pangea 0.0.46 → 0.0.47

data/lib/pangea/components/auto_scaling_web_servers/component/scaling_policies.rb

@@ -0,0 +1,152 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+module Pangea
+  module Components
+    module AutoScalingWebServersComponent
+      module ScalingPolicies
+        def create_scaling_policies(name, component_attrs, asg_ref)
+          policies = {}
+
+          if component_attrs.enable_cpu_scaling
+            policies[:cpu_scaling] = create_cpu_scaling_policy(name, component_attrs, asg_ref)
+          end
+
+          component_attrs.scaling_policies.each_with_index do |policy_config, index|
+            policy_name = "custom_#{index}"
+            policies[policy_name.to_sym] = create_custom_scaling_policy(name, policy_config, policy_name, asg_ref)
+          end
+
+          policies
+        end
+
+        def create_cpu_scaling_policy(name, component_attrs, asg_ref)
+          aws_autoscaling_policy(component_resource_name(name, :policy, :cpu), {
+            name: "#{name}-cpu-scaling-policy",
+            autoscaling_group_name: asg_ref.name,
+            policy_type: "TargetTrackingScaling",
+            target_tracking_configuration: {
+              target_value: component_attrs.cpu_target_value,
+              predefined_metric_specification: { predefined_metric_type: "ASGAverageCPUUtilization" },
+              scale_out_cooldown: 300,
+              scale_in_cooldown: 300,
+              disable_scale_in: false
+            }
+          })
+        end
+
+        def create_custom_scaling_policy(name, policy_config, policy_name, asg_ref)
+          case policy_config.policy_type
+          when "TargetTrackingScaling"
+            create_target_tracking_policy(name, policy_config, policy_name, asg_ref)
+          when "StepScaling", "SimpleScaling"
+            create_step_or_simple_policy(name, policy_config, policy_name, asg_ref)
+          end
+        end
+
+        def create_target_tracking_policy(name, policy_config, policy_name, asg_ref)
+          predefined_metric = build_predefined_metric(policy_config)
+
+          aws_autoscaling_policy(component_resource_name(name, :policy, policy_name.to_sym), {
+            name: "#{name}-#{policy_name}-policy",
+            autoscaling_group_name: asg_ref.name,
+            policy_type: "TargetTrackingScaling",
+            target_tracking_configuration: {
+              target_value: policy_config.target_value,
+              predefined_metric_specification: predefined_metric,
+              scale_out_cooldown: policy_config.scale_out_cooldown,
+              scale_in_cooldown: policy_config.scale_in_cooldown,
+              disable_scale_in: policy_config.disable_scale_in
+            }.compact
+          })
+        end
+
+        def build_predefined_metric(policy_config)
+          case policy_config.metric_type
+          when "ASGAverageCPUUtilization" then { predefined_metric_type: "ASGAverageCPUUtilization" }
+          when "ASGAverageNetworkIn" then { predefined_metric_type: "ASGAverageNetworkIn" }
+          when "ASGAverageNetworkOut" then { predefined_metric_type: "ASGAverageNetworkOut" }
+          when "ALBRequestCountPerTarget"
+            { predefined_metric_type: "ALBRequestCountPerTarget", resource_label: policy_config.target_group_arn }
+          end
+        end
+
+        def create_step_or_simple_policy(name, policy_config, policy_name, asg_ref)
+          policy_attrs = {
+            name: "#{name}-#{policy_name}-policy",
+            autoscaling_group_name: asg_ref.name,
+            policy_type: policy_config.policy_type,
+            adjustment_type: policy_config.adjustment_type,
+            cooldown: policy_config.scale_out_cooldown
+          }
+
+          if policy_config.policy_type == "StepScaling"
+            policy_attrs[:step_adjustments] = policy_config.step_adjustments
+            policy_attrs[:min_adjustment_magnitude] = policy_config.min_adjustment_magnitude
+          else
+            policy_attrs[:scaling_adjustment] = policy_config.scaling_adjustment
+          end
+
+          aws_autoscaling_policy(component_resource_name(name, :policy, policy_name.to_sym), policy_attrs.compact)
+        end
+
+        def create_cloudwatch_alarms(name, component_attrs, asg_ref, component_tag_set)
+          {
+            cpu_high: create_cpu_alarm(name, asg_ref, component_tag_set),
+            instance_count: create_instance_count_alarm(name, component_attrs, asg_ref, component_tag_set),
+            network_high: create_network_alarm(name, asg_ref, component_tag_set)
+          }
+        end
+
+        def create_cpu_alarm(name, asg_ref, component_tag_set)
+          aws_cloudwatch_metric_alarm(component_resource_name(name, :alarm, :cpu_high), {
+            alarm_name: "#{name}-asg-cpu-utilization-high",
+            comparison_operator: "GreaterThanThreshold",
+            evaluation_periods: "2",
+            metric_name: "CPUUtilization",
+            namespace: "AWS/EC2",
+            period: "300",
+            statistic: "Average",
+            threshold: "80.0",
+            alarm_description: "ASG CPU utilization is consistently high",
+            dimensions: { AutoScalingGroupName: asg_ref.name },
+            tags: component_tag_set
+          })
+        end
+
+        def create_instance_count_alarm(name, component_attrs, asg_ref, component_tag_set)
+          aws_cloudwatch_metric_alarm(component_resource_name(name, :alarm, :instance_count), {
+            alarm_name: "#{name}-asg-instance-count-low",
+            comparison_operator: "LessThanThreshold",
+            evaluation_periods: "2",
+            metric_name: "GroupInServiceInstances",
+            namespace: "AWS/AutoScaling",
+            period: "300",
+            statistic: "Average",
+            threshold: component_attrs.min_size.to_s,
+            alarm_description: "ASG has fewer instances than minimum required",
+            dimensions: { AutoScalingGroupName: asg_ref.name },
+            tags: component_tag_set
+          })
+        end
+
+        def create_network_alarm(name, asg_ref, component_tag_set)
+          aws_cloudwatch_metric_alarm(component_resource_name(name, :alarm, :network_high), {
+            alarm_name: "#{name}-asg-network-utilization-high",
+            comparison_operator: "GreaterThanThreshold",
+            evaluation_periods: "3",
+            metric_name: "NetworkOut",
+            namespace: "AWS/EC2",
+            period: "300",
+            statistic: "Average",
+            threshold: "100000000",
+            alarm_description: "ASG network utilization is high",
+            dimensions: { AutoScalingGroupName: asg_ref.name },
+            tags: component_tag_set
+          })
+        end
+      end
+    end
+  end
+end

data/lib/pangea/components/auto_scaling_web_servers/component.rb

@@ -0,0 +1,98 @@
+# frozen_string_literal: true
+
+# Copyright 2025 The Pangea Authors. Licensed under Apache 2.0.
+
+require 'pangea/components/base'
+require 'pangea/components/auto_scaling_web_servers/types'
+require 'pangea/resources/aws'
+require_relative 'component/launch_template'
+require_relative 'component/scaling_policies'
+require_relative 'component/lifecycle'
+
+module Pangea
+  module Components
+    # Auto Scaling Group for web servers with CPU-based scaling and health checks
+    def auto_scaling_web_servers(name, attributes = {})
+      include Base
+      include Resources::AWS
+      include AutoScalingWebServersComponent::LaunchTemplate
+      include AutoScalingWebServersComponent::ScalingPolicies
+      include AutoScalingWebServersComponent::Lifecycle
+
+      component_attrs = AutoScalingWebServers::AutoScalingWebServersAttributes.new(attributes)
+      component_tag_set = component_tags('AutoScalingWebServers', name, component_attrs.tags)
+
+      resources = {}
+
+      # Create Launch Template
+      launch_template_ref = create_launch_template(name, component_attrs, component_tag_set)
+      resources[:launch_template] = launch_template_ref
+
+      # Prepare ASG tags
+      asg_tags_list = component_attrs.asg_tags.merge(component_tag_set).map do |key, value|
+        { key: key.to_s, value: value.to_s, propagate_at_launch: component_attrs.propagate_at_launch }
+      end
+
+      # Create Auto Scaling Group
+      asg_attrs = build_asg_attributes(name, component_attrs, launch_template_ref, asg_tags_list, component_tag_set)
+      asg_ref = aws_autoscaling_group(component_resource_name(name, :asg), asg_attrs)
+      resources[:asg] = asg_ref
+
+      # Create target group attachments
+      attachments = create_target_group_attachments(name, component_attrs, asg_ref)
+      resources[:attachments] = attachments unless attachments.empty?
+
+      # Create scaling policies
+      policies = create_scaling_policies(name, component_attrs, asg_ref)
+      resources[:policies] = policies unless policies.empty?
+
+      # Create CloudWatch alarms
+      resources[:alarms] = create_cloudwatch_alarms(name, component_attrs, asg_ref, component_tag_set)
+
+      # Create lifecycle hooks
+      hooks = create_lifecycle_hooks(name, component_attrs, asg_ref)
+      resources[:hooks] = hooks unless hooks.empty?
+
+      # Build outputs
+      outputs = build_component_outputs(name, component_attrs, launch_template_ref, asg_ref)
+
+      create_component_reference('auto_scaling_web_servers', name, component_attrs.to_h, resources, outputs)
+    end
+
+    private
+
+    def build_asg_attributes(name, component_attrs, launch_template_ref, asg_tags_list, component_tag_set)
+      asg_attrs = {
+        name: "#{name}-asg",
+        launch_template: { id: launch_template_ref.id, version: "$Latest" },
+        min_size: component_attrs.min_size,
+        max_size: component_attrs.max_size,
+        desired_capacity: component_attrs.desired_capacity,
+        default_cooldown: component_attrs.default_cooldown,
+        health_check_type: component_attrs.health_check_type,
+        health_check_grace_period: component_attrs.health_check_grace_period,
+        vpc_zone_identifier: component_attrs.subnet_refs.map(&:id),
+        availability_zones: component_attrs.availability_zones,
+        target_group_arns: component_attrs.target_group_refs.map(&:arn),
+        load_balancers: component_attrs.load_balancer_names,
+        termination_policies: component_attrs.termination_policies,
+        protect_from_scale_in: component_attrs.protect_from_scale_in,
+        service_linked_role_arn: component_attrs.service_linked_role_arn,
+        enabled_metrics: component_attrs.monitoring.enabled_metrics,
+        tag: asg_tags_list,
+        tags: component_tag_set
+      }.compact
+
+      if component_attrs.enable_mixed_instances && component_attrs.mixed_instances_policy
+        asg_attrs[:mixed_instances_policy] = component_attrs.mixed_instances_policy
+        asg_attrs.delete(:launch_template)
+      end
+
+      if component_attrs.enable_warm_pool && component_attrs.warm_pool_config
+        asg_attrs[:warm_pool] = component_attrs.warm_pool_config
+      end
+
+      asg_attrs
+    end
+  end
+end

data/lib/pangea/components/auto_scaling_web_servers/types.rb

@@ -0,0 +1,176 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+require 'dry-struct'
+require 'pangea/resources/types'
+
+module Pangea
+  module Components
+    module AutoScalingWebServers
+      # Block device mapping for EBS volumes
+      class BlockDeviceMapping < Dry::Struct
+        transform_keys(&:to_sym)
+        
+        attribute :device_name, Types::String.default("/dev/xvda")
+        attribute :volume_type, Types::EbsVolumeType.default("gp3")
+        attribute :volume_size, Types::Integer.default(20).constrained(gteq: 8, lteq: 16384)
+        attribute :iops, Types::Integer.optional.constrained(gteq: 100, lteq: 16000)
+        attribute :throughput, Types::Integer.optional.constrained(gteq: 125, lteq: 1000)
+        attribute :encrypted, Types::Bool.default(true)
+        attribute :delete_on_termination, Types::Bool.default(true)
+      end
+      
+      # Scaling policy configuration
+      class ScalingPolicyConfig < Dry::Struct
+        transform_keys(&:to_sym)
+        
+        attribute :policy_type, Types::String.default("TargetTrackingScaling").enum('StepScaling', 'TargetTrackingScaling', 'SimpleScaling')
+        attribute :target_value, Types::Coercible::Float.optional.constrained(gt: 0)
+        attribute :metric_type, Types::String.default("ASGAverageCPUUtilization").enum('ASGAverageCPUUtilization', 'ASGAverageNetworkIn', 'ASGAverageNetworkOut', 'ALBRequestCountPerTarget')
+        attribute :scale_out_cooldown, Types::Integer.default(300).constrained(gteq: 0, lteq: 3600)
+        attribute :scale_in_cooldown, Types::Integer.default(300).constrained(gteq: 0, lteq: 3600)
+        attribute :disable_scale_in, Types::Bool.default(false)
+        
+        # For ALB request count per target metric
+        attribute :target_group_arn, Types::String.optional
+        
+        # For step scaling policies
+        attribute :adjustment_type, Types::String.optional.enum('ChangeInCapacity', 'ExactCapacity', 'PercentChangeInCapacity')
+        attribute :step_adjustments, Types::Array.optional.default([].freeze)
+        attribute :min_adjustment_magnitude, Types::Integer.optional
+        
+        # For simple scaling policies
+        attribute :scaling_adjustment, Types::Integer.optional
+      end
+      
+      # Monitoring configuration
+      class MonitoringConfig < Dry::Struct
+        transform_keys(&:to_sym)
+        
+        attribute :enabled, Types::Bool.default(true)
+        attribute :granularity, Types::String.default("1Minute").enum('1Minute')
+        attribute :enabled_metrics, Types::Array.of(Types::String).default([
+          "GroupMinSize",
+          "GroupMaxSize", 
+          "GroupDesiredCapacity",
+          "GroupInServiceInstances",
+          "GroupTotalInstances",
+          "GroupPendingInstances",
+          "GroupStandbyInstances",
+          "GroupTerminatingInstances"
+        ].freeze)
+      end
+      
+      # Main Auto Scaling Web Servers component attributes
+      class AutoScalingWebServersAttributes < Dry::Struct
+        transform_keys(&:to_sym)
+        
+        # Network configuration
+        attribute :vpc_ref, Types.Instance(Object)  # ResourceReference to VPC
+        attribute :subnet_refs, Types::Array.of(Types.Instance(Object)).constrained(min_size: 1)  # ResourceReferences to subnets
+        attribute :security_group_refs, Types::Array.of(Types.Instance(Object)).default([].freeze)  # ResourceReferences to security groups
+        
+        # Instance configuration
+        attribute :ami_id, Types::String.constrained(format: /\Aami-[a-f0-9]{8,17}\z/)
+        attribute :instance_type, Types::Ec2InstanceType.default("t3.micro")
+        attribute :key_name, Types::String.optional
+        attribute :iam_instance_profile, Types::String.optional
+        
+        # User data script for instance initialization
+        attribute :user_data, Types::String.optional
+        attribute :user_data_base64, Types::String.optional
+        
+        # Auto Scaling configuration
+        attribute :min_size, Types::Integer.default(1).constrained(gteq: 0, lteq: 1000)
+        attribute :max_size, Types::Integer.default(3).constrained(gteq: 1, lteq: 1000)
+        attribute :desired_capacity, Types::Integer.optional.constrained(gteq: 0, lteq: 1000)
+        attribute :default_cooldown, Types::Integer.default(300).constrained(gteq: 0, lteq: 7200)
+        
+        # Health check configuration
+        attribute :health_check_type, Types::String.default("EC2").enum('EC2', 'ELB')
+        attribute :health_check_grace_period, Types::Integer.default(300).constrained(gteq: 0, lteq: 7200)
+        
+        # Load balancer integration
+        attribute :target_group_refs, Types::Array.of(Types.Instance(Object)).default([].freeze)  # ResourceReferences to target groups
+        attribute :load_balancer_names, Types::Array.of(Types::String).default([].freeze)  # Classic ELB names
+        
+        # Storage configuration
+        attribute :block_device_mappings, Types::Array.of(BlockDeviceMapping).default([
+          BlockDeviceMapping.new(device_name: "/dev/xvda")
+        ].freeze)
+        
+        # Scaling policies
+        attribute :enable_cpu_scaling, Types::Bool.default(true)
+        attribute :cpu_target_value, Types::Coercible::Float.default(70.0).constrained(gteq: 1.0, lteq: 100.0)
+        attribute :scaling_policies, Types::Array.of(ScalingPolicyConfig).default([].freeze)
+        
+        # Instance placement
+        attribute :availability_zones, Types::Array.of(Types::String).optional
+        attribute :placement_group, Types::String.optional
+        
+        # Termination policies
+        attribute :termination_policies, Types::Array.of(Types::String).default([
+          "Default"
+        ].freeze).constructor { |value|
+          valid_policies = [
+            "Default", "OldestInstance", "NewestInstance", "OldestLaunchConfiguration",
+            "OldestLaunchTemplate", "ClosestToNextInstanceHour", "AllocationStrategy"
+          ]
+          invalid_policies = value - valid_policies
+          unless invalid_policies.empty?
+            raise Dry::Types::ConstraintError, "Invalid termination policies: #{invalid_policies.join(', ')}"
+          end
+          value
+        }
+        
+        # Instance protection
+        attribute :protect_from_scale_in, Types::Bool.default(false)
+        
+        # Monitoring
+        attribute :monitoring, MonitoringConfig.default({})
+        
+        # Tags
+        attribute :tags, Types::AwsTags.default({}.freeze)
+        
+        # Auto Scaling group tags (different from resource tags)
+        attribute :asg_tags, Types::Hash.default({}.freeze)
+        attribute :propagate_at_launch, Types::Bool.default(true)
+        
+        # Instance metadata service configuration
+        attribute :metadata_options, Types::Hash.default({
+          http_endpoint: "enabled",
+          http_tokens: "required",
+          http_put_response_hop_limit: 1,
+          instance_metadata_tags: "enabled"
+        }.freeze)
+        
+        # Mixed instances policy for cost optimization
+        attribute :enable_mixed_instances, Types::Bool.default(false)
+        attribute :mixed_instances_policy, Types::Hash.optional
+        
+        # Warm pool configuration
+        attribute :enable_warm_pool, Types::Bool.default(false)
+        attribute :warm_pool_config, Types::Hash.optional
+        
+        # Service-linked role
+        attribute :service_linked_role_arn, Types::String.optional.constrained(format: /\Aarn:aws:iam::\d{12}:role\/aws-service-role\/autoscaling\.amazonaws\.com\/AWSServiceRoleForAutoScaling/)
+        
+        # Lifecycle hooks
+        attribute :lifecycle_hooks, Types::Array.default([].freeze)
+      end
+    end
+  end
+end

data/lib/pangea/components/base.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+module Pangea
+  module Components
+    # Base module for all Pangea components
+    #
+    # Provides common functionality and patterns for component implementations.
+    # Components that include this module get access to helper methods and
+    # standard validation patterns.
+    module Base
+      # Base error class for component-related errors
+      class ComponentError < StandardError; end
+      
+      # Error raised when component validation fails
+      class ValidationError < ComponentError; end
+      
+      # Error raised when component composition fails
+      class CompositionError < ComponentError; end
+
+      # Validate required attributes are present
+      #
+      # @param attributes [Hash] Input attributes
+      # @param required [Array<Symbol>] Required attribute names
+      # @raise [ValidationError] if any required attributes are missing
+      def validate_required_attributes(attributes, required)
+        missing = required - attributes.keys
+        unless missing.empty?
+          raise ValidationError, "Missing required attributes: #{missing.join(', ')}"
+        end
+      end
+
+      # Calculate subnet CIDR blocks from a VPC CIDR
+      #
+      # @param vpc_cidr [String] VPC CIDR block (e.g., "10.0.0.0/16")
+      # @param index [Integer] Subnet index
+      # @param new_bits [Integer] Additional bits for subnet mask (default: 8)
+      # @return [String] Subnet CIDR block
+      def calculate_subnet_cidr(vpc_cidr, index, new_bits = 8)
+        require 'ipaddr'
+        
+        vpc_network = IPAddr.new(vpc_cidr)
+        vpc_prefix = vpc_cidr.split('/').last.to_i
+        subnet_prefix = vpc_prefix + new_bits
+        
+        # Calculate the subnet size
+        subnet_size = 2 ** (32 - subnet_prefix)
+        
+        # Calculate the subnet network address
+        subnet_network = vpc_network.to_i + (index * subnet_size)
+        
+        # Return the subnet CIDR
+        "#{IPAddr.new(subnet_network, Socket::AF_INET)}/#{subnet_prefix}"
+      end
+
+      # Generate consistent naming for component resources
+      #
+      # @param component_name [Symbol, String] Base component name
+      # @param resource_type [Symbol, String] Type of resource
+      # @param suffix [String, nil] Optional suffix
+      # @return [Symbol] Generated resource name
+      def component_resource_name(component_name, resource_type, suffix = nil)
+        parts = [component_name, resource_type]
+        parts << suffix if suffix
+        parts.join('_').to_sym
+      end
+
+      # Merge default tags with user-provided tags
+      #
+      # @param default_tags [Hash] Default tags to apply
+      # @param user_tags [Hash] User-provided tags (takes precedence)
+      # @return [Hash] Merged tags
+      def merge_tags(default_tags, user_tags = {})
+        default_tags.merge(user_tags)
+      end
+
+      # Create a component output hash
+      #
+      # @param resources [Hash] Created resources
+      # @param computed [Hash] Computed values
+      # @return [Hash] Combined outputs
+      def component_outputs(resources, computed = {})
+        {
+          resources: resources,
+          computed: computed,
+          created_at: Time.now.utc.iso8601
+        }
+      end
+    end
+  end
+end

data/lib/pangea/components/capabilities.rb

@@ -0,0 +1,93 @@
+# Copyright 2025 The Pangea Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+module Pangea
+  module Components
+    module Capabilities
+      module HighAvailability
+        def self.included(base)
+          base.class_eval do
+            option :high_availability, default: -> { false }
+            option :availability_zones, default: -> { [] }
+            
+            validation :high_availability_zones do
+              if high_availability && availability_zones.size < 2
+                raise ValidationError, "High availability requires at least 2 availability zones"
+              end
+            end
+          end
+        end
+        
+        def apply_high_availability(resource_config)
+          return resource_config unless high_availability
+          
+          case resource_config[:type]
+          when :aws_rds_instance
+            resource_config.merge(multi_az: true)
+          when :aws_elasticache_replication_group
+            resource_config.merge(automatic_failover_enabled: true)
+          else
+            resource_config
+          end
+        end
+      end
+      
+      module Monitoring
+        def self.included(base)
+          base.class_eval do
+            option :enable_monitoring, default: -> { true }
+            option :monitoring_level, default: -> { :standard }
+          end
+        end
+        
+        def monitoring_config
+          return {} unless enable_monitoring
+          
+          case monitoring_level
+          when :basic
+            { detailed_monitoring: false, log_retention: 7 }
+          when :standard
+            { detailed_monitoring: true, log_retention: 30 }
+          when :enhanced
+            { detailed_monitoring: true, log_retention: 90, custom_metrics: true }
+          end
+        end
+      end
+      
+      module Security
+        def self.included(base)
+          base.class_eval do
+            option :enable_encryption, default: -> { true }
+            option :enable_logging, default: -> { true }
+          end
+        end
+        
+        def apply_security(resource_config)
+          config = resource_config.dup
+          
+          if enable_encryption
+            config[:encrypted] = true if config[:type] == :aws_ebs_volume
+            config[:storage_encrypted] = true if config[:type] == :aws_db_instance
+          end
+          
+          if enable_logging
+            config[:logging_enabled] = true
+          end
+          
+          config
+        end
+      end
+    end
+  end
+end