PCI DSS v4.0.1 - AWS

import * as aws from "@pulumi/aws";

const firewallPolicy = new aws.networkfirewall.FirewallPolicy("firewallPolicy", {
    firewallPolicy: {
        statelessDefaultActions: ["aws:forward_to_sfe"], // Not "aws:pass"
        statelessFragmentDefaultActions: ["aws:forward_to_sfe"], // Not "aws:pass"
        statefulRuleGroupReferences: [{ resourceArn: ruleGroup.arn }], // Required
    },
});

const statelessRuleGroup = new aws.networkfirewall.RuleGroup("rules", {
    type: "STATELESS",
    ruleGroup: {
        rulesSource: {
            statelessRulesAndCustomActions: {
                statelessRules: [{ /* at least one rule */ }], // Required
            },
        },
    },
});

import * as aws from "@pulumi/aws";

// Create a CloudWatch log group for API Gateway logs
const apiLogGroup = new aws.cloudwatch.LogGroup("api-gateway-logs", {
    retentionInDays: 30,
});

// Create an API Gateway stage with access logging enabled
const stage = new aws.apigateway.Stage("my-stage", {
    restApi: myApi.id,
    deployment: myDeployment.id,
    stageName: "prod",
    // Enable access logging with destination ARN
    accessLogSettings: {
        destinationArn: apiLogGroup.arn, // Specify CloudWatch log group ARN
    },
});

const method = new aws.apigateway.Method("my-method", {
    restApi: api.id,
    resourceId: resource.id,
    httpMethod: "GET",
    authorization: "AWS_IAM", // Use strong authorization instead of "NONE"
    // For CUSTOM authorization, also specify the authorizer:
    // authorizerId: authorizer.id,
});

import * as aws from "@pulumi/aws";

const methodSettings = new aws.apigateway.MethodSettings("example-method-settings", {
    restApi: restApi.id,
    stageName: stage.stageName,
    methodPath: "*/*",
    settings: {
        cachingEnabled: true,
        cacheDataEncrypted: true,  // Enable cache encryption at rest
        cacheTtlInSeconds: 300,
    },
});

const domainName = new apigateway.DomainName("my-domain", {
    domainName: "api.example.com",
    certificateArn: cert.arn,
    securityPolicy: "TLS_1_2", // Use TLS 1.2 for secure encryption
});

import * as aws from "@pulumi/aws";

// Create a client certificate for SSL/TLS authentication
const clientCert = new aws.apigateway.ClientCertificate("api-client-cert", {
    description: "Client certificate for API Gateway SSL authentication",
});

const stage = new aws.apigateway.Stage("api-stage", {
    restApi: restApi.id,
    deployment: deployment.id,
    stageName: "production",
    clientCertificateId: clientCert.id, // Add this property to enable SSL certificate validation
});

const logGroup = new aws.cloudwatch.LogGroup("api-v2-logs", {
    retentionInDays: 30,
});

const stage = new aws.apigatewayv2.Stage("my-stage", {
    apiId: api.id,
    name: "prod",
    accessLogSettings: { // Enable access logging
        destinationArn: logGroup.arn, // Specify CloudWatch Log Group
        format: "$context.requestId",
    },
});

const domainName = new aws.apigatewayv2.DomainName("my-domain", {
    domainName: "api.example.com",
    domainNameConfiguration: {
        certificateArn: certificate.arn,
        endpointType: "REGIONAL",
        securityPolicy: "TLS_1_2", // Use TLS 1.2 for secure encryption
    },
});

import * as aws from "@pulumi/aws";

// Create or reference a WAF Web ACL
const webAcl = new aws.wafv2.WebAcl("web-acl", {
    scope: "REGIONAL",
    defaultAction: { allow: {} },
    rules: [/* your WAF rules */],
    visibilityConfig: {
        cloudwatchMetricsEnabled: true,
        metricName: "webAclMetric",
        sampledRequestsEnabled: true,
    },
});

// Option 1: attach the Web ACL on the stage itself
const apiStage = new aws.apigateway.Stage("api-stage", {
    restApi: restApi.id,
    stageName: "prod",
    deployment: deployment.id,
    webAclArn: webAcl.arn, // Protects the stage with no separate association resource
});

// Option 2: attach it with a separate association resource
const wafAssociation = new aws.wafv2.WebAclAssociation("stage-waf", {
    resourceArn: apiStage.arn, // Link to the API Gateway stage
    webAclArn: webAcl.arn,
});

const connectorProfile = new aws.appflow.ConnectorProfile("my-connector-profile", {
    name: "salesforce-connector",
    connectorType: "Salesforce",
    connectionMode: "Public",
    kmsArn: kmsKey.arn, // Specify customer-managed KMS key ARN
    connectorProfileConfig: {
        connectorProfileProperties: {
            salesforce: {
                instanceUrl: "https://my-org.my.salesforce.com",
            },
        },
        connectorProfileCredentials: {
            salesforce: {
                accessToken: salesforceAccessToken,
                refreshToken: salesforceRefreshToken,
                oauthRequest: {
                    authCode: authCode,
                    redirectUri: redirectUri,
                },
            },
        },
    },
});

const flow = new aws.appflow.Flow("my-flow", {
    name: "my-appflow",
    kmsArn: kmsKey.arn, // Configure customer-managed KMS key
    sourceFlowConfig: {
        connectorType: "S3",
        sourceConnectorProperties: {
            s3: {
                bucketName: sourceBucket.bucket,
                bucketPrefix: "data/",
            },
        },
    },
    destinationFlowConfigs: [{
        connectorType: "S3",
        destinationConnectorProperties: {
            s3: {
                bucketName: destBucket.bucket,
            },
        },
    }],
    tasks: [{
        taskType: "Map_all",
        sourceFields: [],
        connectorOperators: [{
            s3: "NO_OP",
        }],
    }],
    triggerConfig: {
        triggerType: "OnDemand",
    },
});

const athenaDatabase = new aws.athena.Database("my-database", {
    name: "my_database",
    bucket: myBucket.id,
    encryptionConfiguration: {
        encryptionOption: "SSE_KMS", // Use customer-managed KMS key
        kmsKey: myKmsKey.arn, // Specify the KMS key ARN
    },
});

const athenaDatabase = new aws.athena.Database("my-database", {
    name: "my_database",
    bucket: dataBucket.id,
    encryptionConfiguration: { // Enable encryption
        // SSE_S3 and CSE_KMS also satisfy this policy, but the sibling
        // `athena-database-configure-customer-managed-key` runs in the same packs and accepts
        // only SSE_KMS under a key you own.
        encryptionOption: "SSE_KMS",
        kmsKey: kmsKey.arn,
    },
});

const workgroup = new athena.Workgroup("my-workgroup", {
    name: "my-workgroup",
    configuration: {
        resultConfiguration: {
            outputLocation: "s3://my-bucket/query-results/",
            encryptionConfiguration: {
                encryptionOption: "SSE_KMS", // Enable customer-managed key encryption
                kmsKeyArn: kmsKey.arn, // ARN of the KMS key you create and control
            },
        },
    },
});

const workgroup = new athena.Workgroup("my-workgroup", {
    name: "example-workgroup",
    configuration: {
        resultConfiguration: {
            outputLocation: "s3://my-query-results-bucket/",
            encryptionConfiguration: { // Add encryption configuration
                encryptionOption: "SSE_KMS", // or "SSE_S3" or "CSE_KMS"
                kmsKeyArn: kmsKey.arn, // Required when using SSE_KMS or CSE_KMS
            },
        },
    },
});

const workgroup = new athena.Workgroup("my-workgroup", {
    name: "my-workgroup",
    configuration: {
        enforceWorkgroupConfiguration: true, // Enforce workgroup configuration on clients
        resultConfiguration: {
            outputLocation: "s3://my-query-results/",
            // Required by `athena-workgroup-disallow-unencrypted-workgroup`, which runs in the
            // same packs: a result configuration with no encryption block is reported there.
            encryptionConfiguration: {
                encryptionOption: "SSE_KMS",
                kmsKeyArn: kmsKey.arn,
            },
        },
    },
});

const trail = new aws.cloudtrail.Trail("audit-trail", {
    s3BucketName: bucket.id,
    eventSelectors: [{
        includeManagementEvents: true,  // Enable management event logging
        readWriteType: "All",            // Capture both read and write operations (or "WriteOnly" for admin actions)
    }],
});

const trail = new aws.cloudtrail.Trail("audit-trail", {
    s3BucketName: bucket.id,
    eventSelectors: [{
        readWriteType: "All",
        includeManagementEvents: true,
        dataResources: [{
            type: "AWS::S3::Object",
            // Prefix of every object ARN: logs data events for all S3 buckets, including the audit log bucket
            values: ["arn:aws:s3"],
        }],
    }],
});

const trail = new aws.cloudtrail.Trail("audit-trail", {
    s3BucketName: bucket.id,
    advancedEventSelectors: [{
        name: "Log all S3 data events",
        fieldSelectors: [
            { field: "eventCategory", equals: ["Data"] },
            { field: "resources.type", equals: ["AWS::S3::Object"] },
            // No resources.ARN filter, so every bucket in the account is covered.
        ],
    }],
});

const distribution = new cloudfront.Distribution("my-distribution", {
    enabled: true,
    loggingConfig: {
        bucket: logBucket.bucketDomainName, // S3 bucket for access logs
        includeCookies: false,
        prefix: "cloudfront-logs/",
    },
    // ... other distribution configuration
});

const source = new aws.cloudwatch.LogDeliverySource("cf-access-logs", {
    name: "cf-access-logs",
    logType: "ACCESS_LOGS",
    resourceArn: distribution.arn, // the distribution these logs come from
});

const destination = new aws.cloudwatch.LogDeliveryDestination("cf-access-logs", {
    name: "cf-access-logs",
    deliveryDestinationConfiguration: {
        destinationResourceArn: logGroup.arn,
    },
});

new aws.cloudwatch.LogDelivery("cf-access-logs", {
    deliverySourceName: source.name,
    deliveryDestinationArn: destination.arn,
});

const distribution = new cloudfront.Distribution("my-distribution", {
    enabled: true,
    aliases: ["www.example.com"],
    origins: [/* ... */],
    defaultCacheBehavior: {/* ... */},
    viewerCertificate: {
        // A custom certificate is what makes a modern TLS floor settable at all.
        acmCertificateArn: certificate.arn, // must be issued in us-east-1
        sslSupportMethod: "sni-only",
        minimumProtocolVersion: "TLSv1.2_2021", // Use secure TLS 1.2 with modern cipher suites
    },
});

const distribution = new cloudfront.Distribution("my-distribution", {
    enabled: true,
    origins: [{
        domainName: "my-origin.example.com",
        originId: "myCustomOrigin",
        customOriginConfig: {
            httpPort: 80,
            httpsPort: 443,
            originProtocolPolicy: "https-only",
            originSslProtocols: ["TLSv1.2"], // Only allow TLS 1.2
        },
    }],
    defaultCacheBehavior: {
        targetOriginId: "myCustomOrigin",
        viewerProtocolPolicy: "redirect-to-https",
        allowedMethods: ["GET", "HEAD"],
        cachedMethods: ["GET", "HEAD"],
        forwardedValues: {
            queryString: false,
            cookies: { forward: "none" },
        },
    },
});

const distribution = new aws.cloudfront.Distribution("my-distribution", {
    enabled: true,
    webAclId: webAcl.arn, // Associate WAF Web ACL for protection
    origins: [{
        domainName: bucket.bucketRegionalDomainName,
        originId: "myS3Origin",
    }],
    defaultCacheBehavior: {
        targetOriginId: "myS3Origin",
        viewerProtocolPolicy: "redirect-to-https",
        allowedMethods: ["GET", "HEAD"],
        cachedMethods: ["GET", "HEAD"],
        forwardedValues: {
            queryString: false,
            cookies: { forward: "none" },
        },
    },
});

const distribution = new cloudfront.Distribution("my-distribution", {
    enabled: true,
    defaultCacheBehavior: {
        targetOriginId: origin.originId,
        viewerProtocolPolicy: "redirect-to-https", // Enforce HTTPS for all traffic
        allowedMethods: ["GET", "HEAD"],
        cachedMethods: ["GET", "HEAD"],
        forwardedValues: {
            queryString: false,
            cookies: { forward: "none" },
        },
    },
    orderedCacheBehaviors: [{
        pathPattern: "/api/*",
        targetOriginId: origin.originId,
        viewerProtocolPolicy: "https-only", // Enforce HTTPS-only for API paths
        allowedMethods: ["GET", "HEAD", "OPTIONS"],
        cachedMethods: ["GET", "HEAD"],
        forwardedValues: {
            queryString: true,
            cookies: { forward: "none" },
        },
    }],
    origins: [origin],
    viewerCertificate: {
        cloudfrontDefaultCertificate: true,
    },
});

const distribution = new cloudfront.Distribution("my-distribution", {
    enabled: true,
    origins: [{
        domainName: "my-custom-origin.example.com",
        originId: "my-custom-origin",
        customOriginConfig: {
            httpPort: 80,
            httpsPort: 443,
            originProtocolPolicy: "https-only", // Enforce TLS encryption to origin
            originSslProtocols: ["TLSv1.2"],
        },
    }],
    defaultCacheBehavior: {
        targetOriginId: "my-custom-origin",
        viewerProtocolPolicy: "redirect-to-https",
        allowedMethods: ["GET", "HEAD"],
        cachedMethods: ["GET", "HEAD"],
        forwardedValues: {
            queryString: false,
            cookies: { forward: "none" },
        },
    },
});

import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";

const account = aws.getCallerIdentityOutput();
const region = aws.getRegionOutput();

// The key policy must let the regional CloudWatch Logs service encrypt the log group with this key.
const logsKey = new aws.kms.Key("trail-logs-key", {
    description: "Encrypts the CloudTrail CloudWatch Logs log group",
    enableKeyRotation: true,
    policy: pulumi.all([account.accountId, region.region]).apply(([accountId, regionName]) => JSON.stringify({
        Version: "2012-10-17",
        Statement: [
            {
                Effect: "Allow",
                Principal: { AWS: `arn:aws:iam::${accountId}:root` },
                Action: [
                    "kms:Create*", "kms:Describe*", "kms:Enable*", "kms:List*", "kms:Put*", "kms:Update*",
                    "kms:Revoke*", "kms:Disable*", "kms:Get*", "kms:Delete*", "kms:TagResource",
                    "kms:UntagResource", "kms:ScheduleKeyDeletion", "kms:CancelKeyDeletion",
                ],
                Resource: "*",
            },
            {
                Effect: "Allow",
                Principal: { Service: `logs.${regionName}.amazonaws.com` },
                Action: ["kms:Encrypt*", "kms:Decrypt*", "kms:ReEncrypt*", "kms:GenerateDataKey*", "kms:Describe*"],
                Resource: "*",
                Condition: {
                    ArnLike: { "kms:EncryptionContext:aws:logs:arn": `arn:aws:logs:${regionName}:${accountId}:log-group:*` },
                },
            },
        ],
    })),
});

const logGroup = new aws.cloudwatch.LogGroup("trail-log-group", {
    retentionInDays: 365,
    kmsKeyId: logsKey.arn,
});

const trailRole = new aws.iam.Role("trail-cloudwatch-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: { Service: "cloudtrail.amazonaws.com" },
            Action: "sts:AssumeRole",
        }],
    }),
});

const trailRolePolicy = new aws.iam.RolePolicy("trail-cloudwatch-policy", {
    role: trailRole.id,
    policy: pulumi.all([logGroup.arn]).apply(([logGroupArn]) => JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: ["logs:CreateLogStream", "logs:PutLogEvents"],
            Resource: `${logGroupArn}:*`,
        }],
    })),
});

const trail = new aws.cloudtrail.Trail("my-trail", {
    s3BucketName: bucket.id,
    cloudWatchLogsGroupArn: pulumi.interpolate`${logGroup.arn}:*`,  // CloudTrail requires the log stream wildcard
    cloudWatchLogsRoleArn: trailRole.arn,  // Add this field
}, { dependsOn: [trailRolePolicy] });  // The role must be able to write before CloudTrail accepts it

import * as aws from "@pulumi/aws";

// Create an S3 bucket for CloudTrail logs
const trailBucket = new aws.s3.Bucket("cloudtrail-logs", {
    forceDestroy: true, // Only for demo - remove in production
});

// Create CloudTrail trail
const trail = new aws.cloudtrail.Trail("main-trail", {
    s3BucketName: trailBucket.bucket,
    isMultiRegionTrail: true, // Enable for all regions
    includeGlobalServiceEvents: true,
    enableLogFileValidation: true, // Ensure log integrity
});

import * as aws from "@pulumi/aws";

// Create or reference a KMS key for CloudTrail encryption
const trailKey = new aws.kms.Key("trail-key", {
    description: "KMS key for CloudTrail log encryption",
    enableKeyRotation: true,
});

const trail = new aws.cloudtrail.Trail("my-trail", {
    s3BucketName: bucket.id,
    kmsKeyId: trailKey.arn, // Add the KMS key ARN to enable encryption
});

import * as aws from "@pulumi/aws";

const trail = new aws.cloudtrail.Trail("my-trail", {
    s3BucketName: "my-cloudtrail-bucket",
    enableLogFileValidation: true, // Enable log file validation to ensure audit log integrity
});

const trail = new aws.cloudtrail.Trail("audit-trail", {
    s3BucketName: bucket.bucket,
    isMultiRegionTrail: true, // Enable multi-region trail for system-wide audit coverage
});

import * as aws from "@pulumi/aws";

const cloudtrailBucket = new aws.s3.Bucket("cloudtrail-logs", {
    bucket: "my-cloudtrail-logs"
});

// Enable public access block to protect audit logs
const publicAccessBlock = new aws.s3.BucketPublicAccessBlock("cloudtrail-public-access-block", {
    bucket: cloudtrailBucket.id,
    blockPublicAcls: true,        // Block public ACLs
    blockPublicPolicy: true,      // Block public bucket policies
    ignorePublicAcls: true,       // Ignore existing public ACLs
    restrictPublicBuckets: true,  // Restrict public bucket access
});

import * as aws from "@pulumi/aws";

const trail = new aws.cloudtrail.Trail("my-trail", {
    s3BucketName: trailBucket.bucket,
    eventSelectors: [{
        readWriteType: "All", // Log both read and write operations
        includeManagementEvents: true,
        dataResources: [{
            type: "AWS::S3::Object",
            values: ["arn:aws:s3"], // Prefix of every object ARN: covers every bucket in the account
        }],
    }],
});

const trail = new aws.cloudtrail.Trail("my-trail", {
    s3BucketName: trailBucket.bucket,
    advancedEventSelectors: [{
        name: "Log all S3 data events",
        fieldSelectors: [
            {
                field: "eventCategory",
                equals: ["Data"], // Enable data event logging
            },
            {
                field: "resources.type",
                equals: ["AWS::S3::Object"], // Target S3 objects
            },
            // No resources.ARN filter, so every bucket in the account is covered.
        ],
    }],
});

import * as aws from "@pulumi/aws";

// Create SNS topic for alarm notifications
const alarmTopic = new aws.sns.Topic("alarm-topic", {
    displayName: "CloudWatch Alarm Notifications",
});

// Create CloudWatch alarm with actions enabled
const alarm = new aws.cloudwatch.MetricAlarm("my-alarm", {
    comparisonOperator: "GreaterThanThreshold",
    evaluationPeriods: 2,
    metricName: "CPUUtilization",
    namespace: "AWS/EC2",
    period: 120,
    statistic: "Average",
    threshold: 80,
    actionsEnabled: true,  // Enable actions (default: true)
    alarmActions: [alarmTopic.arn],  // Add SNS topic ARN for ALARM state
});

import * as aws from "@pulumi/aws";

const logGroup = new aws.cloudwatch.LogGroup("my-log-group", {
    name: "/aws/my-application",
    kmsKeyId: kmsKey.arn,  // Add KMS key ARN to enable encryption
    retentionInDays: 365,  // cloudwatch-log-retention requires at least 365 days by default
});

import * as aws from "@pulumi/aws";

const logGroup = new aws.cloudwatch.LogGroup("my-log-group", {
    name: "/aws/lambda/my-function",
    retentionInDays: 365, // Set retention to at least 365 days for compliance
});

import * as aws from "@pulumi/aws";
import * as pulumi from "@pulumi/pulumi";

// IAM role AWS Config assumes, with the AWS managed policy for Config attached
const configRole = new aws.iam.Role("config-role", {
    assumeRolePolicy: {
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: { Service: "config.amazonaws.com" },
            Action: "sts:AssumeRole",
        }],
    },
});

new aws.iam.RolePolicyAttachment("config-role-managed-policy", {
    role: configRole.name,
    policyArn: "arn:aws:iam::aws:policy/service-role/AWS_ConfigRole",
});

// S3 bucket the delivery channel writes configuration history and snapshots to
const configBucket = new aws.s3.Bucket("config-delivery");
const accountId = aws.getCallerIdentityOutput().accountId;

// Let the role deliver to that bucket
const configDeliveryPolicy = new aws.iam.RolePolicy("config-delivery-policy", {
    role: configRole.name,
    policy: {
        Version: "2012-10-17",
        Statement: [
            {
                Effect: "Allow",
                Action: ["s3:PutObject", "s3:PutObjectAcl"],
                Resource: pulumi.interpolate`${configBucket.arn}/AWSLogs/${accountId}/*`,
                Condition: { StringLike: { "s3:x-amz-acl": "bucket-owner-full-control" } },
            },
            {
                Effect: "Allow",
                Action: "s3:GetBucketAcl",
                Resource: configBucket.arn,
            },
        ],
    },
});

// Create Config Recorder
const recorder = new aws.cfg.Recorder("config-recorder", {
    recordingGroup: {
        allSupported: true,  // Record all supported resource types
        includeGlobalResourceTypes: true,  // Include global resources (IAM, etc.)
    },
    roleArn: configRole.arn,  // IAM role with Config permissions
});

// A delivery channel needs the recorder to exist, and the recorder will not start without one
const deliveryChannel = new aws.cfg.DeliveryChannel("config-delivery-channel", {
    s3BucketName: configBucket.bucket,
}, { dependsOn: [recorder, configDeliveryPolicy] });

// Activate the recorder
const recorderStatus = new aws.cfg.RecorderStatus("config-recorder-status", {
    name: recorder.name,
    isEnabled: true,  // Enable the recorder
}, { dependsOn: [deliveryChannel] });

const remediationConfig = new aws.cfg.RemediationConfiguration("remediationConfig", {
    configRuleName: configRule.name,
    automatic: true,
    maximumAutomaticAttempts: 5,
    retryAttemptSeconds: 60,
});

import * as aws from "@pulumi/aws";

const configRetention = new aws.cfg.RetentionConfiguration("config-retention", {
    retentionPeriodInDays: 2555, // Set to 7 years (minimum required)
});

const dbSecurityGroup = new aws.ec2.SecurityGroup("db-sg", {
    egress: [{
        protocol: "tcp",
        fromPort: 443,
        toPort: 443,
        cidrBlocks: ["10.0.0.0/16"], // Not 0.0.0.0/0
    }],
});

// Create a security group with restricted ingress
const dbSecurityGroup = new aws.ec2.SecurityGroup("db-sg", {
    vpcId: vpc.id,
    ingress: [{
        protocol: "tcp",
        fromPort: 3306,
        toPort: 3306,
        cidrBlocks: ["10.0.0.0/16"], // Restrict to internal VPC CIDR only
    }],
});

// Associate security group with RDS instance
const db = new aws.rds.Instance("my-db", {
    engine: "mysql",
    instanceClass: "db.t3.micro",
    allocatedStorage: 20,
    vpcSecurityGroupIds: [dbSecurityGroup.id], // Attach security group
    dbSubnetGroupName: dbSubnetGroup.name,
});

// Ensure subnet group has at least 2 subnets
const dbSubnetGroup = new aws.rds.SubnetGroup("db-subnet-group", {
    subnetIds: [privateSubnet1.id, privateSubnet2.id], // Minimum 2 subnets
});

const replicationInstance = new aws.dms.ReplicationInstance("my-replication-instance", {
    replicationInstanceClass: "dms.t3.micro",
    publiclyAccessible: false,  // Set to false to prevent public access
    // ... other config
});

const clusterInstance = new aws.docdb.ClusterInstance("my-cluster-instance", {
    clusterIdentifier: cluster.id,
    instanceClass: "db.r5.large",
    autoMinorVersionUpgrade: true, // Enable automatic minor version upgrades
});

import * as aws from "@pulumi/aws";

// Create or reference a customer-managed KMS key
const kmsKey = new aws.kms.Key("table-encryption-key", {
    description: "KMS key for DynamoDB table encryption",
    deletionWindowInDays: 10,
});

const table = new aws.dynamodb.Table("my-table", {
    // ... other configuration ...
    serverSideEncryption: {
        enabled: true,  // Enable encryption
        kmsKeyArn: kmsKey.arn,  // Use customer-managed KMS key (not AWS-managed)
    },
});

const table = new aws.dynamodb.Table("my-table", {
    name: "my-table",
    attributes: [
        { name: "id", type: "S" },
    ],
    hashKey: "id",
    streamEnabled: true, // Enable DynamoDB Streams
    billingMode: "PAY_PER_REQUEST",
});

import * as aws from "@pulumi/aws";

// Option 1: Attach the volume to an EC2 instance
const volumeAttachment = new aws.ec2.VolumeAttachment("my-volume-attachment", {
    instanceId: instance.id,
    volumeId: volume.id,  // Attach the previously unattached volume
    deviceName: "/dev/sdh",
});

// Option 2: Delete the unused volume resource from your Pulumi program
// Simply remove the aws.ebs.Volume resource definition if no longer needed

const volume = new aws.ebs.Volume("my-volume", {
    availabilityZone: "us-west-2a",
    size: 100,
    encrypted: true,
    kmsKeyId: customerKey.arn, // Use customer-managed KMS key instead of default AWS-managed key
});

const volume = new aws.ebs.Volume("my-volume", {
    availabilityZone: "us-west-2a",
    size: 100,
    encrypted: true, // Enable encryption for the volume
});

const role = new aws.iam.Role("ec2-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Effect: "Allow",
            Principal: { Service: "ec2.amazonaws.com" },
        }],
    }),
});

const profile = new aws.iam.InstanceProfile("ec2-profile", {
    role: role.name,
});

const instance = new aws.ec2.Instance("app-server", {
    ami: "ami-12345678",
    instanceType: "t3.medium",
    iamInstanceProfile: profile.name,  // Attach IAM instance profile for role-based access
    subnetId: subnet.id,
});

const instance = new ec2.Instance("my-instance", {
    instanceType: "t3.micro",
    ami: "ami-12345678",
    associatePublicIpAddress: false, // Disable public IP assignment
    subnetId: privateSubnet.id,
});

const instance = new aws.ec2.Instance("my-instance", {
    ami: "ami-12345678",
    instanceType: "t3.micro",
    ebsBlockDevices: [{
        deviceName: "/dev/sdf",
        volumeSize: 20,
        encrypted: true, // Enable encryption for the EBS volume
    }],
});

const instance = new aws.ec2.Instance("my-instance", {
    instanceType: "t3.micro",
    ami: "ami-12345678",
    rootBlockDevice: {
        encrypted: true, // Enable encryption for root volume
    },
});

const role = new aws.iam.Role("app", {
    assumeRolePolicy: aws.iam.assumeRolePolicyForPrincipal({ Service: "ec2.amazonaws.com" }),
});

new aws.iam.RolePolicyAttachment("app-read-only", {
    role: role.name,
    policyArn: aws.iam.ManagedPolicy.ReadOnlyAccess,
});

const profile = new aws.iam.InstanceProfile("app", { role: role.name });

const launchConfig = new aws.ec2.LaunchConfiguration("my-launch-config", {
    imageId: "ami-12345678",
    instanceType: "t3.micro",
    associatePublicIpAddress: false, // Disable public IP assignment
    securityGroups: [securityGroup.id],
});

const launchConfig = new aws.ec2.LaunchConfiguration("my-launch-config", {
    imageId: "ami-12345678",
    instanceType: "t3.medium",
    ebsBlockDevices: [{
        deviceName: "/dev/sdf",
        volumeSize: 100,
        encrypted: true, // Enable encryption for all EBS block devices
    }],
});

const launchConfig = new ec2.LaunchConfiguration("my-launch-config", {
    imageId: "ami-0c55b159cbfafe1f0",
    instanceType: "t2.micro",
    rootBlockDevice: {
        encrypted: true, // Enable encryption for root block device
    },
});

const launchTemplate = new aws.ec2.LaunchTemplate("my-template", {
    blockDeviceMappings: [{
        ebs: {
            encrypted: "true",
            kmsKeyId: customerManagedKey.id, // Specify customer-managed KMS key
            volumeSize: 20,
        },
    }],
});

const launchTemplate = new aws.ec2.LaunchTemplate("my-template", {
    imageId: "ami-12345678",
    instanceType: "t3.micro",
    networkInterfaces: [{
        associatePublicIpAddress: "false", // Disable public IP assignment
        securityGroups: [securityGroup.id],
        subnetId: privateSubnet.id,
    }],
});

const launchTemplate = new aws.ec2.LaunchTemplate("my-template", {
    imageId: "ami-12345678",
    instanceType: "t3.micro",
    blockDeviceMappings: [{
        deviceName: "/dev/sda1",
        ebs: {
            encrypted: "true", // Enable encryption for the EBS volume
            volumeSize: 20,
            volumeType: "gp3",
        },
    }],
});

const instance = new aws.ec2.Instance("my-instance", {
    ami: "ami-12345678",
    instanceType: "t3.micro",
    monitoring: true, // Enable detailed (1-minute interval) monitoring
});

const securityGroup = new ec2.SecurityGroup("my-sg", {
    vpcId: vpc.id,
    ingress: [
        {
            protocol: "tcp",
            fromPort: 443, // Use HTTPS instead of HTTP (port 80)
            toPort: 443,
            cidrBlocks: ["0.0.0.0/0"],
        },
        // Remove any rules whose port range covers 80, and any rule with protocol "-1"/"all",
        // which opens every port.
    ],
});

// The same applies to standalone rules, which are the provider's current best practice:
new aws.vpc.SecurityGroupIngressRule("my-sg-https", {
    securityGroupId: securityGroup.id,
    ipProtocol: "tcp",
    fromPort: 443,
    toPort: 443,
    cidrIpv4: "0.0.0.0/0",
});

new aws.ec2.Instance("my-instance", {
    ami: "ami-12345678",
    instanceType: "t3.micro",
    subnetId: mySubnet.id, // Specify a subnet to place instance in VPC
    // ... other configuration
});

const kmsKey = new aws.kms.Key("ecr-key", {
    description: "KMS key for ECR repository encryption",
});

const repo = new ecr.Repository("my-repo", {
    encryptionConfigurations: [{
        encryptionType: "KMS", // Use KMS encryption instead of AES256
        kmsKey: kmsKey.arn, // Specify customer-managed KMS key
    }],
});

const repository = new ecr.Repository("my-repository", {
    imageTagMutability: "IMMUTABLE", // Prevent image tags from being overwritten
});

const repo = new ecr.Repository("my-repo", {
    name: "my-application-repo",
    encryptionConfigurations: [{ // Enable encryption
        encryptionType: "AES256", // Use AWS managed encryption (or "KMS" for customer-managed keys)
    }],
});

const taskDefinition = new aws.ecs.TaskDefinition("my-task", {
    family: "my-app",
    containerDefinitions: JSON.stringify([{
        name: "app",
        image: "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-repo:latest", // Use ECR image with scanning
        memory: 512,
        cpu: 256,
    }]),
    requiresCompatibilities: ["FARGATE"],
    networkMode: "awsvpc",
    cpu: "256",
    memory: "512",
});

const taskDefinition = new aws.ecs.TaskDefinition("app-task", {
    family: "app-task",
    containerDefinitions: JSON.stringify([{
        name: "app-container",
        image: "nginx:latest",
        privileged: false,  // Set to false to disable privileged mode
        user: "1000:1000",  // For host network mode: specify non-root user (UID:GID)
        linuxParameters: {
            capabilities: {
                add: ["NET_BIND_SERVICE"],  // Avoid SYS_ADMIN, NET_ADMIN, or ALL
            },
        },
    }]),
});

const fileSystem = new aws.efs.FileSystem("my-efs", {
    encrypted: true,
    kmsKeyId: kmsKey.arn, // Use customer-managed KMS key instead of AWS-managed key
    lifecyclePolicy: {
        transitionToIa: "AFTER_30_DAYS",
    },
});

const fileSystem = new aws.efs.FileSystem("my-efs", {
    encrypted: true, // Enable encryption at rest
    kmsKeyId: kmsKey.arn, // Optional: specify a custom KMS key
});

const cluster = new aws.eks.Cluster("my-cluster", {
    roleArn: clusterRole.arn,
    vpcConfig: {
        subnetIds: privateSubnetIds,
        endpointPublicAccess: false, // Disable public access to API endpoint
        endpointPrivateAccess: true, // Enable private access for internal communication
    },
});

const cluster = new aws.eks.Cluster("my-cluster", {
    roleArn: clusterRole.arn,
    vpcConfig: {
        subnetIds: privateSubnetIds,
        endpointPublicAccess: true,
        publicAccessCidrs: ["203.0.113.0/24"], // Only the networks that need access
    },
});

const cluster = new aws.eks.Cluster("my-cluster", {
    roleArn: clusterRole.arn,
    vpcConfig: {
        subnetIds: subnetIds,
    },
    encryptionConfig: { // Enable encryption for Kubernetes secrets
        provider: {
            keyArn: kmsKey.arn, // KMS key for encrypting secrets
        },
        resources: ["secrets"], // Encrypt Kubernetes secrets at rest
    },
});

const environment = new aws.elasticbeanstalk.Environment("my-env", {
    application: app.name,
    solutionStackName: "64bit Amazon Linux 2 v5.8.0 running Node.js 18",
    settings: [
        {
            namespace: "aws:elasticbeanstalk:healthreporting:system",
            name: "SystemType",
            value: "enhanced", // Enable enhanced health reporting
        },
    ],
});

import * as aws from "@pulumi/aws";

const environment = new aws.elasticbeanstalk.Environment("my-environment", {
    application: "my-app",
    solutionStackName: "64bit Amazon Linux 2023 v6.0.0 running Node.js 18",
    settings: [
        // Enable managed platform updates
        {
            namespace: "aws:elasticbeanstalk:managedactions",
            name: "ManagedActionsEnabled",
            value: "true",  // Required: Enable automated updates
        },
        {
            namespace: "aws:elasticbeanstalk:managedactions",
            name: "PreferredStartTime",
            value: "sun:02:00",  // Required: Set maintenance window
        },
        // Configure update level
        {
            namespace: "aws:elasticbeanstalk:managedactions:platformupdate",
            name: "UpdateLevel",
            value: "minor",  // Required: Set to "patch", "minor", or "all"
        },
        {
            namespace: "aws:elasticbeanstalk:managedactions:platformupdate",
            name: "InstanceRefreshEnabled",
            value: "true",  // Recommended: Enable for zero-downtime updates
        },
    ],
});