# AWS-Specific Examples

Production patterns for Amazon Web Services.

## EC2 Auto-Scaling Group

```nickel
{
  aws = {
    region = "us-east-1",

    asg = {
      name = "web-asg",
      min_size = 2,
      max_size = 10,
      desired_capacity = 3,

      launch_template = {
        image_id = "ami-0c55b159cbfafe1f0",
        instance_type = "t3.large",
        key_name = "provisioning-key",
        security_groups = ["web-sg"],
        user_data = "#!/bin/bash
apt-get update
apt-get install -y nginx"
      },

      tags = [
        { key = "Name", value = "web-server", propagate = true },
        { key = "Environment", value = "production", propagate = true }
      ],

      scaling_policies = [
        {
          name = "scale-up",
          type = "TargetTrackingScaling",
          metric = "CPUUtilization",
          target_value = 70
        },
        {
          name = "scale-down",
          type = "TargetTrackingScaling",
          metric = "CPUUtilization",
          target_value = 30
        }
      ]
    }
  }
}
```

## RDS PostgreSQL Multi-AZ

```nickel
{
  aws = {
    rds = {
      identifier = "prod-postgres",
      engine = "postgres",
      engine_version = "15.2",
      instance_class = "db.r6i.2xlarge",
      allocated_storage = 1000,
      storage_type = "io2",
      iops = 10000,

      db_name = "production",
      username = "postgres",
      password = std.get_env "RDS_PASSWORD",

      multi_az = true,
      backup_retention_period = 30,
      backup_window = "03:00-04:00",
      maintenance_window = "sun:04:00-sun:05:00",

      enabled_cloudwatch_logs_exports = [
        "postgresql"
      ],

      vpc_security_group_ids = ["sg-rds"],
      db_subnet_group_name = "prod-subnet-group",

      skip_final_snapshot = false,
      final_snapshot_identifier = "prod-postgres-final-snapshot"
    }
  }
}
```

## S3 with CloudFront Distribution

```nickel
{
  aws = {
    s3 = {
      bucket = "app-static-assets",
      region = "us-east-1",
      acl = "private",

      versioning = { enabled = true },

      server_side_encryption_configuration = {
        rules = [{
          apply_server_side_encryption_by_default = {
            sse_algorithm = "AES256"
          }
        }]
      },

      lifecycle_rules = [
        {
          id = "archive-old",
          status = "Enabled",
          transitions = [
            { days = 30, storage_class = "STANDARD_IA" },
            { days = 90, storage_class = "GLACIER" }
          ]
        }
      ]
    },

    cloudfront = {
      domain_name = "d123.cloudfront.net",
      enabled = true,

      origin = {
        domain_name = "app-static-assets.s3.amazonaws.com",
        origin_path = "/assets"
      },

      default_cache_behavior = {
        allowed_methods = ["GET", "HEAD"],
        cached_methods = ["GET", "HEAD"],
        target_origin_id = "myS3Origin",
        viewer_protocol_policy = "redirect-to-https",

        forwarded_values = {
          query_string = false,
          cookies = { forward = "none" }
        },

        min_ttl = 0,
        default_ttl = 3600,
        max_ttl = 86400
      }
    }
  }
}
```

## VPC with Public and Private Subnets

```nickel
{
  aws = {
    vpc = {
      cidr_block = "10.0.0.0/16",
      enable_dns_hostnames = true,
      enable_dns_support = true,

      tags = { Name = "prod-vpc" }
    },

    subnets = [
      # Public subnets
      {
        name = "public-1a",
        vpc_id = "vpc-123",
        cidr_block = "10.0.1.0/24",
        availability_zone = "us-east-1a",
        map_public_ip_on_launch = true
      },
      {
        name = "public-1b",
        vpc_id = "vpc-123",
        cidr_block = "10.0.2.0/24",
        availability_zone = "us-east-1b",
        map_public_ip_on_launch = true
      },

      # Private subnets
      {
        name = "private-1a",
        vpc_id = "vpc-123",
        cidr_block = "10.0.11.0/24",
        availability_zone = "us-east-1a"
      },
      {
        name = "private-1b",
        vpc_id = "vpc-123",
        cidr_block = "10.0.12.0/24",
        availability_zone = "us-east-1b"
      }
    ],

    nat_gateway = {
      allocation_id = "eip-123",
      subnet_id = "subnet-public-1a"
    }
  }
}
```

## ALB with Target Groups

```nickel
{
  aws = {
    alb = {
      name = "prod-alb",
      internal = false,
      load_balancer_type = "application",
      security_groups = ["sg-alb"],
      subnets = ["subnet-public-1a", "subnet-public-1b"],

      enable_deletion_protection = true,
      enable_http2 = true,
      enable_cross_zone_load_balancing = true,

      access_logs = {
        bucket = "alb-logs",
        enabled = true
      }
    },

    target_groups = [
      {
        name = "web-tg",
        port = 80,
        protocol = "HTTP",
        vpc_id = "vpc-123",

        health_check = {
          healthy_threshold = 2,
          unhealthy_threshold = 2,
          timeout = 5,
          interval = 30,
          path = "/health",
          matcher = "200"
        }
      }
    ],

    listener = {
      load_balancer_arn = "arn:aws:...",
      port = 443,
      protocol = "HTTPS",
      ssl_policy = "ELBSecurityPolicy-TLS-1-2-2017-01",
      certificate_arn = "arn:aws:acm:...",

      default_action = {
        type = "forward",
        target_group_arn = "arn:aws:..."
      }
    }
  }
}
```

## Related Documentation

- [AWS Provider Guide](../infrastructure/provider-guides.md)
- [Multi-Cloud Examples](./multi-cloud.md)
