@flowuent-org/diagramming-core 1.3.10 → 1.4.1

package/packages/diagrams/src/lib/templates/cloud-arch/utils/awsValidation.ts

@@ -1,447 +1,447 @@
-import { Node } from 'reactflow';
-import { getTranslatedMessage, getCloudProviderMessageId, formatPlacementRules } from './translations';
-import { 
-  AWS_CATEGORIES, 
-  AWS_COMPUTE_ICONS, 
-  AWS_STORAGE_ICONS, 
-  AWS_DATABASE_ICONS, 
-  AWS_NETWORKING_ICONS, 
-  AWS_SECURITY_ICONS, 
-  AWS_CONTAINER_ICONS 
-} from './aws-icons';
-
-// Define types for validation results
-interface ValidationResult {
-  isValid: boolean;
-  message?: string;
-  suggestions?: string[];
-}
-
-type AWSResourceType = 
-  // Container types
-  | 'account'
-  | 'vpc'
-  | 'subnet'
-  | 'availability-zone'
-  | 'local-zone'
-  // Service categories
-  | 'compute'
-  | 'storage'
-  | 'database'
-  | 'networking'
-  | 'security'
-  | 'containers'
-  | 'serverless';
-
-// Define container rules with detailed descriptions
-const containerRules: Record<string, {
-  canContain: string[];
-  cannotContain: string[];
-  description: string;
-  placementRules: string[];
-}> = {
-  account: {
-    canContain: [
-      'vpc',
-      'availability-zone',
-      'local-zone',
-      'storage',
-      'serverless',
-      'security',
-      'networking'
-    ],
-    cannotContain: ['account'],
-    description: 'AWS Account is the root container for all resources',
-    placementRules: [
-      'Must be at the root level',
-      'Can contain VPCs and global services',
-      'Cannot contain other Accounts',
-      'Global services should be at Account level',
-      'Region-specific services should be in appropriate regions'
-    ]
-  },
-  vpc: {
-    canContain: [
-      'subnet',
-      'availability-zone',
-      'local-zone',
-      'networking',
-      'security',
-      'compute'
-    ],
-    cannotContain: ['vpc', 'storage', 'serverless'],
-    description: 'VPC is an isolated network in AWS',
-    placementRules: [
-      'Must be placed within an Account',
-      'Can contain Subnets and networking resources',
-      'Cannot contain global services',
-      'Cannot contain other VPCs',
-      'Must be in a single region'
-    ]
-  },
-  subnet: {
-    canContain: [
-      'compute',
-      'database',
-      'containers',
-      'networking'
-    ],
-    cannotContain: ['subnet', 'vpc', 'storage', 'serverless'],
-    description: 'Subnet is a range of IP addresses in a VPC',
-    placementRules: [
-      'Must be placed within a VPC',
-      'Can contain compute resources',
-      'Can contain database instances',
-      'Cannot contain global services',
-      'Must be in a single Availability Zone'
-    ]
-  },
-  'availability-zone': {
-    canContain: [
-      'subnet',
-      'compute',
-      'database',
-      'containers'
-    ],
-    cannotContain: ['availability-zone', 'local-zone', 'vpc', 'storage', 'serverless'],
-    description: 'Availability Zone is a distinct location within a region',
-    placementRules: [
-      'Must be placed within a VPC or Account',
-      'Can contain Subnets and compute resources',
-      'Cannot contain other Availability Zones',
-      'Resources within must be in the same AZ'
-    ]
-  },
-  'local-zone': {
-    canContain: [
-      'subnet',
-      'compute',
-      'database',
-      'containers'
-    ],
-    cannotContain: ['local-zone', 'availability-zone', 'vpc', 'storage', 'serverless'],
-    description: 'Local Zone brings AWS services closer to end users',
-    placementRules: [
-      'Must be placed within a VPC or Account',
-      'Can contain Subnets and compute resources',
-      'Cannot contain other Local Zones',
-      'Provides low-latency access to applications'
-    ]
-  }
-};
-
-// Helper function to get resource category from service name
-function getAWSResourceCategory(service: string): string | null {
-  // Check in each category's icons
-  
-  // Check compute services
-  if (service in AWS_COMPUTE_ICONS) {
-    return AWS_COMPUTE_ICONS[service as keyof typeof AWS_COMPUTE_ICONS].category;
-  }
-  
-  // Check storage services
-  if (service in AWS_STORAGE_ICONS) {
-    return AWS_STORAGE_ICONS[service as keyof typeof AWS_STORAGE_ICONS].category;
-  }
-  
-  // Check database services
-  if (service in AWS_DATABASE_ICONS) {
-    return AWS_DATABASE_ICONS[service as keyof typeof AWS_DATABASE_ICONS].category;
-  }
-  
-  // Check networking services
-  if (service in AWS_NETWORKING_ICONS) {
-    return AWS_NETWORKING_ICONS[service as keyof typeof AWS_NETWORKING_ICONS].category;
-  }
-  
-  // Check security services
-  if (service in AWS_SECURITY_ICONS) {
-    return AWS_SECURITY_ICONS[service as keyof typeof AWS_SECURITY_ICONS].category;
-  }
-  
-  // Check container services
-  if (service in AWS_CONTAINER_ICONS) {
-    return AWS_CONTAINER_ICONS[service as keyof typeof AWS_CONTAINER_ICONS].category;
-  }
-
-  // If not found in any category, return null (will be handled gracefully)
-  return null;
-}
-
-// Helper function to get resource type from node
-function getAWSResourceType(node: Node): AWSResourceType | null {
-  if (!node.data?.service) return null;
-  
-  const service = node.data.service;
-  
-  // Container types
-  if (service === 'account' || service === 'aws-account') return 'account';
-  if (service === 'vpc') return 'vpc';
-  if (service === 'subnet') return 'subnet';
-  if (service === 'availability-zone') return 'availability-zone';
-  if (service === 'local-zone') return 'local-zone';
-  
-  // Map service to its category type
-  const category = getAWSResourceCategory(service);
-  if (category) {
-    switch (category) {
-      case AWS_CATEGORIES.COMPUTE: return 'compute';
-      case AWS_CATEGORIES.STORAGE: return 'storage';
-      case AWS_CATEGORIES.DATABASE: return 'database';
-      case AWS_CATEGORIES.NETWORKING: return 'networking';
-      case AWS_CATEGORIES.SECURITY: return 'security';
-      case AWS_CATEGORIES.CONTAINERS: return 'containers';
-      case AWS_CATEGORIES.SERVERLESS: return 'serverless';
-    }
-  }
-
-  return null;
-}
-
-// Helper function to validate container placement
-function validateContainerPlacement(
-  node: Node,
-  parentNode: Node | null,
-  resourceType: string,
-  allNodes: Node[]
-): ValidationResult {
-  const parentType = parentNode ? getAWSResourceType(parentNode) : null;
-  
-  // If no parent, only account is allowed at root
-  if (!parentNode && resourceType !== 'account') {
-    return {
-      isValid: false,
-      message: getTranslatedMessage(
-        getCloudProviderMessageId('aws', 'must_be_in_account'),
-        { resourceType }
-      )
-    };
-  }
-
-  // Check if the resource can be placed in the parent container
-  if (parentNode && parentType) {
-    const rules = containerRules[parentType];
-    if (!rules) {
-      return {
-        isValid: false,
-        message: getTranslatedMessage(
-          getCloudProviderMessageId('aws', 'invalid_parent_container'),
-          { parentType }
-        )
-      };
-    }
-
-    if (!rules.canContain.includes(resourceType)) {
-      const suggestedContainer = getSuggestedContainer(resourceType as AWSResourceType);
-      return {
-        isValid: false,
-        message: getTranslatedMessage(
-          getCloudProviderMessageId('aws', 'container_validation'),
-          {
-            parentType,
-            resourceType,
-            description: rules.description,
-            rules: formatPlacementRules(rules.placementRules),
-            suggestion: suggestedContainer
-          }
-        )
-      };
-    }
-  }
-
-  return { isValid: true };
-}
-
-// Helper function to validate service placement
-function validateServicePlacement(
-  node: Node,
-  parentNode: Node | null,
-  resourceType: string,
-  allNodes: Node[]
-): ValidationResult {
-  const parentType = parentNode ? getAWSResourceType(parentNode) : null;
-
-  // If no parent, only global services are allowed at root
-  if (!parentNode) {
-    const globalServices = ['storage', 'security', 'serverless'];
-    if (!globalServices.includes(resourceType)) {
-      return {
-        isValid: false,
-        message: getTranslatedMessage(
-          getCloudProviderMessageId('aws', 'must_be_in_container'),
-          { resourceType, suggestion: getSuggestedContainer(resourceType as AWSResourceType) }
-        )
-      };
-    }
-  }
-
-  // Check if the resource can be placed in the parent container
-  if (parentNode && parentType) {
-    const rules = containerRules[parentType];
-    if (!rules) {
-      return {
-        isValid: false,
-        message: getTranslatedMessage(
-          getCloudProviderMessageId('aws', 'invalid_parent_container'),
-          { parentType }
-        )
-      };
-    }
-
-    if (!rules.canContain.includes(resourceType)) {
-      const suggestedContainer = getSuggestedContainer(resourceType as AWSResourceType);
-      return {
-        isValid: false,
-        message: getTranslatedMessage(
-          getCloudProviderMessageId('aws', 'container_validation'),
-          {
-            parentType,
-            resourceType,
-            description: rules.description,
-            rules: formatPlacementRules(rules.placementRules),
-            suggestion: suggestedContainer
-          }
-        )
-      };
-    }
-
-    // Special placement rules for specific services
-    if (resourceType === 'compute' && parentType !== 'subnet' && node.data.service === 'ec2') {
-      return {
-        isValid: false,
-        message: getTranslatedMessage(
-          getCloudProviderMessageId('aws', 'ec2_must_be_in_subnet')
-        )
-      };
-    }
-
-    if (resourceType === 'database' && parentType !== 'subnet' && ['rds', 'aurora'].includes(node.data.service)) {
-      return {
-        isValid: false,
-        message: getTranslatedMessage(
-          getCloudProviderMessageId('aws', 'database_must_be_in_subnet')
-        )
-      };
-    }
-
-    if (resourceType === 'storage' && parentType !== 'account' && node.data.service === 's3') {
-      return {
-        isValid: false,
-        message: getTranslatedMessage(
-          getCloudProviderMessageId('aws', 'storage_must_be_in_account')
-        )
-      };
-    }
-  }
-
-  return { isValid: true };
-}
-
-// Validate placement of an AWS resource
-export const validateAWSPlacement = (
-  node: Node,
-  parentNode: Node | null,
-  allNodes: Node[]
-): ValidationResult => {
-  // Only validate AWS resources
-  if (node.data?.cloudProvider !== 'aws') {
-    return { isValid: true };
-  }
-
-  const resourceType = getAWSResourceType(node);
-  
-  // If resource type is not recognized, allow it but with a warning
-  if (!resourceType) {
-    return {
-      isValid: true,
-      message: getTranslatedMessage('cloudProviders.aws.warnings.unknownResource', {
-        resource: node.data?.service || 'Unknown',
-        suggestions: 'This service might be new or have a different name. It will be placed as a generic service.'
-      })
-    };
-  }
-
-  // Container type validation
-  if (['account', 'vpc', 'subnet', 'availability-zone', 'local-zone'].includes(resourceType)) {
-    return validateContainerPlacement(node, parentNode, resourceType, allNodes);
-  }
-
-  // Service type validation
-  return validateServicePlacement(node, parentNode, resourceType, allNodes);
-};
-
-// Helper function to suggest the correct container
-const getSuggestedContainer = (resourceType: AWSResourceType): string => {
-  const suggestions: Record<AWSResourceType, string> = {
-    account: 'AWS Account must be at the root level',
-    vpc: 'VPC must be placed in an AWS Account',
-    subnet: 'Subnet must be placed in a VPC',
-    'availability-zone': 'Availability Zone must be placed in a VPC or Account',
-    'local-zone': 'Local Zone must be placed in a VPC or Account',
-    compute: 'Compute services should be placed in a Subnet (EC2) or Account (Lambda)',
-    storage: 'Storage services should typically be placed at the Account level',
-    database: 'Database services should be placed in a Subnet',
-    networking: 'Networking services can be placed in VPC or Account depending on scope',
-    security: 'Security services can be placed in VPC or Account depending on scope',
-    containers: 'Container services should be placed in a Subnet',
-    serverless: 'Serverless services should be placed at the Account level'
-  };
-
-  return suggestions[resourceType] || 'Please check AWS documentation for placement rules';
-};
-
-// Validate the entire AWS diagram
-export const validateAWSDiagram = (nodes: Node[]): ValidationResult & { messages?: string[] } => {
-  const messages: string[] = [];
-
-  // Get all AWS nodes
-  const awsNodes = nodes.filter(node => node.data?.cloudProvider === 'aws');
-
-  // Validate each node
-  for (const node of awsNodes) {
-    const foundParentNode = node.parentNode 
-      ? nodes.find(n => n.id === node.parentNode)
-      : null;
-    const parentNode = foundParentNode || null;
-    
-    const validation = validateAWSPlacement(node, parentNode, nodes);
-    if (!validation.isValid && validation.message) {
-      messages.push(validation.message);
-    }
-  }
-
-  // Additional diagram-wide validations
-  const accounts = awsNodes.filter(
-    node => getAWSResourceType(node) === 'account'
-  );
-
-  // Check if there are multiple accounts
-  if (accounts.length > 1) {
-    messages.push(
-      getTranslatedMessage(getCloudProviderMessageId('aws', 'multiple_accounts'))
-    );
-  }
-
-  // Check for cross-region dependencies in VPCs
-  const vpcs = awsNodes.filter(
-    node => getAWSResourceType(node) === 'vpc'
-  );
-
-  for (const vpc of vpcs) {
-    const vpcResources = awsNodes.filter(node => node.parentNode === vpc.id);
-    const regions = new Set(vpcResources.map(r => r.data?.region));
-    if (regions.size > 1) {
-      messages.push(
-        getTranslatedMessage(
-          getCloudProviderMessageId('aws', 'cross_region_resources'),
-          { vpcName: vpc.data?.label }
-        )
-      );
-    }
-  }
-
-  return {
-    isValid: messages.length === 0,
-    messages
-  };
+import { Node } from 'reactflow';
+import { getTranslatedMessage, getCloudProviderMessageId, formatPlacementRules } from './translations';
+import { 
+  AWS_CATEGORIES, 
+  AWS_COMPUTE_ICONS, 
+  AWS_STORAGE_ICONS, 
+  AWS_DATABASE_ICONS, 
+  AWS_NETWORKING_ICONS, 
+  AWS_SECURITY_ICONS, 
+  AWS_CONTAINER_ICONS 
+} from './aws-icons';
+
+// Define types for validation results
+export interface ValidationResult {
+  isValid: boolean;
+  message?: string;
+  suggestions?: string[];
+}
+
+type AWSResourceType = 
+  // Container types
+  | 'account'
+  | 'vpc'
+  | 'subnet'
+  | 'availability-zone'
+  | 'local-zone'
+  // Service categories
+  | 'compute'
+  | 'storage'
+  | 'database'
+  | 'networking'
+  | 'security'
+  | 'containers'
+  | 'serverless';
+
+// Define container rules with detailed descriptions
+const containerRules: Record<string, {
+  canContain: string[];
+  cannotContain: string[];
+  description: string;
+  placementRules: string[];
+}> = {
+  account: {
+    canContain: [
+      'vpc',
+      'availability-zone',
+      'local-zone',
+      'storage',
+      'serverless',
+      'security',
+      'networking'
+    ],
+    cannotContain: ['account'],
+    description: 'AWS Account is the root container for all resources',
+    placementRules: [
+      'Must be at the root level',
+      'Can contain VPCs and global services',
+      'Cannot contain other Accounts',
+      'Global services should be at Account level',
+      'Region-specific services should be in appropriate regions'
+    ]
+  },
+  vpc: {
+    canContain: [
+      'subnet',
+      'availability-zone',
+      'local-zone',
+      'networking',
+      'security',
+      'compute'
+    ],
+    cannotContain: ['vpc', 'storage', 'serverless'],
+    description: 'VPC is an isolated network in AWS',
+    placementRules: [
+      'Must be placed within an Account',
+      'Can contain Subnets and networking resources',
+      'Cannot contain global services',
+      'Cannot contain other VPCs',
+      'Must be in a single region'
+    ]
+  },
+  subnet: {
+    canContain: [
+      'compute',
+      'database',
+      'containers',
+      'networking'
+    ],
+    cannotContain: ['subnet', 'vpc', 'storage', 'serverless'],
+    description: 'Subnet is a range of IP addresses in a VPC',
+    placementRules: [
+      'Must be placed within a VPC',
+      'Can contain compute resources',
+      'Can contain database instances',
+      'Cannot contain global services',
+      'Must be in a single Availability Zone'
+    ]
+  },
+  'availability-zone': {
+    canContain: [
+      'subnet',
+      'compute',
+      'database',
+      'containers'
+    ],
+    cannotContain: ['availability-zone', 'local-zone', 'vpc', 'storage', 'serverless'],
+    description: 'Availability Zone is a distinct location within a region',
+    placementRules: [
+      'Must be placed within a VPC or Account',
+      'Can contain Subnets and compute resources',
+      'Cannot contain other Availability Zones',
+      'Resources within must be in the same AZ'
+    ]
+  },
+  'local-zone': {
+    canContain: [
+      'subnet',
+      'compute',
+      'database',
+      'containers'
+    ],
+    cannotContain: ['local-zone', 'availability-zone', 'vpc', 'storage', 'serverless'],
+    description: 'Local Zone brings AWS services closer to end users',
+    placementRules: [
+      'Must be placed within a VPC or Account',
+      'Can contain Subnets and compute resources',
+      'Cannot contain other Local Zones',
+      'Provides low-latency access to applications'
+    ]
+  }
+};
+
+// Helper function to get resource category from service name
+function getAWSResourceCategory(service: string): string | null {
+  // Check in each category's icons
+  
+  // Check compute services
+  if (service in AWS_COMPUTE_ICONS) {
+    return AWS_COMPUTE_ICONS[service as keyof typeof AWS_COMPUTE_ICONS].category;
+  }
+  
+  // Check storage services
+  if (service in AWS_STORAGE_ICONS) {
+    return AWS_STORAGE_ICONS[service as keyof typeof AWS_STORAGE_ICONS].category;
+  }
+  
+  // Check database services
+  if (service in AWS_DATABASE_ICONS) {
+    return AWS_DATABASE_ICONS[service as keyof typeof AWS_DATABASE_ICONS].category;
+  }
+  
+  // Check networking services
+  if (service in AWS_NETWORKING_ICONS) {
+    return AWS_NETWORKING_ICONS[service as keyof typeof AWS_NETWORKING_ICONS].category;
+  }
+  
+  // Check security services
+  if (service in AWS_SECURITY_ICONS) {
+    return AWS_SECURITY_ICONS[service as keyof typeof AWS_SECURITY_ICONS].category;
+  }
+  
+  // Check container services
+  if (service in AWS_CONTAINER_ICONS) {
+    return AWS_CONTAINER_ICONS[service as keyof typeof AWS_CONTAINER_ICONS].category;
+  }
+
+  // If not found in any category, return null (will be handled gracefully)
+  return null;
+}
+
+// Helper function to get resource type from node
+function getAWSResourceType(node: Node): AWSResourceType | null {
+  if (!node.data?.service) return null;
+  
+  const service = node.data.service;
+  
+  // Container types
+  if (service === 'account' || service === 'aws-account') return 'account';
+  if (service === 'vpc') return 'vpc';
+  if (service === 'subnet') return 'subnet';
+  if (service === 'availability-zone') return 'availability-zone';
+  if (service === 'local-zone') return 'local-zone';
+  
+  // Map service to its category type
+  const category = getAWSResourceCategory(service);
+  if (category) {
+    switch (category) {
+      case AWS_CATEGORIES.COMPUTE: return 'compute';
+      case AWS_CATEGORIES.STORAGE: return 'storage';
+      case AWS_CATEGORIES.DATABASE: return 'database';
+      case AWS_CATEGORIES.NETWORKING: return 'networking';
+      case AWS_CATEGORIES.SECURITY: return 'security';
+      case AWS_CATEGORIES.CONTAINERS: return 'containers';
+      case AWS_CATEGORIES.SERVERLESS: return 'serverless';
+    }
+  }
+
+  return null;
+}
+
+// Helper function to validate container placement
+function validateContainerPlacement(
+  node: Node,
+  parentNode: Node | null,
+  resourceType: string,
+  allNodes: Node[]
+): ValidationResult {
+  const parentType = parentNode ? getAWSResourceType(parentNode) : null;
+  
+  // If no parent, only account is allowed at root
+  if (!parentNode && resourceType !== 'account') {
+    return {
+      isValid: false,
+      message: getTranslatedMessage(
+        getCloudProviderMessageId('aws', 'must_be_in_account'),
+        { resourceType }
+      )
+    };
+  }
+
+  // Check if the resource can be placed in the parent container
+  if (parentNode && parentType) {
+    const rules = containerRules[parentType];
+    if (!rules) {
+      return {
+        isValid: false,
+        message: getTranslatedMessage(
+          getCloudProviderMessageId('aws', 'invalid_parent_container'),
+          { parentType }
+        )
+      };
+    }
+
+    if (!rules.canContain.includes(resourceType)) {
+      const suggestedContainer = getSuggestedContainer(resourceType as AWSResourceType);
+      return {
+        isValid: false,
+        message: getTranslatedMessage(
+          getCloudProviderMessageId('aws', 'container_validation'),
+          {
+            parentType,
+            resourceType,
+            description: rules.description,
+            rules: formatPlacementRules(rules.placementRules),
+            suggestion: suggestedContainer
+          }
+        )
+      };
+    }
+  }
+
+  return { isValid: true };
+}
+
+// Helper function to validate service placement
+function validateServicePlacement(
+  node: Node,
+  parentNode: Node | null,
+  resourceType: string,
+  allNodes: Node[]
+): ValidationResult {
+  const parentType = parentNode ? getAWSResourceType(parentNode) : null;
+
+  // If no parent, only global services are allowed at root
+  if (!parentNode) {
+    const globalServices = ['storage', 'security', 'serverless'];
+    if (!globalServices.includes(resourceType)) {
+      return {
+        isValid: false,
+        message: getTranslatedMessage(
+          getCloudProviderMessageId('aws', 'must_be_in_container'),
+          { resourceType, suggestion: getSuggestedContainer(resourceType as AWSResourceType) }
+        )
+      };
+    }
+  }
+
+  // Check if the resource can be placed in the parent container
+  if (parentNode && parentType) {
+    const rules = containerRules[parentType];
+    if (!rules) {
+      return {
+        isValid: false,
+        message: getTranslatedMessage(
+          getCloudProviderMessageId('aws', 'invalid_parent_container'),
+          { parentType }
+        )
+      };
+    }
+
+    if (!rules.canContain.includes(resourceType)) {
+      const suggestedContainer = getSuggestedContainer(resourceType as AWSResourceType);
+      return {
+        isValid: false,
+        message: getTranslatedMessage(
+          getCloudProviderMessageId('aws', 'container_validation'),
+          {
+            parentType,
+            resourceType,
+            description: rules.description,
+            rules: formatPlacementRules(rules.placementRules),
+            suggestion: suggestedContainer
+          }
+        )
+      };
+    }
+
+    // Special placement rules for specific services
+    if (resourceType === 'compute' && parentType !== 'subnet' && node.data.service === 'ec2') {
+      return {
+        isValid: false,
+        message: getTranslatedMessage(
+          getCloudProviderMessageId('aws', 'ec2_must_be_in_subnet')
+        )
+      };
+    }
+
+    if (resourceType === 'database' && parentType !== 'subnet' && ['rds', 'aurora'].includes(node.data.service)) {
+      return {
+        isValid: false,
+        message: getTranslatedMessage(
+          getCloudProviderMessageId('aws', 'database_must_be_in_subnet')
+        )
+      };
+    }
+
+    if (resourceType === 'storage' && parentType !== 'account' && node.data.service === 's3') {
+      return {
+        isValid: false,
+        message: getTranslatedMessage(
+          getCloudProviderMessageId('aws', 'storage_must_be_in_account')
+        )
+      };
+    }
+  }
+
+  return { isValid: true };
+}
+
+// Validate placement of an AWS resource
+export const validateAWSPlacement = (
+  node: Node,
+  parentNode: Node | null,
+  allNodes: Node[]
+): ValidationResult => {
+  // Only validate AWS resources
+  if (node.data?.cloudProvider !== 'aws') {
+    return { isValid: true };
+  }
+
+  const resourceType = getAWSResourceType(node);
+  
+  // If resource type is not recognized, allow it but with a warning
+  if (!resourceType) {
+    return {
+      isValid: true,
+      message: getTranslatedMessage('cloudProviders.aws.warnings.unknownResource', {
+        resource: node.data?.service || 'Unknown',
+        suggestions: 'This service might be new or have a different name. It will be placed as a generic service.'
+      })
+    };
+  }
+
+  // Container type validation
+  if (['account', 'vpc', 'subnet', 'availability-zone', 'local-zone'].includes(resourceType)) {
+    return validateContainerPlacement(node, parentNode, resourceType, allNodes);
+  }
+
+  // Service type validation
+  return validateServicePlacement(node, parentNode, resourceType, allNodes);
+};
+
+// Helper function to suggest the correct container
+const getSuggestedContainer = (resourceType: AWSResourceType): string => {
+  const suggestions: Record<AWSResourceType, string> = {
+    account: 'AWS Account must be at the root level',
+    vpc: 'VPC must be placed in an AWS Account',
+    subnet: 'Subnet must be placed in a VPC',
+    'availability-zone': 'Availability Zone must be placed in a VPC or Account',
+    'local-zone': 'Local Zone must be placed in a VPC or Account',
+    compute: 'Compute services should be placed in a Subnet (EC2) or Account (Lambda)',
+    storage: 'Storage services should typically be placed at the Account level',
+    database: 'Database services should be placed in a Subnet',
+    networking: 'Networking services can be placed in VPC or Account depending on scope',
+    security: 'Security services can be placed in VPC or Account depending on scope',
+    containers: 'Container services should be placed in a Subnet',
+    serverless: 'Serverless services should be placed at the Account level'
+  };
+
+  return suggestions[resourceType] || 'Please check AWS documentation for placement rules';
+};
+
+// Validate the entire AWS diagram
+export const validateAWSDiagram = (nodes: Node[]): ValidationResult & { messages?: string[] } => {
+  const messages: string[] = [];
+
+  // Get all AWS nodes
+  const awsNodes = nodes.filter(node => node.data?.cloudProvider === 'aws');
+
+  // Validate each node
+  for (const node of awsNodes) {
+    const foundParentNode = node.parentNode 
+      ? nodes.find(n => n.id === node.parentNode)
+      : null;
+    const parentNode = foundParentNode || null;
+    
+    const validation = validateAWSPlacement(node, parentNode, nodes);
+    if (!validation.isValid && validation.message) {
+      messages.push(validation.message);
+    }
+  }
+
+  // Additional diagram-wide validations
+  const accounts = awsNodes.filter(
+    node => getAWSResourceType(node) === 'account'
+  );
+
+  // Check if there are multiple accounts
+  if (accounts.length > 1) {
+    messages.push(
+      getTranslatedMessage(getCloudProviderMessageId('aws', 'multiple_accounts'))
+    );
+  }
+
+  // Check for cross-region dependencies in VPCs
+  const vpcs = awsNodes.filter(
+    node => getAWSResourceType(node) === 'vpc'
+  );
+
+  for (const vpc of vpcs) {
+    const vpcResources = awsNodes.filter(node => node.parentNode === vpc.id);
+    const regions = new Set(vpcResources.map(r => r.data?.region));
+    if (regions.size > 1) {
+      messages.push(
+        getTranslatedMessage(
+          getCloudProviderMessageId('aws', 'cross_region_resources'),
+          { vpcName: vpc.data?.label }
+        )
+      );
+    }
+  }
+
+  return {
+    isValid: messages.length === 0,
+    messages
+  };
 };