Pulumi Best Practices - AWS

const logGroup = new aws.cloudwatch.LogGroup("api-logs", {
    retentionInDays: 30,
});

const stage = new aws.apigateway.Stage("my-stage", {
    restApi: api.id,
    stageName: "prod",
    deployment: deployment.id,
    accessLogSettings: { // Enable access logging
        destinationArn: logGroup.arn, // Specify CloudWatch Log Group
        format: "$context.requestId",
    },
});

import * as aws from "@pulumi/aws";

// Create a client certificate for SSL/TLS authentication
const clientCert = new aws.apigateway.ClientCertificate("api-client-cert", {
    description: "Client certificate for API Gateway SSL authentication",
});

const stage = new aws.apigateway.Stage("api-stage", {
    restApi: restApi.id,
    deployment: deployment.id,
    stageName: "production",
    clientCertificateId: clientCert.id, // Add this property to enable SSL certificate validation
});

const logGroup = new aws.cloudwatch.LogGroup("api-v2-logs", {
    retentionInDays: 30,
});

const stage = new aws.apigatewayv2.Stage("my-stage", {
    apiId: api.id,
    name: "prod",
    accessLogSettings: { // Enable access logging
        destinationArn: logGroup.arn, // Specify CloudWatch Log Group
        format: "$context.requestId",
    },
});

import * as aws from "@pulumi/aws";

// Create an S3 bucket for CloudTrail logs
const trailBucket = new aws.s3.Bucket("cloudtrail-logs", {
    forceDestroy: true, // Only for demo - remove in production
});

// Create CloudTrail trail
const trail = new aws.cloudtrail.Trail("main-trail", {
    s3BucketName: trailBucket.bucket,
    isMultiRegionTrail: true, // Enable for all regions
    includeGlobalServiceEvents: true,
    enableLogFileValidation: true, // Ensure log integrity
});

import * as aws from "@pulumi/aws";

const logGroup = new aws.cloudwatch.LogGroup("my-log-group", {
    name: "/aws/lambda/my-function",
    retentionInDays: 365, // Set retention to at least 365 days for compliance
});

const replicationInstance = new aws.dms.ReplicationInstance("my-replication-instance", {
    replicationInstanceClass: "dms.t3.micro",
    publiclyAccessible: false,  // Set to false to prevent public access
    // ... other config
});

import * as aws from "@pulumi/aws";

const table = new aws.dynamodb.Table("myTable", {
    name: "my-table",
    billingMode: "PROVISIONED", // Use provisioned mode with auto-scaling
    readCapacity: 5,
    writeCapacity: 5,
    attributes: [{ name: "id", type: "S" }],
    hashKey: "id",
});

// Configure read capacity auto-scaling
const readTarget = new aws.appautoscaling.Target("readTarget", {
    resourceId: pulumi.interpolate`table/${table.name}`,
    scalableDimension: "dynamodb:table:ReadCapacityUnits",
    serviceNamespace: "dynamodb",
    minCapacity: 5,
    maxCapacity: 100, // Set appropriate scaling limits
});

new aws.appautoscaling.Policy("readPolicy", {
    resourceId: readTarget.resourceId,
    scalableDimension: readTarget.scalableDimension,
    serviceNamespace: readTarget.serviceNamespace,
    policyType: "TargetTrackingScaling",
    targetTrackingScalingPolicyConfiguration: {
        targetValue: 70.0, // Target utilization percentage
        predefinedMetricSpecification: {
            predefinedMetricType: "DynamoDBReadCapacityUtilization",
        },
    },
});

// Configure write capacity auto-scaling
const writeTarget = new aws.appautoscaling.Target("writeTarget", {
    resourceId: pulumi.interpolate`table/${table.name}`,
    scalableDimension: "dynamodb:table:WriteCapacityUnits",
    serviceNamespace: "dynamodb",
    minCapacity: 5,
    maxCapacity: 100,
});

new aws.appautoscaling.Policy("writePolicy", {
    resourceId: writeTarget.resourceId,
    scalableDimension: writeTarget.scalableDimension,
    serviceNamespace: writeTarget.serviceNamespace,
    policyType: "TargetTrackingScaling",
    targetTrackingScalingPolicyConfiguration: {
        targetValue: 70.0,
        predefinedMetricSpecification: {
            predefinedMetricType: "DynamoDBWriteCapacityUtilization",
        },
    },
});

// Alternative: Use on-demand billing mode (no auto-scaling needed)
// const table = new aws.dynamodb.Table("myTable", {
//     billingMode: "PAY_PER_REQUEST", // On-demand mode handles scaling automatically
//     attributes: [{ name: "id", type: "S" }],
//     hashKey: "id",
// });

import * as aws from "@pulumi/aws";

// Create or reference a customer-managed KMS key
const kmsKey = new aws.kms.Key("table-encryption-key", {
    description: "KMS key for DynamoDB table encryption",
    deletionWindowInDays: 10,
});

const table = new aws.dynamodb.Table("my-table", {
    // ... other configuration ...
    serverSideEncryption: {
        enabled: true,  // Enable encryption
        kmsKeyArn: kmsKey.arn,  // Use customer-managed KMS key (not AWS-managed)
    },
});

const table = new aws.dynamodb.Table("my-table", {
    name: "my-table",
    attributes: [
        { name: "id", type: "S" },
    ],
    hashKey: "id",
    streamEnabled: true, // Enable DynamoDB Streams
    billingMode: "PAY_PER_REQUEST",
});

import * as aws from "@pulumi/aws";

const volume = new aws.ebs.Volume("my-volume", {
    availabilityZone: "us-west-2a",
    size: 100,
    encrypted: true, // Enable encryption
});

const instance = new aws.ec2.Instance("app-server", {
    ami: "ami-12345678",
    instanceType: "t3.medium",
    associatePublicIpAddress: false,  // Disable public IP to prevent direct internet access
    subnetId: privateSubnet.id,
});

const instance = new aws.ec2.Instance("my-instance", {
    ami: "ami-12345678",
    instanceType: "t3.micro",
    ebsBlockDevices: [{
        deviceName: "/dev/sdf",
        volumeSize: 20,
        encrypted: true, // Enable encryption for the EBS volume
    }],
});

const instance = new aws.ec2.Instance("my-instance", {
    instanceType: "t3.micro",
    ami: "ami-12345678",
    rootBlockDevice: {
        encrypted: true, // Enable encryption for root volume
    },
});

const launchConfig = new aws.ec2.LaunchConfiguration("my-launch-config", {
    imageId: "ami-12345678",
    instanceType: "t3.medium",
    ebsBlockDevices: [{
        deviceName: "/dev/sdf",
        volumeSize: 100,
        encrypted: true, // Enable encryption for all EBS block devices
    }],
});

const launchTemplate = new aws.ec2.LaunchTemplate("my-template", {
    imageId: "ami-12345678",
    instanceType: "t3.micro",
    blockDeviceMappings: [{
        deviceName: "/dev/sda1",
        ebs: {
            encrypted: "true", // Enable encryption for the EBS volume
            volumeSize: 20,
            volumeType: "gp3",
        },
    }],
});

const loadBalancer = new aws.elb.LoadBalancer("my-lb", {
    availabilityZones: ["us-west-2a", "us-west-2b"],
    listeners: [{ /* ... */ }],
    accessLogs: {
        enabled: true,  // Enable access logging
        bucket: "my-elb-logs-bucket",  // S3 bucket for logs
        bucketPrefix: "my-app",  // Optional prefix for log files
    },
});

const loadBalancer = new aws.elb.LoadBalancer("my-load-balancer", {
    availabilityZones: ["us-west-2a", "us-west-2b"],
    listeners: [{
        instancePort: 80,
        instanceProtocol: "http",
        lbPort: 80,
        lbProtocol: "http",
    }],
    crossZoneLoadBalancing: true, // Enable cross-zone load balancing
});

const loadBalancer = new aws.elb.LoadBalancer("my-lb", {
    listeners: [
        {
            instancePort: 443,
            instanceProtocol: "https",
            lbPort: 443,
            lbProtocol: "https", // Use "https" or "ssl" instead of "http"
            sslCertificateId: "arn:aws:iam::123456789012:server-certificate/my-cert", // Required for HTTPS/SSL
        },
    ],
});

const instance = new aws.ec2.Instance("web-server", {
    instanceType: "t3.micro",
    ami: "ami-12345678",
    tags: {
        "Environment": "production", // Add environment tag for proper separation
        "Name": "web-server",
    },
});

const groupPolicy = new aws.iam.GroupPolicy("my-group-policy", {
    group: myGroup.name,
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "cloudwatch:PutMetricData",  // Specify exact actions needed
            ],
            Resource: "*",  // Some AWS services require "*" for resource
            Condition: {
                StringEquals: {
                    "cloudwatch:namespace": "MyApp",  // Use conditions to scope access
                },
            },
        }],
    }),
});

const policy = new aws.iam.Policy("my-policy", {
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "s3:GetObject",        // Specify exact actions needed
                "s3:PutObject",
            ],
            Resource: [
                "arn:aws:s3:::my-bucket/*",  // Scope to specific resources
            ],
        }],
    }),
});

const role = new aws.iam.Role("my-role", {
    assumeRolePolicy: assumePolicyDoc,
    inlinePolicies: [{
        name: "my-inline-policy",
        policy: JSON.stringify({
            Version: "2012-10-17",
            Statement: [{
                Effect: "Allow",
                Action: [
                    "dynamodb:GetItem",    // Specify exact actions needed
                    "dynamodb:PutItem",
                ],
                Resource: [
                    "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable",  // Scope to specific resources
                ],
            }],
        }),
    }],
});

const rolePolicy = new aws.iam.RolePolicy("my-role-policy", {
    role: myRole.id,
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "ec2:DescribeInstances",   // Specify exact actions needed
                "ec2:StartInstances",
                "ec2:StopInstances",
            ],
            Resource: [
                "arn:aws:ec2:us-east-1:123456789012:instance/*",  // Scope to specific resources
            ],
        }],
    }),
});

const userPolicy = new aws.iam.UserPolicy("my-user-policy", {
    user: myUser.name,
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "s3:ListBucket",         // Specify exact actions needed
            ],
            Resource: [
                "arn:aws:s3:::my-bucket",  // Scope to specific resources
            ],
        }],
    }),
});

const key = new aws.kms.Key("my-key", {
    description: "Key for encrypting application data", // Add clear description
    customerMasterKeySpec: "SYMMETRIC_DEFAULT", // Use approved key spec
    keyUsage: "ENCRYPT_DECRYPT", // Specify key usage
    deletionWindowInDays: 30, // Set deletion window between 7-30 days
    enableKeyRotation: true,
});

const kmsKey = new aws.kms.Key("my-key", {
    description: "Encryption key for application data",
    deletionWindowInDays: 30, // Set deletion window between 7-30 days
    tags: {
        Environment: "production",
        Owner: "security-team",
        Purpose: "data-encryption",
    },
});

const key = new aws.kms.Key("my-key", {
    description: "My KMS key",
    enableKeyRotation: true, // Enable automatic key rotation
});

import * as aws from "@pulumi/aws";

const myFunction = new aws.lambda.Function("myFunction", {
    runtime: "nodejs18.x",
    handler: "index.handler",
    role: lambdaRole.arn,
    code: new pulumi.asset.AssetArchive({
        ".": new pulumi.asset.FileArchive("./function"),
    }),
    // Set reserved concurrent executions to limit resource consumption
    reservedConcurrentExecutions: 10,
});

import * as aws from "@pulumi/aws";

// Create a dead letter queue
const dlq = new aws.sqs.Queue("my-function-dlq", {
    messageRetentionSeconds: 1209600, // 14 days
});

const lambdaFunction = new aws.lambda.Function("my-function", {
    runtime: "nodejs18.x",
    handler: "index.handler",
    role: lambdaRole.arn,
    code: new pulumi.asset.AssetArchive({
        ".": new pulumi.asset.FileArchive("./function"),
    }),
    // Add dead letter configuration to capture failed invocations
    deadLetterConfig: {
        targetArn: dlq.arn, // ARN of SQS queue or SNS topic
    },
});

const myFunction = new aws.lambda.Function("my-function", {
    code: new pulumi.asset.FileArchive("./function"),
    role: lambdaRole.arn,
    handler: "index.handler",
    runtime: "nodejs20.x",
    description: "Processes user authentication requests and validates credentials", // Add descriptive documentation
});

const myFunction = new aws.lambda.Function("my-function", {
    runtime: "nodejs20.x",
    handler: "index.handler",
    role: lambdaRole.arn,
    code: new pulumi.asset.AssetArchive({
        ".": new pulumi.asset.FileArchive("./app"),
    }),
    timeout: 300, // Set timeout to prevent extended access (max 300 seconds by default)
});

const neptuneInstance = new aws.neptune.ClusterInstance("neptune-instance", {
    clusterIdentifier: neptuneCluster.id,
    instanceClass: "db.r5.large",
    engine: "neptune",
    publiclyAccessible: false,  // Disable public access
});

const queuePolicy = new aws.iam.Policy("queue-policy", {
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "sqs:SendMessage",      // Use specific actions instead of sqs:*
                "sqs:ReceiveMessage",
                "sqs:DeleteMessage",
            ],
            Resource: "arn:aws:sqs:us-east-1:123456789012:my-queue", // Use specific ARN instead of *
        }],
    }),
});

const cluster = new aws.rds.Cluster("my-cluster", {
    engine: "aurora-mysql",
    engineVersion: "8.0.mysql_aurora.3.02.0",
    masterUsername: "admin",
    masterPassword: dbPassword,
    storageEncrypted: true, // Enable storage encryption
    databaseName: "mydb",
    skipFinalSnapshot: true,
});

const clusterInstance = new aws.rds.ClusterInstance("my-cluster-instance", {
    clusterIdentifier: cluster.id,
    instanceClass: "db.r5.large",
    engine: "aurora-postgresql",
    publiclyAccessible: false, // Disable public access
});

const clusterParamGroup = new aws.rds.ParameterGroup("cluster-params", {
    family: "aurora-postgresql14",
    parameters: [
        {
            name: "rds.force_ssl",
            value: "1", // Enforce SSL/TLS for all connections
        },
    ],
});

const clusterInstance = new aws.rds.ClusterInstance("my-cluster-instance", {
    clusterIdentifier: cluster.id,
    instanceClass: "db.r5.large",
    engine: cluster.engine,
    dbParameterGroupName: clusterParamGroup.name, // Attach parameter group with SSL enforcement
});

const myRdsInstance = new aws.rds.Instance("my-db", {
    engine: "postgres",
    instanceClass: "db.t3.micro",
    allocatedStorage: 20,
    storageEncrypted: true, // Enable encryption at rest
});

const db = new aws.rds.Instance("my-db", {
    engine: "postgres",
    instanceClass: "db.t3.micro",
    allocatedStorage: 20,
    backupRetentionPeriod: 7, // Enable automated backups with 7-day retention
});

const dbInstance = new aws.rds.Instance("my-database", {
    allocatedStorage: 20,
    engine: "mysql",
    engineVersion: "8.0",
    instanceClass: "db.t3.micro",
    username: "admin",
    password: dbPassword,
    multiAz: true, // Enable Multi-AZ deployment for high availability
    skipFinalSnapshot: true,
});

const dbParamGroup = new aws.rds.ParameterGroup("db-params", {
    family: "mysql8.0",
    parameters: [
        {
            name: "require_secure_transport",
            value: "1", // Enforce SSL/TLS for all connections
        },
    ],
});

const db = new aws.rds.Instance("my-database", {
    engine: "mysql",
    instanceClass: "db.t3.micro",
    allocatedStorage: 20,
    parameterGroupName: dbParamGroup.name, // Attach parameter group with SSL enforcement
    username: "admin",
    password: dbPassword,
});

const privateSubnetGroup = new aws.rds.SubnetGroup("db-subnet-group", {
    subnetIds: [
        privateSubnet1.id,  // Private subnet without Internet Gateway route
        privateSubnet2.id,  // Private subnet without Internet Gateway route
    ],
    tags: {
        Name: "Private DB Subnet Group",
    },
});

const db = new aws.rds.Instance("database", {
    dbSubnetGroupName: privateSubnetGroup.name,
    publiclyAccessible: false,
    // ... other configuration
});

const dbParamGroup = new aws.rds.ParameterGroup("db-params", {
    family: "mysql8.0",
    parameters: [
        {
            name: "require_secure_transport",
            value: "1", // Enforce SSL/TLS for all connections
        },
    ],
});

const db = new aws.rds.Instance("my-database", {
    engine: "mysql",
    instanceClass: "db.t3.micro",
    allocatedStorage: 20,
    caCertIdentifier: "rds-ca-rsa2048-g1", // Specify CA certificate for SSL/TLS
    parameterGroupName: dbParamGroup.name, // Attach parameter group with SSL enforcement
    username: "admin",
    password: dbPassword,
});

const instance = new aws.ec2.Instance("my-instance", {
    ami: "ami-0c55b159cbfafe1f0",
    instanceType: "t3.micro",
    tags: {
        Environment: "production", // Add meaningful tags for change tracking
        Owner: "team-name",
        Application: "web-app",
    },
});

const myBucket = new aws.s3.Bucket("my-bucket", {
    // Bucket configuration
});

const logBucket = new aws.s3.Bucket("log-bucket", {
    // Configure log bucket settings
});

const bucketLogging = new aws.s3.BucketLogging("my-bucket-logging", {
    bucket: myBucket.id,
    targetBucket: logBucket.id, // Specify target bucket for logs
    targetPrefix: "logs/my-bucket/", // Specify prefix for organization
});

const bucket = new aws.s3.BucketV2("my-bucket", {
    bucket: "my-secure-bucket",
});

// Add encryption configuration resource
const bucketEncryption = new aws.s3.BucketServerSideEncryptionConfiguration("my-bucket-encryption", {
    bucket: bucket.id,
    rules: [{
        applyServerSideEncryptionByDefault: {
            sseAlgorithm: "aws:kms", // Enable KMS encryption
            kmsMasterKeyId: kmsKey.arn, // Specify customer-managed key
        },
        bucketKeyEnabled: true, // Enable bucket key for cost optimization
    }],
});

const bucketPolicy = new aws.s3.BucketPolicy("policy", {
    bucket: bucket.id,
    policy: bucket.arn.apply(arn => JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: {
                AWS: "arn:aws:iam::123456789012:role/specific-role" // Specify exact principal ARN
            },
            Action: ["s3:GetObject", "s3:PutObject"], // Use specific S3 actions
            Resource: `${arn}/*` // Scope to specific bucket
        }]
    }))
});

const myBucket = new aws.s3.Bucket("my-bucket", {
    // Bucket configuration
});

const publicAccessBlock = new aws.s3.BucketPublicAccessBlock("my-bucket-public-access-block", {
    bucket: myBucket.id,
    blockPublicAcls: true,       // Blocks new public ACLs
    blockPublicPolicy: true,     // Blocks new public bucket policies
    ignorePublicAcls: true,      // Ignores existing public ACLs
    restrictPublicBuckets: true, // Restricts public access to buckets with public policies
});

const bucket = new aws.s3.BucketV2("my-bucket", {
    bucket: "my-data-bucket",
});

const versioning = new aws.s3.BucketVersioning("my-bucket-versioning", {
    bucket: bucket.id,
    versioningConfiguration: {
        status: "Enabled", // Enable versioning for data integrity and recovery
    },
});

const webSecurityGroup = new aws.ec2.SecurityGroup("web-sg", {
    vpcId: vpc.id,
    ingress: [{
        protocol: "tcp",
        fromPort: 443,
        toPort: 443,
        cidrBlocks: ["10.0.0.0/16"], // Use specific CIDR block instead of 0.0.0.0/0
    }],
    egress: [{
        protocol: "tcp",
        fromPort: 443,
        toPort: 443,
        cidrBlocks: ["10.0.0.0/16"], // Use specific CIDR block instead of 0.0.0.0/0
    }],
});

const securityGroup = new aws.ec2.SecurityGroup("my-sg", {
    vpcId: vpc.id,
    ingress: [
        {
            fromPort: 22,
            toPort: 22,
            protocol: "tcp",
            cidrBlocks: ["10.0.0.0/16"], // Restrict to specific network, not 0.0.0.0/0
        },
        {
            fromPort: 3389,
            toPort: 3389,
            protocol: "tcp",
            cidrBlocks: ["10.0.0.0/16"], // Restrict to specific network, not 0.0.0.0/0
        },
    ],
});

const securityGroup = new aws.ec2.SecurityGroup("my-sg", {
    vpcId: vpc.id,
    ingress: [
        {
            protocol: "tcp", // Use specific protocol, not "-1" (all)
            fromPort: 443,
            toPort: 443,
            cidrBlocks: ["10.0.0.0/8"], // Restrict to internal network, not "0.0.0.0/0"
        },
    ],
    egress: [
        {
            protocol: "-1",
            fromPort: 0,
            toPort: 0,
            cidrBlocks: ["0.0.0.0/0"],
        },
    ],
});

// Create a dead letter queue first
const dlq = new aws.sqs.Queue("my-dlq", {
    messageRetentionSeconds: 1209600, // 14 days
});

// Configure the main queue with redrive policy
const queue = new aws.sqs.Queue("my-queue", {
    redrivePolicy: pulumi.interpolate`{
        "deadLetterTargetArn": "${dlq.arn}",
        "maxReceiveCount": 3
    }`, // Configure DLQ to capture messages that fail processing
    messageRetentionSeconds: 345600,
});

const flowLog = new aws.ec2.FlowLog("vpc-flow-log", {
    vpcId: vpc.id,
    trafficType: "ALL",
    logDestination: "arn:aws:s3:::approved-logging-bucket", // Use approved destination
    logDestinationType: "s3",
});