Cloud Architecture & IaC (AWS, Terraform, Serverless)

import json
import boto3

# AWS Lambda function — API Gateway থেকে triggered
def lambda_handler(event, context):
    """
    event: API Gateway request (HTTP method, path, body, headers)
    context: Lambda runtime info (timeout, memory, request_id)
    """

    http_method = event.get('httpMethod', 'GET')
    path = event.get('path', '/')
    body = json.loads(event.get('body') or '{}')

    # DynamoDB client (Lambda-র IAM role থেকে auto-auth)
    dynamodb = boto3.resource('dynamodb')
    table = dynamodb.Table('users')

    if http_method == 'POST' and path == '/users':
        # User create করুন
        user_id = body.get('user_id')
        name = body.get('name')

        table.put_item(Item={
            'user_id': user_id,
            'name': name,
            'created_at': str(__import__('datetime').datetime.utcnow())
        })

        return {
            'statusCode': 201,
            'headers': {'Content-Type': 'application/json'},
            'body': json.dumps({'message': 'User created', 'user_id': user_id})
        }

    elif http_method == 'GET' and path.startswith('/users/'):
        # User fetch করুন
        user_id = path.split('/')[-1]
        response = table.get_item(Key={'user_id': user_id})
        user = response.get('Item')

        if not user:
            return {'statusCode': 404, 'body': json.dumps({'error': 'Not found'})}

        return {
            'statusCode': 200,
            'headers': {'Content-Type': 'application/json'},
            'body': json.dumps(user)
        }

    return {'statusCode': 400, 'body': json.dumps({'error': 'Bad request'})}

# Lambda-র সুবিধা:
# - Server manage করতে হয় না
# - Auto-scale (0 to 10000+ concurrent)
# - Pay only for execution time (100ms billing)
# - Max execution: 15 minutes, Max memory: 10GB

# Provider configuration
provider "aws" {
  region = var.aws_region  # "ap-southeast-1" for Singapore
}

# ============================================================
# VPC — Isolated Network
# ============================================================
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true

  tags = {
    Name        = "${var.project_name}-vpc"
    Environment = var.environment
  }
}

# Public subnet (EC2, Load Balancer)
resource "aws_subnet" "public" {
  count             = 2
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.${count.index}.0/24"
  availability_zone = data.aws_availability_zones.available.names[count.index]
  map_public_ip_on_launch = true

  tags = { Name = "${var.project_name}-public-${count.index}" }
}

# Private subnet (RDS, ElastiCache)
resource "aws_subnet" "private" {
  count             = 2
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.${count.index + 10}.0/24"
  availability_zone = data.aws_availability_zones.available.names[count.index]

  tags = { Name = "${var.project_name}-private-${count.index}" }
}

# ============================================================
# EC2 — Application Server (Auto Scaling Group)
# ============================================================
resource "aws_launch_template" "app" {
  name_prefix   = "${var.project_name}-"
  image_id      = data.aws_ami.amazon_linux.id
  instance_type = var.instance_type  # "t3.medium"

  vpc_security_group_ids = [aws_security_group.app.id]

  user_data = base64encode(<<-EOF
    #!/bin/bash
    yum update -y
    yum install -y docker
    systemctl start docker
    docker run -d -p 80:8080 ${var.app_image}
  EOF
  )

  tag_specifications {
    resource_type = "instance"
    tags = { Name = "${var.project_name}-app" }
  }
}

resource "aws_autoscaling_group" "app" {
  name                = "${var.project_name}-asg"
  desired_capacity    = var.desired_capacity
  min_size            = var.min_capacity
  max_size            = var.max_capacity
  vpc_zone_identifier = aws_subnet.public[*].id

  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }
}

# ============================================================
# RDS — Managed PostgreSQL
# ============================================================
resource "aws_db_subnet_group" "main" {
  name       = "${var.project_name}-db-subnet"
  subnet_ids = aws_subnet.private[*].id
}

resource "aws_db_instance" "postgres" {
  identifier           = "${var.project_name}-db"
  engine               = "postgres"
  engine_version       = "15.3"
  instance_class       = "db.t3.medium"
  allocated_storage    = 100
  storage_encrypted    = true

  db_name  = var.db_name
  username = var.db_username
  password = var.db_password  # Use AWS Secrets Manager in production!

  db_subnet_group_name   = aws_db_subnet_group.main.name
  vpc_security_group_ids = [aws_security_group.db.id]

  multi_az            = true   # High availability — 2 AZ
  skip_final_snapshot = false
  deletion_protection = true

  tags = { Name = "${var.project_name}-postgres" }
}

# Output: RDS endpoint (app config-এ use করুন)
output "db_endpoint" {
  value     = aws_db_instance.postgres.endpoint
  sensitive = true
}

# Target Tracking Auto Scaling Policy
resource "aws_autoscaling_policy" "cpu_target" {
  name                   = "${var.project_name}-cpu-target"
  autoscaling_group_name = aws_autoscaling_group.app.name
  policy_type            = "TargetTrackingScaling"

  target_tracking_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ASGAverageCPUUtilization"
    }
    # CPU 60% target — over = scale out, under = scale in
    target_value = 60.0

    # Scale in cool-down: 300s (5 min) — sudden traffic drop-এ overreact না
    # Scale out cool-down: 60s (1 min) — traffic spike দ্রুত handle
    disable_scale_in = false
  }
}

# Scheduled Scaling — Office hours (predictable load)
resource "aws_autoscaling_schedule" "scale_up_morning" {
  scheduled_action_name  = "scale-up-morning"
  autoscaling_group_name = aws_autoscaling_group.app.name

  # Mon-Fri 9 AM UTC+6 = 3 AM UTC
  recurrence       = "0 3 * * MON-FRI"
  desired_capacity = 10
  min_size         = 5
  max_size         = 50
}

resource "aws_autoscaling_schedule" "scale_down_night" {
  scheduled_action_name  = "scale-down-night"
  autoscaling_group_name = aws_autoscaling_group.app.name

  # 11 PM UTC+6 = 5 PM UTC
  recurrence       = "0 17 * * MON-FRI"
  desired_capacity = 2
  min_size         = 2
  max_size         = 10
}

# CloudWatch Alarm — High CPU alert
resource "aws_cloudwatch_metric_alarm" "high_cpu" {
  alarm_name          = "${var.project_name}-high-cpu"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 2
  metric_name         = "CPUUtilization"
  namespace           = "AWS/EC2"
  period              = 60
  statistic           = "Average"
  threshold           = 80
  alarm_description   = "EC2 CPU over 80%"

  dimensions = {
    AutoScalingGroupName = aws_autoscaling_group.app.name
  }

  alarm_actions = [aws_sns_topic.alerts.arn]  # SNS → PagerDuty / Slack
}

# Kubernetes Pod-এ Application + Envoy Sidecar
apiVersion: v1
kind: Pod
metadata:
  name: payment-service
  labels:
    app: payment
    version: v1
spec:
  containers:
    # ─── Main Application Container ───────────────────────────────
    - name: payment-app
      image: myregistry/payment-service:latest
      ports:
        - containerPort: 8080
      env:
        - name: DB_HOST
          valueFrom:
            secretKeyRef:
              name: payment-secrets
              key: db-host
      # App code শুধু business logic — networking concern নেই

    # ─── Envoy Sidecar Proxy (Service Mesh) ──────────────────────
    - name: envoy-proxy
      image: envoyproxy/envoy:v1.28
      ports:
        - containerPort: 9901   # Admin port
        - containerPort: 15001  # Outbound proxy
        - containerPort: 15006  # Inbound proxy
      # Sidecar এর দায়িত্ব:
      # ✓ mTLS (mutual TLS) — service-to-service encryption
      # ✓ Circuit breaking — downstream failure isolation
      # ✓ Retry + timeout — configurable per-route
      # ✓ Load balancing — across upstream pods
      # ✓ Observability — metrics, traces automatically
      volumeMounts:
        - name: envoy-config
          mountPath: /etc/envoy

  volumes:
    - name: envoy-config
      configMap:
        name: envoy-config

# Istio আপনার সব pods-এ automatically এই sidecar inject করে
# আপনার app code change করতে হয় না!