuration_values if configuration_values
+            hash[:tags] = tags if tags.any?
+            
+            hash
+          end
+        end
+      end
+    end
+  end
+end