feat: Add StreamWorkspace CloudFormation resource

cfn-resources/stream-workspace/.rpdk-config

@@ -0,0 +1,22 @@
+{
+    "artifact_type": "RESOURCE",
+    "typeName": "MongoDB::Atlas::StreamWorkspace",
+    "language": "go",
+    "runtime": "provided.al2",
+    "entrypoint": "bootstrap",
+    "testEntrypoint": "bootstrap",
+    "settings": {
+        "version": false,
+        "subparser_name": null,
+        "verbose": 0,
+        "force": false,
+        "type_name": "MongoDB::Atlas::StreamWorkspace",
+        "artifact_type": null,
+        "endpoint_url": null,
+        "region": null,
+        "target_schemas": [],
+        "profile": null,
+        "import_path": "github.com/mongodb/mongodbatlas-cloudformation-resources/stream-workspace",
+        "protocolVersion": "2.0.0"
+    }
+}

cfn-resources/stream-workspace/Makefile

@@ -0,0 +1,33 @@
+.PHONY: build test clean
+tags=logging callback metrics scheduler
+cgo=0
+goos=linux
+goarch=amd64
+CFNREP_GIT_SHA?=$(shell git rev-parse HEAD)
+ldXflags=-s -w -X github.com/mongodb/mongodbatlas-cloudformation-resources/util.defaultLogLevel=info -X github.com/mongodb/mongodbatlas-cloudformation-resources/version.Version=${CFNREP_GIT_SHA}
+ldXflagsD=-X github.com/mongodb/mongodbatlas-cloudformation-resources/util.defaultLogLevel=debug -X github.com/mongodb/mongodbatlas-cloudformation-resources/version.Version=${CFNREP_GIT_SHA}
+
+build:
+	cfn generate
+	env GOOS=$(goos) CGO_ENABLED=$(cgo) GOARCH=$(goarch) go build -ldflags="$(ldXflags)" -tags="$(tags)" -o bin/bootstrap cmd/main.go
+
+debug:
+	cfn generate
+	env GOOS=$(goos) CGO_ENABLED=$(cgo) GOARCH=$(goarch) go build -ldflags="$(ldXflagsD)" -tags="$(tags)" -o bin/bootstrap cmd/main.go
+
+clean:
+	rm -rf bin
+
+create-test-resources:
+	@echo "==> Creating test files for contract testing"
+	./test/contract-testing/cfn-test-create-inputs.sh
+
+delete-test-resources:
+	@echo "==> Delete test resources used for contract testing"
+	./test/cfn-test-delete-inputs.sh
+
+run-contract-testing:
+	@echo "==> Run contract testing"
+	make build
+	sam local start-lambda &
+	cfn test --function-name TestEntrypoint --verbose

cfn-resources/stream-workspace/README.md

@@ -0,0 +1,18 @@
+# MongoDB::Atlas::StreamWorkspace
+
+## Description
+
+Resource for managing [Stream Workspaces](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/group/endpoint-streams).
+
+## Requirements
+
+Set up an AWS profile to securely give CloudFormation access to your Atlas credentials.
+For instructions on setting up a profile, [see here](/README.md#mongodb-atlas-api-keys-credential-management).
+
+## Attributes and Parameters
+
+See the [resource docs](docs/README.md). Also refer [AWS security best practices for CloudFormation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/security-best-practices.html#creds) to manage credentials.
+
+## CloudFormation Examples
+
+See the examples [CFN Template](/examples/stream-workspace/stream-workspace.json) for example resource.

cfn-resources/stream-workspace/cmd/resource/mappings.go

@@ -0,0 +1,143 @@
+// Copyright 2026 MongoDB Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package resource
+
+import "go.mongodb.org/atlas-sdk/v20250312010/admin"
+
+func NewStreamWorkspaceCreateReq(model *Model) *admin.StreamsTenant {
+	if model == nil {
+		return nil
+	}
+	dataProcessRegion := *model.DataProcessRegion
+	streamTenant := &admin.StreamsTenant{
+		Name:    model.WorkspaceName,
+		GroupId: model.ProjectId,
+		DataProcessRegion: &admin.StreamsDataProcessRegion{
+			CloudProvider: *dataProcessRegion.CloudProvider,
+			Region:        *dataProcessRegion.Region,
+		},
+	}
+	if streamConfig := model.StreamConfig; streamConfig != nil {
+		streamTenant.StreamConfig = &admin.StreamConfig{}
+		if tier := streamConfig.Tier; tier != nil {
+			streamTenant.StreamConfig.Tier = tier
+		}
+		if maxTierSize := streamConfig.MaxTierSize; maxTierSize != nil {
+			streamTenant.StreamConfig.MaxTierSize = maxTierSize
+		}
+	}
+	return streamTenant
+}
+
+func NewStreamWorkspaceUpdateReq(model *Model) *admin.StreamsDataProcessRegion {
+	if model == nil || model.DataProcessRegion == nil {
+		return nil
+	}
+	dataProcessRegion := *model.DataProcessRegion
+	if dataProcessRegion.Region == nil {
+		return nil
+	}
+	// CloudFormation is AWS-only, so CloudProvider is always AWS
+	return &admin.StreamsDataProcessRegion{
+		CloudProvider: "AWS",
+		Region:        *dataProcessRegion.Region,
+	}
+}
+
+func newModelDataRegion(dataProcessRegion *admin.StreamsDataProcessRegion) *StreamsDataProcessRegion {
+	return &StreamsDataProcessRegion{
+		CloudProvider: &dataProcessRegion.CloudProvider,
+		Region:        &dataProcessRegion.Region,
+	}
+}
+
+func newModelStreamConfig(streamConfig *admin.StreamConfig) *StreamConfig {
+	if streamConfig == nil {
+		return nil
+	}
+	modelConfig := &StreamConfig{}
+	if streamConfig.Tier != nil {
+		modelConfig.Tier = streamConfig.Tier
+	}
+	if streamConfig.MaxTierSize != nil {
+		modelConfig.MaxTierSize = streamConfig.MaxTierSize
+	}
+	return modelConfig
+}
+
+func newModelDBRoleToExecute(dbRole *admin.DBRoleToExecute) *DBRoleToExecute {
+	return &DBRoleToExecute{
+		Role: dbRole.Role,
+		Type: dbRole.Type,
+	}
+}
+
+func newModelAuthentication(authentication *admin.StreamsKafkaAuthentication) *StreamsKafkaAuthentication {
+	return &StreamsKafkaAuthentication{
+		Mechanism: authentication.Mechanism,
+		Username:  authentication.Username,
+	}
+}
+
+func newModelSecurity(security *admin.StreamsKafkaSecurity) *StreamsKafkaSecurity {
+	return &StreamsKafkaSecurity{
+		BrokerPublicCertificate: security.BrokerPublicCertificate,
+		Protocol:                security.Protocol,
+	}
+}
+
+func NewModelConnections(streamConfig *[]admin.StreamsConnection) []StreamsConnection {
+	if streamConfig == nil || len(*streamConfig) == 0 {
+		return nil
+	}
+
+	connections := make([]StreamsConnection, 0)
+	for _, connection := range *streamConfig {
+		modelConnection := StreamsConnection{
+			Name: connection.Name,
+			Type: connection.Type,
+		}
+		if connection.GetType() == Kafka {
+			modelConnection.BootstrapServers = connection.BootstrapServers
+			modelConnection.Authentication = newModelAuthentication(connection.Authentication)
+			modelConnection.Security = newModelSecurity(connection.Security)
+		} else if connection.GetType() == Cluster {
+			modelConnection.ClusterName = connection.ClusterName
+			modelConnection.DbRoleToExecute = newModelDBRoleToExecute(connection.DbRoleToExecute)
+		}
+		connections = append(connections, modelConnection)
+	}
+	return connections
+}
+
+func GetStreamWorkspaceModel(streamTenant *admin.StreamsTenant, currentModel *Model) *Model {
+	model := new(Model)
+
+	if currentModel != nil {
+		model = currentModel
+	}
+
+	if streamTenant != nil {
+		model.WorkspaceName = streamTenant.Name
+		model.DataProcessRegion = newModelDataRegion(streamTenant.DataProcessRegion)
+		model.StreamConfig = newModelStreamConfig(streamTenant.StreamConfig)
+		model.ProjectId = streamTenant.GroupId
+		model.Id = streamTenant.Id
+		model.Hostnames = streamTenant.GetHostnames()
+		model.Connections = NewModelConnections(streamTenant.Connections)
+	}
+
+	return model
+}