alien_core/resources/
remote_stack_management.rs

1use crate::resource::{ResourceDefinition, ResourceOutputsDefinition, ResourceRef, ResourceType};
2use alien_error::AlienError;
3use bon::Builder;
4use serde::{Deserialize, Serialize};
5use std::any::Any;
6use std::fmt::Debug;
7
8/// Represents cross-account management access configuration for a stack deployed
9/// on AWS, GCP, or Azure platforms. This resource sets up the necessary IAM/RBAC
10/// configuration to allow another cloud account to manage the stack.
11///
12/// Maps to:
13/// - AWS: Cross-account IAM role with management permissions
14/// - GCP: Service account with management permissions and impersonation rights
15/// - Azure: Lighthouse registration definition and assignment
16///
17/// This resource is automatically created for AWS, GCP, and Azure platforms
18/// when the stack needs to be managed by another account. The management account
19/// and identity information comes from the platform configuration.
20#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Builder)]
21#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
22#[serde(rename_all = "camelCase", deny_unknown_fields)]
23#[builder(start_fn = new)]
24pub struct RemoteStackManagement {
25    /// Identifier for the remote stack management. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]).
26    /// Maximum 64 characters.
27    #[builder(start_fn)]
28    pub id: String,
29}
30
31impl RemoteStackManagement {
32    /// The resource type identifier for RemoteStackManagement
33    pub const RESOURCE_TYPE: ResourceType = ResourceType::from_static("remote-stack-management");
34
35    /// Returns the remote stack management's unique identifier.
36    pub fn id(&self) -> &str {
37        &self.id
38    }
39}
40
41/// Resource outputs for RemoteStackManagement.
42/// Different platforms will provide different outputs based on their implementation.
43#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
44#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
45#[serde(rename_all = "camelCase", deny_unknown_fields)]
46pub struct RemoteStackManagementOutputs {
47    /// Platform-specific management resource identifier
48    /// For AWS: The ARN of the created cross-account role
49    /// For GCP: The email of the created service account
50    /// For Azure: The resource ID of the lighthouse registration
51    pub management_resource_id: String,
52
53    /// Platform-specific access configuration
54    /// For AWS: The role ARN to assume
55    /// For GCP: The service account email to impersonate
56    /// For Azure: The lighthouse registration assignment ID
57    pub access_configuration: String,
58}
59
60// Implementation of ResourceDefinition trait for RemoteStackManagement
61#[typetag::serde(name = "remote-stack-management")]
62impl ResourceDefinition for RemoteStackManagement {
63    fn resource_type() -> ResourceType {
64        Self::RESOURCE_TYPE.clone()
65    }
66
67    fn get_resource_type(&self) -> ResourceType {
68        Self::resource_type()
69    }
70
71    fn id(&self) -> &str {
72        &self.id
73    }
74
75    fn get_dependencies(&self) -> Vec<ResourceRef> {
76        // RemoteStackManagement typically doesn't depend on other resources,
77        // but may depend on infrastructure requirements like resource groups
78        Vec::new()
79    }
80
81    fn validate_update(&self, new_config: &dyn ResourceDefinition) -> crate::error::Result<()> {
82        // Try to downcast to RemoteStackManagement for type-specific validation
83        if let Some(new_remote_mgmt) = new_config.as_any().downcast_ref::<RemoteStackManagement>() {
84            // Validate that the ID matches
85            if self.id != new_remote_mgmt.id {
86                return Err(AlienError::new(
87                    crate::error::ErrorData::InvalidResourceUpdate {
88                        resource_id: self.id.clone(),
89                        reason: "the 'id' field is immutable".to_string(),
90                    },
91                ));
92            }
93
94            // RemoteStackManagement configuration can be updated
95            Ok(())
96        } else {
97            Err(AlienError::new(
98                crate::error::ErrorData::UnexpectedResourceType {
99                    resource_id: self.id.clone(),
100                    expected: Self::RESOURCE_TYPE,
101                    actual: new_config.get_resource_type(),
102                },
103            ))
104        }
105    }
106
107    fn as_any(&self) -> &dyn Any {
108        self
109    }
110
111    fn as_any_mut(&mut self) -> &mut dyn Any {
112        self
113    }
114
115    fn box_clone(&self) -> Box<dyn ResourceDefinition> {
116        Box::new(self.clone())
117    }
118
119    fn resource_eq(&self, other: &dyn ResourceDefinition) -> bool {
120        other
121            .as_any()
122            .downcast_ref::<RemoteStackManagement>()
123            .map(|other_remote_mgmt| self == other_remote_mgmt)
124            .unwrap_or(false)
125    }
126}
127
128#[typetag::serde(name = "remote-stack-management")]
129impl ResourceOutputsDefinition for RemoteStackManagementOutputs {
130    fn resource_type() -> ResourceType {
131        RemoteStackManagement::RESOURCE_TYPE.clone()
132    }
133
134    fn as_any(&self) -> &dyn Any {
135        self
136    }
137
138    fn box_clone(&self) -> Box<dyn ResourceOutputsDefinition> {
139        Box::new(self.clone())
140    }
141
142    fn outputs_eq(&self, other: &dyn ResourceOutputsDefinition) -> bool {
143        other
144            .as_any()
145            .downcast_ref::<RemoteStackManagementOutputs>()
146            == Some(self)
147    }
148}
alien_core/resources/remote_stack_management.rs

alien_core/resources/
remote_stack_management.rs
