☁️ AWS Interview Questions

# ── List all Regions ──
aws ec2 describe-regions --query "Regions[].RegionName" --output table

# ── List AZs in current Region ──
aws ec2 describe-availability-zones \
    --query "AvailabilityZones[].{Zone:ZoneName,State:State,Type:ZoneType}" \
    --output table

# Output:
# | Zone           | State      | Type              |
# | us-east-1a     | available  | availability-zone |
# | us-east-1b     | available  | availability-zone |
# | us-east-1c     | available  | availability-zone |

# ── CloudFormation: Multi-AZ deployment ──
# Resources:
#   MyVPC:
#     Type: AWS::EC2::VPC
#     Properties:
#       CidrBlock: 10.0.0.0/16
#
#   SubnetAZ1:
#     Type: AWS::EC2::Subnet
#     Properties:
#       VpcId: !Ref MyVPC
#       CidrBlock: 10.0.1.0/24
#       AvailabilityZone: !Select [0, !GetAZs ""]
#
#   SubnetAZ2:
#     Type: AWS::EC2::Subnet
#     Properties:
#       VpcId: !Ref MyVPC
#       CidrBlock: 10.0.2.0/24
#       AvailabilityZone: !Select [1, !GetAZs ""]

# ── Check Edge Location count ──
# As of 2026: 400+ Edge Locations, 13+ Regional Edge Caches
# Edge Locations are used by CloudFront, Route 53, AWS Shield, WAF

# ── Python boto3: Get AZs programmatically ──
# import boto3
# ec2 = boto3.client("ec2", region_name="us-east-1")
# azs = ec2.describe_availability_zones()
# for az in azs["AvailabilityZones"]:
#     print(f"{az['ZoneName']} - {az['State']}")

# ── List available instance types in a Region ──
aws ec2 describe-instance-types \
    --filters "Name=current-generation,Values=true" \
    --query "InstanceTypes[].{Type:InstanceType,vCPUs:VCpuInfo.DefaultVCpus,MemGB:MemoryInfo.SizeInMiB}" \
    --output table | head -20

# ── Launch an EC2 instance ──
aws ec2 run-instances \
    --image-id ami-0abcdef1234567890 \
    --instance-type m7g.large \
    --key-name my-key \
    --subnet-id subnet-abc123 \
    --security-group-ids sg-abc123 \
    --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=WebServer}]"

# ── Check T3 CPU credit balance ──
aws cloudwatch get-metric-statistics \
    --namespace AWS/EC2 \
    --metric-name CPUCreditBalance \
    --dimensions Name=InstanceId,Value=i-1234567890abcdef0 \
    --start-time 2026-05-29T00:00:00Z \
    --end-time 2026-05-30T00:00:00Z \
    --period 3600 --statistics Average

# ── CloudFormation: EC2 with instance type ──
# Resources:
#   WebServer:
#     Type: AWS::EC2::Instance
#     Properties:
#       InstanceType: m7g.large    # Graviton for cost savings
#       ImageId: ami-0abcdef1234567890
#       SubnetId: !Ref PrivateSubnet
#       SecurityGroupIds:
#         - !Ref WebSG
#       CreditSpecification:
#         CPUCredits: unlimited    # For T-family only
#       Tags:
#         - Key: Name
#           Value: WebServer

# ── Instance type comparison (common choices) ──
# t3.medium:  2 vCPU,  4 GB RAM  — $0.0416/hr  (burstable, dev/test)
# m7g.large:  2 vCPU,  8 GB RAM  — $0.0816/hr  (general, Graviton)
# c7g.large:  2 vCPU,  4 GB RAM  — $0.0725/hr  (compute-heavy)
# r7g.large:  2 vCPU, 16 GB RAM  — $0.1008/hr  (memory-heavy)

# ── Upload with specific storage class ──
aws s3 cp backup.tar.gz s3://my-bucket/backups/ \
    --storage-class GLACIER_IR

# ── Check current storage class of an object ──
aws s3api head-object --bucket my-bucket --key data/report.csv \
    --query "StorageClass"

# ── CloudFormation: S3 Lifecycle Policy ──
# Resources:
#   DataBucket:
#     Type: AWS::S3::Bucket
#     Properties:
#       BucketName: my-data-bucket
#       LifecycleConfiguration:
#         Rules:
#           - Id: TransitionToIA
#             Status: Enabled
#             Transitions:
#               # After 30 days → Infrequent Access
#               - TransitionInDays: 30
#                 StorageClass: STANDARD_IA
#               # After 90 days → Glacier Instant
#               - TransitionInDays: 90
#                 StorageClass: GLACIER_IR
#               # After 365 days → Deep Archive
#               - TransitionInDays: 365
#                 StorageClass: DEEP_ARCHIVE
#             ExpirationInDays: 2555  # Delete after 7 years
#
#           - Id: CleanupIncompleteUploads
#             Status: Enabled
#             AbortIncompleteMultipartUpload:
#               DaysAfterInitiation: 7  # Clean up failed uploads

# ── AWS CLI: Set lifecycle policy ──
aws s3api put-bucket-lifecycle-configuration \
    --bucket my-bucket \
    --lifecycle-configuration file://lifecycle.json

# lifecycle.json example:
# {
#   "Rules": [{
#     "ID": "ArchiveOldLogs",
#     "Status": "Enabled",
#     "Filter": { "Prefix": "logs/" },
#     "Transitions": [
#       { "Days": 30, "StorageClass": "STANDARD_IA" },
#       { "Days": 90, "StorageClass": "GLACIER" }
#     ],
#     "Expiration": { "Days": 365 }
#   }]
# }

# ── Storage class cost comparison (us-east-1, per GB/month) ──
# Standard:           $0.023
# Intelligent-Tier:   $0.023 (+ $0.0025/1000 objects monitoring)
# Standard-IA:        $0.0125  (+ $0.01/GB retrieval)
# One Zone-IA:        $0.01    (+ $0.01/GB retrieval)
# Glacier Instant:    $0.004   (+ $0.03/GB retrieval)
# Glacier Flexible:   $0.0036  (+ $0.01-$0.03/GB retrieval)
# Deep Archive:       $0.00099 (+ $0.02/GB retrieval)

# ── IAM Policy JSON structure ──
# {
#   "Version": "2012-10-17",
#   "Statement": [
#     {
#       "Sid": "AllowS3ReadOnly",
#       "Effect": "Allow",
#       "Action": [
#         "s3:GetObject",
#         "s3:ListBucket"
#       ],
#       "Resource": [
#         "arn:aws:s3:::my-bucket",
#         "arn:aws:s3:::my-bucket/*"
#       ]
#     },
#     {
#       "Sid": "DenyDeleteBucket",
#       "Effect": "Deny",
#       "Action": "s3:DeleteBucket",
#       "Resource": "*"
#     }
#   ]
# }

# ── Create an IAM Role for EC2 ──
aws iam create-role --role-name EC2-S3-Reader \
    --assume-role-policy-document \
    '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]}'

# Attach a managed policy
aws iam attach-role-policy --role-name EC2-S3-Reader \
    --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

# Create instance profile (required for EC2)
aws iam create-instance-profile --instance-profile-name EC2-S3-Reader
aws iam add-role-to-instance-profile \
    --instance-profile-name EC2-S3-Reader \
    --role-name EC2-S3-Reader

# ── CloudFormation: IAM Role for Lambda ──
# Resources:
#   LambdaExecutionRole:
#     Type: AWS::IAM::Role
#     Properties:
#       AssumeRolePolicyDocument:
#         Version: "2012-10-17"
#         Statement:
#           - Effect: Allow
#             Principal:
#               Service: lambda.amazonaws.com
#             Action: sts:AssumeRole
#       ManagedPolicyArns:
#         - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
#       Policies:
#         - PolicyName: DynamoDBAccess
#           PolicyDocument:
#             Version: "2012-10-17"
#             Statement:
#               - Effect: Allow
#                 Action:
#                   - dynamodb:GetItem
#                   - dynamodb:PutItem
#                   - dynamodb:Query
#                 Resource: !GetAtt MyTable.Arn

# ── CloudFormation: Complete VPC setup ──
# Resources:
#   VPC:
#     Type: AWS::EC2::VPC
#     Properties:
#       CidrBlock: 10.0.0.0/16
#       EnableDnsSupport: true
#       EnableDnsHostnames: true
#       Tags: [{Key: Name, Value: MyVPC}]
#
#   InternetGateway:
#     Type: AWS::EC2::InternetGateway
#   AttachGateway:
#     Type: AWS::EC2::VPCGatewayAttachment
#     Properties:
#       VpcId: !Ref VPC
#       InternetGatewayId: !Ref InternetGateway
#
#   PublicSubnet1:
#     Type: AWS::EC2::Subnet
#     Properties:
#       VpcId: !Ref VPC
#       CidrBlock: 10.0.1.0/24
#       AvailabilityZone: !Select [0, !GetAZs ""]
#       MapPublicIpOnLaunch: true
#
#   PrivateSubnet1:
#     Type: AWS::EC2::Subnet
#     Properties:
#       VpcId: !Ref VPC
#       CidrBlock: 10.0.10.0/24
#       AvailabilityZone: !Select [0, !GetAZs ""]
#
#   NatGateway:
#     Type: AWS::EC2::NatGateway
#     Properties:
#       SubnetId: !Ref PublicSubnet1  # NAT lives in PUBLIC subnet
#       AllocationId: !GetAtt NatEIP.AllocationId
#   NatEIP:
#     Type: AWS::EC2::EIP
#
#   PublicRouteTable:
#     Type: AWS::EC2::RouteTable
#     Properties:
#       VpcId: !Ref VPC
#   PublicRoute:
#     Type: AWS::EC2::Route
#     Properties:
#       RouteTableId: !Ref PublicRouteTable
#       DestinationCidrBlock: 0.0.0.0/0
#       GatewayId: !Ref InternetGateway  # → Internet
#
#   PrivateRouteTable:
#     Type: AWS::EC2::RouteTable
#     Properties:
#       VpcId: !Ref VPC
#   PrivateRoute:
#     Type: AWS::EC2::Route
#     Properties:
#       RouteTableId: !Ref PrivateRouteTable
#       DestinationCidrBlock: 0.0.0.0/0
#       NatGatewayId: !Ref NatGateway  # → NAT (outbound only)

# ── AWS CLI: Create VPC ──
aws ec2 create-vpc --cidr-block 10.0.0.0/16 \
    --tag-specifications "ResourceType=vpc,Tags=[{Key=Name,Value=MyVPC}]"

# ── Security Group: Web server ──
aws ec2 create-security-group \
    --group-name WebSG --description "Web server SG" \
    --vpc-id vpc-abc123

# Allow HTTPS from anywhere
aws ec2 authorize-security-group-ingress \
    --group-id sg-abc123 \
    --protocol tcp --port 443 --cidr 0.0.0.0/0

# Allow app traffic from ALB Security Group (SG reference!)
aws ec2 authorize-security-group-ingress \
    --group-id sg-abc123 \
    --protocol tcp --port 8080 \
    --source-group sg-alb456  # ← Reference another SG

# ── NACL: Block a specific IP range ──
aws ec2 create-network-acl-entry \
    --network-acl-id acl-abc123 \
    --rule-number 50 --protocol tcp \
    --port-range From=0,To=65535 \
    --cidr-block 203.0.113.0/24 \
    --rule-action deny --ingress

# Allow HTTPS inbound (rule 100 — evaluated after rule 50)
aws ec2 create-network-acl-entry \
    --network-acl-id acl-abc123 \
    --rule-number 100 --protocol tcp \
    --port-range From=443,To=443 \
    --cidr-block 0.0.0.0/0 \
    --rule-action allow --ingress

# Allow ephemeral ports outbound (NACL is STATELESS!)
aws ec2 create-network-acl-entry \
    --network-acl-id acl-abc123 \
    --rule-number 100 --protocol tcp \
    --port-range From=1024,To=65535 \
    --cidr-block 0.0.0.0/0 \
    --rule-action allow --egress

# ── Key comparison ──
# Feature          | Security Group      | NACL
# Level            | Instance (ENI)      | Subnet
# Stateful?        | Yes                 | No
# Rules            | Allow only          | Allow + Deny
# Evaluation       | All rules together  | Ordered by rule #
# Default inbound  | Deny all            | Allow all (default NACL)
# SG references    | Yes                 | No (CIDR only)

# ── Create a gp3 volume with custom IOPS ──
aws ec2 create-volume \
    --volume-type gp3 \
    --size 500 \
    --iops 10000 \
    --throughput 500 \
    --availability-zone us-east-1a \
    --tag-specifications "ResourceType=volume,Tags=[{Key=Name,Value=AppData}]"

# ── Modify existing volume (no downtime!) ──
aws ec2 modify-volume \
    --volume-id vol-abc123 \
    --volume-type gp3 \
    --iops 10000 \
    --throughput 500 \
    --size 1000

# ── CloudFormation: EBS volume for database ──
# Resources:
#   DatabaseVolume:
#     Type: AWS::EC2::Volume
#     Properties:
#       VolumeType: io2
#       Iops: 50000
#       Size: 500        # 500 GB
#       AvailabilityZone: !GetAtt DBInstance.AvailabilityZone
#       Encrypted: true
#       KmsKeyId: !Ref MyKMSKey
#       Tags:
#         - Key: Name
#           Value: DatabaseVolume

# ── Create a snapshot (backup) ──
aws ec2 create-snapshot \
    --volume-id vol-abc123 \
    --description "Pre-upgrade backup" \
    --tag-specifications "ResourceType=snapshot,Tags=[{Key=Name,Value=PreUpgrade}]"

# ── Volume type comparison ──
# Type | Max IOPS  | Max Throughput | Use Case
# gp3  | 16,000    | 1,000 MB/s     | Default choice, boot volumes
# io2  | 256,000   | 4,000 MB/s     | Critical databases
# st1  | 500       | 500 MB/s       | Big data, logs (sequential)
# sc1  | 250       | 250 MB/s       | Cold storage (cheapest)

# ── Monitor IOPS usage ──
aws cloudwatch get-metric-statistics \
    --namespace AWS/EBS \
    --metric-name VolumeReadOps \
    --dimensions Name=VolumeId,Value=vol-abc123 \
    --start-time 2026-05-29T00:00:00Z \
    --end-time 2026-05-30T00:00:00Z \
    --period 300 --statistics Sum

# ── Create a Hosted Zone ──
aws route53 create-hosted-zone \
    --name example.com \
    --caller-reference "2026-05-30"

# ── Create an Alias record pointing to ALB ──
# aws route53 change-resource-record-sets \
#     --hosted-zone-id Z1234567890 \
#     --change-batch '{
#       "Changes": [{
#         "Action": "CREATE",
#         "ResourceRecordSet": {
#           "Name": "www.example.com",
#           "Type": "A",
#           "AliasTarget": {
#             "HostedZoneId": "Z35SXDOTRQ7X7K",
#             "DNSName": "my-alb-1234567890.us-east-1.elb.amazonaws.com",
#             "EvaluateTargetHealth": true
#           }
#         }
#       }]
#     }'

# ── Health Check ──
aws route53 create-health-check --caller-reference "web-hc-2026" \
    --health-check-config \
    Type=HTTPS,FullyQualifiedDomainName=www.example.com,\
Port=443,ResourcePath=/health,RequestInterval=30,FailureThreshold=3

# ── CloudFormation: Failover routing ──
# Resources:
#   PrimaryRecord:
#     Type: AWS::Route53::RecordSet
#     Properties:
#       HostedZoneId: !Ref MyHostedZone
#       Name: api.example.com
#       Type: A
#       AliasTarget:
#         HostedZoneId: !GetAtt PrimaryALB.CanonicalHostedZoneID
#         DNSName: !GetAtt PrimaryALB.DNSName
#         EvaluateTargetHealth: true
#       Failover: PRIMARY
#       SetIdentifier: primary
#       HealthCheckId: !Ref PrimaryHealthCheck
#
#   SecondaryRecord:
#     Type: AWS::Route53::RecordSet
#     Properties:
#       HostedZoneId: !Ref MyHostedZone
#       Name: api.example.com
#       Type: A
#       AliasTarget:
#         HostedZoneId: !GetAtt SecondaryALB.CanonicalHostedZoneID
#         DNSName: !GetAtt SecondaryALB.DNSName
#       Failover: SECONDARY
#       SetIdentifier: secondary

# ── Routing policy comparison ──
# Policy       | Use Case                    | Health Check?
# Simple       | Single resource             | No
# Weighted     | Canary, A/B testing         | Yes
# Latency      | Multi-region, lowest ping   | Yes
# Failover     | Active-passive DR           | Yes (primary)
# Geolocation  | Compliance, localization    | Yes
# Multivalue   | Client-side load balancing  | Yes

# ── CloudFormation: ALB with path-based routing ──
# Resources:
#   ALB:
#     Type: AWS::ElasticLoadBalancingV2::LoadBalancer
#     Properties:
#       Type: application
#       Scheme: internet-facing
#       Subnets: [!Ref PublicSubnet1, !Ref PublicSubnet2]
#       SecurityGroups: [!Ref ALBSG]
#
#   Listener:
#     Type: AWS::ElasticLoadBalancingV2::Listener
#     Properties:
#       LoadBalancerArn: !Ref ALB
#       Port: 443
#       Protocol: HTTPS
#       Certificates:
#         - CertificateArn: !Ref SSLCert
#       DefaultActions:
#         - Type: forward
#           TargetGroupArn: !Ref WebTG
#
#   APIRule:
#     Type: AWS::ElasticLoadBalancingV2::ListenerRule
#     Properties:
#       ListenerArn: !Ref Listener
#       Priority: 10
#       Conditions:
#         - Field: path-pattern
#           Values: ["/api/*"]
#       Actions:
#         - Type: forward
#           TargetGroupArn: !Ref APITG
#
#   WebTG:
#     Type: AWS::ElasticLoadBalancingV2::TargetGroup
#     Properties:
#       VpcId: !Ref VPC
#       Port: 80
#       Protocol: HTTP
#       TargetType: instance
#       HealthCheckPath: /health
#       HealthCheckIntervalSeconds: 15
#       HealthyThresholdCount: 2
#       UnhealthyThresholdCount: 3

# ── AWS CLI: Create NLB with static IP ──
aws elbv2 create-load-balancer \
    --name my-nlb \
    --type network \
    --subnets subnet-aaa subnet-bbb

# NLB gets one static IP per AZ
# Useful for: DNS whitelisting, firewall rules, clients that can't do DNS

# ── Comparison ──
# Feature         | ALB              | NLB              | CLB
# Layer           | 7 (HTTP/HTTPS)   | 4 (TCP/UDP)      | 4 + basic 7
# Latency         | ~ms              | ~μs              | ~ms
# Path routing    | ✅               | ❌               | ❌
# WebSocket       | ✅               | ✅ (TCP)         | ❌
# Static IP       | ❌ (use GA)      | ✅               | ❌
# Lambda target   | ✅               | ❌               | ❌
# Client IP       | X-Forwarded-For  | Preserved        | X-Forwarded-For
# WAF             | ✅               | ❌               | ❌
# Cost            | $$               | $$               | $

# ── Create Launch Template ──
aws ec2 create-launch-template \
    --launch-template-name WebServerTemplate \
    --version-description "v1" \
    --launch-template-data '{
        "ImageId": "ami-0abcdef1234567890",
        "InstanceType": "m7g.large",
        "KeyName": "my-key",
        "SecurityGroupIds": ["sg-abc123"],
        "UserData": "BASE64_ENCODED_USER_DATA"
    }'

# User data script (base64-encode before passing):
# #!/bin/bash
# yum update -y
# yum install -y httpd
# systemctl start httpd

# ── Create Auto Scaling Group ──
aws autoscaling create-auto-scaling-group \
    --auto-scaling-group-name WebASG \
    --launch-template LaunchTemplateName=WebServerTemplate,Version=\$Latest \
    --min-size 2 --max-size 10 --desired-capacity 3 \
    --vpc-zone-identifier "subnet-aaa,subnet-bbb" \
    --target-group-arns arn:aws:elasticloadbalancing:...:targetgroup/WebTG/... \
    --health-check-type ELB \
    --health-check-grace-period 300

# ── Target Tracking Policy (recommended) ──
aws autoscaling put-scaling-policy \
    --auto-scaling-group-name WebASG \
    --policy-name CPUTargetTracking \
    --policy-type TargetTrackingScaling \
    --target-tracking-configuration '{
        "TargetValue": 50.0,
        "PredefinedMetricSpecification": {
            "PredefinedMetricType": "ASGAverageCPUUtilization"
        },
        "ScaleInCooldown": 300,
        "ScaleOutCooldown": 60
    }'

# ── Scheduled Scaling (predictable traffic) ──
aws autoscaling put-scheduled-update-group-action \
    --auto-scaling-group-name WebASG \
    --scheduled-action-name ScaleUpMorning \
    --recurrence "0 9 * * MON-FRI" \
    --desired-capacity 8

aws autoscaling put-scheduled-update-group-action \
    --auto-scaling-group-name WebASG \
    --scheduled-action-name ScaleDownEvening \
    --recurrence "0 18 * * MON-FRI" \
    --desired-capacity 3

# ── CloudFormation: ASG with Target Tracking ──
# Resources:
#   ASG:
#     Type: AWS::AutoScaling::AutoScalingGroup
#     Properties:
#       LaunchTemplate:
#         LaunchTemplateId: !Ref LaunchTemplate
#         Version: !GetAtt LaunchTemplate.LatestVersionNumber
#       MinSize: 2
#       MaxSize: 10
#       DesiredCapacity: 3
#       VPCZoneIdentifier: [!Ref SubnetA, !Ref SubnetB]
#       TargetGroupARNs: [!Ref WebTG]
#       HealthCheckType: ELB
#       HealthCheckGracePeriod: 300

# ── Create RDS Multi-AZ instance ──
aws rds create-db-instance \
    --db-instance-identifier my-db \
    --db-instance-class db.r7g.large \
    --engine postgres \
    --master-username admin \
    --master-user-password "****" \
    --allocated-storage 100 \
    --multi-az \
    --storage-encrypted \
    --vpc-security-group-ids sg-abc123 \
    --db-subnet-group-name my-db-subnets

# ── Create Read Replica ──
aws rds create-db-instance-read-replica \
    --db-instance-identifier my-db-replica \
    --source-db-instance-identifier my-db \
    --db-instance-class db.r7g.large \
    --availability-zone us-east-1b

# ── Create Aurora Cluster ──
aws rds create-db-cluster \
    --db-cluster-identifier my-aurora \
    --engine aurora-postgresql \
    --engine-version 15.4 \
    --master-username admin \
    --master-user-password "****" \
    --vpc-security-group-ids sg-abc123 \
    --db-subnet-group-name my-db-subnets \
    --storage-encrypted

# Add Aurora instances (writer + reader)
aws rds create-db-instance \
    --db-instance-identifier my-aurora-writer \
    --db-cluster-identifier my-aurora \
    --db-instance-class db.r7g.large \
    --engine aurora-postgresql

aws rds create-db-instance \
    --db-instance-identifier my-aurora-reader \
    --db-cluster-identifier my-aurora \
    --db-instance-class db.r7g.large \
    --engine aurora-postgresql

# ── Aurora endpoints ──
# Writer endpoint: my-aurora.cluster-xxxx.us-east-1.rds.amazonaws.com
# Reader endpoint: my-aurora.cluster-ro-xxxx.us-east-1.rds.amazonaws.com
# Reader endpoint auto-load-balances across all Aurora Replicas

# ── Comparison ──
# Feature        | Multi-AZ          | Read Replica      | Aurora
# Purpose        | High availability | Read scaling      | Both
# Replication    | Synchronous       | Asynchronous      | Shared storage
# Failover       | Automatic (60s)   | Manual promotion  | Automatic (30s)
# Read traffic   | No (standby)      | Yes (own endpoint)| Yes (reader EP)
# Cross-Region   | No                | Yes               | Yes (Global DB)

# ── Create a Lambda function ──
aws lambda create-function \
    --function-name ProcessOrder \
    --runtime python3.12 \
    --handler app.handler \
    --role arn:aws:iam::123456789012:role/LambdaExecRole \
    --zip-file fileb://function.zip \
    --timeout 30 \
    --memory-size 512 \
    --environment Variables="{DB_HOST=mydb.cluster-xxx.rds.amazonaws.com}"

# ── Python Lambda handler ──
# import json
# import boto3
#
# # Initialization code runs ONCE per cold start (reused on warm starts)
# dynamodb = boto3.resource("dynamodb")
# table = dynamodb.Table("Orders")
#
# def handler(event, context):
#     """Triggered by API Gateway POST /orders"""
#     body = json.loads(event["body"])
#     table.put_item(Item={
#         "orderId": body["id"],
#         "amount": body["amount"],
#         "status": "pending"
#     })
#     return {
#         "statusCode": 201,
#         "body": json.dumps({"message": "Order created"})
#     }

# ── Set Provisioned Concurrency (no cold starts) ──
aws lambda put-provisioned-concurrency-config \
    --function-name ProcessOrder \
    --qualifier prod \
    --provisioned-concurrent-executions 50

# ── Set Reserved Concurrency (limit + guarantee) ──
aws lambda put-function-concurrency \
    --function-name ProcessOrder \
    --reserved-concurrent-executions 100

# ── Create a Layer (shared dependencies) ──
# zip -r layer.zip python/  # python/lib/python3.12/site-packages/...
aws lambda publish-layer-version \
    --layer-name common-utils \
    --zip-file fileb://layer.zip \
    --compatible-runtimes python3.12

# Attach layer to function
aws lambda update-function-configuration \
    --function-name ProcessOrder \
    --layers arn:aws:lambda:us-east-1:123456789012:layer:common-utils:1

# ── CloudFormation: Lambda + API Gateway ──
# Resources:
#   ProcessOrderFn:
#     Type: AWS::Lambda::Function
#     Properties:
#       FunctionName: ProcessOrder
#       Runtime: python3.12
#       Handler: app.handler
#       Code:
#         S3Bucket: my-deployment-bucket
#         S3Key: function.zip
#       MemorySize: 512
#       Timeout: 30
#       Role: !GetAtt LambdaRole.Arn
#       Environment:
#         Variables:
#           TABLE_NAME: !Ref OrdersTable

# ── Enable Block Public Access (account level) ──
aws s3control put-public-access-block \
    --account-id 123456789012 \
    --public-access-block-configuration \
    BlockPublicAcls=true,IgnorePublicAcls=true,\
BlockPublicPolicy=true,RestrictPublicBuckets=true

# ── Bucket Policy: Enforce HTTPS + encryption ──
# {
#   "Version": "2012-10-17",
#   "Statement": [
#     {
#       "Sid": "DenyHTTP",
#       "Effect": "Deny",
#       "Principal": "*",
#       "Action": "s3:*",
#       "Resource": [
#         "arn:aws:s3:::my-bucket",
#         "arn:aws:s3:::my-bucket/*"
#       ],
#       "Condition": {
#         "Bool": { "aws:SecureTransport": "false" }
#       }
#     },
#     {
#       "Sid": "DenyUnencrypted",
#       "Effect": "Deny",
#       "Principal": "*",
#       "Action": "s3:PutObject",
#       "Resource": "arn:aws:s3:::my-bucket/*",
#       "Condition": {
#         "StringNotEquals": {
#           "s3:x-amz-server-side-encryption": "aws:kms"
#         }
#       }
#     }
#   ]
# }

# ── Enable default encryption ──
aws s3api put-bucket-encryption \
    --bucket my-bucket \
    --server-side-encryption-configuration '{
        "Rules": [{
            "ApplyServerSideEncryptionByDefault": {
                "SSEAlgorithm": "aws:kms",
                "KMSMasterKeyID": "arn:aws:kms:us-east-1:123:key/abc-123"
            },
            "BucketKeyEnabled": true
        }]
    }'

# ── Generate Presigned URL (temporary access) ──
aws s3 presign s3://my-bucket/reports/q4-2025.pdf \
    --expires-in 3600  # 1 hour

# Python boto3:
# s3 = boto3.client("s3")
# url = s3.generate_presigned_url(
#     "get_object",
#     Params={"Bucket": "my-bucket", "Key": "reports/q4.pdf"},
#     ExpiresIn=3600  # seconds
# )
# print(url)  # Share this URL — no AWS credentials needed

# ── Enable versioning (protection against accidental deletes) ──
aws s3api put-bucket-versioning \
    --bucket my-bucket \
    --versioning-configuration Status=Enabled

# ── Enable access logging ──
aws s3api put-bucket-logging --bucket my-bucket \
    --bucket-logging-status '{
        "LoggingEnabled": {
            "TargetBucket": "my-logs-bucket",
            "TargetPrefix": "s3-access-logs/"
        }
    }'

# ── Put custom metric ──
aws cloudwatch put-metric-data \
    --namespace "MyApp/Orders" \
    --metric-name OrderCount \
    --value 1 \
    --unit Count \
    --dimensions Environment=prod,Service=checkout

# ── Python boto3: Custom metric ──
# cloudwatch = boto3.client("cloudwatch")
# cloudwatch.put_metric_data(
#     Namespace="MyApp/Orders",
#     MetricData=[{
#         "MetricName": "OrderProcessingTime",
#         "Value": 245.5,
#         "Unit": "Milliseconds",
#         "Dimensions": [
#             {"Name": "Service", "Value": "checkout"},
#             {"Name": "Environment", "Value": "prod"}
#         ]
#     }]
# )

# ── Create alarm: CPU > 80% for 5 minutes ──
aws cloudwatch put-metric-alarm \
    --alarm-name HighCPU \
    --metric-name CPUUtilization \
    --namespace AWS/EC2 \
    --statistic Average \
    --period 300 \
    --evaluation-periods 2 \
    --threshold 80 \
    --comparison-operator GreaterThanThreshold \
    --dimensions Name=InstanceId,Value=i-abc123 \
    --alarm-actions arn:aws:sns:us-east-1:123:ops-alerts

# ── CloudWatch Logs Insights: Find errors ──
# fields @timestamp, @message
# | filter @message like /ERROR|Exception/
# | sort @timestamp desc
# | limit 50

# ── Logs Insights: P99 latency by API path ──
# fields @timestamp, path, latency
# | stats percentile(latency, 99) as p99,
#         percentile(latency, 50) as p50,
#         count() as requests
#   by path
# | sort p99 desc

# ── Set log retention (default is "never expire"!) ──
aws logs put-retention-policy \
    --log-group-name /aws/lambda/ProcessOrder \
    --retention-in-days 30

# ── CloudFormation: Alarm + SNS ──
# Resources:
#   HighCPUAlarm:
#     Type: AWS::CloudWatch::Alarm
#     Properties:
#       AlarmName: HighCPU
#       MetricName: CPUUtilization
#       Namespace: AWS/EC2
#       Statistic: Average
#       Period: 300
#       EvaluationPeriods: 2
#       Threshold: 80
#       ComparisonOperator: GreaterThanThreshold
#       AlarmActions:
#         - !Ref OpsAlertsTopic
#       Dimensions:
#         - Name: AutoScalingGroupName
#           Value: !Ref ASG

# ── SQS: Create queue + send message ──
aws sqs create-queue --queue-name OrderQueue

aws sqs send-message \
    --queue-url https://sqs.us-east-1.amazonaws.com/123/OrderQueue \
    --message-body '{"orderId":"123","amount":99.99}'

# Receive + process + delete
# msgs = sqs.receive_message(QueueUrl=url, MaxNumberOfMessages=10)
# for msg in msgs["Messages"]:
#     process(msg["Body"])
#     sqs.delete_message(QueueUrl=url, ReceiptHandle=msg["ReceiptHandle"])

# ── SNS → SQS Fan-out pattern ──
# SNS Topic: "OrderEvents"
#   ├── SQS: InventoryQueue (update stock)
#   ├── SQS: EmailQueue (send confirmation)
#   ├── SQS: AnalyticsQueue (track metrics)
#   └── Lambda: FraudCheck (real-time)
#
# One publish → 4 subscribers process independently

aws sns create-topic --name OrderEvents
aws sns subscribe \
    --topic-arn arn:aws:sns:us-east-1:123:OrderEvents \
    --protocol sqs \
    --notification-endpoint arn:aws:sqs:us-east-1:123:InventoryQueue

aws sns publish \
    --topic-arn arn:aws:sns:us-east-1:123:OrderEvents \
    --message '{"orderId":"123","status":"placed"}'

# ── EventBridge: Content-based routing ──
# Rule: Route "order.placed" events to Lambda
aws events put-rule \
    --name ProcessNewOrders \
    --event-pattern '{
        "source": ["com.myapp.orders"],
        "detail-type": ["OrderPlaced"],
        "detail": {
            "amount": [{"numeric": [">", 100]}]
        }
    }'

aws events put-targets --rule ProcessNewOrders \
    --targets "Id=1,Arn=arn:aws:lambda:us-east-1:123:function:ProcessOrder"

# ── Comparison ──
# Feature      | SQS              | SNS             | EventBridge
# Model        | Queue (pull)     | Pub/Sub (push)  | Event Bus (push)
# Consumers    | 1 per message    | Many (fan-out)  | Many (rules)
# Retention    | Up to 14 days    | None            | Replay (up to 24h)
# Ordering     | FIFO available   | FIFO available  | Ordered per rule
# Routing      | None             | Topic filter    | Content-based rules
# Best for     | Work queues      | Fan-out/alerts  | Event architecture

# ── Create DynamoDB table with composite key ──
aws dynamodb create-table \
    --table-name Orders \
    --key-schema \
        AttributeName=customerId,KeyType=HASH \
        AttributeName=orderId,KeyType=RANGE \
    --attribute-definitions \
        AttributeName=customerId,AttributeType=S \
        AttributeName=orderId,AttributeType=S \
        AttributeName=status,AttributeType=S \
    --billing-mode PAY_PER_REQUEST \
    --global-secondary-indexes '[{
        "IndexName": "StatusIndex",
        "KeySchema": [
            {"AttributeName": "status", "KeyType": "HASH"},
            {"AttributeName": "orderId", "KeyType": "RANGE"}
        ],
        "Projection": {"ProjectionType": "ALL"}
    }]'

# ── Write an item ──
aws dynamodb put-item --table-name Orders --item '{
    "customerId": {"S": "CUST-001"},
    "orderId": {"S": "ORD-2026-001"},
    "amount": {"N": "99.99"},
    "status": {"S": "shipped"},
    "items": {"L": [{"S": "Widget"}, {"S": "Gadget"}]}
}'

# ── Query: Get all orders for a customer ──
aws dynamodb query --table-name Orders \
    --key-condition-expression "customerId = :cid" \
    --expression-attribute-values '{":cid": {"S": "CUST-001"}}'

# ── Query: Get orders in a date range (SK) ──
aws dynamodb query --table-name Orders \
    --key-condition-expression "customerId = :cid AND orderId BETWEEN :start AND :end" \
    --expression-attribute-values '{
        ":cid": {"S": "CUST-001"},
        ":start": {"S": "ORD-2026-001"},
        ":end": {"S": "ORD-2026-100"}
    }'

# ── Query GSI: Get all shipped orders ──
aws dynamodb query --table-name Orders \
    --index-name StatusIndex \
    --key-condition-expression "status = :s" \
    --expression-attribute-values '{":s": {"S": "shipped"}}'

# ── Python boto3: Single-table design pattern ──
# table.put_item(Item={
#     "PK": "CUSTOMER#C001",
#     "SK": "ORDER#2026-01-15#O001",
#     "type": "order",
#     "amount": Decimal("99.99")
# })
# table.put_item(Item={
#     "PK": "CUSTOMER#C001",
#     "SK": "PROFILE",
#     "type": "customer",
#     "name": "Alice",
#     "email": "alice@example.com"
# })

# ── ECS Task Definition (simplified) ──
# {
#   "family": "web-app",
#   "networkMode": "awsvpc",
#   "requiresCompatibilities": ["FARGATE"],
#   "cpu": "512",
#   "memory": "1024",
#   "executionRoleArn": "arn:aws:iam::123:role/ecsTaskExecutionRole",
#   "taskRoleArn": "arn:aws:iam::123:role/appTaskRole",
#   "containerDefinitions": [{
#     "name": "web",
#     "image": "123456789012.dkr.ecr.us-east-1.amazonaws.com/web:latest",
#     "portMappings": [{"containerPort": 8080, "protocol": "tcp"}],
#     "logConfiguration": {
#       "logDriver": "awslogs",
#       "options": {
#         "awslogs-group": "/ecs/web-app",
#         "awslogs-region": "us-east-1",
#         "awslogs-stream-prefix": "web"
#       }
#     },
#     "environment": [
#       {"name": "DB_HOST", "value": "mydb.cluster-xxx.rds.amazonaws.com"}
#     ]
#   }]
# }

# ── Create ECS Fargate Service ──
aws ecs create-service \
    --cluster my-cluster \
    --service-name web-service \
    --task-definition web-app:1 \
    --desired-count 3 \
    --launch-type FARGATE \
    --network-configuration '{
        "awsvpcConfiguration": {
            "subnets": ["subnet-aaa", "subnet-bbb"],
            "securityGroups": ["sg-abc123"],
            "assignPublicIp": "DISABLED"
        }
    }' \
    --load-balancers '{
        "targetGroupArn": "arn:aws:elasticloadbalancing:...",
        "containerName": "web",
        "containerPort": 8080
    }'

# ── EKS: Deploy with kubectl ──
# apiVersion: apps/v1
# kind: Deployment
# metadata:
#   name: web-app
# spec:
#   replicas: 3
#   selector:
#     matchLabels:
#       app: web
#   template:
#     spec:
#       containers:
#         - name: web
#           image: 123456789012.dkr.ecr.us-east-1.amazonaws.com/web:latest
#           ports:
#             - containerPort: 8080
#           resources:
#             requests:
#               cpu: "256m"
#               memory: "512Mi"

# ── Comparison ──
# Feature     | ECS             | EKS             | Fargate         | EC2 Launch
# Complexity  | Low             | High            | Lowest          | Medium
# Portability | AWS only        | Multi-cloud     | -               | -
# Cost        | No control plane| $0.10/hr/cluster| Pay per task    | Pay per instance
# GPU         | Yes (EC2)       | Yes (EC2)       | No              | Yes
# Scaling     | Auto (service)  | HPA/Karpenter   | Per task        | ASG

# ── CloudFormation Template (YAML) ──
# AWSTemplateFormatVersion: "2010-09-09"
# Description: Web application infrastructure
#
# Parameters:
#   Environment:
#     Type: String
#     AllowedValues: [dev, staging, prod]
#     Default: dev
#   InstanceType:
#     Type: String
#     Default: m7g.large
#
# Conditions:
#   IsProd: !Equals [!Ref Environment, prod]
#
# Resources:
#   VPC:
#     Type: AWS::EC2::VPC
#     Properties:
#       CidrBlock: 10.0.0.0/16
#       Tags:
#         - Key: Name
#           Value: !Sub "${Environment}-vpc"
#
#   Database:
#     Type: AWS::RDS::DBInstance
#     DeletionPolicy: Snapshot    # ← Take snapshot before delete!
#     Properties:
#       DBInstanceClass: !If [IsProd, db.r7g.xlarge, db.t4g.medium]
#       Engine: postgres
#       MultiAZ: !If [IsProd, true, false]
#       StorageEncrypted: true
#
# Outputs:
#   VPCId:
#     Value: !Ref VPC
#     Export:
#       Name: !Sub "${Environment}-VPCId"

# ── Create stack ──
aws cloudformation create-stack \
    --stack-name my-app-prod \
    --template-body file://template.yaml \
    --parameters ParameterKey=Environment,ParameterValue=prod \
    --capabilities CAPABILITY_IAM

# ── Create Change Set (preview before update) ──
aws cloudformation create-change-set \
    --stack-name my-app-prod \
    --change-set-name update-instance-type \
    --template-body file://template-v2.yaml \
    --parameters ParameterKey=InstanceType,ParameterValue=m7g.xlarge

# Review changes
aws cloudformation describe-change-set \
    --stack-name my-app-prod \
    --change-set-name update-instance-type

# Execute if safe
aws cloudformation execute-change-set \
    --stack-name my-app-prod \
    --change-set-name update-instance-type

# ── Drift Detection ──
aws cloudformation detect-stack-drift --stack-name my-app-prod
# Wait, then check results:
aws cloudformation describe-stack-resource-drifts \
    --stack-name my-app-prod \
    --stack-resource-drift-status-filters MODIFIED DELETED

# ── Nested Stack (reuse VPC template) ──
# Resources:
#   NetworkStack:
#     Type: AWS::CloudFormation::Stack
#     Properties:
#       TemplateURL: https://s3.amazonaws.com/templates/vpc.yaml
#       Parameters:
#         Environment: !Ref Environment

# ── VPC Peering ──
aws ec2 create-vpc-peering-connection \
    --vpc-id vpc-aaa \
    --peer-vpc-id vpc-bbb \
    --peer-owner-id 987654321012  # Cross-account

# Accept in the other account
aws ec2 accept-vpc-peering-connection \
    --vpc-peering-connection-id pcx-abc123

# Add routes in BOTH VPCs
aws ec2 create-route --route-table-id rtb-aaa \
    --destination-cidr-block 10.1.0.0/16 \
    --vpc-peering-connection-id pcx-abc123

# ── Transit Gateway ──
aws ec2 create-transit-gateway \
    --description "Central Hub" \
    --options DefaultRouteTableAssociation=enable,DefaultRouteTablePropagation=enable

# Attach VPCs
aws ec2 create-transit-gateway-vpc-attachment \
    --transit-gateway-id tgw-abc123 \
    --vpc-id vpc-aaa \
    --subnet-ids subnet-aaa1 subnet-aaa2

# All attached VPCs can now communicate through TGW
# Use TGW route tables for segmentation

# ── PrivateLink: Access S3 without NAT (Gateway Endpoint) ──
aws ec2 create-vpc-endpoint \
    --vpc-id vpc-aaa \
    --service-name com.amazonaws.us-east-1.s3 \
    --route-table-ids rtb-private  # Free! No NAT needed for S3

# ── PrivateLink: Interface Endpoint for SQS ──
aws ec2 create-vpc-endpoint \
    --vpc-id vpc-aaa \
    --vpc-endpoint-type Interface \
    --service-name com.amazonaws.us-east-1.sqs \
    --subnet-ids subnet-private1 \
    --security-group-ids sg-endpoint

# ── Comparison ──
# Feature        | VPC Peering   | Transit Gateway  | PrivateLink
# Topology       | 1:1           | Hub-and-spoke    | Service endpoint
# Transitive     | No            | Yes              | N/A
# Scale          | < 10 VPCs     | Hundreds of VPCs | Per-service
# Overlap CIDRs  | No            | No               | Yes
# Cross-Region   | Yes           | Yes (peering)    | No (same Region)
# Cost           | Data transfer | $0.05/hr + data  | $0.01/hr + data

# ── DynamoDB Global Table (active-active database) ──
aws dynamodb create-table \
    --table-name UserSessions \
    --key-schema AttributeName=userId,KeyType=HASH \
    --attribute-definitions AttributeName=userId,AttributeType=S \
    --billing-mode PAY_PER_REQUEST \
    --stream-specification StreamEnabled=true,StreamViewType=NEW_AND_OLD_IMAGES

# Add replica in eu-west-1
aws dynamodb update-table --table-name UserSessions \
    --replica-updates '[{"Create":{"RegionName":"eu-west-1"}}]'

# ── Aurora Global Database ──
aws rds create-global-cluster \
    --global-cluster-identifier my-global-db \
    --source-db-cluster-identifier arn:aws:rds:us-east-1:123:cluster:my-aurora \
    --engine aurora-postgresql

# Add secondary Region
aws rds create-db-cluster \
    --db-cluster-identifier my-aurora-secondary \
    --engine aurora-postgresql \
    --global-cluster-identifier my-global-db \
    --region eu-west-1

# ── S3 Cross-Region Replication ──
aws s3api put-bucket-replication --bucket source-bucket \
    --replication-configuration '{
        "Role": "arn:aws:iam::123:role/S3ReplicationRole",
        "Rules": [{
            "Status": "Enabled",
            "Destination": {
                "Bucket": "arn:aws:s3:::destination-bucket-eu",
                "StorageClass": "STANDARD_IA"
            }
        }]
    }'

# ── Route 53: Latency-based routing (active-active) ──
# US users → us-east-1 ALB (30ms)
# EU users → eu-west-1 ALB (25ms)
# Health checks on both → automatic failover if one Region fails

# ── Route 53: Failover routing (active-passive) ──
# Primary: us-east-1 ALB + health check
# Secondary: eu-west-1 ALB (standby)
# Primary fails → DNS switches to secondary

# ── Architecture diagram ──
# Active-Active:
# Users → Route 53 (Latency) → us-east-1 ALB / eu-west-1 ALB
#                                    ↓                ↓
#                              Aurora Primary    Aurora Secondary
#                                    ←  replication  →
#                              DynamoDB Global Table (both write)

# ── SCP: Deny all Regions except us-east-1 and eu-west-1 ──
# {
#   "Version": "2012-10-17",
#   "Statement": [{
#     "Sid": "DenyOtherRegions",
#     "Effect": "Deny",
#     "Action": "*",
#     "Resource": "*",
#     "Condition": {
#       "StringNotEquals": {
#         "aws:RequestedRegion": ["us-east-1", "eu-west-1"]
#       },
#       "ForAnyValue:StringNotLike": {
#         "aws:PrincipalArn": [
#           "arn:aws:iam::*:role/OrganizationAdmin"
#         ]
#       }
#     }
#   }]
# }

# ── SCP: Prevent disabling CloudTrail ──
# {
#   "Version": "2012-10-17",
#   "Statement": [{
#     "Sid": "ProtectCloudTrail",
#     "Effect": "Deny",
#     "Action": [
#       "cloudtrail:StopLogging",
#       "cloudtrail:DeleteTrail",
#       "cloudtrail:UpdateTrail"
#     ],
#     "Resource": "*"
#   }]
# }

# ── SCP: Prevent public S3 ──
# {
#   "Version": "2012-10-17",
#   "Statement": [{
#     "Sid": "DenyS3PublicAccess",
#     "Effect": "Deny",
#     "Action": "s3:PutBucketPublicAccessBlock",
#     "Resource": "*",
#     "Condition": {
#       "StringNotEquals": {
#         "s3:PublicAccessBlockConfiguration/BlockPublicAcls": "true"
#       }
#     }
#   }]
# }

# ── Create OU structure ──
aws organizations create-organizational-unit \
    --parent-id r-xxxx --name "Security"
aws organizations create-organizational-unit \
    --parent-id r-xxxx --name "Workloads"
aws organizations create-organizational-unit \
    --parent-id ou-workloads --name "Production"
aws organizations create-organizational-unit \
    --parent-id ou-workloads --name "Development"

# ── Attach SCP to an OU ──
aws organizations attach-policy \
    --policy-id p-abc123 \
    --target-id ou-workloads

# ── OU hierarchy ──
# Root
# ├── Security OU (log archive, security tools)
# ├── Infrastructure OU (networking, CI/CD)
# ├── Workloads OU
# │   ├── Production OU (SCP: deny risky actions)
# │   ├── Staging OU
# │   └── Development OU (SCP: restrict instance types)
# └── Sandbox OU (SCP: spending limit, Region restrict)

# ── CloudFormation: REST API with Lambda backend ──
# Resources:
#   MyAPI:
#     Type: AWS::ApiGateway::RestApi
#     Properties:
#       Name: OrderAPI
#       Description: Order management API
#
#   OrdersResource:
#     Type: AWS::ApiGateway::Resource
#     Properties:
#       RestApiId: !Ref MyAPI
#       ParentId: !GetAtt MyAPI.RootResourceId
#       PathPart: orders
#
#   PostOrder:
#     Type: AWS::ApiGateway::Method
#     Properties:
#       RestApiId: !Ref MyAPI
#       ResourceId: !Ref OrdersResource
#       HttpMethod: POST
#       AuthorizationType: COGNITO_USER_POOLS
#       AuthorizerId: !Ref CognitoAuth
#       Integration:
#         Type: AWS_PROXY
#         IntegrationHttpMethod: POST
#         Uri: !Sub "arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${OrderFn.Arn}/invocations"

# ── HTTP API (simpler, cheaper) ──
aws apigatewayv2 create-api \
    --name OrderAPI \
    --protocol-type HTTP \
    --target arn:aws:lambda:us-east-1:123:function:ProcessOrder

# ── Enable caching (REST API only) ──
aws apigateway update-stage \
    --rest-api-id abc123 \
    --stage-name prod \
    --patch-operations \
    op=replace,path=/cacheClusterEnabled,value=true \
    op=replace,path=/cacheClusterSize,value=0.5

# ── Usage Plan + API Key (per-customer rate limiting) ──
aws apigateway create-usage-plan --name "FreeTier" \
    --throttle burstLimit=10,rateLimit=5 \
    --quota limit=1000,period=MONTH \
    --api-stages apiId=abc123,stage=prod

aws apigateway create-api-key --name "customer-001" --enabled
aws apigateway create-usage-plan-key \
    --usage-plan-id plan123 \
    --key-id key123 \
    --key-type API_KEY

# ── Comparison ──
# Feature        | REST API              | HTTP API
# Cost           | $3.50/million         | $1.00/million
# Caching        | ✅                    | ❌
# Usage Plans    | ✅                    | ❌
# WAF            | ✅                    | ❌
# Transformation | ✅ (VTL templates)    | ❌
# Auth           | IAM, Cognito, Lambda  | JWT, IAM, Lambda
# Private API    | ✅                    | ❌
# Performance    | ~29ms overhead        | ~10ms overhead

# ── Create Redis cluster (cluster mode disabled) ──
aws elasticache create-replication-group \
    --replication-group-id my-redis \
    --replication-group-description "App Cache" \
    --engine redis \
    --cache-node-type cache.r7g.large \
    --num-cache-clusters 3 \
    --multi-az-enabled \
    --automatic-failover-enabled \
    --at-rest-encryption-enabled \
    --transit-encryption-enabled \
    --cache-subnet-group-name my-cache-subnets \
    --security-group-ids sg-redis

# ── Create Redis cluster (cluster mode enabled — sharding) ──
aws elasticache create-replication-group \
    --replication-group-id my-redis-cluster \
    --replication-group-description "Sharded Cache" \
    --engine redis \
    --cache-node-type cache.r7g.large \
    --num-node-groups 3 \
    --replicas-per-node-group 2 \
    --cluster-enabled

# ── Python: Lazy Loading (Cache-Aside) pattern ──
# import redis, json, boto3
#
# r = redis.Redis(host="my-redis.xxx.cache.amazonaws.com", port=6379, ssl=True)
# dynamodb = boto3.resource("dynamodb")
# table = dynamodb.Table("Products")
#
# def get_product(product_id):
#     # 1. Check cache
#     cached = r.get(f"product:{product_id}")
#     if cached:
#         return json.loads(cached)  # Cache HIT
#
#     # 2. Cache MISS — read from DB
#     response = table.get_item(Key={"productId": product_id})
#     product = response.get("Item")
#
#     # 3. Write to cache with TTL
#     if product:
#         r.setex(f"product:{product_id}", 3600, json.dumps(product))
#
#     return product
#
# def update_product(product_id, data):
#     # Write-through: update DB + invalidate cache
#     table.put_item(Item=data)
#     r.delete(f"product:{product_id}")  # Invalidate, not update

# ── Comparison ──
# Feature        | Redis             | Memcached
# Data types     | Rich (lists,sets) | String only
# Persistence    | Yes (RDB+AOF)     | No
# Replication    | Yes (Multi-AZ)    | No
# Failover       | Automatic         | None (data lost)
# Pub/Sub        | Yes               | No
# Cluster mode   | Yes (sharding)    | Yes (hash-based)
# Threading      | Single-threaded   | Multi-threaded
# Max data       | 340 TB (cluster)  | Per-node only

# ── Create a KMS key ──
aws kms create-key \
    --description "Application data encryption" \
    --key-usage ENCRYPT_DECRYPT \
    --origin AWS_KMS

# Enable automatic key rotation
aws kms enable-key-rotation --key-id abc-123-def

# ── Envelope encryption with boto3 ──
# import boto3, base64
# from cryptography.fernet import Fernet
#
# kms = boto3.client("kms")
#
# # 1. Generate data key
# response = kms.generate_data_key(
#     KeyId="alias/my-app-key",
#     KeySpec="AES_256"
# )
# plaintext_key = response["Plaintext"]
# encrypted_key = response["CiphertextBlob"]
#
# # 2. Encrypt data locally (fast, no KMS API call)
# f = Fernet(base64.urlsafe_b64encode(plaintext_key[:32]))
# ciphertext = f.encrypt(b"sensitive data here")
#
# # 3. Store encrypted_key + ciphertext together
# # 4. Delete plaintext_key from memory
# del plaintext_key
#
# # To decrypt:
# # 1. Send encrypted_key to KMS → get plaintext key
# # 2. Decrypt ciphertext locally with plaintext key

# ── Secrets Manager: Store a database password ──
aws secretsmanager create-secret \
    --name prod/myapp/db-password \
    --description "Production DB credentials" \
    --secret-string '{"username":"admin","password":"SuperS3cret!","host":"mydb.cluster-xxx.rds.amazonaws.com","port":"5432","dbname":"appdb"}'

# ── Enable automatic rotation (every 30 days) ──
aws secretsmanager rotate-secret \
    --secret-id prod/myapp/db-password \
    --rotation-lambda-arn arn:aws:lambda:us-east-1:123:function:SecretRotation \
    --rotation-rules AutomaticallyAfterDays=30

# ── Python: Retrieve secret at runtime ──
# import boto3, json
#
# def get_db_credentials():
#     client = boto3.client("secretsmanager")
#     response = client.get_secret_value(SecretId="prod/myapp/db-password")
#     return json.loads(response["SecretString"])
#
# creds = get_db_credentials()
# conn = psycopg2.connect(
#     host=creds["host"],
#     user=creds["username"],
#     password=creds["password"],
#     dbname=creds["dbname"]
# )

# ── KMS Key Policy: Cross-account access ──
# {
#   "Statement": [{
#     "Sid": "AllowCrossAccountDecrypt",
#     "Effect": "Allow",
#     "Principal": {"AWS": "arn:aws:iam::987654321:root"},
#     "Action": ["kms:Decrypt", "kms:DescribeKey"],
#     "Resource": "*"
#   }]
# }

# ── buildspec.yml (CodeBuild) ──
# version: 0.2
# phases:
#   install:
#     runtime-versions:
#       nodejs: 20
#   pre_build:
#     commands:
#       - npm ci
#       - echo "Running tests..."
#       - npm test
#   build:
#     commands:
#       - npm run build
#       - echo "Building Docker image..."
#       - docker build -t $ECR_REPO:$CODEBUILD_RESOLVED_SOURCE_VERSION .
#   post_build:
#     commands:
#       - docker push $ECR_REPO:$CODEBUILD_RESOLVED_SOURCE_VERSION
#       - printf '{"ImageURI":"%s"}' $ECR_REPO:$CODEBUILD_RESOLVED_SOURCE_VERSION > imageDetail.json
# artifacts:
#   files:
#     - imageDetail.json
#     - appspec.yaml
#     - taskdef.json

# ── appspec.yml (CodeDeploy for ECS Blue/Green) ──
# version: 0.0
# Resources:
#   - TargetService:
#       Type: AWS::ECS::Service
#       Properties:
#         TaskDefinition: <TASK_DEFINITION>
#         LoadBalancerInfo:
#           ContainerName: "web"
#           ContainerPort: 8080
# Hooks:
#   - BeforeInstall: "LambdaFunctionToValidateBeforeInstall"
#   - AfterAllowTestTraffic: "LambdaFunctionToValidateTestTraffic"
#   - AfterAllowTraffic: "LambdaFunctionToValidateAfterTraffic"

# ── CloudFormation: CodePipeline ──
# Resources:
#   Pipeline:
#     Type: AWS::CodePipeline::Pipeline
#     Properties:
#       Stages:
#         - Name: Source
#           Actions:
#             - Name: GitHub
#               ActionTypeId:
#                 Category: Source
#                 Provider: CodeStarSourceConnection
#               Configuration:
#                 ConnectionArn: !Ref GitHubConnection
#                 FullRepositoryId: "myorg/myapp"
#                 BranchName: main
#               OutputArtifacts: [{Name: SourceOutput}]
#
#         - Name: Build
#           Actions:
#             - Name: BuildAndTest
#               ActionTypeId:
#                 Category: Build
#                 Provider: CodeBuild
#               Configuration:
#                 ProjectName: !Ref BuildProject
#               InputArtifacts: [{Name: SourceOutput}]
#               OutputArtifacts: [{Name: BuildOutput}]
#
#         - Name: Approval
#           Actions:
#             - Name: ManualApproval
#               ActionTypeId:
#                 Category: Approval
#                 Provider: Manual
#
#         - Name: Deploy
#           Actions:
#             - Name: DeployToECS
#               ActionTypeId:
#                 Category: Deploy
#                 Provider: ECS
#               Configuration:
#                 ClusterName: !Ref Cluster
#                 ServiceName: !Ref Service

# ── CloudFormation: CloudFront + S3 with OAC ──
# Resources:
#   Distribution:
#     Type: AWS::CloudFront::Distribution
#     Properties:
#       DistributionConfig:
#         Origins:
#           - Id: S3Origin
#             DomainName: !GetAtt AssetsBucket.RegionalDomainName
#             OriginAccessControlId: !GetAtt OAC.Id
#             S3OriginConfig:
#               OriginAccessIdentity: ""
#           - Id: ALBOrigin
#             DomainName: !GetAtt ALB.DNSName
#             CustomOriginConfig:
#               OriginProtocolPolicy: https-only
#         DefaultCacheBehavior:
#           TargetOriginId: S3Origin
#           ViewerProtocolPolicy: redirect-to-https
#           CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6  # CachingOptimized
#           Compress: true
#         CacheBehaviors:
#           - PathPattern: "/api/*"
#             TargetOriginId: ALBOrigin
#             ViewerProtocolPolicy: https-only
#             CachePolicyId: 4135ea2d-6df8-44a3-9df3-4b5a84be39ad  # CachingDisabled
#         Aliases: [cdn.example.com]
#         ViewerCertificate:
#           AcmCertificateArn: !Ref SSLCert
#           SslSupportMethod: sni-only
#
#   OAC:
#     Type: AWS::CloudFront::OriginAccessControl
#     Properties:
#       OriginAccessControlConfig:
#         Name: S3OAC
#         OriginAccessControlOriginType: s3
#         SigningBehavior: always
#         SigningProtocol: sigv4

# ── S3 Bucket Policy allowing only CloudFront OAC ──
# {
#   "Statement": [{
#     "Effect": "Allow",
#     "Principal": {"Service": "cloudfront.amazonaws.com"},
#     "Action": "s3:GetObject",
#     "Resource": "arn:aws:s3:::my-bucket/*",
#     "Condition": {
#       "StringEquals": {
#         "AWS:SourceArn": "arn:aws:cloudfront::123:distribution/E1234"
#       }
#     }
#   }]
# }

# ── Invalidation ──
aws cloudfront create-invalidation \
    --distribution-id E1234ABCDEF \
    --paths "/index.html" "/css/*"

# ── CloudFront Function: Add security headers ──
# function handler(event) {
#   var response = event.response;
#   response.headers["x-frame-options"] = {value: "DENY"};
#   response.headers["x-content-type-options"] = {value: "nosniff"};
#   response.headers["strict-transport-security"] = {
#     value: "max-age=63072000; includeSubdomains; preload"
#   };
#   return response;
# }

# ── Step Functions: Order processing workflow (ASL) ──
# {
#   "StartAt": "ValidateOrder",
#   "States": {
#     "ValidateOrder": {
#       "Type": "Task",
#       "Resource": "arn:aws:lambda:...:ValidateOrderFn",
#       "Next": "CheckInventory",
#       "Retry": [{"ErrorEquals": ["States.ALL"], "MaxAttempts": 3}],
#       "Catch": [{"ErrorEquals": ["States.ALL"], "Next": "OrderFailed"}]
#     },
#     "CheckInventory": {
#       "Type": "Task",
#       "Resource": "arn:aws:lambda:...:CheckInventoryFn",
#       "Next": "ProcessPayment"
#     },
#     "ProcessPayment": {
#       "Type": "Task",
#       "Resource": "arn:aws:lambda:...:ProcessPaymentFn",
#       "Next": "ParallelNotifications"
#     },
#     "ParallelNotifications": {
#       "Type": "Parallel",
#       "Branches": [
#         {"StartAt": "SendEmail", "States": {"SendEmail": {"Type": "Task", "Resource": "arn:aws:lambda:...:SendEmailFn", "End": true}}},
#         {"StartAt": "UpdateAnalytics", "States": {"UpdateAnalytics": {"Type": "Task", "Resource": "arn:aws:lambda:...:AnalyticsFn", "End": true}}}
#       ],
#       "Next": "OrderComplete"
#     },
#     "OrderComplete": {"Type": "Succeed"},
#     "OrderFailed": {"Type": "Fail", "Error": "OrderProcessingFailed"}
#   }
# }

# ── Create State Machine ──
aws stepfunctions create-state-machine \
    --name OrderProcessing \
    --definition file://workflow.json \
    --role-arn arn:aws:iam::123:role/StepFunctionsRole

# ── Start execution ──
aws stepfunctions start-execution \
    --state-machine-arn arn:aws:states:us-east-1:123:stateMachine:OrderProcessing \
    --input '{"orderId":"ORD-001","amount":99.99}'

# ── Comparison ──
# Feature       | Step Functions      | SQS            | EventBridge
# Pattern       | Orchestration       | Choreography   | Choreography
# State         | Full state machine  | None           | None
# Branching     | Choice, Parallel    | None           | Rule-based routing
# Error handling| Retry + Catch       | DLQ            | DLQ
# Visibility    | Visual workflow     | Queue depth    | Events log
# Max duration  | 1 year (Standard)   | 14 days retain | Instant
# Cost model    | Per transition      | Per message    | Per event

# ── Create Web ACL with managed rules ──
aws wafv2 create-web-acl \
    --name MyAppWAF \
    --scope REGIONAL \
    --default-action Allow={} \
    --rules '[
        {
            "Name": "AWSManagedRulesCommonRuleSet",
            "Priority": 1,
            "OverrideAction": {"None": {}},
            "Statement": {
                "ManagedRuleGroupStatement": {
                    "VendorName": "AWS",
                    "Name": "AWSManagedRulesCommonRuleSet"
                }
            },
            "VisibilityConfig": {
                "SampledRequestsEnabled": true,
                "CloudWatchMetricsEnabled": true,
                "MetricName": "CommonRuleSet"
            }
        },
        {
            "Name": "RateLimitRule",
            "Priority": 2,
            "Action": {"Block": {}},
            "Statement": {
                "RateBasedStatement": {
                    "Limit": 2000,
                    "AggregateKeyType": "IP"
                }
            },
            "VisibilityConfig": {
                "SampledRequestsEnabled": true,
                "CloudWatchMetricsEnabled": true,
                "MetricName": "RateLimit"
            }
        }
    ]'

# ── CloudFormation: WAF for ALB ──
# Resources:
#   WebACL:
#     Type: AWS::WAFv2::WebACL
#     Properties:
#       Name: MyAppWAF
#       Scope: REGIONAL
#       DefaultAction: {Allow: {}}
#       Rules:
#         - Name: AWSManagedRulesCommonRuleSet
#           Priority: 1
#           OverrideAction: {None: {}}
#           Statement:
#             ManagedRuleGroupStatement:
#               VendorName: AWS
#               Name: AWSManagedRulesCommonRuleSet
#         - Name: SQLiProtection
#           Priority: 2
#           OverrideAction: {None: {}}
#           Statement:
#             ManagedRuleGroupStatement:
#               VendorName: AWS
#               Name: AWSManagedRulesSQLiRuleSet
#         - Name: RateLimit
#           Priority: 3
#           Action: {Block: {}}
#           Statement:
#             RateBasedStatement:
#               Limit: 2000
#               AggregateKeyType: IP
#
#   WebACLAssociation:
#     Type: AWS::WAFv2::WebACLAssociation
#     Properties:
#       ResourceArn: !Ref ALB
#       WebACLArn: !GetAtt WebACL.Arn

# ── Common AWS Managed Rule Groups ──
# AWSManagedRulesCommonRuleSet — general protection (XSS, SSRF, etc.)
# AWSManagedRulesSQLiRuleSet — SQL injection
# AWSManagedRulesKnownBadInputsRuleSet — log4j, Spring exploits
# AWSManagedRulesBotControlRuleSet — bot detection ($10/million)
# AWSManagedRulesATPRuleSet — account takeover protection

# ── Well-Architected Tool: Create a workload review ──
aws wellarchitected create-workload \
    --workload-name "E-Commerce Platform" \
    --description "Production e-commerce application" \
    --environment PRODUCTION \
    --lenses wellarchitected \
    --aws-regions us-east-1

# ── Answer a question in the review ──
aws wellarchitected update-answer \
    --workload-id w-abc123 \
    --lens-alias wellarchitected \
    --question-id "ops-1" \
    --selected-choices "ops_1_aws_cloud_ops_1" \
    --notes "We use CloudFormation for all infrastructure"

# ── Pillar checklist (key questions per pillar) ──
# OPERATIONAL EXCELLENCE:
# □ Do you use IaC for all infrastructure?
# □ Do you have a CI/CD pipeline with automated testing?
# □ Do you have runbooks for common operational tasks?
# □ Do you have observability (metrics, logs, traces)?
#
# SECURITY:
# □ Is MFA enabled for all human users?
# □ Are IAM roles used instead of access keys?
# □ Is encryption enabled at rest and in transit?
# □ Are security groups following least privilege?
# □ Is CloudTrail enabled for audit logging?
#
# RELIABILITY:
# □ Are workloads deployed across multiple AZs?
# □ Is Auto Scaling configured with health checks?
# □ Do you have automated backups and tested restores?
# □ Is there a disaster recovery plan with defined RPO/RTO?
#
# PERFORMANCE EFFICIENCY:
# □ Are instances right-sized (Compute Optimizer)?
# □ Is caching used (CloudFront, ElastiCache)?
# □ Are you using serverless where appropriate?
#
# COST OPTIMIZATION:
# □ Are Reserved Instances/Savings Plans used for steady-state?
# □ Are unused resources identified and removed?
# □ Are S3 lifecycle policies configured?
# □ Are budgets and billing alerts set up?
#
# SUSTAINABILITY:
# □ Are you using Graviton instances (40% more energy-efficient)?
# □ Are you using serverless to minimize idle resources?

# ── Buy a Savings Plan ──
aws savingsplans create-savings-plan \
    --savings-plan-offering-id offering-abc123 \
    --commitment 10.00 \
    --term-duration-in-seconds 31536000  # 1 year

# ── Request Spot Instances ──
aws ec2 run-instances \
    --instance-type m7g.xlarge \
    --instance-market-options MarketType=spot \
    --count 5 \
    --image-id ami-abc123 \
    --tag-specifications "ResourceType=instance,Tags=[{Key=Purpose,Value=BatchProcessing}]"

# ── Right-sizing: Get Compute Optimizer recommendations ──
aws compute-optimizer get-ec2-instance-recommendations \
    --filters name=Finding,values=OVER_PROVISIONED \
    --query "instanceRecommendations[].{Instance:instanceArn,Current:currentInstanceType,Recommended:recommendationOptions[0].instanceType,Savings:recommendationOptions[0].estimatedMonthlySavings.value}"

# ── Find unused EBS volumes ──
aws ec2 describe-volumes \
    --filters Name=status,Values=available \
    --query "Volumes[].{VolumeId:VolumeId,Size:Size,Created:CreateTime}" \
    --output table

# ── Set up billing alarm ──
aws cloudwatch put-metric-alarm \
    --alarm-name BillingAlarm \
    --metric-name EstimatedCharges \
    --namespace AWS/Billing \
    --statistic Maximum --period 21600 \
    --evaluation-periods 1 --threshold 1000 \
    --comparison-operator GreaterThanThreshold \
    --alarm-actions arn:aws:sns:us-east-1:123:billing-alerts \
    --dimensions Name=Currency,Value=USD

# ── Cost comparison (m7g.large, us-east-1) ──
# Pricing Model    | $/hour  | Monthly (730hr) | Savings
# On-Demand        | $0.0816 | $59.57          | 0%
# 1yr Savings Plan | $0.0518 | $37.81          | 37%
# 3yr Savings Plan | $0.0332 | $24.24          | 59%
# Spot Instance    | ~$0.024 | ~$17.52         | ~70%
#
# ── When to use each ──
# Steady-state production → Savings Plan (1yr or 3yr)
# Variable production     → On-Demand + Auto Scaling
# Batch processing        → Spot Instances (fault-tolerant)
# Dev/Test                → Spot or On-Demand + shutdown schedule

# ── Strategy 1: Backup & Restore ──
# Automated backups:
aws rds modify-db-instance \
    --db-instance-identifier mydb \
    --backup-retention-period 7 \
    --preferred-backup-window "03:00-04:00"

# S3 cross-region backup
aws s3 sync s3://prod-data s3://dr-backup-eu --storage-class STANDARD_IA

# To recover: create new infrastructure from CloudFormation,
# restore DB from latest snapshot
aws rds restore-db-instance-from-db-snapshot \
    --db-instance-identifier mydb-restored \
    --db-snapshot-identifier rds:mydb-2026-05-30-03-00

# ── Strategy 2: Pilot Light ──
# Aurora read replica in DR Region (always running)
# ASG with min=0, max=10 in DR Region (no instances running)
# Route 53 failover with health checks

# On disaster: scale up ASG
aws autoscaling update-auto-scaling-group \
    --auto-scaling-group-name DR-WebServers \
    --min-size 3 --desired-capacity 6

# Promote Aurora replica to primary
aws rds failover-global-cluster \
    --global-cluster-identifier my-global-db \
    --target-db-cluster-identifier arn:aws:rds:eu-west-1:123:cluster:my-aurora-secondary

# ── Strategy 3: Warm Standby ──
# Scaled-down infra in DR Region always running
# Primary: 10 instances, DR: 2 instances
# Route 53 weighted: 100% primary, 0% DR (or failover)

# ── Strategy 4: Active-Active ──
# DynamoDB Global Tables + Aurora Global DB
# Route 53 latency-based routing
# Both Regions serve live traffic simultaneously

# ── DR Strategy comparison ──
# Strategy      | RPO           | RTO           | Cost
# Backup/Restore| Hours         | Hours         | $
# Pilot Light   | Minutes       | 10-30 min     | $$
# Warm Standby  | Seconds       | Minutes       | $$$
# Active-Active | Near-zero     | Near-zero     | $$$$

# ── Key AWS services for DR ──
# Data: Aurora Global DB, DynamoDB Global Tables, S3 CRR
# Compute: ASG, Launch Templates, AMIs (copy cross-region)
# DNS: Route 53 failover/latency routing + health checks
# IaC: CloudFormation StackSets (deploy to multiple Regions)

# ── Enable Control Tower (via Console — no CLI support yet) ──
# 1. Go to AWS Control Tower in the management account
# 2. Set up landing zone → creates:
#    - Log Archive account
#    - Audit account
#    - Security OU, Sandbox OU
#    - 20+ mandatory guardrails

# ── Account Factory: Create a new workload account ──
# Via Service Catalog or CLI:
aws servicecatalog provision-product \
    --product-name "AWS Control Tower Account Factory" \
    --provisioned-product-name "team-alpha-prod" \
    --provisioning-parameters \
    Key=AccountName,Value=team-alpha-prod \
    Key=AccountEmail,Value=team-alpha-prod@company.com \
    Key=SSOUserEmail,Value=admin@company.com \
    Key=ManagedOrganizationalUnit,Value="Workloads/Production"

# ── Guardrails (Controls) ──
# Mandatory (always on):
# - Disallow changes to CloudTrail configuration
# - Disallow changes to AWS Config rules
# - Disallow deletion of log archive

# Strongly recommended:
# - Enable encryption for EBS volumes
# - Disallow public S3 buckets
# - Disallow internet access for RDS instances
# - Enable MFA for root user

# ── Enable additional guardrails ──
aws controltower enable-control \
    --control-identifier arn:aws:controltower:us-east-1::control/AWS-GR_ENCRYPTED_VOLUMES \
    --target-identifier arn:aws:organizations::123:ou/o-xxx/ou-xxx

# ── Landing Zone structure ──
# Root (Management Account — billing only)
# ├── Security OU
# │   ├── Log Archive Account (CloudTrail, Config, immutable S3)
# │   └── Audit Account (GuardDuty, Security Hub, IAM Analyzer)
# ├── Infrastructure OU
# │   └── Shared Services (Transit Gateway, DNS, CI/CD)
# ├── Workloads OU
# │   ├── Production OU
# │   │   ├── team-alpha-prod
# │   │   └── team-beta-prod
# │   ├── Staging OU
# │   └── Development OU
# └── Sandbox OU (experimentation, budget limits)

# ── Customizations for Control Tower (CfCT) ──
# Deploy additional CloudFormation stacks to new accounts:
# - VPC with standard subnets
# - Security groups baseline
# - IAM roles for CI/CD
# - CloudWatch alarm baseline

# ── Enable X-Ray for Lambda ──
aws lambda update-function-configuration \
    --function-name ProcessOrder \
    --tracing-config Mode=Active

# ── Python: X-Ray SDK for custom subsegments ──
# from aws_xray_sdk.core import xray_recorder, patch_all
# patch_all()  # Auto-instrument boto3, requests, etc.
#
# @xray_recorder.capture("process_payment")
# def process_payment(order):
#     # Add annotation for filtering in X-Ray console
#     xray_recorder.current_subsegment().put_annotation("orderId", order["id"])
#     xray_recorder.current_subsegment().put_annotation("amount", order["amount"])
#     # ... payment logic
#     return {"status": "success"}
#
# def handler(event, context):
#     subsegment = xray_recorder.begin_subsegment("validate_input")
#     order = validate(event)
#     xray_recorder.end_subsegment()
#
#     result = process_payment(order)
#     return result

# ── Enable Container Insights for ECS ──
aws ecs update-cluster-settings \
    --cluster my-cluster \
    --settings name=containerInsights,value=enabled

# ── EKS: Install CloudWatch agent for Container Insights ──
# kubectl apply -f https://raw.githubusercontent.com/aws-samples/\
# amazon-cloudwatch-container-insights/latest/k8s-deployment-manifest-templates/\
# deployment-mode/daemonSet/container-insights-monitoring/quickstart/\
# cwagent-fluentd-quickstart.yaml

# ── X-Ray: Get Service Map ──
aws xray get-service-graph \
    --start-time 2026-05-30T00:00:00Z \
    --end-time 2026-05-30T23:59:59Z

# ── Observability stack architecture ──
# Metrics:  CloudWatch Metrics + Container Insights → Grafana
# Logs:     CloudWatch Logs + Fluent Bit → Logs Insights
# Traces:   X-Ray + SDK instrumentation → Service Map
#
# The three pillars together:
# "API latency increased" → (Metrics: P99 spike)
# "Which requests?" → (Traces: X-Ray shows DB calls slow)
# "What error?" → (Logs: CloudWatch Logs Insights query)

# ── CloudWatch dashboard (IaC) ──
# Resources:
#   ObservabilityDashboard:
#     Type: AWS::CloudWatch::Dashboard
#     Properties:
#       DashboardName: AppOverview
#       DashboardBody: !Sub |
#         {"widgets": [
#           {"type": "metric", "properties": {
#             "metrics": [["AWS/Lambda","Duration","FunctionName","ProcessOrder"]],
#             "title": "Lambda Duration"
#           }},
#           {"type": "metric", "properties": {
#             "metrics": [["AWS/Lambda","Errors","FunctionName","ProcessOrder"]],
#             "title": "Lambda Errors"
#           }}
#         ]}

# ── Data Lake S3 structure ──
# s3://my-data-lake/
# ├── raw/                    # Landing zone (original data)
# │   ├── orders/2026/05/30/  # Partitioned by date
# │   │   └── orders.json
# │   └── clickstream/2026/05/30/
# │       └── events.json
# ├── processed/              # Cleaned, Parquet format
# │   └── orders/year=2026/month=05/day=30/
# │       └── part-00000.snappy.parquet
# └── curated/                # Analytics-ready
#     └── daily_revenue/year=2026/month=05/
#         └── revenue.parquet

# ── Glue Crawler: Auto-discover schema ──
aws glue create-crawler \
    --name orders-crawler \
    --role GlueServiceRole \
    --database-name datalake \
    --targets '{"S3Targets":[{"Path":"s3://my-data-lake/processed/orders/"}]}'

aws glue start-crawler --name orders-crawler
# Creates table "orders" in Glue Data Catalog with schema

# ── Athena: Query S3 data with SQL ──
aws athena start-query-execution \
    --query-string "SELECT product, SUM(amount) as revenue
                    FROM datalake.orders
                    WHERE year='2026' AND month='05'
                    GROUP BY product
                    ORDER BY revenue DESC
                    LIMIT 10" \
    --result-configuration OutputLocation=s3://athena-results/

# ── Glue ETL Job (PySpark) ──
# import sys
# from awsglue.transforms import *
# from awsglue.context import GlueContext
# from pyspark.context import SparkContext
#
# sc = SparkContext()
# glueContext = GlueContext(sc)
#
# # Read from raw zone
# raw_df = glueContext.create_dynamic_frame.from_catalog(
#     database="datalake", table_name="raw_orders"
# )
#
# # Transform: clean, filter, flatten
# cleaned = raw_df.filter(lambda x: x["amount"] > 0)
#
# # Write to processed zone in Parquet (partitioned)
# glueContext.write_dynamic_frame.from_options(
#     frame=cleaned,
#     connection_type="s3",
#     connection_options={
#         "path": "s3://my-data-lake/processed/orders/",
#         "partitionKeys": ["year", "month", "day"]
#     },
#     format="parquet"
# )

# ── Lake Formation: Grant permissions ──
aws lakeformation grant-permissions \
    --principal DataLakePrincipalIdentifier=arn:aws:iam::123:role/AnalystRole \
    --resource '{"Table":{"DatabaseName":"datalake","Name":"orders"}}' \
    --permissions SELECT \
    --permissions-with-grant-option []

# ── Cost optimization ──
# Raw JSON: Athena scans 100 GB → $0.50/query
# Parquet + Snappy: scans 10 GB → $0.05/query (90% cheaper!)
# Add partitioning: scans 1 GB → $0.005/query (99% cheaper!)

# ── AWS DMS: Migrate Oracle to Aurora PostgreSQL ──
# 1. Create replication instance
aws dms create-replication-instance \
    --replication-instance-identifier oracle-to-aurora \
    --replication-instance-class dms.r5.large \
    --allocated-storage 100

# 2. Create source endpoint (Oracle)
aws dms create-endpoint \
    --endpoint-identifier oracle-source \
    --endpoint-type source \
    --engine-name oracle \
    --server-name oracle.onprem.company.com \
    --port 1521 \
    --username dms_user \
    --password "****" \
    --database-name ORCL

# 3. Create target endpoint (Aurora PostgreSQL)
aws dms create-endpoint \
    --endpoint-identifier aurora-target \
    --endpoint-type target \
    --engine-name aurora-postgresql \
    --server-name myaurora.cluster-xxx.rds.amazonaws.com \
    --port 5432 \
    --username dms_user \
    --password "****" \
    --database-name appdb

# 4. Create migration task (full load + CDC)
aws dms create-replication-task \
    --replication-task-identifier full-migration \
    --source-endpoint-arn arn:aws:dms:...:endpoint:oracle-source \
    --target-endpoint-arn arn:aws:dms:...:endpoint:aurora-target \
    --replication-instance-arn arn:aws:dms:...:rep:oracle-to-aurora \
    --migration-type full-load-and-cdc \
    --table-mappings file://table-mappings.json

# ── 7 Rs decision matrix ──
# Application Profile            | Strategy     | AWS Tool
# Legacy, unused                 | Retire       | N/A
# Not ready / compliance hold    | Retain       | N/A
# Standard VM workload           | Rehost       | MGN (lift-and-shift)
# VMware workloads               | Relocate     | VMware Cloud on AWS
# Database to managed            | Replatform   | DMS + RDS/Aurora
# COTS software available as SaaS| Repurchase   | SaaS vendor
# Strategic app, needs scale     | Refactor     | Containers, Lambda, etc.

# ── MGN: Application Migration Service ──
# 1. Install replication agent on source server
# 2. Agent replicates to AWS (continuous block-level replication)
# 3. Test: launch test instance from replicated data
# 4. Cutover: launch final instance, update DNS
# Minimal downtime: only the final cutover (minutes)

# ── Migration Hub: Track progress ──
aws migrationhub notify-migration-task-state \
    --progress-update-stream my-migration \
    --migration-task-name "Oracle DB Migration" \
    --task Status=IN_PROGRESS \
    --update-date-time 2026-05-30T12:00:00Z

# ── Create a Cluster Placement Group ──
aws ec2 create-placement-group \
    --group-name hpc-cluster \
    --strategy cluster

# Launch instances in the cluster
aws ec2 run-instances \
    --instance-type c7gn.16xlarge \
    --placement GroupName=hpc-cluster \
    --count 8 \
    --image-id ami-abc123

# ── Verify Enhanced Networking (ENA) ──
aws ec2 describe-instances \
    --instance-ids i-abc123 \
    --query "Reservations[].Instances[].EnaSupport"
# Output: true

# ── Instance Store: Check available NVMe drives ──
# lsblk   (on the instance)
# NAME    SIZE  TYPE
# nvme0n1 1.9T  disk    ← Instance store (ephemeral!)
# nvme1n1 1.9T  disk    ← Instance store
# nvme2n1 500G  disk    ← EBS root volume

# ── Instance Store: Format and mount ──
# mkfs.xfs /dev/nvme0n1
# mount /dev/nvme0n1 /mnt/scratch
# Warning: data lost on stop/terminate!

# ── CloudFormation: Cluster Placement Group ──
# Resources:
#   HPCPlacementGroup:
#     Type: AWS::EC2::PlacementGroup
#     Properties:
#       Strategy: cluster
#
#   HPCInstance:
#     Type: AWS::EC2::Instance
#     Properties:
#       InstanceType: c7gn.16xlarge
#       Placement:
#         GroupName: !Ref HPCPlacementGroup
#       NetworkInterfaces:
#         - DeviceIndex: 0
#           SubnetId: !Ref HPCSubnet
#           Groups: [!Ref HPCSG]
#           InterfaceType: efa  # EFA for HPC networking

# ── Performance comparison ──
# Networking:
# Standard:  up to 25 Gbps, ~100μs latency
# ENA:       up to 200 Gbps, ~25μs latency
# EFA:       up to 400 Gbps, ~5μs latency (OS bypass)
# Cluster PG: < 1μs between instances (same rack)
#
# Storage:
# gp3 EBS:      16,000 IOPS, ~1ms latency
# io2 EBS:      256,000 IOPS, ~sub-ms latency
# Instance Store: 7.5M IOPS (i4i.metal), ~μs latency

# ── Multipart Upload (AWS CLI does this automatically for large files) ──
aws s3 cp large-file.zip s3://my-bucket/ \
    --expected-size 5368709120  # 5 GB

# ── Manual multipart with boto3 (for custom control) ──
# import boto3
# from boto3.s3.transfer import TransferConfig
#
# s3 = boto3.client("s3")
# config = TransferConfig(
#     multipart_threshold=100 * 1024 * 1024,  # 100 MB
#     multipart_chunksize=25 * 1024 * 1024,   # 25 MB per part
#     max_concurrency=10                       # 10 parallel uploads
# )
# s3.upload_file("large-file.zip", "my-bucket", "large-file.zip", Config=config)

# ── Enable Transfer Acceleration ──
aws s3api put-bucket-accelerate-configuration \
    --bucket my-bucket \
    --accelerate-configuration Status=Enabled

# Upload using accelerated endpoint
aws s3 cp large-file.zip s3://my-bucket/ \
    --endpoint-url https://my-bucket.s3-accelerate.amazonaws.com

# ── S3 Select: Query CSV without downloading ──
aws s3api select-object-content \
    --bucket my-bucket \
    --key data/sales.csv \
    --expression "SELECT s.product, s.amount FROM s3object s WHERE s.amount > '1000'" \
    --expression-type SQL \
    --input-serialization '{"CSV":{"FileHeaderInfo":"USE"}}' \
    --output-serialization '{"JSON":{}}'

# ── Python: S3 Select ──
# response = s3.select_object_content(
#     Bucket="my-bucket",
#     Key="data/sales.csv",
#     Expression="SELECT * FROM s3object s WHERE s.region = 'US'",
#     ExpressionType="SQL",
#     InputSerialization={"CSV": {"FileHeaderInfo": "USE"}},
#     OutputSerialization={"JSON": {}}
# )
# for event in response["Payload"]:
#     if "Records" in event:
#         print(event["Records"]["Payload"].decode())

# ── Prefix distribution for high request rates ──
# Bad: all objects under one prefix
# s3://bucket/images/img001.jpg  → 1 prefix, limited to 5,500 GET/s
# s3://bucket/images/img002.jpg
#
# Good: distribute across prefixes (use hash or date)
# s3://bucket/a1b2/images/img001.jpg  → prefix "a1b2"
# s3://bucket/c3d4/images/img002.jpg  → prefix "c3d4"
# Or: s3://bucket/2026/05/30/img001.jpg

# ── Performance tuning checklist ──
# ✅ Objects > 100 MB: use multipart upload
# ✅ Cross-continent uploads: enable Transfer Acceleration
# ✅ Need only subset of data: use S3 Select
# ✅ > 5,500 GET/s: distribute across multiple prefixes
# ✅ Large downloads: use byte-range fetches (parallel)
# ✅ Analytics: use Parquet (columnar) instead of CSV/JSON

# ── Write Sharding: Distribute hot keys ──
# Problem: PK = "trending_products" gets 10,000 WCU/s
# Solution: shard across N keys

# import random
# SHARD_COUNT = 10
#
# def write_trending(product_data):
#     shard = random.randint(0, SHARD_COUNT - 1)
#     table.put_item(Item={
#         "PK": f"trending_products#{shard}",  # Distributed!
#         "SK": product_data["productId"],
#         "data": product_data
#     })
#
# def read_all_trending():
#     """Scatter-gather across all shards"""
#     items = []
#     for shard in range(SHARD_COUNT):
#         response = table.query(
#             KeyConditionExpression=Key("PK").eq(f"trending_products#{shard}")
#         )
#         items.extend(response["Items"])
#     return items

# ── DAX: In-memory cache ──
aws dax create-cluster \
    --cluster-name my-dax \
    --node-type dax.r5.large \
    --replication-factor 3 \
    --iam-role-arn arn:aws:iam::123:role/DAXRole \
    --subnet-group-name my-dax-subnets \
    --security-group-ids sg-dax

# Python: Switch from DynamoDB to DAX (minimal code change)
# import amazondax
#
# # Before (DynamoDB direct):
# # dynamodb = boto3.resource("dynamodb")
#
# # After (DAX — API compatible!):
# dax = amazondax.AmazonDaxClient(endpoint_url="daxs://my-dax.xxx.dax-clusters.us-east-1.amazonaws.com:8111")
# table = dax.Table("Products")
# response = table.get_item(Key={"productId": "P001"})
# # Microsecond response from cache!

# ── Efficient queries ──
# Only read attributes you need (save RCUs)
aws dynamodb query \
    --table-name Orders \
    --key-condition-expression "customerId = :cid" \
    --projection-expression "orderId, amount, #s" \
    --expression-attribute-names '{"#s": "status"}' \
    --expression-attribute-values '{":cid": {"S": "CUST-001"}}'

# ── BatchGetItem: Read up to 100 items at once ──
aws dynamodb batch-get-item --request-items '{
    "Products": {
        "Keys": [
            {"productId": {"S": "P001"}},
            {"productId": {"S": "P002"}},
            {"productId": {"S": "P003"}}
        ],
        "ProjectionExpression": "productId, productName, price"
    }
}'

# ── Enable TTL (auto-delete expired items) ──
aws dynamodb update-time-to-live \
    --table-name Sessions \
    --time-to-live-specification Enabled=true,AttributeName=expiresAt

# ── Performance metrics to monitor ──
# ConsumedReadCapacityUnits / ConsumedWriteCapacityUnits
# ThrottledRequests (should be 0!)
# SuccessfulRequestLatency (P99 should be < 10ms)
# AccountProvisionedReadCapacityUtilization

# ── Set Provisioned Concurrency ──
# First, publish a version (can't set PC on $LATEST)
aws lambda publish-version \
    --function-name ProcessOrder \
    --description "v1"

aws lambda put-provisioned-concurrency-config \
    --function-name ProcessOrder \
    --qualifier 1 \
    --provisioned-concurrent-executions 50

# ── Enable SnapStart (Java only) ──
aws lambda update-function-configuration \
    --function-name JavaOrderProcessor \
    --snap-start ApplyOn=PublishedVersions

# Publish a version to trigger snapshot creation
aws lambda publish-version --function-name JavaOrderProcessor

# ── Auto Scaling for Provisioned Concurrency ──
aws application-autoscaling register-scalable-target \
    --service-namespace lambda \
    --resource-id function:ProcessOrder:prod \
    --scalable-dimension lambda:function:ProvisionedConcurrency \
    --min-capacity 10 --max-capacity 200

aws application-autoscaling put-scaling-policy \
    --service-namespace lambda \
    --resource-id function:ProcessOrder:prod \
    --scalable-dimension lambda:function:ProvisionedConcurrency \
    --policy-name LambdaPCAutoScaling \
    --policy-type TargetTrackingScaling \
    --target-tracking-scaling-policy-configuration '{
        "TargetValue": 0.7,
        "PredefinedMetricSpecification": {
            "PredefinedMetricType": "LambdaProvisionedConcurrencyUtilization"
        }
    }'

# ── Lambda Power Tuning results (example) ──
# Memory (MB) | Duration (ms) | Cost ($) | Notes
# 128         | 3,200         | 0.000053 | CPU throttled, very slow
# 512         | 850           | 0.000056 | Better, still CPU-bound
# 1024        | 420           | 0.000055 | Sweet spot!
# 1769        | 250           | 0.000057 | Full vCPU, diminishing returns
# 3008        | 240           | 0.000093 | Minimal improvement, more expensive
# Optimal: 1024 MB — fastest AND cheapest!

# ── Cold start reduction tips ──
# 1. Keep deployment package small
#    zip -r function.zip handler.py  # Not the entire virtualenv
#    Use Layers for shared dependencies
#
# 2. Initialize outside the handler
#    import boto3
#    dynamodb = boto3.resource("dynamodb")  # Init once!
#    table = dynamodb.Table("Orders")       # Reused on warm starts
#
#    def handler(event, context):
#        return table.get_item(Key={"id": event["id"]})
#
# 3. Avoid unnecessary imports
#    # Bad: import boto3 (loads entire SDK)
#    # Good: from boto3 import client (loads only what you need)
#
# 4. Use arm64 (Graviton) — 34% cheaper, often faster
aws lambda update-function-configuration \
    --function-name ProcessOrder \
    --architectures arm64

# ── Create Gateway Endpoint for S3 (FREE!) ──
aws ec2 create-vpc-endpoint \
    --vpc-id vpc-abc123 \
    --service-name com.amazonaws.us-east-1.s3 \
    --route-table-ids rtb-private1 rtb-private2 \
    --vpc-endpoint-type Gateway

# ── Create Interface Endpoint for SQS ──
aws ec2 create-vpc-endpoint \
    --vpc-id vpc-abc123 \
    --service-name com.amazonaws.us-east-1.sqs \
    --vpc-endpoint-type Interface \
    --subnet-ids subnet-private1 subnet-private2 \
    --security-group-ids sg-endpoint \
    --private-dns-enabled

# ── Global Accelerator ──
aws globalaccelerator create-accelerator \
    --name my-app-accelerator \
    --ip-address-type IPV4 \
    --enabled

# Add listener
aws globalaccelerator create-listener \
    --accelerator-arn arn:aws:globalaccelerator::123:accelerator/abc \
    --port-ranges FromPort=443,ToPort=443 \
    --protocol TCP

# Add endpoint group (ALBs in two Regions)
aws globalaccelerator create-endpoint-group \
    --listener-arn arn:aws:globalaccelerator::123:accelerator/abc/listener/def \
    --endpoint-group-region us-east-1 \
    --endpoint-configurations \
    EndpointId=arn:aws:elasticloadbalancing:us-east-1:123:loadbalancer/app/my-alb/xxx,Weight=70 \
    EndpointId=arn:aws:elasticloadbalancing:eu-west-1:123:loadbalancer/app/my-alb-eu/xxx,Weight=30

# ── Data transfer cost optimization ──
# Scenario: Lambda in private subnet calls S3 via NAT Gateway
# Without VPC endpoint:
#   Lambda → NAT Gateway → Internet → S3
#   Cost: $0.045/GB (NAT) + $0.09/GB (internet) = $0.135/GB
#
# With S3 Gateway Endpoint:
#   Lambda → VPC Endpoint → S3 (AWS backbone)
#   Cost: $0.00/GB (free!)
#   Savings: 100%!

# ── Monitor data transfer ──
aws ce get-cost-and-usage \
    --time-period Start=2026-05-01,End=2026-05-31 \
    --granularity MONTHLY \
    --filter '{"Dimensions":{"Key":"USAGE_TYPE","Values":["DataTransfer-Out-Bytes"]}}' \
    --metrics BlendedCost

# ── Architecture: Minimize cross-AZ data transfer ──
# Bad: Web server in AZ-a, Redis in AZ-b
#   Every cache call: $0.01/GB cross-AZ each way
#   10TB/month cache traffic = $200/month in data transfer alone
#
# Good: Co-locate in same AZ, or accept cross-AZ for HA
#   Use private IPs (not public IPs — public IPs go via IGW, cost more)

# ── Comparison: Global Accelerator vs CloudFront ──
# Feature        | Global Accelerator   | CloudFront
# Caching        | No                   | Yes
# Static IPs     | Yes (2 anycast)      | No
# Protocol       | TCP, UDP             | HTTP, HTTPS, WebSocket
# Use case       | Dynamic APIs, gaming | Static content, web apps
# Failover       | < 30 seconds         | Origin failover
# Cost           | $0.025/hr + data     | Data transfer only