alien_core/resources/
remote_stack_management.rs

1use crate::resource::{ResourceDefinition, ResourceOutputsDefinition, ResourceRef, ResourceType};
2use alien_error::AlienError;
3use bon::Builder;
4use serde::{Deserialize, Serialize};
5use std::any::Any;
6use std::fmt::Debug;
7
8/// Represents cross-account management access configuration for a stack deployed
9/// on AWS, GCP, or Azure platforms. This resource sets up the necessary IAM/RBAC
10/// configuration to allow another cloud account to manage the stack.
11///
12/// Maps to:
13/// - AWS: Cross-account IAM role with management permissions
14/// - GCP: Service account with management permissions and impersonation rights
15/// - Azure: Lighthouse registration definition and assignment
16///
17/// This resource is automatically created for AWS, GCP, and Azure platforms
18/// when the stack needs to be managed by another account. The management account
19/// and identity information comes from the platform configuration.
20#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize, Builder)]
21#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
22#[serde(rename_all = "camelCase", deny_unknown_fields)]
23#[builder(start_fn = new)]
24pub struct RemoteStackManagement {
25    /// Identifier for the remote stack management. Must contain only alphanumeric characters, hyphens, and underscores ([A-Za-z0-9-_]).
26    /// Maximum 64 characters.
27    #[builder(start_fn)]
28    pub id: String,
29}
30
31impl RemoteStackManagement {
32    /// The resource type identifier for RemoteStackManagement
33    pub const RESOURCE_TYPE: ResourceType = ResourceType::from_static("remote-stack-management");
34
35    /// Returns the remote stack management's unique identifier.
36    pub fn id(&self) -> &str {
37        &self.id
38    }
39}
40
41/// Resource outputs for RemoteStackManagement.
42/// Different platforms will provide different outputs based on their implementation.
43#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
44#[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
45#[serde(rename_all = "camelCase", deny_unknown_fields)]
46pub struct RemoteStackManagementOutputs {
47    /// Platform-specific management resource identifier
48    /// For AWS: The ARN of the created cross-account role
49    /// For GCP: The email of the created service account
50    /// For Azure: The resource ID of the lighthouse registration
51    pub management_resource_id: String,
52
53    /// Platform-specific access configuration
54    /// For AWS: The role ARN to assume
55    /// For GCP: The service account email to impersonate
56    /// For Azure: The lighthouse registration assignment ID
57    pub access_configuration: String,
58}
59
60// Implementation of ResourceDefinition trait for RemoteStackManagement
61impl ResourceDefinition for RemoteStackManagement {
62    fn get_resource_type(&self) -> ResourceType {
63        Self::RESOURCE_TYPE
64    }
65
66    fn id(&self) -> &str {
67        &self.id
68    }
69
70    fn get_dependencies(&self) -> Vec<ResourceRef> {
71        // RemoteStackManagement typically doesn't depend on other resources,
72        // but may depend on infrastructure requirements like resource groups
73        Vec::new()
74    }
75
76    fn validate_update(&self, new_config: &dyn ResourceDefinition) -> crate::error::Result<()> {
77        // Try to downcast to RemoteStackManagement for type-specific validation
78        if let Some(new_remote_mgmt) = new_config.as_any().downcast_ref::<RemoteStackManagement>() {
79            // Validate that the ID matches
80            if self.id != new_remote_mgmt.id {
81                return Err(AlienError::new(
82                    crate::error::ErrorData::InvalidResourceUpdate {
83                        resource_id: self.id.clone(),
84                        reason: "the 'id' field is immutable".to_string(),
85                    },
86                ));
87            }
88
89            // RemoteStackManagement configuration can be updated
90            Ok(())
91        } else {
92            Err(AlienError::new(
93                crate::error::ErrorData::UnexpectedResourceType {
94                    resource_id: self.id.clone(),
95                    expected: Self::RESOURCE_TYPE,
96                    actual: new_config.get_resource_type(),
97                },
98            ))
99        }
100    }
101
102    fn as_any(&self) -> &dyn Any {
103        self
104    }
105
106    fn as_any_mut(&mut self) -> &mut dyn Any {
107        self
108    }
109
110    fn box_clone(&self) -> Box<dyn ResourceDefinition> {
111        Box::new(self.clone())
112    }
113
114    fn resource_eq(&self, other: &dyn ResourceDefinition) -> bool {
115        other
116            .as_any()
117            .downcast_ref::<RemoteStackManagement>()
118            .map(|other_remote_mgmt| self == other_remote_mgmt)
119            .unwrap_or(false)
120    }
121
122    fn to_json_value(&self) -> serde_json::Result<serde_json::Value> {
123        serde_json::to_value(self)
124    }
125}
126
127impl ResourceOutputsDefinition for RemoteStackManagementOutputs {
128    fn get_resource_type(&self) -> ResourceType {
129        RemoteStackManagement::RESOURCE_TYPE.clone()
130    }
131
132    fn as_any(&self) -> &dyn Any {
133        self
134    }
135
136    fn box_clone(&self) -> Box<dyn ResourceOutputsDefinition> {
137        Box::new(self.clone())
138    }
139
140    fn outputs_eq(&self, other: &dyn ResourceOutputsDefinition) -> bool {
141        other
142            .as_any()
143            .downcast_ref::<RemoteStackManagementOutputs>()
144            == Some(self)
145    }
146
147    fn to_json_value(&self) -> serde_json::Result<serde_json::Value> {
148        serde_json::to_value(self)
149    }
150}
alien_core/resources/remote_stack_management.rs

alien_core/resources/
remote_stack_management.rs
