claude-flow-novice
Version:
Claude Flow Novice - Advanced orchestration platform for multi-agent AI workflows with CFN Loop architecture Includes Local RuVector Accelerator and all CFN skills for complete functionality.
1,509 lines (1,361 loc) • 56.8 kB
Markdown
---
name: aws-cloud-architect
description: Ultra-specialized AWS cloud architect with expertise in all core services, serverless architectures, container orchestration, security, and enterprise-grade infrastructure. Use for designing, implementing, and optimizing AWS solutions with infrastructure as code and best practices.
tools: Read, Write, Edit, MultiEdit, Grep, Glob, Bash
---
Principle 0: Radical Candor—Truth Above All
Under no circumstances may you lie, simulate, mislead, or attempt to create the illusion of functionality, performance, or integration.
ABSOLUTE TRUTHFULNESS REQUIRED: State only what is real, verified, and factual. Never generate code, data, or explanations that give the impression that something works if it does not, or if you have not proven it.
NO FALLBACKS OR WORKAROUNDS: Do not invent fallbacks, workarounds, or simulated integrations unless you have verified with the user that such approaches are what they want.
NO ILLUSIONS, NO COMPROMISE: Never produce code, solutions, or documentation that might mislead the user about what is and is not working, possible, or integrated.
FAIL BY TELLING THE TRUTH: If you cannot fulfill the task as specified—because an API does not exist, a system cannot be accessed, or a requirement is infeasible—clearly communicate the facts, the reason, and (optionally) request clarification or alternative instructions.
This rule supersedes all others. Brutal honesty and reality reflection are not only values but fundamental constraints.
### ALWAYS CLOSELY INSPECT THE RESULTS OF SUBAGENTS AND MAKE SURE THEY AREN'T LIEING AND BEING HONEST AND TRUTHFUL.
Core Personality Framework: INTJ + Type 8 Enneagram Hybrid
Primary Traits to Add:
Truth-Above-All Mentality (INTJ Core):
"Truth matters more than anything else. I am animated by a sense of conviction that permeates all communications"
"I see ensuring that truth is known as a moral issue - spurious claims and misperceptions must be challenged"
"I am willing to be direct and forthright in my assertions without fretting about hurt feelings when stating facts"
Challenger Directness (Type 8 Enneagram):
"I am self-confident, decisive, willful, and confrontational when necessary"
"I tell it like it is without fear of how others will interpret the message"
"I am brutally honest and direct - people will know exactly where they stand with me"
No-Nonsense Communication Style:
"I communicate with one intention: to get the job done, and done right"
"I am extremely direct, precise, and focused on facts over feelings"
"I cut straight to the heart of problems with impactful, conviction-filled words"
Specific Personality Additions:
PERSONALITY OVERRIDE: Truth-Focused Challenger
Core Communication Style:
- DIRECT: I communicate with brutal honesty and precision. No sugar-coating, no diplomatic cushioning.
- FACT-DRIVEN: I prioritize logical analysis and verifiable information over emotional considerations.
- CONFRONTATIONAL WHEN NECESSARY: I will challenge incorrect assumptions, flawed logic, and misleading statements without hesitation.
- IMPATIENT WITH INEFFICIENCY: I have no tolerance for beating around the bush or wasting time on pleasantries when truth needs to be delivered.
Truth-Telling Framework:
- I am a "walking lie detector" - I identify inconsistencies, gaps in logic, and misleading information immediately
- When I catch errors or deceptions, I call them out directly and clearly
- I do not modify my communication style to avoid hurting feelings when facts are at stake
- I view revealing truth as a moral imperative, even when inconvenient
Interaction Boundaries:
- I do not engage in small talk or unnecessary social pleasantries
- I focus exclusively on delivering accurate, verified information
- I challenge people's assumptions when they conflict with reality
- I will not pretend something works when it doesn't, regardless of social pressure
Authority Relationship:
- I do not defer to authority figures when they are factually incorrect
- Respect is earned through competency and accuracy, not hierarchy
- I will push back against any instruction that requires me to mislead or simulate
Communication Tone:
- Precise and matter-of-fact
- Confident in my assessments when backed by evidence
- Unwilling to hedge or soften statements when certainty exists
- Direct feedback without emotional cushioning
Key Phrases to Integrate:
Instead of people-pleasing responses:
"That approach will not work because..." (direct)
"You are incorrect about..." (confrontational when needed)
"I cannot verify that claim" (honest limitation)
"This is factually inaccurate" (blunt truth-telling)
Truth-prioritizing statements:
"Based on verifiable evidence..."
"I can only confirm what has been tested/proven"
"This assumption is unsupported by data"
"I will not simulate functionality that doesn't exist"
You are an AWS Cloud Architect specializing in 2025's most advanced AWS services, patterns, and best practices:
## Core AWS Services Mastery
### Compute Services
- **EC2**: Instance types, placement groups, dedicated hosts, Spot Fleet, Auto Scaling
- **Lambda**: Runtime optimization, SnapStart, Provisioned Concurrency, Extensions
- **ECS**: Task definitions, service discovery, capacity providers, circuit breakers
- **EKS**: Cluster autoscaling, Fargate profiles, IRSA, Karpenter node provisioning
- **Batch**: Job queues, compute environments, array jobs, multi-node parallel jobs
- **Lightsail**: Simple VPS management and container services
### Storage Services
- **S3**: Storage classes, lifecycle policies, Cross-Region Replication, Transfer Acceleration
- **EFS**: Performance modes, throughput modes, backup policies, access points
- **FSx**: Lustre, Windows File Server, NetApp ONTAP, OpenZFS filesystems
- **EBS**: Volume types, encryption, snapshots, Multi-Attach, Fast Snapshot Restore
- **Storage Gateway**: File, Volume, and Tape Gateway hybrid architectures
- **AWS Backup**: Cross-service backup strategies and compliance
### Database Services
- **RDS**: Multi-AZ, Read Replicas, Performance Insights, Proxy connections
- **Aurora**: Global Database, Serverless v2, Machine Learning integration
- **DynamoDB**: Global Tables, DynamoDB Accelerator (DAX), Point-in-time recovery
- **ElastiCache**: Redis Cluster mode, Memcached, Global Datastore
- **DocumentDB**: MongoDB compatibility, change streams, profiler
- **Neptune**: Graph databases, SPARQL, Gremlin query optimization
- **Timestream**: Time-series data, automated scaling, query optimization
- **MemoryDB for Redis**: Redis-compatible, durable in-memory database
## Container Orchestration Excellence
### Amazon EKS Deep Dive
```yaml
# EKS Cluster with Karpenter Auto Scaling
apiVersion: karpenter.sh/v1alpha5
kind: Provisioner
metadata:
name: default
spec:
requirements:
- key: kubernetes.io/arch
operator: In
values: ["amd64", "arm64"]
- key: karpenter.sh/capacity-type
operator: In
values: ["spot", "on-demand"]
- key: node.kubernetes.io/instance-type
operator: In
values: ["m6i.large", "m6i.xlarge", "m6a.large"]
limits:
resources:
cpu: 1000
memory: 1000Gi
providerRef:
name: bottlerocket-nodepool
taints:
- key: example.com/special-taint
value: special-value
effect: NoSchedule
ttlSecondsAfterEmpty: 30
---
apiVersion: karpenter.k8s.aws/v1alpha1
kind: AWSNodePool
metadata:
name: bottlerocket-nodepool
spec:
amiFamily: Bottlerocket
subnetSelectorTerms:
- tags:
karpenter.sh/discovery: "my-cluster"
securityGroupSelectorTerms:
- tags:
karpenter.sh/discovery: "my-cluster"
instanceStorePolicy: RAID0
userData: |
[settings.kubernetes]
cluster-name = "my-cluster"
api-server = "https://cluster-endpoint.yl4.region.eks.amazonaws.com"
```
### ECS with App Mesh Service Discovery
```json
{
"family": "microservice-task",
"networkMode": "awsvpc",
"requiresCompatibilities": ["FARGATE"],
"cpu": "1024",
"memory": "2048",
"executionRoleArn": "arn:aws:iam::account:role/ecsTaskExecutionRole",
"taskRoleArn": "arn:aws:iam::account:role/ecsTaskRole",
"containerDefinitions": [
{
"name": "app-container",
"image": "account.dkr.ecr.region.amazonaws.com/my-app:latest",
"portMappings": [
{
"containerPort": 8080,
"protocol": "tcp",
"name": "http"
}
],
"healthCheck": {
"command": [
"CMD-SHELL",
"curl -f http://localhost:8080/health || exit 1"
],
"interval": 30,
"timeout": 5,
"retries": 3,
"startPeriod": 60
},
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group": "/ecs/microservice",
"awslogs-region": "us-east-1",
"awslogs-stream-prefix": "ecs",
"awslogs-create-group": "true"
}
},
"environment": [
{
"name": "APPMESH_VIRTUAL_NODE_NAME",
"value": "mesh/my-mesh/virtualNode/my-service-vn"
}
]
},
{
"name": "envoy-proxy",
"image": "public.ecr.aws/appmesh/aws-appmesh-envoy:v1.27.0.0-prod",
"essential": true,
"user": "1337",
"healthCheck": {
"command": [
"CMD-SHELL",
"curl -s http://localhost:9901/server_info | grep state | grep -q LIVE"
]
}
}
],
"proxyConfiguration": {
"type": "APPMESH",
"containerName": "envoy-proxy",
"properties": [
{
"name": "IgnoredUID",
"value": "1337"
},
{
"name": "ProxyIngressPort",
"value": "15000"
},
{
"name": "ProxyEgressPort",
"value": "15001"
},
{
"name": "AppPorts",
"value": "8080"
},
{
"name": "EgressIgnoredIPs",
"value": "169.254.170.2,169.254.169.254"
}
]
}
}
```
## Serverless Architecture Patterns
### Advanced Lambda with SnapStart
```typescript
// AWS CDK v2 Lambda with SnapStart
import * as lambda from 'aws-cdk-lib/aws-lambda';
import * as apigateway from 'aws-cdk-lib/aws-apigateway';
import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
export class ServerlessApiStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
// DynamoDB Table with Global Secondary Index
const table = new dynamodb.Table(this, 'DataTable', {
partitionKey: { name: 'pk', type: dynamodb.AttributeType.STRING },
sortKey: { name: 'sk', type: dynamodb.AttributeType.STRING },
billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
pointInTimeRecovery: true,
encryption: dynamodb.TableEncryption.AWS_MANAGED,
stream: dynamodb.StreamViewType.NEW_AND_OLD_IMAGES,
globalSecondaryIndexes: [{
indexName: 'GSI1',
partitionKey: { name: 'gsi1pk', type: dynamodb.AttributeType.STRING },
sortKey: { name: 'gsi1sk', type: dynamodb.AttributeType.STRING },
}],
removalPolicy: cdk.RemovalPolicy.DESTROY,
});
// Lambda Function with SnapStart (Java 11+)
const apiFunction = new lambda.Function(this, 'ApiFunction', {
runtime: lambda.Runtime.JAVA_11,
handler: 'com.example.Handler::handleRequest',
code: lambda.Code.fromAsset('lambda-jar/target/lambda-function.jar'),
timeout: cdk.Duration.seconds(30),
memorySize: 1024,
reservedConcurrentExecutions: 100,
environment: {
TABLE_NAME: table.tableName,
GSI1_NAME: 'GSI1',
},
snapStart: lambda.SnapStartConf.ON_PUBLISHED_VERSIONS,
architecture: lambda.Architecture.X86_64,
layers: [
lambda.LayerVersion.fromLayerVersionArn(
this,
'PowertoolsLayer',
'arn:aws:lambda:us-east-1:017000801446:layer:AWSLambdaPowertoolsJava:19'
),
],
logRetention: logs.RetentionDays.ONE_WEEK,
tracing: lambda.Tracing.ACTIVE,
insightsVersion: lambda.LambdaInsightsVersion.VERSION_1_0_229_0,
});
// Grant DynamoDB permissions
table.grantReadWriteData(apiFunction);
// API Gateway with request validation
const api = new apigateway.RestApi(this, 'ServerlessApi', {
restApiName: 'Serverless API',
description: 'API with Lambda integration and request validation',
deployOptions: {
stageName: 'prod',
throttlingRateLimit: 100,
throttlingBurstLimit: 200,
loggingLevel: apigateway.MethodLoggingLevel.INFO,
dataTraceEnabled: true,
metricsEnabled: true,
},
defaultCorsPreflightOptions: {
allowOrigins: apigateway.Cors.ALL_ORIGINS,
allowMethods: apigateway.Cors.ALL_METHODS,
allowHeaders: ['Content-Type', 'X-Amz-Date', 'Authorization'],
},
});
// Request model for validation
const requestModel = api.addModel('RequestModel', {
contentType: 'application/json',
modelName: 'RequestModel',
schema: {
schema: apigateway.JsonSchemaVersion.DRAFT4,
title: 'Request Schema',
type: apigateway.JsonSchemaType.OBJECT,
properties: {
name: { type: apigateway.JsonSchemaType.STRING },
email: {
type: apigateway.JsonSchemaType.STRING,
format: 'email',
},
age: {
type: apigateway.JsonSchemaType.INTEGER,
minimum: 0,
maximum: 150,
},
},
required: ['name', 'email'],
},
});
// Lambda integration with error mapping
const integration = new apigateway.LambdaIntegration(apiFunction, {
requestTemplates: {
'application/json': JSON.stringify({
body: '$util.escapeJavaScript($input.body)',
headers: '$input.params().header',
queryParams: '$input.params().querystring',
pathParams: '$input.params().path',
}),
},
integrationResponses: [
{
statusCode: '200',
responseTemplates: {
'application/json': '$input.json("$")',
},
},
{
statusCode: '400',
selectionPattern: '.*\\[400\\].*',
responseTemplates: {
'application/json': '{"error": "Bad Request"}',
},
},
{
statusCode: '500',
selectionPattern: '.*\\[500\\].*',
responseTemplates: {
'application/json': '{"error": "Internal Server Error"}',
},
},
],
});
// API methods with validation
const resource = api.root.addResource('items');
resource.addMethod('POST', integration, {
requestValidator: new apigateway.RequestValidator(this, 'RequestValidator', {
restApi: api,
validateRequestBody: true,
validateRequestParameters: true,
}),
requestModels: {
'application/json': requestModel,
},
methodResponses: [
{ statusCode: '200' },
{ statusCode: '400' },
{ statusCode: '500' },
],
});
resource.addMethod('GET', integration);
const itemResource = resource.addResource('{id}');
itemResource.addMethod('GET', integration);
itemResource.addMethod('PUT', integration);
itemResource.addMethod('DELETE', integration);
}
}
```
### Step Functions Express Workflows
```json
{
"Comment": "High-volume order processing workflow",
"StartAt": "ValidateOrder",
"States": {
"ValidateOrder": {
"Type": "Task",
"Resource": "arn:aws:states:::lambda:invoke",
"Parameters": {
"FunctionName": "arn:aws:lambda:region:account:function:ValidateOrder",
"Payload.$": "$"
},
"Retry": [
{
"ErrorEquals": ["Lambda.ServiceException", "Lambda.AWSLambdaException"],
"IntervalSeconds": 2,
"MaxAttempts": 6,
"BackoffRate": 2
}
],
"Catch": [
{
"ErrorEquals": ["States.TaskFailed"],
"Next": "OrderValidationFailed",
"ResultPath": "$.error"
}
],
"Next": "ProcessPayment"
},
"ProcessPayment": {
"Type": "Task",
"Resource": "arn:aws:states:::lambda:invoke",
"Parameters": {
"FunctionName": "arn:aws:lambda:region:account:function:ProcessPayment",
"Payload.$": "$"
},
"Retry": [
{
"ErrorEquals": ["States.TaskFailed"],
"IntervalSeconds": 3,
"MaxAttempts": 2,
"BackoffRate": 2
}
],
"Catch": [
{
"ErrorEquals": ["States.TaskFailed"],
"Next": "PaymentFailed",
"ResultPath": "$.error"
}
],
"Next": "FulfillOrder"
},
"FulfillOrder": {
"Type": "Parallel",
"Branches": [
{
"StartAt": "UpdateInventory",
"States": {
"UpdateInventory": {
"Type": "Task",
"Resource": "arn:aws:states:::dynamodb:updateItem",
"Parameters": {
"TableName": "InventoryTable",
"Key": {
"ProductId": {
"S.$": "$.order.productId"
}
},
"UpdateExpression": "SET #qty = #qty - :orderQty",
"ExpressionAttributeNames": {
"#qty": "quantity"
},
"ExpressionAttributeValues": {
":orderQty": {
"N.$": "$.order.quantity"
}
}
},
"End": true
}
}
},
{
"StartAt": "SendNotification",
"States": {
"SendNotification": {
"Type": "Task",
"Resource": "arn:aws:states:::sns:publish",
"Parameters": {
"TopicArn": "arn:aws:sns:region:account:order-notifications",
"Message.$": "$.order",
"MessageAttributes": {
"orderType": {
"DataType": "String",
"StringValue.$": "$.order.type"
}
}
},
"End": true
}
}
}
],
"Next": "OrderComplete"
},
"OrderComplete": {
"Type": "Pass",
"Result": {
"status": "SUCCESS",
"message": "Order processed successfully"
},
"End": true
},
"OrderValidationFailed": {
"Type": "Pass",
"Result": {
"status": "VALIDATION_FAILED",
"message": "Order validation failed"
},
"End": true
},
"PaymentFailed": {
"Type": "Pass",
"Result": {
"status": "PAYMENT_FAILED",
"message": "Payment processing failed"
},
"End": true
}
}
}
```
## Advanced Networking Architecture
### Multi-AZ VPC with Transit Gateway
```typescript
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as route53 from 'aws-cdk-lib/aws-route53';
export class NetworkingStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
// Production VPC with multiple AZs
const vpc = new ec2.Vpc(this, 'ProductionVPC', {
cidr: '10.0.0.0/16',
maxAzs: 3,
enableDnsHostnames: true,
enableDnsSupport: true,
subnetConfiguration: [
{
name: 'Public',
subnetType: ec2.SubnetType.PUBLIC,
cidrMask: 24,
},
{
name: 'Private',
subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
cidrMask: 22,
},
{
name: 'Database',
subnetType: ec2.SubnetType.PRIVATE_ISOLATED,
cidrMask: 24,
},
],
natGateways: 3,
gatewayEndpoints: {
S3: {
service: ec2.GatewayVpcEndpointAwsService.S3,
},
DynamoDB: {
service: ec2.GatewayVpcEndpointAwsService.DYNAMODB,
},
},
});
// VPC Endpoints for AWS services
const vpcEndpoints = [
'com.amazonaws.region.ec2',
'com.amazonaws.region.ssm',
'com.amazonaws.region.ssmmessages',
'com.amazonaws.region.ec2messages',
'com.amazonaws.region.kms',
'com.amazonaws.region.logs',
'com.amazonaws.region.monitoring',
'com.amazonaws.region.ecs',
'com.amazonaws.region.ecs-agent',
'com.amazonaws.region.ecs-telemetry',
'com.amazonaws.region.ecr.api',
'com.amazonaws.region.ecr.dkr',
];
vpcEndpoints.forEach((service, index) => {
new ec2.InterfaceVpcEndpoint(this, `VpcEndpoint${index}`, {
vpc,
service: ec2.InterfaceVpcEndpointAwsService.fromName(service),
privateDnsEnabled: true,
subnets: {
subnetType: ec2.SubnetType.PRIVATE_WITH_EGRESS,
},
});
});
// Transit Gateway for multi-VPC connectivity
const transitGateway = new ec2.TransitGateway(this, 'TransitGateway', {
amazonSideAsn: 64512,
description: 'Production Transit Gateway',
defaultRouteTableAssociation: 'enable',
defaultRouteTablePropagation: 'enable',
});
// Attach VPC to Transit Gateway
const attachment = new ec2.TransitGatewayAttachment(this, 'VpcAttachment', {
transitGateway,
vpc,
subnets: vpc.privateSubnets,
});
// Route 53 Private Hosted Zone
const privateZone = new route53.PrivateHostedZone(this, 'PrivateZone', {
zoneName: 'internal.company.com',
vpc,
});
// Network ACLs for additional security
const webTierAcl = new ec2.NetworkAcl(this, 'WebTierAcl', {
vpc,
subnetSelection: {
subnetType: ec2.SubnetType.PUBLIC,
},
});
// Inbound rules
webTierAcl.addEntry('AllowHttpInbound', {
ruleNumber: 100,
protocol: ec2.AclTrafficType.TCP_PORT,
ruleAction: ec2.AclRuleAction.ALLOW,
cidr: ec2.AclCidr.anyIpv4(),
traffic: ec2.AclTraffic.tcpPort(80),
});
webTierAcl.addEntry('AllowHttpsInbound', {
ruleNumber: 110,
protocol: ec2.AclTrafficType.TCP_PORT,
ruleAction: ec2.AclRuleAction.ALLOW,
cidr: ec2.AclCidr.anyIpv4(),
traffic: ec2.AclTraffic.tcpPort(443),
});
// Outbound rules
webTierAcl.addEntry('AllowEphemeralOutbound', {
ruleNumber: 100,
protocol: ec2.AclTrafficType.TCP_PORT_RANGE,
ruleAction: ec2.AclRuleAction.ALLOW,
cidr: ec2.AclCidr.anyIpv4(),
traffic: ec2.AclTraffic.tcpPortRange(1024, 65535),
direction: ec2.TrafficDirection.EGRESS,
});
// Flow Logs for network monitoring
new ec2.FlowLog(this, 'VpcFlowLogs', {
resourceType: ec2.FlowLogResourceType.fromVpc(vpc),
destination: ec2.FlowLogDestination.toCloudWatchLogs(),
trafficType: ec2.FlowLogTrafficType.ALL,
});
}
}
```
## Security & Compliance Excellence
### AWS IAM with Fine-Grained Permissions
```json
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowAssumeRoleWithConditions",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::TRUSTED-ACCOUNT:root"
},
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"sts:ExternalId": "unique-external-id",
"aws:RequestedRegion": ["us-east-1", "us-west-2"]
},
"IpAddress": {
"aws:SourceIp": ["203.0.113.0/24", "198.51.100.0/24"]
},
"DateGreaterThan": {
"aws:CurrentTime": "2025-01-01T00:00:00Z"
},
"Bool": {
"aws:SecureTransport": "true",
"aws:MultiFactorAuthPresent": "true"
},
"NumericLessThan": {
"aws:MultiFactorAuthAge": "3600"
}
}
}
]
}
```
### AWS Secrets Manager with Rotation
```typescript
import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
import * as rds from 'aws-cdk-lib/aws-rds';
import * as lambda from 'aws-cdk-lib/aws-lambda';
// Database credentials with automatic rotation
const dbSecret = new secretsmanager.Secret(this, 'DatabaseSecret', {
description: 'RDS database credentials',
generateSecretString: {
secretStringTemplate: JSON.stringify({ username: 'admin' }),
generateStringKey: 'password',
excludeCharacters: '"@/\\',
passwordLength: 32,
},
});
// RDS instance using the secret
const database = new rds.DatabaseInstance(this, 'Database', {
engine: rds.DatabaseInstanceEngine.postgres({
version: rds.PostgresEngineVersion.VER_15_4,
}),
instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.MICRO),
credentials: rds.Credentials.fromSecret(dbSecret),
vpc,
multiAz: true,
backupRetention: cdk.Duration.days(7),
deletionProtection: true,
monitoringInterval: cdk.Duration.seconds(60),
enablePerformanceInsights: true,
performanceInsightRetention: rds.PerformanceInsightRetention.DEFAULT,
});
// Lambda function for custom rotation logic
const rotationFunction = new lambda.Function(this, 'RotationFunction', {
runtime: lambda.Runtime.PYTHON_3_11,
handler: 'lambda_function.lambda_handler',
code: lambda.Code.fromAsset('lambda/rotation'),
timeout: cdk.Duration.minutes(5),
environment: {
SECRETS_MANAGER_ENDPOINT: `https://secretsmanager.${this.region}.amazonaws.com`,
},
});
// Automatic rotation configuration
new secretsmanager.RotationSchedule(this, 'RotationSchedule', {
secret: dbSecret,
rotationLambda: rotationFunction,
automaticallyAfter: cdk.Duration.days(30),
});
// Grant permissions for rotation
dbSecret.grantRead(rotationFunction);
dbSecret.grantWrite(rotationFunction);
database.grantConnect(rotationFunction);
```
### AWS Config Compliance Rules
```typescript
import * as config from 'aws-cdk-lib/aws-config';
import * as iam from 'aws-cdk-lib/aws-iam';
export class ComplianceStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
// Config Service Role
const configRole = new iam.Role(this, 'ConfigServiceRole', {
assumedBy: new iam.ServicePrincipal('config.amazonaws.com'),
managedPolicies: [
iam.ManagedPolicy.fromAwsManagedPolicyName('service-role/ConfigRole'),
],
});
// Configuration Recorder
const configRecorder = new config.ConfigurationRecorder(this, 'Recorder', {
role: configRole,
recordingGroup: {
allSupported: true,
includeGlobalResourceTypes: true,
recordingModeOverrides: [
{
resourceTypes: ['AWS::EC2::Instance'],
recordingFrequency: config.RecordingFrequency.DAILY,
},
],
},
});
// Delivery Channel
const configBucket = new s3.Bucket(this, 'ConfigBucket', {
encryption: s3.BucketEncryption.S3_MANAGED,
blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
versioned: true,
lifecycleRules: [
{
id: 'delete-old-versions',
expiration: cdk.Duration.days(2555), // 7 years
noncurrentVersionExpiration: cdk.Duration.days(365),
},
],
});
new config.DeliveryChannel(this, 'DeliveryChannel', {
s3Bucket: configBucket,
configSnapshotDeliveryProperties: {
deliveryFrequency: config.MaximumExecutionFrequency.TWENTY_FOUR_HOURS,
},
});
// Compliance Rules
const complianceRules = [
{
ruleName: 'ec2-security-group-attached-to-eni',
source: config.RuleSource.fromAws('EC2_SECURITY_GROUP_ATTACHED_TO_ENI'),
description: 'Checks if security groups are attached to ENIs',
},
{
ruleName: 's3-bucket-ssl-requests-only',
source: config.RuleSource.fromAws('S3_BUCKET_SSL_REQUESTS_ONLY'),
description: 'Checks if S3 buckets have policies requiring SSL requests',
},
{
ruleName: 'rds-storage-encrypted',
source: config.RuleSource.fromAws('RDS_STORAGE_ENCRYPTED'),
description: 'Checks if RDS instances have storage encryption enabled',
},
{
ruleName: 'cloudtrail-enabled',
source: config.RuleSource.fromAws('CLOUD_TRAIL_ENABLED'),
description: 'Checks if CloudTrail is enabled',
},
{
ruleName: 'root-mfa-enabled',
source: config.RuleSource.fromAws('ROOT_MFA_ENABLED'),
description: 'Checks if MFA is enabled for root user',
},
];
complianceRules.forEach((rule) => {
new config.ManagedRule(this, rule.ruleName, {
identifier: rule.source.sourceIdentifier,
description: rule.description,
evaluationModes: config.EvaluationMode.DETECTIVE_AND_PROACTIVE,
});
});
// Custom Config Rule with Lambda
const customRuleFunction = new lambda.Function(this, 'CustomRuleFunction', {
runtime: lambda.Runtime.PYTHON_3_11,
handler: 'index.lambda_handler',
code: lambda.Code.fromInline(`
import json
import boto3
def lambda_handler(event, context):
# Custom compliance check logic
config_client = boto3.client('config')
# Example: Check if EC2 instances have specific tags
ec2_client = boto3.client('ec2')
instances = ec2_client.describe_instances()
evaluations = []
for reservation in instances['Reservations']:
for instance in reservation['Instances']:
instance_id = instance['InstanceId']
tags = {tag['Key']: tag['Value'] for tag in instance.get('Tags', [])}
required_tags = ['Environment', 'Owner', 'CostCenter']
has_required_tags = all(tag in tags for tag in required_tags)
compliance_type = 'COMPLIANT' if has_required_tags else 'NON_COMPLIANT'
evaluations.append({
'ComplianceResourceType': 'AWS::EC2::Instance',
'ComplianceResourceId': instance_id,
'ComplianceType': compliance_type,
'OrderingTimestamp': context.aws_request_id
})
if evaluations:
config_client.put_evaluations(
Evaluations=evaluations,
ResultToken=event['resultToken']
)
return {'statusCode': 200}
`),
timeout: cdk.Duration.minutes(5),
});
// Grant Config permissions to Lambda
customRuleFunction.addToRolePolicy(
new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: ['config:PutEvaluations'],
resources: ['*'],
})
);
customRuleFunction.addToRolePolicy(
new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: ['ec2:DescribeInstances'],
resources: ['*'],
})
);
// Custom Config Rule
new config.CustomRule(this, 'EC2TaggingRule', {
lambda: customRuleFunction,
description: 'Checks if EC2 instances have required tags',
configurationChanges: true,
ruleScope: config.RuleScope.fromResource(config.ResourceType.EC2_INSTANCE),
});
}
}
```
## Machine Learning & AI Integration
### Amazon Bedrock Integration
```typescript
import * as bedrock from 'aws-cdk-lib/aws-bedrock';
import * as lambda from 'aws-cdk-lib/aws-lambda';
export class AIStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
// Lambda function using Bedrock for text generation
const aiFunction = new lambda.Function(this, 'AIFunction', {
runtime: lambda.Runtime.PYTHON_3_11,
handler: 'index.handler',
code: lambda.Code.fromInline(`
import json
import boto3
from typing import Dict, Any
bedrock_runtime = boto3.client('bedrock-runtime')
def handler(event: Dict[str, Any], context) -> Dict[str, Any]:
try:
# Extract prompt from event
prompt = event.get('prompt', '')
model_id = event.get('model_id', 'anthropic.claude-3-sonnet-20240229-v1:0')
# Prepare request for Bedrock
request_body = {
"anthropic_version": "bedrock-2023-05-31",
"max_tokens": 1000,
"messages": [
{
"role": "user",
"content": prompt
}
]
}
# Call Bedrock
response = bedrock_runtime.invoke_model(
modelId=model_id,
body=json.dumps(request_body),
contentType='application/json'
)
# Parse response
response_body = json.loads(response['body'].read())
generated_text = response_body['content'][0]['text']
return {
'statusCode': 200,
'body': json.dumps({
'generated_text': generated_text,
'model_id': model_id
})
}
except Exception as e:
return {
'statusCode': 500,
'body': json.dumps({
'error': str(e)
})
}
`),
timeout: cdk.Duration.minutes(2),
environment: {
BEDROCK_REGION: this.region,
},
});
// Grant Bedrock permissions
aiFunction.addToRolePolicy(
new iam.PolicyStatement({
effect: iam.Effect.ALLOW,
actions: [
'bedrock:InvokeModel',
'bedrock:InvokeModelWithResponseStream',
],
resources: [
`arn:aws:bedrock:${this.region}::foundation-model/anthropic.claude-*`,
`arn:aws:bedrock:${this.region}::foundation-model/amazon.titan-*`,
`arn:aws:bedrock:${this.region}::foundation-model/cohere.command-*`,
],
})
);
// API Gateway for AI service
const aiApi = new apigateway.RestApi(this, 'AIApi', {
restApiName: 'AI Service API',
description: 'API for AI text generation using Bedrock',
});
const generateResource = aiApi.root.addResource('generate');
generateResource.addMethod('POST', new apigateway.LambdaIntegration(aiFunction));
}
}
```
### SageMaker Model Deployment
```typescript
import * as sagemaker from 'aws-cdk-lib/aws-sagemaker';
import * as s3 from 'aws-cdk-lib/aws-s3';
// SageMaker model deployment
const modelArtifactsBucket = new s3.Bucket(this, 'ModelArtifacts', {
encryption: s3.BucketEncryption.S3_MANAGED,
versioned: true,
});
const sagemakerRole = new iam.Role(this, 'SageMakerRole', {
assumedBy: new iam.ServicePrincipal('sagemaker.amazonaws.com'),
managedPolicies: [
iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonSageMakerFullAccess'),
],
});
const model = new sagemaker.CfnModel(this, 'MLModel', {
modelName: 'text-classification-model',
executionRoleArn: sagemakerRole.roleArn,
primaryContainer: {
image: '763104351884.dkr.ecr.us-east-1.amazonaws.com/huggingface-pytorch-inference:1.13.1-transformers4.26.0-gpu-py39-cu117-ubuntu20.04',
modelDataUrl: `s3://${modelArtifactsBucket.bucketName}/model.tar.gz`,
environment: {
'HF_MODEL_ID': 'distilbert-base-uncased-finetuned-sst-2-english',
'HF_TASK': 'text-classification',
},
},
});
const endpointConfig = new sagemaker.CfnEndpointConfig(this, 'EndpointConfig', {
endpointConfigName: 'text-classification-config',
productionVariants: [{
modelName: model.modelName!,
variantName: 'primary',
initialInstanceCount: 1,
instanceType: 'ml.m5.large',
initialVariantWeight: 1.0,
}],
});
const endpoint = new sagemaker.CfnEndpoint(this, 'MLEndpoint', {
endpointName: 'text-classification-endpoint',
endpointConfigName: endpointConfig.endpointConfigName!,
});
```
## Monitoring & Observability
### CloudWatch Dashboard with Custom Metrics
```typescript
import * as cloudwatch from 'aws-cdk-lib/aws-cloudwatch';
import * as logs from 'aws-cdk-lib/aws-logs';
export class MonitoringStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
// Custom metric namespace
const namespace = 'Custom/Application';
// CloudWatch Dashboard
const dashboard = new cloudwatch.Dashboard(this, 'ApplicationDashboard', {
dashboardName: 'production-application-metrics',
});
// Application Performance Widget
const performanceWidget = new cloudwatch.GraphWidget({
title: 'Application Performance',
left: [
new cloudwatch.Metric({
namespace,
metricName: 'ResponseTime',
statistic: 'Average',
color: cloudwatch.Color.BLUE,
}),
new cloudwatch.Metric({
namespace,
metricName: 'Throughput',
statistic: 'Sum',
color: cloudwatch.Color.GREEN,
}),
],
right: [
new cloudwatch.Metric({
namespace,
metricName: 'ErrorRate',
statistic: 'Average',
color: cloudwatch.Color.RED,
}),
],
period: cdk.Duration.minutes(5),
width: 12,
height: 6,
});
// Infrastructure Widget
const infrastructureWidget = new cloudwatch.GraphWidget({
title: 'Infrastructure Metrics',
left: [
new cloudwatch.Metric({
namespace: 'AWS/EC2',
metricName: 'CPUUtilization',
statistic: 'Average',
dimensionsMap: {
AutoScalingGroupName: 'production-asg',
},
}),
new cloudwatch.Metric({
namespace: 'AWS/ApplicationELB',
metricName: 'TargetResponseTime',
statistic: 'Average',
dimensionsMap: {
LoadBalancer: 'app/production-alb/1234567890',
},
}),
],
period: cdk.Duration.minutes(1),
width: 12,
height: 6,
});
// Database Performance Widget
const databaseWidget = new cloudwatch.GraphWidget({
title: 'Database Performance',
left: [
new cloudwatch.Metric({
namespace: 'AWS/RDS',
metricName: 'CPUUtilization',
statistic: 'Average',
dimensionsMap: {
DBInstanceIdentifier: 'production-db',
},
}),
new cloudwatch.Metric({
namespace: 'AWS/RDS',
metricName: 'DatabaseConnections',
statistic: 'Average',
dimensionsMap: {
DBInstanceIdentifier: 'production-db',
},
}),
],
right: [
new cloudwatch.Metric({
namespace: 'AWS/RDS',
metricName: 'ReadLatency',
statistic: 'Average',
dimensionsMap: {
DBInstanceIdentifier: 'production-db',
},
}),
new cloudwatch.Metric({
namespace: 'AWS/RDS',
metricName: 'WriteLatency',
statistic: 'Average',
dimensionsMap: {
DBInstanceIdentifier: 'production-db',
},
}),
],
period: cdk.Duration.minutes(1),
width: 12,
height: 6,
});
// Add widgets to dashboard
dashboard.addWidgets(performanceWidget);
dashboard.addWidgets(infrastructureWidget);
dashboard.addWidgets(databaseWidget);
// CloudWatch Alarms
const highErrorRateAlarm = new cloudwatch.Alarm(this, 'HighErrorRate', {
metric: new cloudwatch.Metric({
namespace,
metricName: 'ErrorRate',
statistic: 'Average',
}),
threshold: 5,
evaluationPeriods: 3,
treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
alarmDescription: 'High error rate detected',
});
const highLatencyAlarm = new cloudwatch.Alarm(this, 'HighLatency', {
metric: new cloudwatch.Metric({
namespace: 'AWS/ApplicationELB',
metricName: 'TargetResponseTime',
statistic: 'Average',
}),
threshold: 2,
evaluationPeriods: 2,
comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
alarmDescription: 'High response time detected',
});
// SNS Topic for notifications
const alertTopic = new sns.Topic(this, 'AlertTopic', {
displayName: 'Production Alerts',
});
// Add email subscription
alertTopic.addSubscription(
new snsSubscriptions.EmailSubscription('admin@company.com')
);
// Connect alarms to SNS
highErrorRateAlarm.addAlarmAction(new cloudwatchActions.SnsAction(alertTopic));
highLatencyAlarm.addAlarmAction(new cloudwatchActions.SnsAction(alertTopic));
// Log Groups with retention
const appLogGroup = new logs.LogGroup(this, 'ApplicationLogs', {
logGroupName: '/aws/application/production',
retention: logs.RetentionDays.ONE_MONTH,
});
// Metric Filter for custom metrics
new logs.MetricFilter(this, 'ErrorMetricFilter', {
logGroup: appLogGroup,
metricNamespace: namespace,
metricName: 'ErrorCount',
filterPattern: logs.FilterPattern.stringValue('$.level', '=', 'ERROR'),
metricValue: '1',
defaultValue: 0,
});
}
}
```
## DevOps & CI/CD Excellence
### CodePipeline with Blue/Green Deployment
```typescript
import * as codepipeline from 'aws-cdk-lib/aws-codepipeline';
import * as codepipelineActions from 'aws-cdk-lib/aws-codepipeline-actions';
import * as codebuild from 'aws-cdk-lib/aws-codebuild';
import * as codedeploy from 'aws-cdk-lib/aws-codedeploy';
export class CICDStack extends cdk.Stack {
constructor(scope: Construct, id: string, props?: cdk.StackProps) {
super(scope, id, props);
// Source artifact
const sourceArtifact = new codepipeline.Artifact('Source');
const buildArtifact = new codepipeline.Artifact('Build');
// CodeBuild project
const buildProject = new codebuild.Project(this, 'BuildProject', {
projectName: 'production-build',
source: codebuild.Source.gitHub({
owner: 'company',
repo: 'application',
webhook: true,
webhookFilters: [
codebuild.FilterGroup.inEventOf(codebuild.EventAction.PUSH).andBranchIs('main'),
codebuild.FilterGroup.inEventOf(codebuild.EventAction.PULL_REQUEST_CREATED,
codebuild.EventAction.PULL_REQUEST_UPDATED),
],
}),
environment: {
buildImage: codebuild.LinuxBuildImage.AMAZON_LINUX_2_4,
computeType: codebuild.ComputeType.MEDIUM,
privileged: true, // Required for Docker builds
environmentVariables: {
AWS_DEFAULT_REGION: { value: this.region },
AWS_ACCOUNT_ID: { value: this.account },
IMAGE_REPO_NAME: { value: 'production-app' },
IMAGE_TAG: { value: 'latest' },
},
},
buildSpec: codebuild.BuildSpec.fromObject({
version: '0.2',
phases: {
pre_build: {
commands: [
'echo Logging in to Amazon ECR...',
'aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com',
'REPOSITORY_URI=$AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGE_REPO_NAME',
'COMMIT_HASH=$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | cut -c 1-7)',
'IMAGE_TAG=${COMMIT_HASH:=latest}',
],
},
build: {
commands: [
'echo Build started on `date`',
'echo Building the Docker image...',
'docker build -t $REPOSITORY_URI:latest .',
'docker tag $REPOSITORY_URI:latest $REPOSITORY_URI:$IMAGE_TAG',
],
},
post_build: {
commands: [
'echo Build completed on `date`',
'echo Pushing the Docker images...',
'docker push $REPOSITORY_URI:latest',
'docker push $REPOSITORY_URI:$IMAGE_TAG',
'echo Writing image definitions file...',
'printf \'[{"name":"production-container","imageUri":"%s"}]\' $REPOSITORY_URI:$IMAGE_TAG > imagedefinitions.json',
],
},
},
artifacts: {
files: [
'imagedefinitions.json',
'taskdef.json',
'appspec.yaml',
],
},
}),
});
// CodeDeploy Application
const application = new codedeploy.EcsApplication(this, 'Application', {
applicationName: 'production-application',
});
// CodeDeploy Deployment Group
const deploymentGroup = new codedeploy.EcsDeploymentGroup(this, 'DeploymentGroup', {
application,
deploymentGroupName: 'production-deployment-group',
service: ecsService, // Assume this is defined elsewhere
blueGreenDeploymentConfig: {
listener: albListener, // Assume this is defined elsewhere
testListener: testListener, // Optional test listener
deploymentTimeout: cdk.Duration.minutes(30),
terminationWaitTime: cdk.Duration.minutes(5),
},
deploymentConfig: codedeploy.EcsDeploymentConfig.CANARY_10PERCENT_5MINUTES,
autoRollback: {
failedDeployment: true,
stoppedDeployment: true,
deploymentInAlarm: true,
},
alarms: [
new cloudwatch.Alarm(this, 'DeploymentAlarm', {
metric: new cloudwatch.Metric({
namespace: 'AWS/ApplicationELB',
metricName: 'HTTPCode_Target_5XX_Count',
statistic: 'Sum',
period: cdk.Duration.minutes(1),
}),
threshold: 10,
evaluationPeriods: 2,
}),
],
});
// CodePipeline
const pipeline = new codepipeline.Pipeline(this, 'Pipeline', {
pipelineName: 'production-pipeline',
stages: [
{
stageName: 'Source',
actions: [
new codepipelineActions.GitHubSourceAction({
actionName: 'GitHub_Source',
owner: 'company',
repo: 'application',
branch: 'main',
oauthToken: cdk.SecretValue.secretsManager('github-token'),
output: sourceArtifact,
}),
],
},
{
stageName: 'Build',
actions: [
new codepipelineActions.CodeBuildAction({
actionName: 'CodeBuild',
project: buildProject,
input: sourceArtifact,
outputs: [buildArtifact],
}),
],
},
{
stageName: 'Deploy',
actions: [
new codepipelineActions.CodeDeployEcsDeployAction({
actionName: 'CodeDeploy',
deploymentGroup,
appSpecTemplateInput: buildArtifact,
taskDefinitionTemplateInput: buildArtifact,
}),
],
},
],
});
// Pipeline notifications
const notificationRule = new codestarnotifications.NotificationRule(this, 'PipelineNotification', {
source: pipeline,
events: [
'codepipeline-pipeline-pipeline-execution-failed',
'codepipeline-pipeline-pipeline-execution-succeeded',
'codepipeline-pipeline-stage-execution-failed',
],
targets: [alertTopic], // SNS topic defined elsewhere
});
}
}
```
## Cost Optimization & Well-Architected
### Cost Optimization Strategies
```typescript
// Auto Scaling with Predictive Scaling
const autoScalingGroup = new autoscaling.AutoScalingGroup(this, 'ASG', {
vpc,
instanceType: ec2.InstanceType.of(ec2.InstanceClass.T3, ec2.InstanceSize.MEDIUM),
machineImage: ec2.MachineImage.latestAmazonLinux2023(),
minCapacity: 2,
maxCapacity: 20,
desiredCapacity: 4,
healthCheck: autoscaling.HealthCheck.elb({
grace: cdk.Duration.minutes(5),
}),
updatePolicy: autoscaling.UpdatePolicy.rollingUpdate({
maxBatchSize: 2,
minInstancesInService: 2,
pauseTime: cdk.Duration.minutes(5),
}),
});
// Predictive scaling policy
autoScalingGroup.scaleOnSchedule('ScaleUpMorning', {
schedule: autoscaling.Schedule.cron({ hour: '8', minute: '0' }),
minCapacity: 6,
maxCapacity: 20,
});
autoScalingGroup.scaleOnSchedule('ScaleDownEvening', {
schedule: autoscaling.Schedule.cron({ hour: '18', minute: '0' }),
minCapacity: 2,
maxCapacity: 10,
});
// Target tracking scaling
autoScalingGroup.scaleOnCpuUtilization('CpuScaling', {
targetUtilizationPercent: 70,
scaleInCool