Cloud Architecture & Multi-Cloud Strategy

cloud_services:
  compute:
    aws: ec2, lambda, fargate
    azure: virtual_machines, functions, container_instances
    gcp: compute_engine, cloud_functions, cloud_run
  
  storage:
    aws: s3, ebs, efs
    azure: blob_storage, managed_disks, files
    gcp: cloud_storage, persistent_disk, filestore
  
  databases:
    aws: rds, dynamodb, aurora
    azure: sql_database, cosmosdb, postgresql
    gcp: cloud_sql, firestore, spanner
  
  networking:
    aws: vpc, cloudfront, route53
    azure: vnet, cdn, dns
    gcp: vpc, cdn, cloud_dns
  
  messaging:
    aws: sqs, sns, kinesis
    azure: service_bus, event_hubs, event_grid
    gcp: pub_sub, cloud_tasks

class MultiCloudDeployer:
    def __init__(self):
        self.providers = {
            'aws': AWSProvider(),
            'azure': AzureProvider(),
            'gcp': GCPProvider()
        }
        self.deployment_config = self.load_deployment_config()
    
    def deploy_application(self, app_config):
        """Deploy application across multiple cloud providers"""
        deployment_results = {}
        
        for region_config in app_config['regions']:
            provider = region_config['provider']
            region = region_config['region']
            
            try:
                # Deploy infrastructure
                infrastructure = self.deploy_infrastructure(provider, region, app_config)
                
                # Deploy application
                application = self.deploy_app(provider, region, app_config, infrastructure)
                
                # Configure networking
                networking = self.configure_networking(provider, region, infrastructure)
                
                deployment_results[f"{provider}-{region}"] = {
                    'status': 'success',
                    'infrastructure': infrastructure,
                    'application': application,
                    'networking': networking
                }
                
            except Exception as e:
                deployment_results[f"{provider}-{region}"] = {
                    'status': 'failed',
                    'error': str(e)
                }
        
        return deployment_results
    
    def configure_cross_cloud_networking(self, deployments):
        """Configure networking between cloud providers"""
        # Set up VPN connections or private peering
        for provider1, provider2 in itertools.combinations(self.providers.keys(), 2):
            if provider1 in deployments and provider2 in deployments:
                self.setup_inter_cloud_connection(provider1, provider2)

# Cluster configuration for different environments
clusters:
  development:
    provider: gcp
    region: us-central1
    node_pools:
      - name: default
        machine_type: n1-standard-2
        initial_node_count: 2
        autoscaling:
          min_nodes: 1
          max_nodes: 5
  
  staging:
    provider: aws
    region: us-west-2
    node_groups:
      - name: staging-nodes
        instance_type: m5.large
        desired_capacity: 2
        min_size: 1
        max_size: 5
  
  production:
    provider: azure
    region: eastus
    node_pools:
      - name: production
        vm_size: Standard_D4s_v3
        node_count: 5
        autoscaling:
          min_nodes: 3
          max_nodes: 20

# Istio service mesh configuration
apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: control-plane
spec:
  components:
    pilot:
      k8s:
        resources:
          requests:
            cpu: 500m
            memory: 2048Mi
    ingressGateways:
    - name: istio-ingressgateway
      enabled: true
      k8s:
        service:
          type: LoadBalancer
          ports:
          - port: 80
            targetPort: 8080
            name: http2
          - port: 443
            targetPort: 8443
            name: https
  values:
    global:
      meshID: mesh1
      multiCluster:
        clusterName: production-cluster
      network: network1

class ContainerSecurityScanner:
    def __init__(self):
        self.scanners = {
            'vulnerability': VulnerabilityScanner(),
            'compliance': ComplianceScanner(),
            'secrets': SecretsScanner()
        }
    
    def scan_image(self, image_name, image_tag):
        """Comprehensive container image security scan"""
        scan_results = {}
        
        # Vulnerability scanning
        vulnerabilities = self.scanners['vulnerability'].scan(image_name, image_tag)
        scan_results['vulnerabilities'] = vulnerabilities
        
        # Compliance checks
        compliance_issues = self.scanners['compliance'].check_compliance(image_name, image_tag)
        scan_results['compliance'] = compliance_issues
        
        # Secrets detection
        secrets = self.scanners['secrets'].detect_secrets(image_name, image_tag)
        scan_results['secrets'] = secrets
        
        # Generate security report
        security_score = self.calculate_security_score(scan_results)
        scan_results['security_score'] = security_score
        scan_results['recommendation'] = self.get_security_recommendation(security_score)
        
        return scan_results
    
    def generate_security_policy(self, scan_results):
        """Generate Kubernetes security policies based on scan results"""
        policies = {
            'network_policy': self.create_network_policy(),
            'pod_security_policy': self.create_pod_security_policy(scan_results),
            'rbac': self.create_rbac_policy()
        }
        
        return policies

# AWS Lambda with event triggers
import json
import boto3
from datetime import datetime

def lambda_handler(event, context):
    """Event-driven Lambda function for order processing"""
    
    # Parse event data
    if 'Records' in event:
        # S3 or SQS trigger
        for record in event['Records']:
            if record['eventSource'] == 'aws:s3':
                process_s3_event(record)
            elif record['eventSource'] == 'aws:sqs':
                process_sqs_message(record)
    
    elif 'detail-type' in event:
        # CloudWatch Events trigger
        if event['detail-type'] == 'Order Placed':
            process_order_event(event['detail'])
    
    return {
        'statusCode': 200,
        'body': json.dumps({
            'message': 'Event processed successfully',
            'timestamp': datetime.utcnow().isoformat()
        })
    }

def process_order_event(order_data):
    """Process order placement event"""
    # Send confirmation email
    send_email_notification(order_data['customer_email'], order_data)
    
    # Update inventory
    update_inventory(order_data['items'])
    
    # Trigger fulfillment workflow
    trigger_fulfillment(order_data['order_id'])

# Serverless application architecture
serverless_architecture = {
    'functions': {
        'order-processor': {
            'handler': 'orders.process_order',
            'events': [
                {'sqs': 'order-queue'},
                {'s3': {'bucket': 'order-uploads', 'event': 's3:ObjectCreated:*'}}
            ],
            'environment': {
                'DYNAMODB_TABLE': 'orders',
                'SES_REGION': 'us-east-1'
            }
        },
        'inventory-updater': {
            'handler': 'inventory.update_inventory',
            'events': [{'stream': 'orders-dynamodb-stream'}]
        },
        'notification-sender': {
            'handler': 'notifications.send_notification',
            'events': [{'sns': 'order-notifications'}]
        }
    },
    'resources': {
        'order-queue': {'Type': 'AWS::SQS::Queue'},
        'order-notifications': {'Type': 'AWS::SNS::Topic'},
        'orders-table': {
            'Type': 'AWS::DynamoDB::Table',
            'Properties': {
                'StreamSpecification': {'StreamViewType': 'NEW_AND_OLD_IMAGES'}
            }
        }
    }
}

# OpenAPI specification for serverless API
openapi: 3.0.0
info:
  title: Serverless API
  version: 1.0.0

paths:
  /orders:
    post:
      summary: Create new order
      x-amazon-apigateway-integration:
        type: aws_proxy
        httpMethod: POST
        uri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:createOrder/invocations
      responses:
        '200':
          description: Order created successfully
        '400':
          description: Invalid request
    
    get:
      summary: List orders
      parameters:
        - name: limit
          in: query
          schema:
            type: integer
            minimum: 1
            maximum: 100
      x-amazon-apigateway-integration:
        type: aws_proxy
        httpMethod: POST
        uri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:listOrders/invocations
  
  /orders/{orderId}:
    get:
      summary: Get order by ID
      parameters:
        - name: orderId
          in: path
          required: true
          schema:
            type: string
      x-amazon-apigateway-integration:
        type: aws_proxy
        httpMethod: POST
        uri: arn:aws:apigateway:us-east-1:lambda:path/2015-03-31/functions/arn:aws:lambda:us-east-1:123456789012:function:getOrder/invocations

import json
import boto3
from functools import lru_cache
import os

# Global variables for connection reuse
dynamodb = None
s3_client = None

def lambda_handler(event, context):
    """Optimized Lambda function with connection reuse"""
    global dynamodb, s3_client
    
    # Initialize connections outside handler for reuse
    if dynamodb is None:
        dynamodb = boto3.resource('dynamodb')
    
    if s3_client is None:
        s3_client = boto3.client('s3')
    
    # Use cached configuration
    config = get_cached_config()
    
    # Process request
    result = process_request(event, config)
    
    return {
        'statusCode': 200,
        'headers': {
            'Content-Type': 'application/json',
            'Cache-Control': 'max-age=300'
        },
        'body': json.dumps(result)
    }

@lru_cache(maxsize=128)
def get_cached_config():
    """Cache configuration to avoid repeated lookups"""
    return {
        'table_name': os.environ.get('DYNAMODB_TABLE'),
        'bucket_name': os.environ.get('S3_BUCKET'),
        'api_endpoint': os.environ.get('API_ENDPOINT')
    }

# Provisioned concurrency configuration
provisioned_concurrency = {
    'production': {
        'allocated_concurrency': 50,
        'schedule': [
            {
                'time': '08:00',
                'concurrency': 100  # Scale up during business hours
            },
            {
                'time': '18:00',
                'concurrency': 25   # Scale down after hours
            }
        ]
    }
}

# Multi-cloud Terraform configuration
terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
    google = {
      source  = "hashicorp/google"
      version = "~> 4.0"
    }
  }
  
  backend "s3" {
    bucket         = "terraform-state-bucket"
    key            = "global/terraform.tfstate"
    region         = "us-east-1"
    encrypt        = true
    dynamodb_table = "terraform-locks"
  }
}

# AWS Provider
provider "aws" {
  region = var.aws_region
  default_tags {
    tags = {
      Environment = var.environment
      Project     = var.project_name
      ManagedBy   = "Terraform"
    }
  }
}

# Azure Provider
provider "azurerm" {
  features {}
  subscription_id = var.azure_subscription_id
}

# Google Cloud Provider
provider "google" {
  project = var.gcp_project_id
  region  = var.gcp_region
}

# Kubernetes cluster module
module "kubernetes_cluster" {
  source = "./modules/kubernetes"
  
  for_each = var.clusters
  
  cluster_name     = each.key
  cloud_provider   = each.value.provider
  region          = each.value.region
  node_count      = each.value.node_count
  machine_type    = each.value.machine_type
  
  # Network configuration
  vpc_cidr        = each.value.vpc_cidr
  subnet_cidrs    = each.value.subnet_cidrs
  
  # Security configuration
  enable_network_policy = true
  enable_pod_security   = true
  
  # Monitoring and logging
  enable_monitoring = true
  enable_logging    = true
  
  tags = merge(
    local.common_tags,
    {
      Cluster = each.key
      Type    = "kubernetes"
    }
  )
}

# Load balancer module
module "load_balancer" {
  source = "./modules/load-balancer"
  
  for_each = var.load_balancers
  
  name            = each.key
  cloud_provider  = each.value.provider
  type           = each.value.type  # application, network
  scheme         = each.value.scheme # internet-facing, internal
  
  # Target configuration
  targets = each.value.targets
  
  # Health check configuration
  health_check = {
    enabled             = true
    healthy_threshold   = 2
    unhealthy_threshold = 2
    timeout            = 5
    interval           = 30
    path               = "/health"
    port               = "traffic-port"
    protocol           = "HTTP"
  }
  
  # SSL configuration
  ssl_policy      = each.value.ssl_policy
  certificate_arn = each.value.certificate_arn
  
  tags = merge(
    local.common_tags,
    {
      LoadBalancer = each.key
      Type        = "load-balancer"
    }
  )
}

# GitHub Actions workflow for Terraform
name: Infrastructure Deployment

on:
  push:
    branches: [main]
    paths: ['infrastructure/**']
  pull_request:
    branches: [main]
    paths: ['infrastructure/**']

jobs:
  terraform:
    runs-on: ubuntu-latest
    
    steps:
    - name: Checkout code
      uses: actions/checkout@v3
    
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2
      with:
        terraform_version: 1.6.0
    
    - name: Configure AWS credentials
      uses: aws-actions/configure-aws-credentials@v2
      with:
        aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
        aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        aws-region: us-east-1
    
    - name: Configure Azure credentials
      uses: azure/login@v1
      with:
        creds: ${{ secrets.AZURE_CREDENTIALS }}
    
    - name: Configure GCP credentials
      uses: google-github-actions/auth@v1
      with:
        credentials_json: ${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}
    
    - name: Terraform Init
      run: terraform init
      working-directory: infrastructure
    
    - name: Terraform Format Check
      run: terraform fmt -check
      working-directory: infrastructure
    
    - name: Terraform Validate
      run: terraform validate
      working-directory: infrastructure
    
    - name: Terraform Plan
      run: terraform plan -out=tfplan
      working-directory: infrastructure
      env:
        TF_VAR_environment: ${{ github.ref_name == 'main' && 'production' || 'staging' }}
    
    - name: Terraform Apply
      if: github.ref == 'refs/heads/main' && github.event_name == 'push'
      run: terraform apply -auto-approve tfplan
      working-directory: infrastructure

class ZeroTrustAccessControl:
    def __init__(self, identity_provider, policy_engine):
        self.identity_provider = identity_provider
        self.policy_engine = policy_engine
        self.risk_engine = RiskAssessmentEngine()
    
    def evaluate_access_request(self, request):
        """Evaluate access request using zero trust principles"""
        
        # 1. Verify identity
        identity_verification = self.verify_identity(request.user)
        if not identity_verification.verified:
            return AccessDecision(denied=True, reason="Identity verification failed")
        
        # 2. Assess device trust
        device_assessment = self.assess_device_trust(request.device)
        
        # 3. Evaluate network location
        network_assessment = self.assess_network_location(request.network_info)
        
        # 4. Check behavioral patterns
        behavioral_assessment = self.analyze_behavior(request.user, request.access_pattern)
        
        # 5. Risk-based decision
        risk_score = self.risk_engine.calculate_risk({
            'identity': identity_verification,
            'device': device_assessment,
            'network': network_assessment,
            'behavior': behavioral_assessment
        })
        
        # 6. Policy evaluation
        policy_decision = self.policy_engine.evaluate_policies(
            user=request.user,
            resource=request.resource,
            action=request.action,
            context={
                'risk_score': risk_score,
                'device_trust': device_assessment.trust_level,
                'network_trust': network_assessment.trust_level
            }
        )
        
        # 7. Make final decision
        if policy_decision.allow and risk_score < 70:  # Risk threshold
            return AccessDecision(
                granted=True,
                conditions=self.determine_access_conditions(risk_score),
                monitoring=True
            )
        else:
            return AccessDecision(
                denied=True,
                reason=policy_decision.denial_reason or "High risk score",
                alternative_auth=risk_score < 90  # Allow MFA challenge
            )

# Network segmentation with micro-segmentation
network_security:
  vpc_configuration:
    public_subnets:
      - cidr: "10.0.1.0/24"
        purpose: "Internet-facing load balancers"
        nacl_rules:
          - rule_number: 100
            protocol: tcp
            rule_action: allow
            port_range: {from: 80, to: 80}
          - rule_number: 110
            protocol: tcp
            rule_action: allow
            port_range: {from: 443, to: 443}
    
    private_subnets:
      - cidr: "10.0.2.0/24"
        purpose: "Application servers"
      - cidr: "10.0.3.0/24"
        purpose: "Database servers"
    
    isolated_subnets:
      - cidr: "10.0.4.0/24"
        purpose: "Security tools and monitoring"
  
  security_groups:
    web_tier:
      ingress:
        - from_port: 80
          to_port: 80
          protocol: tcp
          source_security_group_id: "${aws_security_group.alb.id}"
        - from_port: 443
          to_port: 443
          protocol: tcp
          source_security_group_id: "${aws_security_group.alb.id}"
    
    app_tier:
      ingress:
        - from_port: 8080
          to_port: 8080
          protocol: tcp
          source_security_group_id: "${aws_security_group.web_tier.id}"
    
    data_tier:
      ingress:
        - from_port: 3306
          to_port: 3306
          protocol: tcp
          source_security_group_id: "${aws_security_group.app_tier.id}"

class ComplianceMonitor:
    def __init__(self, compliance_frameworks):
        self.frameworks = compliance_frameworks  # SOC2, ISO27001, GDPR, etc.
        self.config_rules = self.load_compliance_rules()
        self.remediation_engine = RemediationEngine()
    
    def assess_compliance(self, cloud_resources):
        """Assess compliance across all cloud resources"""
        compliance_results = {}
        
        for framework in self.frameworks:
            framework_results = {
                'compliant_resources': 0,
                'non_compliant_resources': 0,
                'violations': [],
                'recommendations': []
            }
            
            for resource in cloud_resources:
                resource_compliance = self.check_resource_compliance(
                    resource, framework
                )
                
                if resource_compliance.compliant:
                    framework_results['compliant_resources'] += 1
                else:
                    framework_results['non_compliant_resources'] += 1
                    framework_results['violations'].extend(resource_compliance.violations)
                    framework_results['recommendations'].extend(resource_compliance.recommendations)
            
            compliance_results[framework] = framework_results
        
        return compliance_results
    
    def automated_remediation(self, violations):
        """Automatically remediate compliance violations where possible"""
        remediation_results = []
        
        for violation in violations:
            if violation.auto_remediable:
                try:
                    self.remediation_engine.remediate(violation)
                    remediation_results.append({
                        'violation_id': violation.id,
                        'status': 'remediated',
                        'action_taken': violation.remediation_action
                    })
                except Exception as e:
                    remediation_results.append({
                        'violation_id': violation.id,
                        'status': 'failed',
                        'error': str(e)
                    })
            else:
                # Create ticket for manual remediation
                ticket_id = self.create_remediation_ticket(violation)
                remediation_results.append({
                    'violation_id': violation.id,
                    'status': 'manual_intervention_required',
                    'ticket_id': ticket_id
                })
        
        return remediation_results

class CloudCostOptimizer:
    def __init__(self, cloud_providers):
        self.providers = cloud_providers
        self.cost_analyzer = CostAnalyzer()
        self.rightsizing_engine = RightSizingEngine()
    
    def analyze_cost_optimization_opportunities(self):
        """Identify cost optimization opportunities across cloud resources"""
        optimization_opportunities = {}
        
        for provider in self.providers:
            provider_opportunities = {
                'compute': self.analyze_compute_costs(provider),
                'storage': self.analyze_storage_costs(provider),
                'networking': self.analyze_networking_costs(provider),
                'databases': self.analyze_database_costs(provider),
                'reserved_instances': self.analyze_reservation_opportunities(provider)
            }
            
            optimization_opportunities[provider.name] = provider_opportunities
        
        return optimization_opportunities
    
    def rightsizing_recommendations(self, compute_resources):
        """Generate right-sizing recommendations for compute resources"""
        recommendations = []
        
        for resource in compute_resources:
            # Analyze utilization metrics
            utilization = self.get_utilization_metrics(resource, days=30)
            
            # CPU utilization analysis
            avg_cpu = utilization['cpu']['average']
            max_cpu = utilization['cpu']['maximum']
            
            # Memory utilization analysis
            avg_memory = utilization['memory']['average']
            max_memory = utilization['memory']['maximum']
            
            # Network utilization analysis
            avg_network = utilization['network']['average']
            
            # Generate recommendation
            if avg_cpu < 20 and max_cpu < 40:
                # Under-utilized - recommend smaller instance
                recommended_instance = self.get_smaller_instance_type(resource.instance_type)
                potential_savings = self.calculate_savings(resource.instance_type, recommended_instance)
                
                recommendations.append({
                    'resource_id': resource.id,
                    'current_type': resource.instance_type,
                    'recommended_type': recommended_instance,
                    'reason': 'Under-utilized CPU',
                    'potential_monthly_savings': potential_savings,
                    'risk_level': 'low' if max_cpu < 30 else 'medium'
                })
            
            elif avg_cpu > 80 or max_cpu > 95:
                # Over-utilized - recommend larger instance
                recommended_instance = self.get_larger_instance_type(resource.instance_type)
                
                recommendations.append({
                    'resource_id': resource.id,
                    'current_type': resource.instance_type,
                    'recommended_type': recommended_instance,
                    'reason': 'Over-utilized CPU - performance risk',
                    'potential_monthly_cost_increase': self.calculate_cost_increase(resource.instance_type, recommended_instance),
                    'risk_level': 'high',
                    'priority': 'immediate' if max_cpu > 95 else 'high'
                })
        
        return recommendations
    
    def spot_instance_opportunities(self, workloads):
        """Identify workloads suitable for spot instances"""
        spot_opportunities = []
        
        for workload in workloads:
            if self.is_spot_suitable(workload):
                current_cost = workload.monthly_cost
                spot_cost = current_cost * 0.3  # Typical 70% savings
                
                spot_opportunities.append({
                    'workload_id': workload.id,
                    'workload_type': workload.type,
                    'fault_tolerance': workload.fault_tolerance,
                    'current_monthly_cost': current_cost,
                    'estimated_spot_cost': spot_cost,
                    'potential_savings': current_cost - spot_cost,
                    'interruption_handling': workload.interruption_strategy
                })
        
        return spot_opportunities