NIST SP 800-53 - AWS

const logGroup = new aws.cloudwatch.LogGroup("api-logs", {
    retentionInDays: 30,
});

const stage = new aws.apigateway.Stage("my-stage", {
    restApi: api.id,
    stageName: "prod",
    deployment: deployment.id,
    accessLogSettings: { // Enable access logging
        destinationArn: logGroup.arn, // Specify CloudWatch Log Group
        format: "$context.requestId",
    },
});

import * as aws from "@pulumi/aws";

const methodSettings = new aws.apigateway.MethodSettings("example-method-settings", {
    restApi: restApi.id,
    stageName: stage.stageName,
    methodPath: "*/*",
    settings: {
        cachingEnabled: true,
        cacheDataEncrypted: true,  // Enable cache encryption at rest
        cacheTtlInSeconds: 300,
    },
});

import * as aws from "@pulumi/aws";

// Create a client certificate for SSL/TLS authentication
const clientCert = new aws.apigateway.ClientCertificate("api-client-cert", {
    description: "Client certificate for API Gateway SSL authentication",
});

const stage = new aws.apigateway.Stage("api-stage", {
    restApi: restApi.id,
    deployment: deployment.id,
    stageName: "production",
    clientCertificateId: clientCert.id, // Add this property to enable SSL certificate validation
});

const logGroup = new aws.cloudwatch.LogGroup("api-v2-logs", {
    retentionInDays: 30,
});

const stage = new aws.apigatewayv2.Stage("my-stage", {
    apiId: api.id,
    name: "prod",
    accessLogSettings: { // Enable access logging
        destinationArn: logGroup.arn, // Specify CloudWatch Log Group
        format: "$context.requestId",
    },
});

import * as aws from "@pulumi/aws";

// Your existing API Gateway stage
const apiStage = new aws.apigateway.Stage("api-stage", {
    restApi: restApi.id,
    stageName: "prod",
    deployment: deployment.id,
});

// Create or reference a WAF Web ACL
const webAcl = new aws.wafv2.WebAcl("web-acl", {
    scope: "REGIONAL",
    defaultAction: { allow: {} },
    rules: [/* your WAF rules */],
    visibilityConfig: {
        cloudwatchMetricsEnabled: true,
        metricName: "webAclMetric",
        sampledRequestsEnabled: true,
    },
});

// Associate the WAF Web ACL with the API Gateway stage
const wafAssociation = new aws.wafv2.WebAclAssociation("stage-waf", {
    resourceArn: apiStage.arn, // Link to the API Gateway stage
    webAclArn: webAcl.arn,
});

const asg = new aws.autoscaling.Group("my-asg", {
    minSize: 1,
    maxSize: 3,
    targetGroupArns: [targetGroup.arn],
    healthCheckType: "ELB", // Enable ELB health checks
    healthCheckGracePeriod: 300, // Set grace period to at least 300 seconds
    vpcZoneIdentifiers: subnetIds,
    launchTemplate: {
        id: launchTemplate.id,
        version: "$Latest",
    },
});

const logGroup = new aws.cloudwatch.LogGroup("trail-log-group", {
    retentionInDays: 90,
});

const trailRole = new aws.iam.Role("trail-cloudwatch-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: { Service: "cloudtrail.amazonaws.com" },
            Action: "sts:AssumeRole",
        }],
    }),
});

const trail = new aws.cloudtrail.Trail("my-trail", {
    s3BucketName: bucket.id,
    cloudWatchLogsGroupArn: logGroup.arn,  // Add this field
    cloudWatchLogsRoleArn: trailRole.arn,  // Add this field
});

import * as aws from "@pulumi/aws";

// Create an S3 bucket for CloudTrail logs
const trailBucket = new aws.s3.Bucket("cloudtrail-logs", {
    forceDestroy: true, // Only for demo - remove in production
});

// Create CloudTrail trail
const trail = new aws.cloudtrail.Trail("main-trail", {
    s3BucketName: trailBucket.bucket,
    isMultiRegionTrail: true, // Enable for all regions
    includeGlobalServiceEvents: true,
    enableLogFileValidation: true, // Ensure log integrity
});

import * as aws from "@pulumi/aws";

// Create or reference a KMS key for CloudTrail encryption
const trailKey = new aws.kms.Key("trail-key", {
    description: "KMS key for CloudTrail log encryption",
    enableKeyRotation: true,
});

const trail = new aws.cloudtrail.Trail("my-trail", {
    s3BucketName: bucket.id,
    kmsKeyId: trailKey.arn, // Add the KMS key ARN to enable encryption
});

import * as aws from "@pulumi/aws";

const trail = new aws.cloudtrail.Trail("my-trail", {
    s3BucketName: "my-cloudtrail-bucket",
    enableLogFileValidation: true, // Enable log file validation to ensure audit log integrity
});

const trail = new aws.cloudtrail.Trail("audit-trail", {
    s3BucketName: bucket.bucket,
    isMultiRegionTrail: true, // Enable multi-region trail for system-wide audit coverage
});

import * as aws from "@pulumi/aws";

const cloudtrailBucket = new aws.s3.Bucket("cloudtrail-logs", {
    bucket: "my-cloudtrail-logs"
});

// Enable public access block to protect audit logs
const publicAccessBlock = new aws.s3.BucketPublicAccessBlock("cloudtrail-public-access-block", {
    bucket: cloudtrailBucket.id,
    blockPublicAcls: true,        // Block public ACLs
    blockPublicPolicy: true,      // Block public bucket policies
    ignorePublicAcls: true,       // Ignore existing public ACLs
    restrictPublicBuckets: true,  // Restrict public bucket access
});

import * as aws from "@pulumi/aws";

const trail = new aws.cloudtrail.Trail("my-trail", {
    s3BucketName: trailBucket.bucket,
    // Enable S3 data events for all buckets
    eventSelectors: [{
        readWriteType: "All", // Log both read and write operations
        includeManagementEvents: true,
        dataResources: [{
            type: "AWS::S3::Object",
            values: ["arn:aws:s3:::*/*"], // Monitor all S3 objects
        }],
    }],
});

const trail = new aws.cloudtrail.Trail("my-trail", {
    s3BucketName: trailBucket.bucket,
    advancedEventSelectors: [{
        name: "Log S3 data events",
        fieldSelectors: [
            {
                field: "eventCategory",
                equals: ["Data"], // Data events category
            },
            {
                field: "resources.type",
                equals: ["AWS::S3::Object"], // S3 object operations
            },
        ],
    }],
});

import * as aws from "@pulumi/aws";

// Create SNS topic for alarm notifications
const alarmTopic = new aws.sns.Topic("alarm-topic", {
    displayName: "CloudWatch Alarm Notifications",
});

// Create CloudWatch alarm with actions enabled
const alarm = new aws.cloudwatch.MetricAlarm("my-alarm", {
    comparisonOperator: "GreaterThanThreshold",
    evaluationPeriods: 2,
    metricName: "CPUUtilization",
    namespace: "AWS/EC2",
    period: 120,
    statistic: "Average",
    threshold: 80,
    actionsEnabled: true,  // Enable actions (default: true)
    alarmActions: [alarmTopic.arn],  // Add SNS topic ARN for ALARM state
});

import * as aws from "@pulumi/aws";

const logGroup = new aws.cloudwatch.LogGroup("my-log-group", {
    name: "/aws/my-application",
    kmsKeyId: kmsKey.arn,  // Add KMS key ARN to enable encryption
    retentionInDays: 30,
});

import * as aws from "@pulumi/aws";

const logGroup = new aws.cloudwatch.LogGroup("my-log-group", {
    name: "/aws/lambda/my-function",
    retentionInDays: 365, // Set retention to at least 365 days for compliance
});

import * as aws from "@pulumi/aws";

// Create Config Recorder
const recorder = new aws.cfg.Recorder("config-recorder", {
    recordingGroup: {
        allSupported: true,  // Record all supported resource types
        includeGlobalResourceTypes: true,  // Include global resources (IAM, etc.)
    },
    roleArn: configRole.arn,  // IAM role with Config permissions
});

// Activate the recorder
const recorderStatus = new aws.cfg.RecorderStatus("config-recorder-status", {
    name: recorder.name,
    isEnabled: true,  // Enable the recorder
});

import * as aws from "@pulumi/aws";

// Your existing Config rule
const myConfigRule = new aws.cfg.Rule("my-rule", {
    name: "my-compliance-rule",
    source: {
        owner: "AWS",
        sourceIdentifier: "S3_BUCKET_PUBLIC_READ_PROHIBITED",
    },
});

// Add automatic remediation configuration
const remediation = new aws.cfg.RemediationConfiguration("my-rule-remediation", {
    configRuleName: myConfigRule.name,
    targetType: "SSM_DOCUMENT",
    targetIdentifier: "AWS-PublishSNSNotification", // Use appropriate SSM document
    automatic: true, // Enable automatic remediation
    maximumAutomaticAttempts: 5,
    retryAttemptSeconds: 60,
    parameters: [
        {
            name: "AutomationAssumeRole",
            staticValue: "arn:aws:iam::123456789012:role/RemediationRole",
        },
        {
            name: "Message",
            staticValue: "Remediating compliance violation",
        },
    ],
});

import * as aws from "@pulumi/aws";

const configRetention = new aws.cfg.RetentionConfiguration("config-retention", {
    retentionPeriodInDays: 2555, // Set to 7 years (minimum required)
});

const replicationInstance = new aws.dms.ReplicationInstance("my-replication-instance", {
    replicationInstanceClass: "dms.t3.micro",
    publiclyAccessible: false,  // Set to false to prevent public access
    // ... other config
});

const clusterInstance = new aws.docdb.ClusterInstance("my-cluster-instance", {
    clusterIdentifier: cluster.id,
    instanceClass: "db.r5.large",
    autoMinorVersionUpgrade: true, // Enable automatic minor version upgrades
});

import * as aws from "@pulumi/aws";

const table = new aws.dynamodb.Table("myTable", {
    name: "my-table",
    billingMode: "PROVISIONED", // Use provisioned mode with auto-scaling
    readCapacity: 5,
    writeCapacity: 5,
    attributes: [{ name: "id", type: "S" }],
    hashKey: "id",
});

// Configure read capacity auto-scaling
const readTarget = new aws.appautoscaling.Target("readTarget", {
    resourceId: pulumi.interpolate`table/${table.name}`,
    scalableDimension: "dynamodb:table:ReadCapacityUnits",
    serviceNamespace: "dynamodb",
    minCapacity: 5,
    maxCapacity: 100, // Set appropriate scaling limits
});

new aws.appautoscaling.Policy("readPolicy", {
    resourceId: readTarget.resourceId,
    scalableDimension: readTarget.scalableDimension,
    serviceNamespace: readTarget.serviceNamespace,
    policyType: "TargetTrackingScaling",
    targetTrackingScalingPolicyConfiguration: {
        targetValue: 70.0, // Target utilization percentage
        predefinedMetricSpecification: {
            predefinedMetricType: "DynamoDBReadCapacityUtilization",
        },
    },
});

// Configure write capacity auto-scaling
const writeTarget = new aws.appautoscaling.Target("writeTarget", {
    resourceId: pulumi.interpolate`table/${table.name}`,
    scalableDimension: "dynamodb:table:WriteCapacityUnits",
    serviceNamespace: "dynamodb",
    minCapacity: 5,
    maxCapacity: 100,
});

new aws.appautoscaling.Policy("writePolicy", {
    resourceId: writeTarget.resourceId,
    scalableDimension: writeTarget.scalableDimension,
    serviceNamespace: writeTarget.serviceNamespace,
    policyType: "TargetTrackingScaling",
    targetTrackingScalingPolicyConfiguration: {
        targetValue: 70.0,
        predefinedMetricSpecification: {
            predefinedMetricType: "DynamoDBWriteCapacityUtilization",
        },
    },
});

// Alternative: Use on-demand billing mode (no auto-scaling needed)
// const table = new aws.dynamodb.Table("myTable", {
//     billingMode: "PAY_PER_REQUEST", // On-demand mode handles scaling automatically
//     attributes: [{ name: "id", type: "S" }],
//     hashKey: "id",
// });

import * as aws from "@pulumi/aws";

// Create or reference a customer-managed KMS key
const kmsKey = new aws.kms.Key("table-encryption-key", {
    description: "KMS key for DynamoDB table encryption",
    deletionWindowInDays: 10,
});

const table = new aws.dynamodb.Table("my-table", {
    // ... other configuration ...
    serverSideEncryption: {
        enabled: true,  // Enable encryption
        kmsKeyArn: kmsKey.arn,  // Use customer-managed KMS key (not AWS-managed)
    },
});

const table = new aws.dynamodb.Table("my-table", {
    name: "my-table",
    attributes: [
        { name: "id", type: "S" },
    ],
    hashKey: "id",
    billingMode: "PAY_PER_REQUEST",
    // Enable point-in-time recovery for backup and recovery capabilities
    pointInTimeRecovery: {
        enabled: true,  // Set to true to enable PITR
    },
});

import * as aws from "@pulumi/aws";

// Option 1: Attach the volume to an EC2 instance
const volumeAttachment = new aws.ec2.VolumeAttachment("my-volume-attachment", {
    instanceId: instance.id,
    volumeId: volume.id,  // Attach the previously unattached volume
    deviceName: "/dev/sdh",
});

// Option 2: Delete the unused volume resource from your Pulumi program
// Simply remove the aws.ebs.Volume resource definition if no longer needed

const volume = new aws.ebs.Volume("my-volume", {
    availabilityZone: "us-west-2a",
    size: 100,
    encrypted: true, // Enable encryption for the volume
});

const instance = new aws.ec2.Instance("my-instance", {
    instanceType: "t3.medium",
    ami: "ami-0c55b159cbfafe1f0",
    ebsOptimized: true, // Enable EBS optimization
});

const role = new aws.iam.Role("ec2-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Principal: { Service: "ec2.amazonaws.com" },
        }],
    }),
});

const profile = new aws.iam.InstanceProfile("ec2-profile", {
    role: role.name,
});

const instance = new aws.ec2.Instance("app-server", {
    ami: "ami-12345678",
    instanceType: "t3.medium",
    iamInstanceProfile: profile.name,  // Attach IAM instance profile for role-based access
    subnetId: subnet.id,
});

new aws.ec2.Instance("my-instance", {
    instanceType: "t3.micro",
    ami: "ami-12345678",
    metadataOptions: {
        httpTokens: "required",  // Enforce IMDSv2
    },
});

const instance = new ec2.Instance("my-instance", {
    instanceType: "t3.micro",
    ami: "ami-12345678",
    associatePublicIpAddress: false, // Disable public IP assignment
    subnetId: privateSubnet.id,
});

const instance = new aws.ec2.Instance("my-instance", {
    ami: "ami-12345678",
    instanceType: "t3.micro",
    ebsBlockDevices: [{
        deviceName: "/dev/sdf",
        volumeSize: 20,
        encrypted: true, // Enable encryption for the EBS volume
    }],
});

const instance = new aws.ec2.Instance("my-instance", {
    instanceType: "t3.micro",
    ami: "ami-12345678",
    rootBlockDevice: {
        encrypted: true, // Enable encryption for root volume
    },
});

const instance = new aws.ec2.Instance("my-instance", {
    ami: "ami-12345678",
    instanceType: "t3.micro",
    monitoring: true, // Enable detailed (1-minute interval) monitoring
});

new aws.ec2.Instance("my-instance", {
    ami: "ami-12345678",
    instanceType: "t3.micro",
    subnetId: mySubnet.id, // Specify a subnet to place instance in VPC
    // ... other configuration
});

const taskDefinition = new aws.ecs.TaskDefinition("app-task", {
    family: "app-task",
    containerDefinitions: JSON.stringify([{
        name: "app-container",
        image: "nginx:latest",
        privileged: false,  // Set to false to disable privileged mode
        user: "1000:1000",  // For host network mode: specify non-root user (UID:GID)
        linuxParameters: {
            capabilities: {
                add: ["NET_BIND_SERVICE"],  // Avoid SYS_ADMIN, NET_ADMIN, or ALL
            },
        },
    }]),
});

const fileSystem = new aws.efs.FileSystem("my-efs", {
    encrypted: true, // Enable encryption at rest
    kmsKeyId: kmsKey.arn, // Optional: specify a custom KMS key
});

new aws.elasticache.ReplicationGroup("redis-cluster", {
    replicationGroupId: "my-redis-cluster",
    // Enable automatic backups with minimum 15 days retention
    snapshotRetentionLimit: 15,
    // Optional: Configure backup window during low-traffic periods
    snapshotWindow: "03:00-05:00",
    // Optional: Preserve data when cluster is deleted
    finalSnapshotIdentifier: "final-snapshot-redis-cluster",
});

const environment = new aws.elasticbeanstalk.Environment("my-env", {
    application: app.name,
    solutionStackName: "64bit Amazon Linux 2 v5.8.0 running Node.js 18",
    settings: [
        {
            namespace: "aws:elasticbeanstalk:healthreporting:system",
            name: "SystemType",
            value: "enhanced", // Enable enhanced health reporting
        },
    ],
});

import * as aws from "@pulumi/aws";

const environment = new aws.elasticbeanstalk.Environment("my-environment", {
    application: "my-app",
    solutionStackName: "64bit Amazon Linux 2023 v6.0.0 running Node.js 18",
    settings: [
        // Enable managed platform updates
        {
            namespace: "aws:elasticbeanstalk:managedactions",
            name: "ManagedActionsEnabled",
            value: "true",  // Required: Enable automated updates
        },
        {
            namespace: "aws:elasticbeanstalk:managedactions",
            name: "PreferredStartTime",
            value: "sun:02:00",  // Required: Set maintenance window
        },
        // Configure update level
        {
            namespace: "aws:elasticbeanstalk:managedactions:platformupdate",
            name: "UpdateLevel",
            value: "minor",  // Required: Set to "patch", "minor", or "all"
        },
        {
            namespace: "aws:elasticbeanstalk:managedactions:platformupdate",
            name: "InstanceRefreshEnabled",
            value: "true",  // Recommended: Enable for zero-downtime updates
        },
    ],
});

const logGroup = new aws.cloudwatch.LogGroup("es-audit-logs", {
    retentionInDays: 7
});

const domain = new aws.elasticsearch.Domain("my-domain", {
    // ... other configuration ...
    logPublishingOptions: [
        {
            logType: "AUDIT_LOGS",  // Enable audit logging
            enabled: true,
            cloudwatchLogGroupArn: logGroup.arn,
        },
    ],
});

const domain = new aws.elasticsearch.Domain("my-domain", {
    domainName: "my-elasticsearch-domain",
    encryptAtRest: {
        enabled: true,  // Enable encryption at rest
    },
    // ... other configuration
});

import * as aws from "@pulumi/aws";

const domain = new aws.elasticsearch.Domain("my-domain", {
    domainName: "my-elasticsearch-domain",
    domainEndpointOptions: {
        enforceHttps: true, // Enable HTTPS enforcement
        tlsSecurityPolicy: "Policy-Min-TLS-1-2-2019-07", // Optional: Set minimum TLS version
    },
    // ... other configuration
});

const esDomain = new aws.elasticsearch.Domain("my-domain", {
    domainName: "my-elasticsearch-domain",
    elasticsearchVersion: "7.10",
    clusterConfig: {
        instanceType: "r5.large.elasticsearch",
    },
    nodeToNodeEncryption: {
        enabled: true, // Enable encryption for inter-node communication
    },
    // ... other configuration
});

import * as aws from "@pulumi/aws";

const myElasticsearchDomain = new aws.elasticsearch.Domain("my-domain", {
    domainName: "my-domain",
    elasticsearchVersion: "7.10",
    clusterConfig: {
        instanceType: "r5.large.elasticsearch",
        instanceCount: 2,
    },
    // Add VPC configuration for network isolation
    vpcOptions: {
        subnetIds: [subnet1.id, subnet2.id], // Specify subnet IDs from your VPC
        securityGroupIds: [securityGroup.id], // Optional: specify security groups
    },
    ebsOptions: {
        ebsEnabled: true,
        volumeSize: 10,
    },
});

const loadBalancer = new aws.elb.LoadBalancer("my-load-balancer", {
    availabilityZones: ["us-west-2a", "us-west-2b"],
    listeners: [{
        instancePort: 80,
        instanceProtocol: "http",
        lbPort: 80,
        lbProtocol: "http",
    }],
    crossZoneLoadBalancing: true, // Enable cross-zone load balancing
});

const alb = new aws.lb.LoadBalancer("my-alb", {
    loadBalancerType: "application",
    enableDeletionProtection: true, // Enable deletion protection
    subnets: subnetIds,
});

const lb = new aws.elb.LoadBalancer("my-lb", {
    availabilityZones: ["us-west-2a", "us-west-2b"],
    listeners: [{
        instancePort: 80,
        instanceProtocol: "http",
        lbPort: 80,
        lbProtocol: "http",
    }],
    accessLogs: {
        enabled: true, // Enable access logging
        bucket: "my-logs-bucket", // S3 bucket for logs
    },
});

const lb = new aws.elb.LoadBalancer("my-lb", {
    availabilityZones: ["us-east-1a", "us-east-1b"], // Configure multiple AZs for resilience
    listeners: [{
        instancePort: 8000,
        instanceProtocol: "http",
        lbPort: 80,
        lbProtocol: "http",
    }],
});

const lb = new aws.elb.LoadBalancer("my-lb", {
    availabilityZones: ["us-west-2a", "us-west-2b"],
    listeners: [{
        instancePort: 443,
        instanceProtocol: "https",
        lbPort: 443,
        lbProtocol: "https", // Use HTTPS instead of HTTP
        sslCertificateId: "arn:aws:iam::123456789012:server-certificate/my-cert",
    }],
});

const lb = new aws.elb.LoadBalancer("my-load-balancer", {
    availabilityZones: ["us-west-2a", "us-west-2b"],
    listeners: [{
        instancePort: 80,
        instanceProtocol: "HTTP",
        lbPort: 80,
        lbProtocol: "HTTP",
    }],
    healthCheck: { // Enable health check configuration
        target: "HTTP:80/",
        interval: 30,
        timeout: 5,
        healthyThreshold: 2,
        unhealthyThreshold: 2,
    },
});

import * as aws from "@pulumi/aws";

// Create or reference an existing WAF Web ACL
const webAcl = new aws.wafv2.WebAcl("my-web-acl", {
    scope: "REGIONAL",
    defaultAction: { allow: {} },
    visibilityConfig: {
        cloudwatchMetricsEnabled: true,
        metricName: "myWebAclMetric",
        sampledRequestsEnabled: true,
    },
    rules: [/* Add your WAF rules here */],
});

// Associate the WAF Web ACL with your Application Load Balancer
const wafAssociation = new aws.wafv2.WebAclAssociation("alb-waf-association", {
    resourceArn: loadBalancer.arn, // Reference your ALB
    webAclArn: webAcl.arn,         // Associate with the Web ACL
});

const cluster = new aws.emr.Cluster("my-cluster", {
    name: "my-emr-cluster",
    releaseLabel: "emr-6.10.0",
    ec2Attributes: {
        subnetId: privateSubnet.id,  // Explicitly specify a private subnet
        emrManagedMasterSecurityGroup: masterSg.id,
        emrManagedSlaveSecurityGroup: slaveSg.id,
        instanceProfile: instanceProfile.arn,
    },
    // ... other configuration
});

const privateSubnet = new aws.ec2.Subnet("private-subnet", {
    vpcId: vpc.id,
    cidrBlock: "10.0.1.0/24",
    mapPublicIpOnLaunch: false,  // Disable auto-assign public IP
    availabilityZone: "us-east-1a",
});

const emrCluster = new aws.emr.Cluster("my-cluster", {
    releaseLabel: "emr-6.10.0",
    ec2Attributes: {
        subnetId: privateSubnet.id,  // Use private subnet without public IP auto-assignment
        emrManagedMasterSecurityGroup: masterSecurityGroup.id,
        emrManagedSlaveSecurityGroup: slaveSecurityGroup.id,
    },
    // ... other cluster configuration
});

import * as aws from "@pulumi/aws";

// Enable GuardDuty detector
const detector = new aws.guardduty.Detector("guardduty-detector", {
    enable: true, // Ensure detector is enabled
});

// Enable EBS malware protection for EC2 instances
new aws.guardduty.DetectorFeature("ebs-malware-protection", {
    detectorId: detector.id,
    name: "EBS_MALWARE_PROTECTION",
    status: "ENABLED", // Enable malware scanning for EBS volumes
});

// Enable S3 data events protection
new aws.guardduty.DetectorFeature("s3-protection", {
    detectorId: detector.id,
    name: "S3_DATA_EVENTS",
    status: "ENABLED", // Enable S3 threat detection
});

const groupPolicy = new aws.iam.GroupPolicy("my-group-policy", {
    group: myGroup.name,
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "cloudwatch:PutMetricData",  // Specify exact actions needed
            ],
            Resource: "*",  // Some AWS services require "*" for resource
            Condition: {
                StringEquals: {
                    "cloudwatch:namespace": "MyApp",  // Use conditions to scope access
                },
            },
        }],
    }),
});

// Create a managed policy instead of inline policy
const customPolicy = new aws.iam.Policy("custom-policy", {
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: ["s3:ListBucket", "s3:GetBucketLocation"],
            Resource: "arn:aws:s3:::my-shared-bucket",
        }],
    }),
});

// Don't use aws.iam.GroupPolicy (inline attachment)
// Instead, use GroupPolicyAttachment with managed policy
new aws.iam.GroupPolicyAttachment("group-policy-attachment", {
    group: myGroup.name,
    policyArn: customPolicy.arn,  // Attach managed policy for consistent permission management
});

new aws.iam.AccountPasswordPolicy("account-password-policy", {
    requireLowercaseCharacters: true,  // Require lowercase letters
    requireUppercaseCharacters: true,  // Require uppercase letters
    requireNumbers: true,              // Require numbers
    requireSymbols: true,              // Require symbols
    minimumPasswordLength: 14,
});

import * as aws from "@pulumi/aws";

const accountPasswordPolicy = new aws.iam.AccountPasswordPolicy("policy", {
    maxPasswordAge: 90,  // Passwords must be changed every 90 days
    minimumPasswordLength: 14,
    requireNumbers: true,
    requireSymbols: true,
    requireLowercaseCharacters: true,
    requireUppercaseCharacters: true,
});

const passwordPolicy = new aws.iam.AccountPasswordPolicy("account-password-policy", {
    minimumPasswordLength: 14, // Set minimum length to at least 14 characters
});

const accountPasswordPolicy = new aws.iam.AccountPasswordPolicy("password-policy", {
    minimumPasswordLength: 14,
    requireNumbers: true,
    requireSymbols: true,
    requireUppercaseCharacters: true,
    requireLowercaseCharacters: true,
    passwordReusePrevention: 24, // Prevent reuse of previous 24 passwords
});

const policy = new aws.iam.Policy("my-policy", {
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "s3:GetObject",        // Specify exact actions needed
                "s3:PutObject",
            ],
            Resource: [
                "arn:aws:s3:::my-bucket/*",  // Scope to specific resources
            ],
        }],
    }),
});

new aws.iam.Policy("admin-policy", {
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "iam:*",
                "organizations:*",
                "s3:DeleteBucket",
                "rds:DeleteDBInstance"
            ],
            Resource: "*",
            Condition: {
                Bool: {
                    // Require MFA for privileged operations
                    "aws:MultiFactorAuthPresent": "true"
                }
            }
        }]
    })
});

const adminRole = new aws.iam.Role("admin-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: {
                AWS: "arn:aws:iam::123456789012:root" // Root account (human)
            },
            Action: "sts:AssumeRole",
            Condition: {
                Bool: {
                    "aws:MultiFactorAuthPresent": "true" // Require MFA
                }
            }
        }],
    }),
});

const userAssumeRole = new aws.iam.Role("user-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: {
                AWS: "arn:aws:iam::123456789012:user/john.doe" // IAM user (human)
            },
            Action: "sts:AssumeRole",
            Condition: {
                Bool: {
                    "aws:MultiFactorAuthPresent": "true" // Require MFA
                }
            }
        }],
    }),
});

// Service roles are automatically exempt (no MFA condition needed)
const ecsTaskRole = new aws.iam.Role("ecs-task-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: {
                Service: "ecs-tasks.amazonaws.com" // Service principal - no MFA needed
            },
            Action: "sts:AssumeRole"
        }],
    }),
});

// Role principals are never flagged (could be cross-account service roles)
const crossAccountRole = new aws.iam.Role("cross-account-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: {
                AWS: "arn:aws:iam::111111111111:role/service-role" // Role principal - not checked
            },
            Action: "sts:AssumeRole"
        }],
    }),
});

// Create a managed policy
const customPolicy = new aws.iam.Policy("custom-policy", {
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: ["s3:GetObject", "s3:PutObject"],
            Resource: "arn:aws:s3:::my-bucket/*",
        }],
    }),
});

// Create the role without inline policies
const role = new aws.iam.Role("app-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: { Service: "ec2.amazonaws.com" },
            Action: "sts:AssumeRole",
        }],
    }),
    // Remove inlinePolicies property entirely
});

// Attach the managed policy instead
new aws.iam.RolePolicyAttachment("role-policy-attachment", {
    role: role.name,
    policyArn: customPolicy.arn,  // Use managed policy for better governance
});

const role = new aws.iam.Role("my-role", {
    assumeRolePolicy: assumePolicyDoc,
    inlinePolicies: [{
        name: "my-inline-policy",
        policy: JSON.stringify({
            Version: "2012-10-17",
            Statement: [{
                Effect: "Allow",
                Action: [
                    "dynamodb:GetItem",    // Specify exact actions needed
                    "dynamodb:PutItem",
                ],
                Resource: [
                    "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable",  // Scope to specific resources
                ],
            }],
        }),
    }],
});

new aws.iam.Role("admin-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: { AWS: "arn:aws:iam::123456789012:root" },
            Action: "sts:AssumeRole"
        }]
    }),
    inlinePolicies: [{
        name: "admin-policy",
        policy: JSON.stringify({
            Version: "2012-10-17",
            Statement: [{
                Effect: "Allow",
                Action: ["iam:*", "organizations:*"],
                Resource: "*",
                Condition: {
                    Bool: {
                        // Require MFA for privileged operations
                        "aws:MultiFactorAuthPresent": "true"
                    }
                }
            }]
        })
    }]
});

const rolePolicy = new aws.iam.RolePolicy("my-role-policy", {
    role: myRole.id,
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "ec2:DescribeInstances",   // Specify exact actions needed
                "ec2:StartInstances",
                "ec2:StopInstances",
            ],
            Resource: [
                "arn:aws:ec2:us-east-1:123456789012:instance/*",  // Scope to specific resources
            ],
        }],
    }),
});

new aws.iam.RolePolicy("admin-role-policy", {
    role: adminRole.id,
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: ["iam:CreateUser", "iam:DeleteUser", "iam:*"],
            Resource: "*",
            Condition: {
                Bool: {
                    // Require MFA for privileged operations
                    "aws:MultiFactorAuthPresent": "true"
                }
            }
        }]
    })
});

// Create a managed policy instead of inline policy
const customPolicy = new aws.iam.Policy("custom-policy", {
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: ["dynamodb:GetItem", "dynamodb:PutItem"],
            Resource: "arn:aws:dynamodb:*:*:table/MyTable",
        }],
    }),
});

// Don't use aws.iam.RolePolicy (inline attachment)
// Instead, use RolePolicyAttachment with managed policy
new aws.iam.RolePolicyAttachment("role-policy-attachment", {
    role: myRole.name,
    policyArn: customPolicy.arn,  // Attach managed policy for centralized governance
});

const user = new aws.iam.User("developer", {
    name: "developer-user",
});

const group = new aws.iam.Group("developers", {
    name: "developers",
});

// Add user to group to satisfy group membership requirement
new aws.iam.UserGroupMembership("developer-membership", {
    user: user.name,
    groups: [group.name],  // Assign user to appropriate groups
});

const user = new aws.iam.User("example-user", {
    name: "example-user",
});

const loginProfile = new aws.iam.UserLoginProfile("example-login", {
    user: user.name,
});

// Create Virtual MFA Device for the user
const mfaDevice = new aws.iam.VirtualMfaDevice("example-user-mfa", {
    virtualMfaDeviceName: "example-user-mfa", // Name must match pattern: <username>-mfa or <username>-mfa-device
    userName: user.name, // Associate MFA device with the user
});

const userPolicy = new aws.iam.UserPolicy("my-user-policy", {
    user: myUser.name,
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "s3:ListBucket",         // Specify exact actions needed
            ],
            Resource: [
                "arn:aws:s3:::my-bucket",  // Scope to specific resources
            ],
        }],
    }),
});

// Create a managed policy instead of inline policy
const customPolicy = new aws.iam.Policy("custom-policy", {
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: ["ec2:DescribeInstances", "ec2:StartInstances"],
            Resource: "*",
        }],
    }),
});

// Don't use aws.iam.UserPolicy (inline attachment)
// Instead, use UserPolicyAttachment with managed policy
new aws.iam.UserPolicyAttachment("user-policy-attachment", {
    user: myUser.name,
    policyArn: customPolicy.arn,  // Attach managed policy for reusability and audit tracking
});

const key = new aws.kms.Key("my-key", {
    description: "Key for encrypting application data", // Add clear description
    customerMasterKeySpec: "SYMMETRIC_DEFAULT", // Use approved key spec
    keyUsage: "ENCRYPT_DECRYPT", // Specify key usage
    deletionWindowInDays: 30, // Set deletion window between 7-30 days
    enableKeyRotation: true,
});

const kmsKey = new aws.kms.Key("my-key", {
    description: "Encryption key for application data",
    deletionWindowInDays: 30, // Set deletion window between 7-30 days
    tags: {
        Environment: "production",
        Owner: "security-team",
        Purpose: "data-encryption",
    },
});

const key = new kms.Key("my-key", {
    description: "KMS key with automatic rotation",
    enableKeyRotation: true, // Enable automatic annual key rotation
});

import * as aws from "@pulumi/aws";

const myFunction = new aws.lambda.Function("myFunction", {
    runtime: "nodejs18.x",
    handler: "index.handler",
    role: lambdaRole.arn,
    code: new pulumi.asset.AssetArchive({
        ".": new pulumi.asset.FileArchive("./function"),
    }),
    // Set reserved concurrent executions to limit resource consumption
    reservedConcurrentExecutions: 10,
});

import * as aws from "@pulumi/aws";

// Create a dead letter queue
const dlq = new aws.sqs.Queue("my-function-dlq", {
    messageRetentionSeconds: 1209600, // 14 days
});

const lambdaFunction = new aws.lambda.Function("my-function", {
    runtime: "nodejs18.x",
    handler: "index.handler",
    role: lambdaRole.arn,
    code: new pulumi.asset.AssetArchive({
        ".": new pulumi.asset.FileArchive("./function"),
    }),
    // Add dead letter configuration to capture failed invocations
    deadLetterConfig: {
        targetArn: dlq.arn, // ARN of SQS queue or SNS topic
    },
});