# ALWAYS: Use modules with clear inputs and outputs
# modules/database/main.tf
 
resource "aws_db_instance" "primary" {
  identifier     = "${var.project}-${var.environment}-primary"
  engine         = "postgres"
  engine_version = "16.4"
  instance_class = var.instance_class
 
  allocated_storage     = var.allocated_storage
  max_allocated_storage = var.max_allocated_storage
  storage_encrypted     = true
  kms_key_id           = var.kms_key_arn
 
  db_name  = var.database_name
  username = var.master_username
  password = var.master_password
 
  multi_az               = var.environment == "production"
  db_subnet_group_name   = aws_db_subnet_group.this.name
  vpc_security_group_ids = [aws_security_group.database.id]
 
  backup_retention_period = var.environment == "production" ? 30 : 7
  backup_window          = "03:00-04:00"
  maintenance_window     = "sun:04:00-sun:05:00"
 
  deletion_protection = var.environment == "production"
  skip_final_snapshot = var.environment != "production"
 
  performance_insights_enabled = true
  monitoring_interval         = 60
  monitoring_role_arn        = aws_iam_role.rds_monitoring.arn
 
  tags = {
    Project     = var.project
    Environment = var.environment
    ManagedBy   = "terraform"
  }
}
 
resource "aws_db_instance" "read_replica" {
  count = var.read_replica_count
 
  identifier          = "${var.project}-${var.environment}-replica-${count.index}"
  replicate_source_db = aws_db_instance.primary.identifier
  instance_class      = var.replica_instance_class
 
  storage_encrypted = true
  kms_key_id       = var.kms_key_arn
 
  tags = {
    Project     = var.project
    Environment = var.environment
    Role        = "read-replica"
    ManagedBy   = "terraform"
  }
}

// ALWAYS: Use Pulumi for complex infrastructure with TypeScript type safety
// pulumi/src/lambda.ts
 
import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";
 
interface ApiLambdaConfig {
  name: string;
  handler: string;
  memorySize: number;
  timeout: number;
  environment: Record<string, pulumi.Input<string>>;
  vpcConfig?: {
    subnetIds: pulumi.Input<string>[];
    securityGroupIds: pulumi.Input<string>[];
  };
}
 
export function createApiLambda(config: ApiLambdaConfig) {
  const role = new aws.iam.Role(`${config.name}-role`, {
    assumeRolePolicy: JSON.stringify({
      Version: "2012-10-17",
      Statement: [{
        Action: "sts:AssumeRole",
        Effect: "Allow",
        Principal: { Service: "lambda.amazonaws.com" },
      }],
    }),
  });
 
  // Attach minimal required policies
  new aws.iam.RolePolicyAttachment(`${config.name}-basic-execution`, {
    role: role.name,
    policyArn: aws.iam.ManagedPolicies.AWSLambdaBasicExecutionRole,
  });
 
  if (config.vpcConfig) {
    new aws.iam.RolePolicyAttachment(`${config.name}-vpc-access`, {
      role: role.name,
      policyArn: aws.iam.ManagedPolicies.AWSLambdaVPCAccessExecutionRole,
    });
  }
 
  const fn = new aws.lambda.Function(config.name, {
    runtime: aws.lambda.Runtime.NodeJS22dX,
    handler: config.handler,
    role: role.arn,
    memorySize: config.memorySize,
    timeout: config.timeout,
    environment: {
      variables: config.environment,
    },
    vpcConfig: config.vpcConfig ? {
      subnetIds: config.vpcConfig.subnetIds,
      securityGroupIds: config.vpcConfig.securityGroupIds,
    } : undefined,
    tracingConfig: {
      mode: "Active", // Enable X-Ray tracing
    },
  });
 
  // Create function URL for direct invocation
  const functionUrl = new aws.lambda.FunctionUrl(`${config.name}-url`, {
    functionName: fn.name,
    authorizationType: "AWS_IAM",
  });
 
  return { function: fn, role, functionUrl };
}

// ALWAYS: Use edge functions for low-latency middleware
// middleware.ts (Next.js)
 
import { NextRequest, NextResponse } from "next/server";
import { geolocation } from "@vercel/functions";
 
export function middleware(request: NextRequest) {
  const { country, region } = geolocation(request);
 
  // Geo-based routing
  if (country === "DE" || country === "FR") {
    const url = request.nextUrl.clone();
    url.pathname = `/eu${url.pathname}`;
    return NextResponse.rewrite(url);
  }
 
  // A/B testing at the edge
  const bucket = request.cookies.get("ab-bucket")?.value;
  if (!bucket) {
    const newBucket = Math.random() < 0.5 ? "control" : "variant";
    const response = NextResponse.next();
    response.cookies.set("ab-bucket", newBucket, {
      maxAge: 60 * 60 * 24 * 30, // 30 days
      httpOnly: true,
    });
    return response;
  }
 
  return NextResponse.next();
}
 
export const config = {
  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
};

// Pulumi: S3 bucket with CloudFront distribution
// pulumi/src/cdn.ts
 
import * as aws from "@pulumi/aws";
 
export function createCdnDistribution(bucketName: string, domainName: string) {
  const bucket = new aws.s3.BucketV2(bucketName, {
    bucket: bucketName,
  });
 
  new aws.s3.BucketVersioningV2(`${bucketName}-versioning`, {
    bucket: bucket.id,
    versioningConfiguration: { status: "Enabled" },
  });
 
  new aws.s3.BucketLifecycleConfigurationV2(`${bucketName}-lifecycle`, {
    bucket: bucket.id,
    rules: [
      {
        id: "intelligent-tiering",
        status: "Enabled",
        transitions: [{
          days: 30,
          storageClass: "INTELLIGENT_TIERING",
        }],
      },
      {
        id: "expire-old-versions",
        status: "Enabled",
        noncurrentVersionExpiration: { noncurrentDays: 90 },
      },
    ],
  });
 
  const oac = new aws.cloudfront.OriginAccessControl(`${bucketName}-oac`, {
    name: `${bucketName}-oac`,
    originAccessControlOriginType: "s3",
    signingBehavior: "always",
    signingProtocol: "sigv4",
  });
 
  const distribution = new aws.cloudfront.Distribution(`${bucketName}-cdn`, {
    enabled: true,
    origins: [{
      domainName: bucket.bucketRegionalDomainName,
      originId: "s3",
      originAccessControlId: oac.id,
    }],
    defaultCacheBehavior: {
      targetOriginId: "s3",
      viewerProtocolPolicy: "redirect-to-https",
      allowedMethods: ["GET", "HEAD", "OPTIONS"],
      cachedMethods: ["GET", "HEAD"],
      compress: true,
      cachePolicyId: "658327ea-f89d-4fab-a63d-7e88639e58f6", // CachingOptimized
    },
    restrictions: {
      geoRestriction: { restrictionType: "none" },
    },
    viewerCertificate: {
      acmCertificateArn: domainName ? getCertArn(domainName) : undefined,
      cloudfrontDefaultCertificate: !domainName,
      sslSupportMethod: domainName ? "sni-only" : undefined,
    },
  });
 
  return { bucket, distribution };
}

// ALWAYS: Set up cost alerts and budgets
// pulumi/src/monitoring.ts
 
import * as aws from "@pulumi/aws";
 
export function createCostAlerts(monthlyBudget: number, emails: string[]) {
  new aws.budgets.Budget("monthly-budget", {
    budgetType: "COST",
    limitAmount: monthlyBudget.toString(),
    limitUnit: "USD",
    timePeriodStart: "2024-01-01_00:00",
    timeUnit: "MONTHLY",
    notifications: [
      {
        comparisonOperator: "GREATER_THAN",
        threshold: 50,
        thresholdType: "PERCENTAGE",
        notificationType: "ACTUAL",
        subscriberEmailAddresses: emails,
      },
      {
        comparisonOperator: "GREATER_THAN",
        threshold: 80,
        thresholdType: "PERCENTAGE",
        notificationType: "ACTUAL",
        subscriberEmailAddresses: emails,
      },
      {
        comparisonOperator: "GREATER_THAN",
        threshold: 100,
        thresholdType: "PERCENTAGE",
        notificationType: "FORECASTED",
        subscriberEmailAddresses: emails,
      },
    ],
  });
 
  // Per-service cost anomaly detection
  new aws.costexplorer.AnomalyMonitor("service-anomaly-monitor", {
    monitorType: "DIMENSIONAL",
    monitorDimension: "SERVICE",
    name: "Service Cost Anomaly Monitor",
  });
}

# ALWAYS: Configure auto-scaling based on actual metrics
# modules/compute/autoscaling.tf
 
resource "aws_appautoscaling_target" "ecs_target" {
  max_capacity       = var.max_capacity
  min_capacity       = var.min_capacity
  resource_id        = "service/${var.cluster_name}/${var.service_name}"
  scalable_dimension = "ecs:service:DesiredCount"
  service_namespace  = "ecs"
}
 
# Scale on CPU utilization
resource "aws_appautoscaling_policy" "cpu" {
  name               = "${var.service_name}-cpu-scaling"
  policy_type        = "TargetTrackingScaling"
  resource_id        = aws_appautoscaling_target.ecs_target.resource_id
  scalable_dimension = aws_appautoscaling_target.ecs_target.scalable_dimension
  service_namespace  = aws_appautoscaling_target.ecs_target.service_namespace
 
  target_tracking_scaling_policy_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ECSServiceAverageCPUUtilization"
    }
    target_value       = 70
    scale_in_cooldown  = 300
    scale_out_cooldown = 60
  }
}
 
# Scale on request count per target
resource "aws_appautoscaling_policy" "requests" {
  name               = "${var.service_name}-request-scaling"
  policy_type        = "TargetTrackingScaling"
  resource_id        = aws_appautoscaling_target.ecs_target.resource_id
  scalable_dimension = aws_appautoscaling_target.ecs_target.scalable_dimension
  service_namespace  = aws_appautoscaling_target.ecs_target.service_namespace
 
  target_tracking_scaling_policy_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ALBRequestCountPerTarget"
      resource_label         = var.alb_target_group_arn_suffix
    }
    target_value       = 1000
    scale_in_cooldown  = 300
    scale_out_cooldown = 60
  }
}