@friggframework/devtools 2.0.0--canary.474.efd7936.0 → 2.0.0--canary.474.082077e.0

package/infrastructure/domains/health/infrastructure/adapters/aws-resource-detector.js

@@ -0,0 +1,471 @@
+/**
+ * AWSResourceDetector - AWS Resource Discovery Adapter
+ *
+ * Infrastructure Adapter - Hexagonal Architecture
+ *
+ * Implements IResourceDetector port for AWS.
+ * Discovers cloud resources using AWS SDK v3 (EC2, RDS, KMS).
+ *
+ * Supports:
+ * - EC2: VPC, Subnet, SecurityGroup, RouteTable
+ * - RDS: DBCluster
+ * - KMS: Key
+ *
+ * Lazy-loads AWS SDK to minimize cold start time and memory usage.
+ */
+
+const IResourceDetector = require('../../application/ports/IResourceDetector');
+
+// Lazy-loaded AWS SDK clients
+let EC2Client, DescribeVpcsCommand, DescribeSubnetsCommand, DescribeSecurityGroupsCommand,
+    DescribeRouteTablesCommand;
+let RDSClient, DescribeDBClustersCommand;
+let KMSClient, ListKeysCommand, DescribeKeyCommand, ListAliasesCommand;
+
+/**
+ * Lazy load EC2 SDK
+ */
+function loadEC2() {
+    if (!EC2Client) {
+        const ec2Module = require('@aws-sdk/client-ec2');
+        EC2Client = ec2Module.EC2Client;
+        DescribeVpcsCommand = ec2Module.DescribeVpcsCommand;
+        DescribeSubnetsCommand = ec2Module.DescribeSubnetsCommand;
+        DescribeSecurityGroupsCommand = ec2Module.DescribeSecurityGroupsCommand;
+        DescribeRouteTablesCommand = ec2Module.DescribeRouteTablesCommand;
+    }
+}
+
+/**
+ * Lazy load RDS SDK
+ */
+function loadRDS() {
+    if (!RDSClient) {
+        const rdsModule = require('@aws-sdk/client-rds');
+        RDSClient = rdsModule.RDSClient;
+        DescribeDBClustersCommand = rdsModule.DescribeDBClustersCommand;
+    }
+}
+
+/**
+ * Lazy load KMS SDK
+ */
+function loadKMS() {
+    if (!KMSClient) {
+        const kmsModule = require('@aws-sdk/client-kms');
+        KMSClient = kmsModule.KMSClient;
+        ListKeysCommand = kmsModule.ListKeysCommand;
+        DescribeKeyCommand = kmsModule.DescribeKeyCommand;
+        ListAliasesCommand = kmsModule.ListAliasesCommand;
+    }
+}
+
+class AWSResourceDetector extends IResourceDetector {
+    /**
+     * Supported resource types
+     * @private
+     */
+    static SUPPORTED_TYPES = [
+        'AWS::EC2::VPC',
+        'AWS::EC2::Subnet',
+        'AWS::EC2::SecurityGroup',
+        'AWS::EC2::RouteTable',
+        'AWS::RDS::DBCluster',
+        'AWS::KMS::Key',
+    ];
+
+    /**
+     * Create AWS Resource Detector
+     *
+     * @param {Object} [config={}]
+     * @param {string} [config.region] - AWS region (defaults to AWS_REGION env var)
+     */
+    constructor(config = {}) {
+        super();
+        this.region = config.region || process.env.AWS_REGION || 'us-east-1';
+        this.ec2Client = null;
+        this.rdsClient = null;
+        this.kmsClient = null;
+    }
+
+    /**
+     * Get or create EC2 client
+     * @private
+     */
+    _getEC2Client() {
+        if (!this.ec2Client) {
+            loadEC2();
+            this.ec2Client = new EC2Client({ region: this.region });
+        }
+        return this.ec2Client;
+    }
+
+    /**
+     * Get or create RDS client
+     * @private
+     */
+    _getRDSClient() {
+        if (!this.rdsClient) {
+            loadRDS();
+            this.rdsClient = new RDSClient({ region: this.region });
+        }
+        return this.rdsClient;
+    }
+
+    /**
+     * Get or create KMS client
+     * @private
+     */
+    _getKMSClient() {
+        if (!this.kmsClient) {
+            loadKMS();
+            this.kmsClient = new KMSClient({ region: this.region });
+        }
+        return this.kmsClient;
+    }
+
+    /**
+     * Get list of supported resource types
+     */
+    async getSupportedResourceTypes() {
+        return [...AWSResourceDetector.SUPPORTED_TYPES];
+    }
+
+    /**
+     * Detect all resources of a specific type in a region
+     */
+    async detectResources({ resourceType, region, filters = {} }) {
+        if (!AWSResourceDetector.SUPPORTED_TYPES.includes(resourceType)) {
+            throw new Error(`Resource type ${resourceType} is not supported`);
+        }
+
+        switch (resourceType) {
+            case 'AWS::EC2::VPC':
+                return await this._detectVPCs(filters);
+            case 'AWS::EC2::Subnet':
+                return await this._detectSubnets(filters);
+            case 'AWS::EC2::SecurityGroup':
+                return await this._detectSecurityGroups(filters);
+            case 'AWS::EC2::RouteTable':
+                return await this._detectRouteTables(filters);
+            case 'AWS::RDS::DBCluster':
+                return await this._detectDBClusters(filters);
+            case 'AWS::KMS::Key':
+                return await this._detectKMSKeys(filters);
+            default:
+                throw new Error(`Resource type ${resourceType} is not supported`);
+        }
+    }
+
+    /**
+     * Get details for a specific resource
+     */
+    async getResourceDetails({ resourceType, physicalId, region }) {
+        const resources = await this.detectResources({ resourceType, region });
+
+        const resource = resources.find((r) => r.physicalId === physicalId);
+
+        if (!resource) {
+            throw new Error(`Resource ${physicalId} not found`);
+        }
+
+        return resource;
+    }
+
+    /**
+     * Check if a resource exists
+     */
+    async resourceExists({ resourceType, physicalId, region }) {
+        try {
+            await this.getResourceDetails({ resourceType, physicalId, region });
+            return true;
+        } catch (error) {
+            if (error.message?.includes('not found')) {
+                return false;
+            }
+            throw error;
+        }
+    }
+
+    /**
+     * Detect resources by tags
+     */
+    async detectResourcesByTags({ tags, region, resourceTypes = [] }) {
+        const types = resourceTypes.length > 0 ? resourceTypes : AWSResourceDetector.SUPPORTED_TYPES;
+
+        const allResources = [];
+
+        for (const resourceType of types) {
+            const resources = await this.detectResources({
+                resourceType,
+                region,
+                filters: { tags },
+            });
+
+            allResources.push(...resources);
+        }
+
+        return allResources;
+    }
+
+    /**
+     * Find orphaned resources (exist in cloud but not in any stack)
+     */
+    async findOrphanedResources({ region, resourceTypes = [], excludePhysicalIds = [] }) {
+        const types = resourceTypes.length > 0 ? resourceTypes : AWSResourceDetector.SUPPORTED_TYPES;
+
+        const orphans = [];
+
+        for (const resourceType of types) {
+            const resources = await this.detectResources({ resourceType, region });
+
+            for (const resource of resources) {
+                // Exclude specified physical IDs
+                if (excludePhysicalIds.includes(resource.physicalId)) {
+                    continue;
+                }
+
+                // Mark as orphaned (in real implementation, would check CloudFormation stacks)
+                orphans.push({
+                    ...resource,
+                    isOrphaned: true,
+                    reason: `Resource ${resource.physicalId} exists in cloud but is not managed by CloudFormation`,
+                });
+            }
+        }
+
+        return orphans;
+    }
+
+    // ========================================
+    // Private Resource Detection Methods
+    // ========================================
+
+    /**
+     * Detect VPCs
+     * @private
+     */
+    async _detectVPCs(filters) {
+        const client = this._getEC2Client();
+
+        const command = new DescribeVpcsCommand({});
+        const response = await client.send(command);
+
+        const vpcs = response.Vpcs || [];
+
+        return vpcs
+            .filter((vpc) => this._matchesTagFilter(vpc.Tags, filters.tags))
+            .map((vpc) => ({
+                physicalId: vpc.VpcId,
+                resourceType: 'AWS::EC2::VPC',
+                properties: {
+                    VpcId: vpc.VpcId,
+                    CidrBlock: vpc.CidrBlock,
+                    State: vpc.State,
+                    EnableDnsHostnames: vpc.EnableDnsHostnames,
+                    EnableDnsSupport: vpc.EnableDnsSupport,
+                },
+                tags: this._parseTags(vpc.Tags),
+                createdTime: new Date(), // VPCs don't have creation time in API
+            }));
+    }
+
+    /**
+     * Detect Subnets
+     * @private
+     */
+    async _detectSubnets(filters) {
+        const client = this._getEC2Client();
+
+        const command = new DescribeSubnetsCommand({});
+        const response = await client.send(command);
+
+        const subnets = response.Subnets || [];
+
+        return subnets
+            .filter((subnet) => this._matchesTagFilter(subnet.Tags, filters.tags))
+            .map((subnet) => ({
+                physicalId: subnet.SubnetId,
+                resourceType: 'AWS::EC2::Subnet',
+                properties: {
+                    SubnetId: subnet.SubnetId,
+                    VpcId: subnet.VpcId,
+                    CidrBlock: subnet.CidrBlock,
+                    AvailabilityZone: subnet.AvailabilityZone,
+                    State: subnet.State,
+                },
+                tags: this._parseTags(subnet.Tags),
+                createdTime: new Date(),
+            }));
+    }
+
+    /**
+     * Detect SecurityGroups
+     * @private
+     */
+    async _detectSecurityGroups(filters) {
+        const client = this._getEC2Client();
+
+        const command = new DescribeSecurityGroupsCommand({});
+        const response = await client.send(command);
+
+        const securityGroups = response.SecurityGroups || [];
+
+        return securityGroups
+            .filter((sg) => this._matchesTagFilter(sg.Tags, filters.tags))
+            .map((sg) => ({
+                physicalId: sg.GroupId,
+                resourceType: 'AWS::EC2::SecurityGroup',
+                properties: {
+                    GroupId: sg.GroupId,
+                    GroupName: sg.GroupName,
+                    Description: sg.Description,
+                    VpcId: sg.VpcId,
+                },
+                tags: this._parseTags(sg.Tags),
+                createdTime: new Date(),
+            }));
+    }
+
+    /**
+     * Detect RouteTables
+     * @private
+     */
+    async _detectRouteTables(filters) {
+        const client = this._getEC2Client();
+
+        const command = new DescribeRouteTablesCommand({});
+        const response = await client.send(command);
+
+        const routeTables = response.RouteTables || [];
+
+        return routeTables
+            .filter((rt) => this._matchesTagFilter(rt.Tags, filters.tags))
+            .map((rt) => ({
+                physicalId: rt.RouteTableId,
+                resourceType: 'AWS::EC2::RouteTable',
+                properties: {
+                    RouteTableId: rt.RouteTableId,
+                    VpcId: rt.VpcId,
+                    Routes: rt.Routes,
+                    Associations: rt.Associations,
+                },
+                tags: this._parseTags(rt.Tags),
+                createdTime: new Date(),
+            }));
+    }
+
+    /**
+     * Detect RDS DBClusters
+     * @private
+     */
+    async _detectDBClusters(filters) {
+        const client = this._getRDSClient();
+
+        const command = new DescribeDBClustersCommand({});
+        const response = await client.send(command);
+
+        const dbClusters = response.DBClusters || [];
+
+        return dbClusters
+            .filter((cluster) => this._matchesTagFilter(cluster.TagList, filters.tags))
+            .map((cluster) => ({
+                physicalId: cluster.DBClusterIdentifier,
+                resourceType: 'AWS::RDS::DBCluster',
+                properties: {
+                    DBClusterIdentifier: cluster.DBClusterIdentifier,
+                    DBClusterArn: cluster.DBClusterArn,
+                    Engine: cluster.Engine,
+                    EngineVersion: cluster.EngineVersion,
+                    Status: cluster.Status,
+                },
+                tags: this._parseTags(cluster.TagList),
+                createdTime: cluster.ClusterCreateTime,
+            }));
+    }
+
+    /**
+     * Detect KMS Keys
+     * @private
+     */
+    async _detectKMSKeys(filters) {
+        const client = this._getKMSClient();
+
+        // List all keys
+        const listCommand = new ListKeysCommand({});
+        const listResponse = await client.send(listCommand);
+
+        const keys = listResponse.Keys || [];
+        const resources = [];
+
+        // Get details for each key
+        for (const key of keys) {
+            const describeCommand = new DescribeKeyCommand({ KeyId: key.KeyId });
+            const describeResponse = await client.send(describeCommand);
+            const keyMetadata = describeResponse.KeyMetadata;
+
+            // Get aliases for this key
+            const aliasCommand = new ListAliasesCommand({ KeyId: key.KeyId });
+            const aliasResponse = await client.send(aliasCommand);
+
+            resources.push({
+                physicalId: keyMetadata.KeyId,
+                resourceType: 'AWS::KMS::Key',
+                properties: {
+                    KeyId: keyMetadata.KeyId,
+                    Arn: keyMetadata.Arn,
+                    Enabled: keyMetadata.Enabled,
+                    KeyState: keyMetadata.KeyState,
+                    KeyManager: keyMetadata.KeyManager,
+                },
+                tags: {}, // KMS uses separate tagging API
+                createdTime: keyMetadata.CreationDate,
+            });
+        }
+
+        return resources;
+    }
+
+    // ========================================
+    // Private Helper Methods
+    // ========================================
+
+    /**
+     * Parse AWS tags to key-value object
+     * @private
+     */
+    _parseTags(tags) {
+        if (!tags || tags.length === 0) {
+            return {};
+        }
+
+        const result = {};
+        for (const tag of tags) {
+            result[tag.Key] = tag.Value;
+        }
+        return result;
+    }
+
+    /**
+     * Check if resource tags match filter
+     * @private
+     */
+    _matchesTagFilter(resourceTags, filterTags) {
+        if (!filterTags || Object.keys(filterTags).length === 0) {
+            return true; // No filter, match all
+        }
+
+        const tags = this._parseTags(resourceTags);
+
+        // Check if all filter tags match
+        for (const [key, value] of Object.entries(filterTags)) {
+            if (tags[key] !== value) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+}
+
+module.exports = AWSResourceDetector;

package/infrastructure/domains/health/infrastructure/adapters/aws-resource-detector.test.js

@@ -0,0 +1,497 @@
+/**
+ * Tests for AWSResourceDetector Adapter
+ *
+ * Tests AWS resource discovery for EC2, RDS, and KMS resources
+ */
+
+const AWSResourceDetector = require('./aws-resource-detector');
+
+// Mock AWS SDK
+jest.mock('@aws-sdk/client-ec2', () => ({
+    EC2Client: jest.fn(),
+    DescribeVpcsCommand: jest.fn(),
+    DescribeSubnetsCommand: jest.fn(),
+    DescribeSecurityGroupsCommand: jest.fn(),
+    DescribeRouteTablesCommand: jest.fn(),
+}));
+
+jest.mock('@aws-sdk/client-rds', () => ({
+    RDSClient: jest.fn(),
+    DescribeDBClustersCommand: jest.fn(),
+}));
+
+jest.mock('@aws-sdk/client-kms', () => ({
+    KMSClient: jest.fn(),
+    ListKeysCommand: jest.fn(),
+    DescribeKeyCommand: jest.fn(),
+    ListAliasesCommand: jest.fn(),
+}));
+
+describe('AWSResourceDetector', () => {
+    let detector;
+    let mockEC2Send;
+    let mockRDSSend;
+    let mockKMSSend;
+
+    beforeEach(() => {
+        jest.clearAllMocks();
+
+        // Mock EC2 client
+        mockEC2Send = jest.fn();
+        const { EC2Client } = require('@aws-sdk/client-ec2');
+        EC2Client.mockImplementation(() => ({ send: mockEC2Send }));
+
+        // Mock RDS client
+        mockRDSSend = jest.fn();
+        const { RDSClient } = require('@aws-sdk/client-rds');
+        RDSClient.mockImplementation(() => ({ send: mockRDSSend }));
+
+        // Mock KMS client
+        mockKMSSend = jest.fn();
+        const { KMSClient } = require('@aws-sdk/client-kms');
+        KMSClient.mockImplementation(() => ({ send: mockKMSSend }));
+
+        detector = new AWSResourceDetector({ region: 'us-east-1' });
+    });
+
+    describe('getSupportedResourceTypes', () => {
+        it('should return list of supported resource types', async () => {
+            const types = await detector.getSupportedResourceTypes();
+
+            expect(types).toContain('AWS::EC2::VPC');
+            expect(types).toContain('AWS::EC2::Subnet');
+            expect(types).toContain('AWS::EC2::SecurityGroup');
+            expect(types).toContain('AWS::EC2::RouteTable');
+            expect(types).toContain('AWS::RDS::DBCluster');
+            expect(types).toContain('AWS::KMS::Key');
+            expect(types).toHaveLength(6);
+        });
+    });
+
+    describe('detectResources - VPC', () => {
+        it('should detect VPCs', async () => {
+            mockEC2Send.mockResolvedValue({
+                Vpcs: [
+                    {
+                        VpcId: 'vpc-123',
+                        CidrBlock: '10.0.0.0/16',
+                        State: 'available',
+                        Tags: [{ Key: 'Name', Value: 'Main VPC' }],
+                    },
+                    {
+                        VpcId: 'vpc-456',
+                        CidrBlock: '10.1.0.0/16',
+                        State: 'available',
+                        Tags: [],
+                    },
+                ],
+            });
+
+            const resources = await detector.detectResources({
+                resourceType: 'AWS::EC2::VPC',
+                region: 'us-east-1',
+            });
+
+            expect(resources).toHaveLength(2);
+            expect(resources[0]).toEqual({
+                physicalId: 'vpc-123',
+                resourceType: 'AWS::EC2::VPC',
+                properties: {
+                    VpcId: 'vpc-123',
+                    CidrBlock: '10.0.0.0/16',
+                    State: 'available',
+                },
+                tags: { Name: 'Main VPC' },
+                createdTime: expect.any(Date),
+            });
+        });
+
+        it('should filter VPCs by tags', async () => {
+            mockEC2Send.mockResolvedValue({
+                Vpcs: [
+                    {
+                        VpcId: 'vpc-123',
+                        CidrBlock: '10.0.0.0/16',
+                        State: 'available',
+                        Tags: [{ Key: 'Environment', Value: 'production' }],
+                    },
+                ],
+            });
+
+            const resources = await detector.detectResources({
+                resourceType: 'AWS::EC2::VPC',
+                region: 'us-east-1',
+                filters: { tags: { Environment: 'production' } },
+            });
+
+            expect(resources).toHaveLength(1);
+            expect(resources[0].tags).toEqual({ Environment: 'production' });
+        });
+    });
+
+    describe('detectResources - Subnet', () => {
+        it('should detect Subnets', async () => {
+            mockEC2Send.mockResolvedValue({
+                Subnets: [
+                    {
+                        SubnetId: 'subnet-123',
+                        VpcId: 'vpc-123',
+                        CidrBlock: '10.0.1.0/24',
+                        AvailabilityZone: 'us-east-1a',
+                        State: 'available',
+                        Tags: [{ Key: 'Name', Value: 'Private Subnet' }],
+                    },
+                ],
+            });
+
+            const resources = await detector.detectResources({
+                resourceType: 'AWS::EC2::Subnet',
+                region: 'us-east-1',
+            });
+
+            expect(resources).toHaveLength(1);
+            expect(resources[0].physicalId).toBe('subnet-123');
+            expect(resources[0].properties.VpcId).toBe('vpc-123');
+        });
+    });
+
+    describe('detectResources - SecurityGroup', () => {
+        it('should detect SecurityGroups', async () => {
+            mockEC2Send.mockResolvedValue({
+                SecurityGroups: [
+                    {
+                        GroupId: 'sg-123',
+                        GroupName: 'default',
+                        Description: 'Default security group',
+                        VpcId: 'vpc-123',
+                        Tags: [],
+                    },
+                ],
+            });
+
+            const resources = await detector.detectResources({
+                resourceType: 'AWS::EC2::SecurityGroup',
+                region: 'us-east-1',
+            });
+
+            expect(resources).toHaveLength(1);
+            expect(resources[0].physicalId).toBe('sg-123');
+        });
+    });
+
+    describe('detectResources - RouteTable', () => {
+        it('should detect RouteTables', async () => {
+            mockEC2Send.mockResolvedValue({
+                RouteTables: [
+                    {
+                        RouteTableId: 'rtb-123',
+                        VpcId: 'vpc-123',
+                        Routes: [],
+                        Associations: [],
+                        Tags: [{ Key: 'Name', Value: 'Main Route Table' }],
+                    },
+                ],
+            });
+
+            const resources = await detector.detectResources({
+                resourceType: 'AWS::EC2::RouteTable',
+                region: 'us-east-1',
+            });
+
+            expect(resources).toHaveLength(1);
+            expect(resources[0].physicalId).toBe('rtb-123');
+        });
+    });
+
+    describe('detectResources - RDS DBCluster', () => {
+        it('should detect RDS DBClusters', async () => {
+            mockRDSSend.mockResolvedValue({
+                DBClusters: [
+                    {
+                        DBClusterIdentifier: 'my-aurora-cluster',
+                        DBClusterArn: 'arn:aws:rds:us-east-1:123456789012:cluster:my-aurora-cluster',
+                        Engine: 'aurora-postgresql',
+                        EngineVersion: '13.7',
+                        Status: 'available',
+                        ClusterCreateTime: new Date('2024-01-01T00:00:00Z'),
+                        TagList: [{ Key: 'Environment', Value: 'production' }],
+                    },
+                ],
+            });
+
+            const resources = await detector.detectResources({
+                resourceType: 'AWS::RDS::DBCluster',
+                region: 'us-east-1',
+            });
+
+            expect(resources).toHaveLength(1);
+            expect(resources[0]).toEqual({
+                physicalId: 'my-aurora-cluster',
+                resourceType: 'AWS::RDS::DBCluster',
+                properties: {
+                    DBClusterIdentifier: 'my-aurora-cluster',
+                    DBClusterArn: 'arn:aws:rds:us-east-1:123456789012:cluster:my-aurora-cluster',
+                    Engine: 'aurora-postgresql',
+                    EngineVersion: '13.7',
+                    Status: 'available',
+                },
+                tags: { Environment: 'production' },
+                createdTime: new Date('2024-01-01T00:00:00Z'),
+            });
+        });
+    });
+
+    describe('detectResources - KMS Key', () => {
+        it('should detect KMS Keys', async () => {
+            // First call: ListKeys
+            mockKMSSend.mockResolvedValueOnce({
+                Keys: [
+                    { KeyId: 'key-123', KeyArn: 'arn:aws:kms:us-east-1:123456789012:key/key-123' },
+                ],
+            });
+
+            // Second call: DescribeKey for key-123
+            mockKMSSend.mockResolvedValueOnce({
+                KeyMetadata: {
+                    KeyId: 'key-123',
+                    Arn: 'arn:aws:kms:us-east-1:123456789012:key/key-123',
+                    CreationDate: new Date('2024-01-01T00:00:00Z'),
+                    Enabled: true,
+                    KeyState: 'Enabled',
+                    KeyManager: 'CUSTOMER',
+                },
+            });
+
+            // Third call: ListAliases for key-123
+            mockKMSSend.mockResolvedValueOnce({
+                Aliases: [{ AliasName: 'alias/my-key', TargetKeyId: 'key-123' }],
+            });
+
+            const resources = await detector.detectResources({
+                resourceType: 'AWS::KMS::Key',
+                region: 'us-east-1',
+            });
+
+            expect(resources).toHaveLength(1);
+            expect(resources[0].physicalId).toBe('key-123');
+            expect(resources[0].properties.KeyState).toBe('Enabled');
+            expect(mockKMSSend).toHaveBeenCalledTimes(3);
+        });
+    });
+
+    describe('detectResources - unsupported type', () => {
+        it('should throw error for unsupported resource type', async () => {
+            await expect(
+                detector.detectResources({
+                    resourceType: 'AWS::Lambda::Function',
+                    region: 'us-east-1',
+                })
+            ).rejects.toThrow('Resource type AWS::Lambda::Function is not supported');
+        });
+    });
+
+    describe('getResourceDetails', () => {
+        it('should get VPC details', async () => {
+            mockEC2Send.mockResolvedValue({
+                Vpcs: [
+                    {
+                        VpcId: 'vpc-123',
+                        CidrBlock: '10.0.0.0/16',
+                        State: 'available',
+                        EnableDnsHostnames: true,
+                        EnableDnsSupport: true,
+                        Tags: [{ Key: 'Name', Value: 'Main VPC' }],
+                    },
+                ],
+            });
+
+            const resource = await detector.getResourceDetails({
+                resourceType: 'AWS::EC2::VPC',
+                physicalId: 'vpc-123',
+                region: 'us-east-1',
+            });
+
+            expect(resource.physicalId).toBe('vpc-123');
+            expect(resource.properties.EnableDnsHostnames).toBe(true);
+        });
+
+        it('should get RDS DBCluster details', async () => {
+            mockRDSSend.mockResolvedValue({
+                DBClusters: [
+                    {
+                        DBClusterIdentifier: 'my-cluster',
+                        Engine: 'aurora-postgresql',
+                        EngineVersion: '13.7',
+                        Status: 'available',
+                        ClusterCreateTime: new Date('2024-01-01T00:00:00Z'),
+                    },
+                ],
+            });
+
+            const resource = await detector.getResourceDetails({
+                resourceType: 'AWS::RDS::DBCluster',
+                physicalId: 'my-cluster',
+                region: 'us-east-1',
+            });
+
+            expect(resource.physicalId).toBe('my-cluster');
+            expect(resource.properties.Engine).toBe('aurora-postgresql');
+        });
+
+        it('should throw error if resource not found', async () => {
+            mockEC2Send.mockResolvedValue({ Vpcs: [] });
+
+            await expect(
+                detector.getResourceDetails({
+                    resourceType: 'AWS::EC2::VPC',
+                    physicalId: 'vpc-nonexistent',
+                    region: 'us-east-1',
+                })
+            ).rejects.toThrow('Resource vpc-nonexistent not found');
+        });
+    });
+
+    describe('resourceExists', () => {
+        it('should return true if VPC exists', async () => {
+            mockEC2Send.mockResolvedValue({
+                Vpcs: [{ VpcId: 'vpc-123' }],
+            });
+
+            const exists = await detector.resourceExists({
+                resourceType: 'AWS::EC2::VPC',
+                physicalId: 'vpc-123',
+                region: 'us-east-1',
+            });
+
+            expect(exists).toBe(true);
+        });
+
+        it('should return false if VPC does not exist', async () => {
+            mockEC2Send.mockResolvedValue({ Vpcs: [] });
+
+            const exists = await detector.resourceExists({
+                resourceType: 'AWS::EC2::VPC',
+                physicalId: 'vpc-nonexistent',
+                region: 'us-east-1',
+            });
+
+            expect(exists).toBe(false);
+        });
+    });
+
+    describe('detectResourcesByTags', () => {
+        it('should detect resources matching tags', async () => {
+            // VPCs
+            mockEC2Send.mockResolvedValueOnce({
+                Vpcs: [
+                    {
+                        VpcId: 'vpc-123',
+                        CidrBlock: '10.0.0.0/16',
+                        State: 'available',
+                        Tags: [{ Key: 'Environment', Value: 'production' }],
+                    },
+                ],
+            });
+
+            // Subnets
+            mockEC2Send.mockResolvedValueOnce({
+                Subnets: [
+                    {
+                        SubnetId: 'subnet-123',
+                        VpcId: 'vpc-123',
+                        CidrBlock: '10.0.1.0/24',
+                        State: 'available',
+                        Tags: [{ Key: 'Environment', Value: 'production' }],
+                    },
+                ],
+            });
+
+            const resources = await detector.detectResourcesByTags({
+                tags: { Environment: 'production' },
+                region: 'us-east-1',
+                resourceTypes: ['AWS::EC2::VPC', 'AWS::EC2::Subnet'],
+            });
+
+            expect(resources).toHaveLength(2);
+            expect(resources[0].physicalId).toBe('vpc-123');
+            expect(resources[1].physicalId).toBe('subnet-123');
+        });
+
+        it('should detect all supported types if resourceTypes not specified', async () => {
+            // Mock responses for all supported types
+            mockEC2Send.mockResolvedValueOnce({ Vpcs: [] });
+            mockEC2Send.mockResolvedValueOnce({ Subnets: [] });
+            mockEC2Send.mockResolvedValueOnce({ SecurityGroups: [] });
+            mockEC2Send.mockResolvedValueOnce({ RouteTables: [] });
+            mockRDSSend.mockResolvedValueOnce({ DBClusters: [] });
+            mockKMSSend.mockResolvedValueOnce({ Keys: [] });
+
+            const resources = await detector.detectResourcesByTags({
+                tags: { Team: 'platform' },
+                region: 'us-east-1',
+            });
+
+            expect(resources).toEqual([]);
+            expect(mockEC2Send).toHaveBeenCalledTimes(4);
+            expect(mockRDSSend).toHaveBeenCalledTimes(1);
+            expect(mockKMSSend).toHaveBeenCalledTimes(1);
+        });
+    });
+
+    describe('findOrphanedResources', () => {
+        it('should find orphaned RDS DBCluster', async () => {
+            mockRDSSend.mockResolvedValue({
+                DBClusters: [
+                    {
+                        DBClusterIdentifier: 'orphan-cluster',
+                        DBClusterArn: 'arn:aws:rds:us-east-1:123456789012:cluster:orphan-cluster',
+                        Engine: 'aurora-postgresql',
+                        Status: 'available',
+                        ClusterCreateTime: new Date('2024-01-01T00:00:00Z'),
+                        TagList: [],
+                    },
+                ],
+            });
+
+            const orphans = await detector.findOrphanedResources({
+                region: 'us-east-1',
+                resourceTypes: ['AWS::RDS::DBCluster'],
+            });
+
+            expect(orphans).toHaveLength(1);
+            expect(orphans[0].physicalId).toBe('orphan-cluster');
+            expect(orphans[0].isOrphaned).toBe(true);
+            expect(orphans[0].reason).toContain('not managed by CloudFormation');
+        });
+
+        it('should exclude specified physical IDs', async () => {
+            mockEC2Send.mockResolvedValue({
+                Vpcs: [
+                    { VpcId: 'vpc-123', CidrBlock: '10.0.0.0/16', State: 'available', Tags: [] },
+                    { VpcId: 'vpc-456', CidrBlock: '10.1.0.0/16', State: 'available', Tags: [] },
+                ],
+            });
+
+            const orphans = await detector.findOrphanedResources({
+                region: 'us-east-1',
+                resourceTypes: ['AWS::EC2::VPC'],
+                excludePhysicalIds: ['vpc-123'],
+            });
+
+            expect(orphans).toHaveLength(1);
+            expect(orphans[0].physicalId).toBe('vpc-456');
+        });
+    });
+
+    describe('constructor', () => {
+        it('should create instance with default region', () => {
+            const det = new AWSResourceDetector();
+            expect(det).toBeInstanceOf(AWSResourceDetector);
+        });
+
+        it('should create instance with custom region', () => {
+            const det = new AWSResourceDetector({ region: 'eu-west-1' });
+            expect(det).toBeInstanceOf(AWSResourceDetector);
+        });
+    });
+});

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@friggframework/devtools",
   "prettier": "@friggframework/prettier-config",
-  "version": "2.0.0--canary.474.efd7936.0",
+  "version": "2.0.0--canary.474.082077e.0",
   "dependencies": {
     "@aws-sdk/client-ec2": "^3.835.0",
     "@aws-sdk/client-kms": "^3.835.0",
@@ -11,8 +11,8 @@
     "@babel/eslint-parser": "^7.18.9",
     "@babel/parser": "^7.25.3",
     "@babel/traverse": "^7.25.3",
-    "@friggframework/schemas": "2.0.0--canary.474.efd7936.0",
-    "@friggframework/test": "2.0.0--canary.474.efd7936.0",
+    "@friggframework/schemas": "2.0.0--canary.474.082077e.0",
+    "@friggframework/test": "2.0.0--canary.474.082077e.0",
     "@hapi/boom": "^10.0.1",
     "@inquirer/prompts": "^5.3.8",
     "axios": "^1.7.2",
@@ -34,8 +34,8 @@
     "serverless-http": "^2.7.0"
   },
   "devDependencies": {
-    "@friggframework/eslint-config": "2.0.0--canary.474.efd7936.0",
-    "@friggframework/prettier-config": "2.0.0--canary.474.efd7936.0",
+    "@friggframework/eslint-config": "2.0.0--canary.474.082077e.0",
+    "@friggframework/prettier-config": "2.0.0--canary.474.082077e.0",
     "aws-sdk-client-mock": "^4.1.0",
     "aws-sdk-client-mock-jest": "^4.1.0",
     "jest": "^30.1.3",
@@ -70,5 +70,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "efd79365aef7bb559b15d072ae85000069c61837"
+  "gitHead": "082077ef7bba084fdeaaee60a08f9039542bff40"
 }