Advanced Deployment¶

module "stdapi_ai_integrated" {
  source  = "stdapi-ai/stdapi-ai/aws"
  version = "~> 1.0"

  name_prefix = "my-stdapi-integrated"

  # Use existing network infrastructure
  subnet_ids = [
    "subnet-0123456789abcdef0",
    "subnet-0123456789abcdef1",
    "subnet-0123456789abcdef2"
  ]
  security_group_id = "sg-0123456789abcdef0"

  # Optional: Reuse existing S3 bucket
  aws_s3_bucket = "my-existing-s3-bucket"

  # Optional: Service Discovery for private communication
  service_discovery_dns_namespace_id = "ns-xxxxx"
  service_discovery_dns_name         = "stdapi"

  # Optional: Use existing Secrets Manager secret for API key
  api_key_secretsmanager_secret = "my-api-keys"
  api_key_secretsmanager_key    = "stdapi_key"

  # Optional: Attach custom IAM policies
  ecs_task_role_policy_arns = [
    aws_iam_policy.custom_s3_access.arn,
    aws_iam_policy.api_key_secrets_access.arn
  ]

  # Monitoring
  container_insight = "enhanced"
  alarms_enabled    = true
  sns_topic_arn     = "arn:aws:sns:us-east-1:123456789012:alerts"
}

# Example: Custom IAM policy for additional S3 bucket access
data "aws_iam_policy_document" "custom_s3_access" {
  statement {
    sid    = "S3BucketAccess"
    effect = "Allow"
    actions = [
      "s3:GetObject",
      "s3:PutObject",
      "s3:DeleteObject"
    ]
    resources = ["arn:aws:s3:::my-existing-s3-bucket/*"]
  }

  statement {
    sid    = "KMSEncryptionForS3"
    effect = "Allow"
    actions = [
      "kms:Decrypt",
      "kms:GenerateDataKey"
    ]
    resources = ["arn:aws:kms:us-east-1:123456789012:key/your-s3-bucket-kms-key-id"]
    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["s3.us-east-1.amazonaws.com"]
    }
  }
}

resource "aws_iam_policy" "custom_s3_access" {
  name        = "stdapi-custom-s3-access"
  description = "Custom S3 access for stdapi.ai integration"
  policy      = data.aws_iam_policy_document.custom_s3_access.json
}

# Example: IAM policy for API key access from Secrets Manager
# Required when using api_key_secretsmanager_secret parameter
data "aws_iam_policy_document" "api_key_secrets_access" {
  statement {
    sid       = "SecretsManagerAccess"
    effect    = "Allow"
    actions   = ["secretsmanager:GetSecretValue"]
    resources = ["arn:aws:secretsmanager:us-east-1:123456789012:secret:my-api-keys-*"]
  }

  statement {
    sid       = "KMSDecryptionForSecretsManager"
    effect    = "Allow"
    actions   = ["kms:Decrypt"]
    resources = ["arn:aws:kms:us-east-1:123456789012:key/your-kms-key-id"]
    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["secretsmanager.us-east-1.amazonaws.com"]
    }
  }
}

resource "aws_iam_policy" "api_key_secrets_access" {
  name        = "stdapi-api-key-secrets-access"
  description = "Access to Secrets Manager for stdapi.ai API key"
  policy      = data.aws_iam_policy_document.api_key_secrets_access.json
}

# Alternative: IAM policy for API key access from SSM Parameter Store
# Use this when using api_key_ssm_parameter instead of Secrets Manager
data "aws_iam_policy_document" "api_key_ssm_access" {
  statement {
    sid       = "SSMParameterAccess"
    effect    = "Allow"
    actions   = ["ssm:GetParameter"]
    resources = ["arn:aws:ssm:us-east-1:123456789012:parameter/stdapi/api-key"]
  }

  statement {
    sid       = "KMSDecryptionForSSM"
    effect    = "Allow"
    actions   = ["kms:Decrypt"]
    resources = ["arn:aws:kms:us-east-1:123456789012:key/your-kms-key-id"]
    condition {
      test     = "StringEquals"
      variable = "kms:ViaService"
      values   = ["ssm.us-east-1.amazonaws.com"]
    }
  }
}

resource "aws_iam_policy" "api_key_ssm_access" {
  name        = "stdapi-api-key-ssm-access"
  description = "Access to SSM Parameter Store for stdapi.ai API key"
  policy      = data.aws_iam_policy_document.api_key_ssm_access.json
}

# Outputs for integration
output "ecs_service_info" {
  description = "ECS service details for connecting your resources"
  value       = {
    cluster_name      = module.stdapi_ai_integrated.ecs_cluster_name
    service_name      = module.stdapi_ai_integrated.ecs_service_name
    security_group_id = module.stdapi_ai_integrated.security_group_id
    port              = module.stdapi_ai_integrated.port
    service_discovery = module.stdapi_ai_integrated.service_discovery_service_name
  }
}

output "integration_resources" {
  description = "Resources for connecting stdapi.ai to your infrastructure"
  value       = {
    s3_bucket_id = module.stdapi_ai_integrated.bucket_id
    kms_key_arn  = module.stdapi_ai_integrated.kms_key_arn
    log_groups   = module.stdapi_ai_integrated.cloudwatch_log_groups_names
  }
}

# Main deployment
module "stdapi_ai" {
  source  = "stdapi-ai/stdapi-ai/aws"
  version = "~> 1.0"

  # Custom public domain with TLS
  alb_domain_name   = "api.example.com"
  alb_enabled       = true
  alb_public        = true

  # AWS Bedrock region configuration
  # Select regions to get available models in the order of preference
  aws_bedrock_regions = [
    "eu-west-3",
    "eu-west-1",
    "eu-central-1",
    "eu-north-1"
  ]

  # Regional buckets for Bedrock multimodal operations
  # Required by some models and features, create one per extra region in aws_bedrock_regions
  aws_s3_regional_buckets = merge(
    module.bedrock_bucket_eu_west_1.regional_bucket_map,
    module.bedrock_bucket_eu_central_1.regional_bucket_map,
    module.bedrock_bucket_eu_north_1.regional_bucket_map,
  )
  aws_s3_buckets_kms_keys_arns = [
    module.bedrock_bucket_eu_west_1.kms_key_arn,
    module.bedrock_bucket_eu_central_1.kms_key_arn,
    module.bedrock_bucket_eu_north_1.kms_key_arn,
  ]

  # (Optional) In case of regional compliance requirements like GDPR,
  # disable "global" cross-region inference to ensure everything is done in valid regions.
  # Cross-region inference allows AWS Bedrock to route requests to different regions for better availability.
  # In this example, cross-region inferences will be in EU regions only and comply with GDPR
  aws_bedrock_cross_region_inference_global = false

  # AI services region extra configuration
  # Required if a service or a feature is not available in your main region
  # In this example, AWS Comprehend is not available on eu-west-3, so we use eu-west-1
  aws_comprehend_region = "eu-west-1"

  # Authentication (Recommended)
  # Enable authentication by generating an API key that can be retrieved using the "api_key" module attribute.
  api_key_create = true

  # Web Application Firewall (Recommended on public APIs when ALB is enabled)
  alb_waf_enabled             = true
  alb_waf_rate_limit          = 2000  # Requests per 5 minutes per IP
  alb_waf_block_anonymous_ips = true

  # Monitoring & Alerts (Recommended to get alarms notifications)
  alarms_enabled = true
  sns_topic_arn  = "arn:aws:sns:eu-west-3:123456789012:alerts"
}

# Get the API key (Generated with api_key_create = true)

output "api_key" {
  value     = module.stdapi_ai.api_key
  sensitive = true
}

# Main/default region provider
provider "aws" {
  region = "eu-west-3"
}

# Additional providers for regional Bedrock buckets

provider "aws" {
  alias  = "eu-central-1"
  region = "eu-central-1"
}

provider "aws" {
  alias  = "eu-west-1"
  region = "eu-west-1"
}

provider "aws" {
  alias  = "eu-north-1"
  region = "eu-north-1"
}

# Regional S3 buckets for Bedrock operations (optional but recommended)
module "bedrock_bucket_eu_west_1" {
  source  = "stdapi-ai/stdapi-ai-s3-regional-bucket/aws"
  version = "~> 1.0"

  providers = { aws = aws.eu-west-1 }
  name_prefix = module.stdapi_ai.name_prefix
  aws_s3_tmp_prefix = module.stdapi_ai.aws_s3_tmp_prefix
  deletion_protection = module.stdapi_ai.deletion_protection
}

module "bedrock_bucket_eu_central_1" {
  source  = "stdapi-ai/stdapi-ai-s3-regional-bucket/aws"
  version = "~> 1.0"

  providers = { aws = aws.eu-central-1 }
  name_prefix = module.stdapi_ai.name_prefix
  aws_s3_tmp_prefix = module.stdapi_ai.aws_s3_tmp_prefix
  deletion_protection = module.stdapi_ai.deletion_protection
}

module "bedrock_bucket_eu_north_1" {
  source  = "stdapi-ai/stdapi-ai-s3-regional-bucket/aws"
  version = "~> 1.0"

  providers = { aws = aws.eu-north-1 }
  name_prefix = module.stdapi_ai.name_prefix
  aws_s3_tmp_prefix = module.stdapi_ai.aws_s3_tmp_prefix
  deletion_protection = module.stdapi_ai.deletion_protection
}

module "stdapi_ai" {
  source  = "stdapi-ai/stdapi-ai/aws"
  version = "~> 1.0"

  # HTTPS with your domain
  alb_domain_name = "api.example.com"
  alb_enabled     = true
  alb_public      = true

  # Security
  api_key_create              = true
  alb_waf_enabled             = true
  alb_waf_rate_limit          = 2000
  alb_waf_block_anonymous_ips = true

  # Monitoring
  alarms_enabled = true
  sns_topic_arn  = "arn:aws:sns:us-east-1:123456789012:alerts"
}

output "api_key" {
  value     = module.stdapi_ai.api_key
  sensitive = true
}

output "api_endpoint" {
  value = module.stdapi_ai.application_url
}

module "stdapi_ai_cost_optimized" {
  source  = "stdapi-ai/stdapi-ai/aws"
  version = "~> 1.0"

  # Aggressive Auto-scaling with Fargate spot
  autoscaling_enabled            = true
  autoscaling_min_capacity       = 1
  autoscaling_max_capacity       = 3
  autoscaling_cpu_target_percent = 85
  autoscaling_scale_in_cooldown  = 60   # Scale down quickly
  autoscaling_scale_out_cooldown = 120
  autoscaling_spot_percent       = 100  # Use 100% Spot pricing (~70% discount)

  # Schedule: Stop at 7 PM, start at 8 AM on weekdays (UTC)
  autoscaling_schedule_stop  = "cron(0 19 ? * MON-FRI *)"
  autoscaling_schedule_start = "cron(0 8 ? * MON-FRI *)"

  # Use Existing Subnets and security group (no VPC creation)
  subnet_ids = [
    "subnet-0123456789abcdef0",  # Your existing private subnet 1
    "subnet-0123456789abcdef1",  # Your existing private subnet 2
    "subnet-0123456789abcdef2"   # Your existing private subnet 3
  ]
  security_group_id = "sg-0123456789abcdef0"

  # Minimal Monitoring & Logging
  container_insight                 = "disabled"  # Disable Container Insights
  vpc_flow_log_enabled              = false       # Disable VPC Flow Logs
  cloudwatch_logs_retention_in_days = 7           # Reduce log retention to 7 days
}