Aws Advisor

#!/usr/bin/env python3
"""
Architecture Validator

Validates architecture description against best practices and identifies gaps.
Usage: python architecture_validator.py
       echo "Lambda API with public S3 bucket" | python architecture_validator.py
"""

import argparse
import sys
import json
import re
from datetime import datetime

# Validation rules organized by category
VALIDATION_RULES = {
    "security": [
        {
            "id": "SEC-001",
            "name": "Public S3 Warning",
            "pattern": r"public\s+s3|s3\s+public|public\s+bucket",
            "severity": "HIGH",
            "message": "Public S3 buckets detected. Ensure Block Public Access is intentionally disabled and bucket policy is restrictive.",
            "recommendation": "Use CloudFront with OAI/OAC for public content distribution instead of public buckets."
        },
        {
            "id": "SEC-002",
            "name": "Missing Authentication",
            "pattern": r"(api|endpoint|gateway)(?!.*(cognito|iam|auth|jwt|oauth|authorizer))",
            "severity": "HIGH",
            "message": "API mentioned without authentication mechanism.",
            "recommendation": "Specify authentication: Cognito, IAM, Lambda Authorizer, or API Keys."
        },
        {
            "id": "SEC-003",
            "name": "Database in Public Subnet",
            "pattern": r"(rds|database|aurora|dynamodb).*(public|internet)",
            "severity": "HIGH",
            "message": "Database may be in public subnet or publicly accessible.",
            "recommendation": "Place databases in private subnets with no public IP."
        },
        {
            "id": "SEC-004",
            "name": "Missing Encryption Mention",
            "pattern": r"^(?!.*(encrypt|kms|ssl|tls|https)).*$",
            "severity": "MEDIUM",
            "message": "No encryption mentioned in architecture.",
            "recommendation": "Explicitly define encryption at rest (KMS) and in transit (TLS)."
        },
        {
            "id": "SEC-005",
            "name": "Hardcoded Credentials Risk",
            "pattern": r"(password|secret|key|credential).*(env|environment|config|code)",
            "severity": "HIGH",
            "message": "Credentials may be hardcoded or in environment variables.",
            "recommendation": "Use AWS Secrets Manager or Parameter Store for all secrets."
        },
    ],
    "reliability": [
        {
            "id": "REL-001",
            "name": "Single AZ Deployment",
            "pattern": r"single\s+az|one\s+az|1\s+az",
            "severity": "HIGH",
            "message": "Single AZ deployment detected. Risk of availability zone failure.",
            "recommendation": "Deploy across multiple AZs for production workloads."
        },
        {
            "id": "REL-002",
            "name": "Missing Backup Strategy",
            "pattern": r"(rds|database|dynamodb|s3)(?!.*(backup|pitr|point-in-time|versioning))",
            "severity": "MEDIUM",
            "message": "Data store mentioned without backup strategy.",
            "recommendation": "Enable automated backups, PITR, or versioning for data stores."
        },
        {
            "id": "REL-003",
            "name": "Missing Error Handling",
            "pattern": r"(lambda|function|api)(?!.*(retry|dlq|dead.letter|error|fallback))",
            "severity": "MEDIUM",
            "message": "Processing component without error handling mentioned.",
            "recommendation": "Implement retries, DLQs, and circuit breakers for resilience."
        },
        {
            "id": "REL-004",
            "name": "No Health Checks",
            "pattern": r"(ecs|ec2|fargate|alb)(?!.*(health|healthcheck|monitoring))",
            "severity": "MEDIUM",
            "message": "Compute resources without health checks mentioned.",
            "recommendation": "Configure health checks for load balancers and container orchestration."
        },
    ],
    "performance": [
        {
            "id": "PERF-001",
            "name": "Missing Caching Layer",
            "pattern": r"(api|database|rds)(?!.*(cache|redis|elasticache|cloudfront|dax))",
            "severity": "LOW",
            "message": "No caching layer mentioned. May impact performance under load.",
            "recommendation": "Consider ElastiCache, DAX, or CloudFront for caching."
        },
        {
            "id": "PERF-002",
            "name": "Potential Cold Start Impact",
            "pattern": r"lambda.*(latency|real-time|low.latency|critical)",
            "severity": "MEDIUM",
            "message": "Lambda used for latency-sensitive workload.",
            "recommendation": "Consider Provisioned Concurrency or container alternatives for latency-critical paths."
        },
        {
            "id": "PERF-003",
            "name": "Missing CDN for Static Content",
            "pattern": r"s3.*(static|website|assets|images|frontend)(?!.*cloudfront)",
            "severity": "LOW",
            "message": "Static content served from S3 without CDN.",
            "recommendation": "Use CloudFront for global distribution and reduced latency."
        },
    ],
    "cost": [
        {
            "id": "COST-001",
            "name": "NAT Gateway Usage",
            "pattern": r"nat\s+gateway|natgateway",
            "severity": "INFO",
            "message": "NAT Gateway detected. This can be expensive for high traffic.",
            "recommendation": "Consider VPC endpoints for AWS services to reduce NAT costs."
        },
        {
            "id": "COST-002",
            "name": "Provisioned Capacity Without Justification",
            "pattern": r"provisioned.*(concurrency|capacity|iops)",
            "severity": "INFO",
            "message": "Provisioned capacity mentioned. Ensure traffic patterns justify this.",
            "recommendation": "Use on-demand unless you have predictable, steady-state traffic."
        },
        {
            "id": "COST-003",
            "name": "Multi-Region Without Requirement",
            "pattern": r"multi.region|global.table|cross.region",
            "severity": "INFO",
            "message": "Multi-region architecture detected. Ensure business requirement justifies cost.",
            "recommendation": "Multi-region doubles infrastructure cost. Confirm DR/latency requirements."
        },
    ],
    "operational": [
        {
            "id": "OPS-001",
            "name": "Missing Observability",
            "pattern": r"^(?!.*(cloudwatch|x-ray|logging|monitoring|metrics|tracing|alarm)).*$",
            "severity": "MEDIUM",
            "message": "No observability components mentioned.",
            "recommendation": "Include CloudWatch, X-Ray, and alerting in architecture."
        },
        {
            "id": "OPS-002",
            "name": "Missing IaC",
            "pattern": r"^(?!.*(cdk|cloudformation|terraform|sam|serverless.framework|iac)).*$",
            "severity": "MEDIUM",
            "message": "No Infrastructure as Code mentioned.",
            "recommendation": "Use CDK, CloudFormation, or Terraform for reproducible deployments."
        },
        {
            "id": "OPS-003",
            "name": "Missing CI/CD",
            "pattern": r"^(?!.*(cicd|ci/cd|pipeline|codepipeline|github.actions|deployment)).*$",
            "severity": "LOW",
            "message": "No CI/CD pipeline mentioned.",
            "recommendation": "Include deployment pipeline in architecture for automated, safe deployments."
        },
    ],
    "completeness": [
        {
            "id": "COMP-001",
            "name": "Missing Network Architecture",
            "pattern": r"^(?!.*(vpc|subnet|security.group|network)).*$",
            "severity": "MEDIUM",
            "message": "Network architecture not specified.",
            "recommendation": "Define VPC, subnets (public/private), and security groups."
        },
        {
            "id": "COMP-002",
            "name": "Missing Data Flow",
            "pattern": r"^(?!.*(flow|connects|calls|invokes|reads|writes|stores)).*$",
            "severity": "LOW",
            "message": "Data flow between components not clear.",
            "recommendation": "Describe how data flows between components."
        },
    ],
}

def validate_architecture(text: str) -> dict:
    """Validate architecture description against rules."""
    text_lower = text.lower()
    
    results = {
        "validated_at": datetime.now().isoformat(),
        "input_length": len(text),
        "findings": [],
        "summary": {
            "HIGH": 0,
            "MEDIUM": 0,
            "LOW": 0,
            "INFO": 0
        },
        "categories_checked": list(VALIDATION_RULES.keys())
    }
    
    for category, rules in VALIDATION_RULES.items():
        for rule in rules:
            try:
                if re.search(rule["pattern"], text_lower, re.IGNORECASE | re.MULTILINE):
                    finding = {
                        "id": rule["id"],
                        "category": category,
                        "name": rule["name"],
                        "severity": rule["severity"],
                        "message": rule["message"],
                        "recommendation": rule["recommendation"]
                    }
                    results["findings"].append(finding)
                    results["summary"][rule["severity"]] += 1
            except re.error:
                pass  # Skip invalid regex
    
    # Add positive findings for good practices detected
    good_practices = []
    if re.search(r"multi.az|multiple.az", text_lower):
        good_practices.append("✅ Multi-AZ deployment mentioned")
    if re.search(r"encrypt|kms", text_lower):
        good_practices.append("✅ Encryption mentioned")
    if re.search(r"cognito|auth|iam", text_lower):
        good_practices.append("✅ Authentication mechanism mentioned")
    if re.search(r"cloudwatch|monitoring|x-ray", text_lower):
        good_practices.append("✅ Observability mentioned")
    if re.search(r"cdk|cloudformation|terraform", text_lower):
        good_practices.append("✅ Infrastructure as Code mentioned")
    if re.search(r"private.subnet|private\s+subnet", text_lower):
        good_practices.append("✅ Private subnets mentioned")
    
    results["good_practices"] = good_practices
    
    return results

def main():
    parser = argparse.ArgumentParser(description="Validate AWS Architecture Description")
    parser.add_argument("--json", action="store_true", help="Output as JSON")
    parser.add_argument("--severity", choices=["HIGH", "MEDIUM", "LOW", "INFO"], 
                        help="Filter by minimum severity")
    args = parser.parse_args()
    
    # Get description from stdin
    if not sys.stdin.isatty():
        text = sys.stdin.read().strip()
    else:
        print("Please provide architecture description via stdin.")
        print("Example: echo 'Lambda API with DynamoDB' | python architecture_validator.py")
        return
    
    results = validate_architecture(text)
    
    # Filter by severity if requested
    if args.severity:
        severity_order = ["HIGH", "MEDIUM", "LOW", "INFO"]
        min_index = severity_order.index(args.severity)
        allowed = severity_order[:min_index + 1]
        results["findings"] = [f for f in results["findings"] if f["severity"] in allowed]
    
    if args.json:
        print(json.dumps(results, indent=2))
    else:
        print(f"\n{'='*70}")
        print("ARCHITECTURE VALIDATION REPORT")
        print(f"{'='*70}")
        print(f"Validated: {results['validated_at']}")
        print(f"Findings: {len(results['findings'])} issues found")
        print(f"  HIGH: {results['summary']['HIGH']} | MEDIUM: {results['summary']['MEDIUM']} | LOW: {results['summary']['LOW']} | INFO: {results['summary']['INFO']}")
        
        if results["good_practices"]:
            print(f"\n{'='*70}")
            print("GOOD PRACTICES DETECTED")
            print(f"{'='*70}")
            for practice in results["good_practices"]:
                print(f"  {practice}")
        
        if results["findings"]:
            print(f"\n{'='*70}")
            print("FINDINGS")
            print(f"{'='*70}")
            
            for finding in sorted(results["findings"], 
                                 key=lambda x: ["HIGH", "MEDIUM", "LOW", "INFO"].index(x["severity"])):
                severity_icon = {
                    "HIGH": "🔴",
                    "MEDIUM": "🟡", 
                    "LOW": "🟢",
                    "INFO": "ℹ️"
                }[finding["severity"]]
                
                print(f"\n{severity_icon} [{finding['id']}] {finding['name']}")
                print(f"   Category: {finding['category']}")
                print(f"   Issue: {finding['message']}")
                print(f"   Recommendation: {finding['recommendation']}")
        else:
            print("\n✅ No issues found!")
        
        print(f"\n{'='*70}")
        print("Note: This is an automated check. Use aws___search_documentation for detailed guidance.")
        print(f"{'='*70}\n")

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Cost Considerations Generator

Generates a list of cost factors to evaluate for an AWS architecture.
Does NOT estimate actual costs - use AWS Pricing Calculator for that.

Usage: python cost_considerations.py --services "Lambda,DynamoDB,API Gateway"
       echo "serverless API with Lambda and DynamoDB" | python cost_considerations.py
"""

import argparse
import sys
import json
from datetime import datetime

# Cost factors by service
COST_FACTORS = {
    "Lambda": {
        "category": "Compute - Serverless",
        "pricing_model": "Pay per invocation + duration (GB-seconds)",
        "factors": [
            {"factor": "Number of invocations per month", "unit": "requests", "impact": "HIGH"},
            {"factor": "Average execution duration", "unit": "ms", "impact": "HIGH"},
            {"factor": "Memory allocated", "unit": "MB", "impact": "HIGH"},
            {"factor": "Provisioned Concurrency (if used)", "unit": "concurrent executions", "impact": "MEDIUM"},
            {"factor": "Architecture (ARM vs x86)", "unit": "type", "impact": "MEDIUM", "note": "ARM is ~20% cheaper"},
            {"factor": "Data transfer out", "unit": "GB", "impact": "LOW"},
        ],
        "free_tier": "1M requests, 400,000 GB-seconds per month",
        "optimization_tips": [
            "Use ARM/Graviton architecture for 20% cost reduction",
            "Optimize memory size (use Lambda Power Tuning)",
            "Minimize cold starts to reduce duration",
            "Use Provisioned Concurrency only when needed",
        ],
        "calculator_link": "https://calculator.aws/#/addService/Lambda"
    },
    
    "API Gateway": {
        "category": "API Management",
        "pricing_model": "Pay per request + data transfer",
        "factors": [
            {"factor": "API type (REST vs HTTP)", "unit": "type", "impact": "HIGH", "note": "HTTP API is ~70% cheaper"},
            {"factor": "Number of API calls per month", "unit": "million requests", "impact": "HIGH"},
            {"factor": "Caching enabled", "unit": "GB-hours", "impact": "MEDIUM"},
            {"factor": "WebSocket connection minutes", "unit": "minutes", "impact": "MEDIUM"},
            {"factor": "Data transfer out", "unit": "GB", "impact": "LOW"},
        ],
        "free_tier": "1M REST API calls, 1M HTTP API calls per month (12 months)",
        "optimization_tips": [
            "Use HTTP API instead of REST API when features allow",
            "Enable caching for repeated requests",
            "Use request validation to reject invalid requests early",
        ],
        "calculator_link": "https://calculator.aws/#/addService/APIGateway"
    },
    
    "DynamoDB": {
        "category": "Database - NoSQL",
        "pricing_model": "On-demand OR Provisioned capacity",
        "factors": [
            {"factor": "Capacity mode", "unit": "type", "impact": "HIGH", "note": "On-demand vs Provisioned"},
            {"factor": "Read request units (RRU/RCU)", "unit": "per million / per hour", "impact": "HIGH"},
            {"factor": "Write request units (WRU/WCU)", "unit": "per million / per hour", "impact": "HIGH"},
            {"factor": "Storage size", "unit": "GB", "impact": "MEDIUM"},
            {"factor": "Global Tables (cross-region)", "unit": "replicated writes", "impact": "HIGH"},
            {"factor": "Backup (on-demand, PITR)", "unit": "GB", "impact": "LOW"},
            {"factor": "DAX (if used)", "unit": "node-hours", "impact": "MEDIUM"},
            {"factor": "Streams (if enabled)", "unit": "read request units", "impact": "LOW"},
        ],
        "free_tier": "25 GB storage, 25 RCU, 25 WCU (always free)",
        "optimization_tips": [
            "Use On-demand for unpredictable traffic",
            "Use Provisioned + Auto-scaling for predictable traffic",
            "Consider Reserved Capacity for steady-state (up to 77% savings)",
            "Design for efficient access patterns to minimize RCU/WCU",
            "Use sparse indexes to reduce storage",
        ],
        "calculator_link": "https://calculator.aws/#/addService/DynamoDB"
    },
    
    "S3": {
        "category": "Storage - Object",
        "pricing_model": "Pay per GB stored + requests + data transfer",
        "factors": [
            {"factor": "Storage class", "unit": "type", "impact": "HIGH", "note": "Standard vs IA vs Glacier"},
            {"factor": "Data stored", "unit": "GB", "impact": "HIGH"},
            {"factor": "PUT/COPY/POST/LIST requests", "unit": "per 1,000", "impact": "MEDIUM"},
            {"factor": "GET/SELECT requests", "unit": "per 1,000", "impact": "MEDIUM"},
            {"factor": "Data transfer out", "unit": "GB", "impact": "HIGH"},
            {"factor": "S3 Transfer Acceleration", "unit": "GB transferred", "impact": "LOW"},
        ],
        "free_tier": "5 GB Standard storage, 20,000 GET, 2,000 PUT (12 months)",
        "optimization_tips": [
            "Use S3 Intelligent-Tiering for unknown access patterns",
            "Set lifecycle policies to move to cheaper tiers",
            "Use CloudFront to reduce data transfer costs",
            "Enable S3 Analytics to understand access patterns",
        ],
        "calculator_link": "https://calculator.aws/#/addService/S3"
    },
    
    "RDS": {
        "category": "Database - Relational",
        "pricing_model": "Pay per instance hour + storage + I/O",
        "factors": [
            {"factor": "Instance class", "unit": "type", "impact": "HIGH"},
            {"factor": "Multi-AZ deployment", "unit": "boolean", "impact": "HIGH", "note": "Doubles cost"},
            {"factor": "Storage type and size", "unit": "GB", "impact": "MEDIUM"},
            {"factor": "Provisioned IOPS (if applicable)", "unit": "IOPS", "impact": "MEDIUM"},
            {"factor": "Backup storage", "unit": "GB", "impact": "LOW"},
            {"factor": "Data transfer out", "unit": "GB", "impact": "LOW"},
            {"factor": "Read replicas", "unit": "count", "impact": "HIGH"},
        ],
        "free_tier": "750 hours db.t2.micro, 20 GB storage (12 months)",
        "optimization_tips": [
            "Right-size instances based on actual utilization",
            "Use Reserved Instances for production (up to 72% savings)",
            "Consider Aurora Serverless v2 for variable workloads",
            "Use Graviton instances for better price/performance",
        ],
        "calculator_link": "https://calculator.aws/#/addService/RDS"
    },
    
    "ECS": {
        "category": "Compute - Containers",
        "pricing_model": "Fargate: vCPU + Memory per second | EC2: instance costs",
        "factors": [
            {"factor": "Launch type", "unit": "type", "impact": "HIGH", "note": "Fargate vs EC2"},
            {"factor": "vCPU per task", "unit": "vCPU", "impact": "HIGH"},
            {"factor": "Memory per task", "unit": "GB", "impact": "HIGH"},
            {"factor": "Number of tasks", "unit": "count", "impact": "HIGH"},
            {"factor": "Running hours per month", "unit": "hours", "impact": "HIGH"},
            {"factor": "Fargate Spot (if used)", "unit": "percentage", "impact": "MEDIUM", "note": "Up to 70% savings"},
        ],
        "free_tier": "None for Fargate, EC2 free tier applies",
        "optimization_tips": [
            "Use Fargate Spot for fault-tolerant workloads",
            "Right-size task definitions",
            "Use Savings Plans for steady-state",
            "Consider ARM/Graviton for Fargate",
        ],
        "calculator_link": "https://calculator.aws/#/addService/Fargate"
    },
    
    "CloudFront": {
        "category": "CDN",
        "pricing_model": "Pay per data transfer + requests",
        "factors": [
            {"factor": "Data transfer out to internet", "unit": "GB", "impact": "HIGH"},
            {"factor": "Data transfer to origin", "unit": "GB", "impact": "MEDIUM"},
            {"factor": "HTTP/HTTPS requests", "unit": "per 10,000", "impact": "MEDIUM"},
            {"factor": "Price class", "unit": "type", "impact": "MEDIUM", "note": "All edges vs subset"},
            {"factor": "Lambda@Edge invocations", "unit": "requests", "impact": "LOW"},
        ],
        "free_tier": "1 TB data transfer, 10M requests (12 months)",
        "optimization_tips": [
            "Use Price Class 100 if serving mainly US/Europe",
            "Enable compression to reduce data transfer",
            "Set appropriate cache TTLs",
        ],
        "calculator_link": "https://calculator.aws/#/addService/CloudFront"
    },
    
    "NAT Gateway": {
        "category": "Networking",
        "pricing_model": "Pay per hour + data processed",
        "factors": [
            {"factor": "Number of NAT Gateways", "unit": "count", "impact": "HIGH"},
            {"factor": "Hours running per month", "unit": "hours", "impact": "HIGH"},
            {"factor": "Data processed", "unit": "GB", "impact": "HIGH"},
        ],
        "free_tier": "None",
        "optimization_tips": [
            "Use VPC Endpoints for AWS service traffic (free for S3, DynamoDB)",
            "Consider NAT Instance for low-traffic scenarios",
            "Review if all traffic really needs NAT Gateway",
        ],
        "calculator_link": "https://calculator.aws/#/addService/VPC"
    },
    
    "VPC Endpoints": {
        "category": "Networking",
        "pricing_model": "Gateway: Free | Interface: hourly + data",
        "factors": [
            {"factor": "Endpoint type", "unit": "type", "impact": "HIGH", "note": "Gateway (free) vs Interface"},
            {"factor": "Interface endpoint hours", "unit": "hours per AZ", "impact": "MEDIUM"},
            {"factor": "Data processed", "unit": "GB", "impact": "MEDIUM"},
        ],
        "free_tier": "Gateway endpoints (S3, DynamoDB) are free",
        "optimization_tips": [
            "Use Gateway endpoints for S3 and DynamoDB (free)",
            "Interface endpoints have cost per AZ - minimize AZ count if possible",
        ],
        "calculator_link": "https://calculator.aws/#/addService/VPC"
    },
    
    "Secrets Manager": {
        "category": "Security",
        "pricing_model": "Pay per secret + API calls",
        "factors": [
            {"factor": "Number of secrets stored", "unit": "secrets", "impact": "HIGH"},
            {"factor": "API calls", "unit": "per 10,000", "impact": "LOW"},
        ],
        "free_tier": "None (but Parameter Store standard is free)",
        "optimization_tips": [
            "Use Parameter Store for non-rotating secrets (free)",
            "Batch secrets when possible",
        ],
        "calculator_link": "https://calculator.aws/#/addService/SecretsManager"
    },
}

def detect_services(text: str) -> list:
    """Detect AWS services mentioned in text."""
    service_keywords = {
        "Lambda": ["lambda", "serverless function"],
        "DynamoDB": ["dynamodb", "dynamo"],
        "S3": ["s3", "bucket", "object storage"],
        "RDS": ["rds", "postgres", "mysql", "aurora", "database"],
        "API Gateway": ["api gateway", "apigateway", "rest api", "http api"],
        "ECS": ["ecs", "container", "fargate"],
        "CloudFront": ["cloudfront", "cdn"],
        "NAT Gateway": ["nat gateway", "nat"],
        "VPC Endpoints": ["vpc endpoint", "privatelink"],
        "Secrets Manager": ["secrets manager"],
    }
    
    text_lower = text.lower()
    detected = []
    for service, keywords in service_keywords.items():
        if any(kw in text_lower for kw in keywords):
            detected.append(service)
    
    return detected if detected else ["Lambda", "API Gateway", "DynamoDB"]

def generate_cost_report(services: list) -> dict:
    """Generate cost considerations report for given services."""
    report = {
        "generated_at": datetime.now().isoformat(),
        "services": services,
        "total_factors": 0,
        "service_details": [],
        "general_tips": [
            "Use AWS Pricing Calculator for actual estimates",
            "Enable Cost Explorer for usage analysis",
            "Set up AWS Budgets for alerts",
            "Tag resources for cost allocation",
            "Review monthly for optimization opportunities",
        ],
        "calculator_link": "https://calculator.aws/#/"
    }
    
    for service in services:
        if service in COST_FACTORS:
            details = COST_FACTORS[service].copy()
            report["service_details"].append({
                "service": service,
                **details
            })
            report["total_factors"] += len(details["factors"])
    
    return report

def main():
    parser = argparse.ArgumentParser(description="Generate Cost Considerations Report")
    parser.add_argument("--services", help="Comma-separated list of AWS services")
    parser.add_argument("--json", action="store_true", help="Output as JSON")
    args = parser.parse_args()
    
    # Get services from args or stdin
    if args.services:
        services = [s.strip() for s in args.services.split(",")]
    elif not sys.stdin.isatty():
        text = sys.stdin.read()
        services = detect_services(text)
    else:
        services = ["Lambda", "API Gateway", "DynamoDB", "S3"]
    
    report = generate_cost_report(services)
    
    if args.json:
        print(json.dumps(report, indent=2))
    else:
        print(f"\n{'='*70}")
        print("COST CONSIDERATIONS REPORT")
        print(f"{'='*70}")
        print(f"Generated: {report['generated_at']}")
        print(f"Services: {', '.join(services)}")
        print(f"Total factors to evaluate: {report['total_factors']}")
        print(f"\n⚠️  This report lists WHAT to consider, not actual costs.")
        print(f"    Use AWS Pricing Calculator: {report['calculator_link']}")
        
        for service_data in report["service_details"]:
            print(f"\n{'='*70}")
            print(f"## {service_data['service']}")
            print(f"   Category: {service_data['category']}")
            print(f"   Pricing Model: {service_data['pricing_model']}")
            if service_data.get('free_tier'):
                print(f"   Free Tier: {service_data['free_tier']}")
            
            print(f"\n   📊 Cost Factors to Evaluate:")
            for factor in service_data['factors']:
                impact_icon = {"HIGH": "🔴", "MEDIUM": "🟡", "LOW": "🟢"}[factor["impact"]]
                note = f" ({factor['note']})" if factor.get('note') else ""
                print(f"      {impact_icon} {factor['factor']} [{factor['unit']}]{note}")
            
            print(f"\n   💡 Optimization Tips:")
            for tip in service_data['optimization_tips']:
                print(f"      • {tip}")
            
            print(f"\n   🔗 Calculator: {service_data['calculator_link']}")
        
        print(f"\n{'='*70}")
        print("GENERAL RECOMMENDATIONS")
        print(f"{'='*70}")
        for tip in report["general_tips"]:
            print(f"  • {tip}")
        
        print(f"\n{'='*70}")
        print("Next Steps:")
        print("  1. Gather actual usage estimates for each factor")
        print("  2. Use AWS Pricing Calculator with your estimates")
        print("  3. Consider Reserved Capacity / Savings Plans for production")
        print("  4. Set up Cost Explorer and Budgets after deployment")
        print(f"{'='*70}\n")

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
AWS Architecture Diagram Generator

Generates Mermaid diagrams from architecture descriptions.
Usage: python generate_diagram.py --type flowchart --title "My API"
       echo "Lambda API with DynamoDB" | python generate_diagram.py

Outputs Mermaid syntax that can be rendered.
"""

import argparse
import sys
import json
import re

# Architecture patterns with Mermaid templates
PATTERNS = {
    "serverless_api": {
        "keywords": ["lambda", "api gateway", "serverless api", "rest api"],
        "template": """flowchart LR
    subgraph Internet
        Client[Client]
    end
    
    subgraph AWS Cloud
        subgraph API Layer
            APIGW[API Gateway]
        end
        
        subgraph Compute
            Lambda[Lambda Function]
        end
        
        subgraph Data
            {database}
        end
    end
    
    Client --> APIGW
    APIGW --> Lambda
    Lambda --> {database_ref}
    
    style APIGW fill:#FF9900
    style Lambda fill:#FF9900
    style {database_ref} fill:#3B48CC"""
    },
    
    "event_driven": {
        "keywords": ["event", "sqs", "sns", "eventbridge", "async", "queue"],
        "template": """flowchart LR
    subgraph Producers
        Producer1[Producer 1]
        Producer2[Producer 2]
    end
    
    subgraph AWS Cloud
        subgraph Event Bus
            EB[EventBridge]
        end
        
        subgraph Processing
            Rule1[Rule 1]
            Rule2[Rule 2]
            Lambda1[Lambda 1]
            Lambda2[Lambda 2]
        end
        
        subgraph Storage
            {storage}
        end
    end
    
    Producer1 --> EB
    Producer2 --> EB
    EB --> Rule1
    EB --> Rule2
    Rule1 --> Lambda1
    Rule2 --> Lambda2
    Lambda1 --> {storage_ref}
    Lambda2 --> {storage_ref}
    
    style EB fill:#FF4F8B
    style Lambda1 fill:#FF9900
    style Lambda2 fill:#FF9900"""
    },
    
    "microservices": {
        "keywords": ["microservice", "ecs", "fargate", "container", "alb"],
        "template": """flowchart TB
    subgraph Internet
        Client[Client]
    end
    
    subgraph AWS Cloud
        subgraph Load Balancing
            ALB[Application Load Balancer]
        end
        
        subgraph ECS Cluster
            subgraph Service A
                TaskA1[Task A-1]
                TaskA2[Task A-2]
            end
            
            subgraph Service B
                TaskB1[Task B-1]
                TaskB2[Task B-2]
            end
        end
        
        subgraph Data Layer
            RDS[(RDS Database)]
            Cache[(ElastiCache)]
        end
    end
    
    Client --> ALB
    ALB --> TaskA1
    ALB --> TaskA2
    ALB --> TaskB1
    ALB --> TaskB2
    TaskA1 --> RDS
    TaskA2 --> RDS
    TaskB1 --> Cache
    TaskB2 --> Cache
    
    style ALB fill:#FF9900
    style RDS fill:#3B48CC
    style Cache fill:#3B48CC"""
    },
    
    "web_app": {
        "keywords": ["web app", "cloudfront", "s3 website", "static", "spa", "react", "frontend"],
        "template": """flowchart LR
    subgraph Internet
        User[User Browser]
    end
    
    subgraph AWS Cloud
        subgraph CDN
            CF[CloudFront]
        end
        
        subgraph Origin
            S3[S3 Bucket<br/>Static Assets]
        end
        
        subgraph API
            APIGW[API Gateway]
            Lambda[Lambda]
        end
        
        subgraph Data
            {database}
        end
    end
    
    User --> CF
    CF --> S3
    CF --> APIGW
    APIGW --> Lambda
    Lambda --> {database_ref}
    
    style CF fill:#8C4FFF
    style S3 fill:#3F8624
    style APIGW fill:#FF9900
    style Lambda fill:#FF9900"""
    },
    
    "data_pipeline": {
        "keywords": ["data pipeline", "etl", "kinesis", "firehose", "glue", "athena", "data lake"],
        "template": """flowchart LR
    subgraph Sources
        Source1[Data Source 1]
        Source2[Data Source 2]
    end
    
    subgraph AWS Cloud
        subgraph Ingestion
            Kinesis[Kinesis Data Streams]
            Firehose[Kinesis Firehose]
        end
        
        subgraph Storage
            S3Raw[S3 Raw Zone]
            S3Processed[S3 Processed Zone]
        end
        
        subgraph Processing
            Glue[Glue ETL Job]
        end
        
        subgraph Analytics
            Athena[Athena]
            QuickSight[QuickSight]
        end
    end
    
    Source1 --> Kinesis
    Source2 --> Kinesis
    Kinesis --> Firehose
    Firehose --> S3Raw
    S3Raw --> Glue
    Glue --> S3Processed
    S3Processed --> Athena
    Athena --> QuickSight
    
    style Kinesis fill:#FF4F8B
    style S3Raw fill:#3F8624
    style S3Processed fill:#3F8624
    style Glue fill:#FF9900"""
    },
    
    "multi_region": {
        "keywords": ["multi-region", "global", "disaster recovery", "dr", "failover"],
        "template": """flowchart TB
    subgraph Global
        R53[Route 53<br/>Failover Routing]
    end
    
    subgraph us-east-1[Primary - us-east-1]
        ALB1[ALB]
        App1[Application]
        DB1[(Primary DB)]
    end
    
    subgraph us-west-2[Secondary - us-west-2]
        ALB2[ALB]
        App2[Application]
        DB2[(Replica DB)]
    end
    
    R53 --> ALB1
    R53 -.-> ALB2
    ALB1 --> App1
    ALB2 --> App2
    App1 --> DB1
    App2 --> DB2
    DB1 -->|Replication| DB2
    
    style R53 fill:#8C4FFF
    style DB1 fill:#3B48CC
    style DB2 fill:#3B48CC"""
    },
}

DATABASE_COMPONENTS = {
    "dynamodb": ("DDB[(DynamoDB)]", "DDB"),
    "rds": ("RDS[(RDS Database)]", "RDS"),
    "aurora": ("Aurora[(Aurora)]", "Aurora"),
    "s3": ("S3[S3 Bucket]", "S3"),
    "elasticache": ("Cache[(ElastiCache)]", "Cache"),
    "documentdb": ("DocDB[(DocumentDB)]", "DocDB"),
}

def detect_pattern(text: str) -> str:
    """Detect which architecture pattern matches the text."""
    text_lower = text.lower()
    
    for pattern_name, pattern_data in PATTERNS.items():
        if any(kw in text_lower for kw in pattern_data["keywords"]):
            return pattern_name
    
    return "serverless_api"  # Default

def detect_database(text: str) -> tuple:
    """Detect database type from text."""
    text_lower = text.lower()
    
    for db_name, (component, ref) in DATABASE_COMPONENTS.items():
        if db_name in text_lower:
            return component, ref
    
    return "DDB[(DynamoDB)]", "DDB"  # Default

def generate_diagram(text: str, diagram_type: str = None, title: str = None) -> str:
    """Generate Mermaid diagram from architecture description."""
    
    # Detect pattern if not specified
    if diagram_type is None:
        diagram_type = detect_pattern(text)
    
    if diagram_type not in PATTERNS:
        diagram_type = "serverless_api"
    
    template = PATTERNS[diagram_type]["template"]
    
    # Detect and replace database component
    db_component, db_ref = detect_database(text)
    template = template.replace("{database}", db_component)
    template = template.replace("{database_ref}", db_ref)
    
    # Replace storage placeholder
    if "s3" in text.lower():
        template = template.replace("{storage}", "S3[S3 Bucket]")
        template = template.replace("{storage_ref}", "S3")
    else:
        template = template.replace("{storage}", "DDB[(DynamoDB)]")
        template = template.replace("{storage_ref}", "DDB")
    
    # Add title if provided
    if title:
        template = f"---\ntitle: {title}\n---\n{template}"
    
    return template

def generate_custom(components: list, connections: list, title: str = None) -> str:
    """Generate custom diagram from components and connections."""
    
    lines = ["flowchart TB"]
    
    if title:
        lines.insert(0, f"---\ntitle: {title}\n---")
    
    # Add components
    lines.append("    %% Components")
    for comp in components:
        lines.append(f"    {comp}")
    
    # Add connections
    lines.append("    %% Connections")
    for conn in connections:
        lines.append(f"    {conn}")
    
    return "\n".join(lines)

def main():
    parser = argparse.ArgumentParser(description="Generate AWS Architecture Diagrams")
    parser.add_argument("--type", choices=list(PATTERNS.keys()), help="Diagram pattern type")
    parser.add_argument("--title", help="Diagram title")
    parser.add_argument("--list-patterns", action="store_true", help="List available patterns")
    parser.add_argument("--json", action="store_true", help="Output as JSON with metadata")
    args = parser.parse_args()
    
    if args.list_patterns:
        print("\nAvailable Patterns:\n")
        for name, data in PATTERNS.items():
            print(f"  {name}")
            print(f"    Keywords: {', '.join(data['keywords'])}")
            print()
        return
    
    # Get description from stdin
    if not sys.stdin.isatty():
        text = sys.stdin.read().strip()
    else:
        text = "serverless api with lambda and dynamodb"
    
    diagram = generate_diagram(text, args.type, args.title)
    
    if args.json:
        output = {
            "input": text,
            "pattern": args.type or detect_pattern(text),
            "title": args.title,
            "mermaid": diagram
        }
        print(json.dumps(output, indent=2))
    else:
        print("\n```mermaid")
        print(diagram)
        print("```\n")
        print("Copy the mermaid code above to visualize the diagram.")
        print("Or use the Mermaid Chart MCP: validate_and_render_mermaid_diagram")

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Security Review Checklist Generator

Generates security checklist based on architecture components.
Usage: python security_review.py --services "Lambda,DynamoDB,S3"
       echo "API with Lambda, DynamoDB, and S3" | python security_review.py
"""

import argparse
import sys
import json
from datetime import datetime

SECURITY_CHECKS = {
    "IAM": {
        "category": "Identity & Access Management",
        "checks": [
            {"id": "IAM-001", "check": "IAM roles use least privilege principle", "severity": "HIGH"},
            {"id": "IAM-002", "check": "No wildcard (*) in resource ARNs", "severity": "HIGH"},
            {"id": "IAM-003", "check": "No wildcard (*) in actions unless justified", "severity": "MEDIUM"},
            {"id": "IAM-004", "check": "Conditions used where applicable (source IP, MFA, tags)", "severity": "MEDIUM"},
            {"id": "IAM-005", "check": "Cross-account access uses external ID", "severity": "HIGH"},
            {"id": "IAM-006", "check": "Service roles scoped to specific resources", "severity": "HIGH"},
            {"id": "IAM-007", "check": "Permission boundaries for delegated administration", "severity": "MEDIUM"},
            {"id": "IAM-008", "check": "No long-term access keys (use roles instead)", "severity": "HIGH"},
        ]
    },
    "Lambda": {
        "category": "AWS Lambda",
        "checks": [
            {"id": "LAM-001", "check": "Execution role follows least privilege", "severity": "HIGH"},
            {"id": "LAM-002", "check": "Environment variables with secrets use encryption", "severity": "HIGH"},
            {"id": "LAM-003", "check": "Secrets retrieved from Secrets Manager, not env vars", "severity": "MEDIUM"},
            {"id": "LAM-004", "check": "Function in VPC if accessing private resources", "severity": "MEDIUM"},
            {"id": "LAM-005", "check": "Reserved concurrency set to prevent resource exhaustion", "severity": "MEDIUM"},
            {"id": "LAM-006", "check": "Function URL authentication configured (if used)", "severity": "HIGH"},
            {"id": "LAM-007", "check": "No sensitive data in function code or layers", "severity": "HIGH"},
            {"id": "LAM-008", "check": "Input validation on all event data", "severity": "HIGH"},
        ]
    },
    "API Gateway": {
        "category": "API Gateway",
        "checks": [
            {"id": "API-001", "check": "Authentication configured (Cognito/IAM/Lambda authorizer)", "severity": "HIGH"},
            {"id": "API-002", "check": "Throttling configured to prevent abuse", "severity": "HIGH"},
            {"id": "API-003", "check": "WAF attached for public-facing APIs", "severity": "HIGH"},
            {"id": "API-004", "check": "Access logging enabled", "severity": "MEDIUM"},
            {"id": "API-005", "check": "Request validation enabled", "severity": "MEDIUM"},
            {"id": "API-006", "check": "CORS configured restrictively (not wildcard)", "severity": "MEDIUM"},
            {"id": "API-007", "check": "API keys not sole authentication method", "severity": "HIGH"},
            {"id": "API-008", "check": "Private APIs use VPC endpoints", "severity": "MEDIUM"},
        ]
    },
    "DynamoDB": {
        "category": "DynamoDB",
        "checks": [
            {"id": "DDB-001", "check": "Encryption at rest enabled (KMS CMK if required)", "severity": "HIGH"},
            {"id": "DDB-002", "check": "IAM policies scoped to specific tables", "severity": "HIGH"},
            {"id": "DDB-003", "check": "IAM policies scoped to specific actions", "severity": "MEDIUM"},
            {"id": "DDB-004", "check": "Point-in-time recovery enabled for critical tables", "severity": "MEDIUM"},
            {"id": "DDB-005", "check": "Fine-grained access control if multi-tenant", "severity": "HIGH"},
            {"id": "DDB-006", "check": "VPC endpoints used for private access", "severity": "LOW"},
        ]
    },
    "S3": {
        "category": "Amazon S3",
        "checks": [
            {"id": "S3-001", "check": "Block Public Access enabled at account level", "severity": "HIGH"},
            {"id": "S3-002", "check": "Block Public Access enabled at bucket level", "severity": "HIGH"},
            {"id": "S3-003", "check": "Bucket policy does not allow public access", "severity": "HIGH"},
            {"id": "S3-004", "check": "Server-side encryption enabled", "severity": "HIGH"},
            {"id": "S3-005", "check": "Access logging enabled for sensitive buckets", "severity": "MEDIUM"},
            {"id": "S3-006", "check": "Versioning enabled for critical data", "severity": "MEDIUM"},
            {"id": "S3-007", "check": "Object Lock for compliance (if required)", "severity": "LOW"},
            {"id": "S3-008", "check": "CORS policy restrictive (if enabled)", "severity": "MEDIUM"},
            {"id": "S3-009", "check": "Presigned URLs have appropriate expiration", "severity": "MEDIUM"},
        ]
    },
    "RDS": {
        "category": "RDS / Aurora",
        "checks": [
            {"id": "RDS-001", "check": "Encryption at rest enabled", "severity": "HIGH"},
            {"id": "RDS-002", "check": "Database in private subnet (no public IP)", "severity": "HIGH"},
            {"id": "RDS-003", "check": "Security groups restrict access to app tier only", "severity": "HIGH"},
            {"id": "RDS-004", "check": "IAM database authentication considered", "severity": "MEDIUM"},
            {"id": "RDS-005", "check": "SSL/TLS enforced for connections", "severity": "HIGH"},
            {"id": "RDS-006", "check": "Automated backups enabled", "severity": "MEDIUM"},
            {"id": "RDS-007", "check": "Database credentials in Secrets Manager", "severity": "HIGH"},
            {"id": "RDS-008", "check": "Audit logging enabled (if required)", "severity": "MEDIUM"},
        ]
    },
    "ECS": {
        "category": "ECS / Fargate",
        "checks": [
            {"id": "ECS-001", "check": "Container images scanned for vulnerabilities", "severity": "HIGH"},
            {"id": "ECS-002", "check": "Task role follows least privilege", "severity": "HIGH"},
            {"id": "ECS-003", "check": "Secrets injected via Secrets Manager", "severity": "HIGH"},
            {"id": "ECS-004", "check": "No sensitive data in environment variables", "severity": "HIGH"},
            {"id": "ECS-005", "check": "Container runs as non-root user", "severity": "MEDIUM"},
            {"id": "ECS-006", "check": "Read-only root filesystem (where possible)", "severity": "LOW"},
            {"id": "ECS-007", "check": "Network mode appropriate for isolation", "severity": "MEDIUM"},
            {"id": "ECS-008", "check": "ECR repository policy restricts access", "severity": "MEDIUM"},
        ]
    },
    "VPC": {
        "category": "VPC & Networking",
        "checks": [
            {"id": "VPC-001", "check": "Private subnets for databases and app servers", "severity": "HIGH"},
            {"id": "VPC-002", "check": "Security groups default deny (no inbound by default)", "severity": "HIGH"},
            {"id": "VPC-003", "check": "No 0.0.0.0/0 ingress on sensitive ports", "severity": "HIGH"},
            {"id": "VPC-004", "check": "Security groups reference other SGs, not CIDR where possible", "severity": "MEDIUM"},
            {"id": "VPC-005", "check": "VPC Flow Logs enabled", "severity": "MEDIUM"},
            {"id": "VPC-006", "check": "VPC endpoints for AWS services (private access)", "severity": "MEDIUM"},
            {"id": "VPC-007", "check": "NACLs as additional layer for sensitive subnets", "severity": "LOW"},
        ]
    },
    "Cognito": {
        "category": "Amazon Cognito",
        "checks": [
            {"id": "COG-001", "check": "Strong password policy configured", "severity": "HIGH"},
            {"id": "COG-002", "check": "MFA enabled or enforced", "severity": "HIGH"},
            {"id": "COG-003", "check": "Account recovery requires verified email/phone", "severity": "MEDIUM"},
            {"id": "COG-004", "check": "Token expiration appropriately short", "severity": "MEDIUM"},
            {"id": "COG-005", "check": "Advanced security features enabled (if applicable)", "severity": "LOW"},
        ]
    },
    "CloudWatch": {
        "category": "Logging & Monitoring",
        "checks": [
            {"id": "LOG-001", "check": "CloudTrail enabled in all regions", "severity": "HIGH"},
            {"id": "LOG-002", "check": "CloudTrail logs encrypted", "severity": "MEDIUM"},
            {"id": "LOG-003", "check": "CloudTrail log file validation enabled", "severity": "MEDIUM"},
            {"id": "LOG-004", "check": "No sensitive data in application logs", "severity": "HIGH"},
            {"id": "LOG-005", "check": "Log retention configured appropriately", "severity": "MEDIUM"},
            {"id": "LOG-006", "check": "Alarms on security-relevant events", "severity": "MEDIUM"},
            {"id": "LOG-007", "check": "GuardDuty enabled", "severity": "HIGH"},
        ]
    },
}

def detect_services(text: str) -> list:
    """Detect AWS services mentioned in text."""
    service_keywords = {
        "Lambda": ["lambda", "serverless function", "function"],
        "DynamoDB": ["dynamodb", "dynamo", "nosql"],
        "S3": ["s3", "bucket", "object storage"],
        "RDS": ["rds", "postgres", "mysql", "aurora", "database", "sql"],
        "API Gateway": ["api gateway", "apigateway", "rest api", "http api"],
        "ECS": ["ecs", "container", "fargate", "docker"],
        "VPC": ["vpc", "subnet", "security group", "network"],
        "Cognito": ["cognito", "user pool", "authentication"],
        "CloudWatch": ["cloudwatch", "logging", "monitoring"],
    }
    
    text_lower = text.lower()
    detected = []
    for service, keywords in service_keywords.items():
        if any(kw in text_lower for kw in keywords):
            detected.append(service)
    
    # Always include IAM and CloudWatch
    if "IAM" not in detected:
        detected.append("IAM")
    if "CloudWatch" not in detected:
        detected.append("CloudWatch")
    
    return detected

def generate_checklist(services: list, severity_filter: str = None) -> dict:
    """Generate security checklist for given services."""
    checklist = {
        "generated_at": datetime.now().isoformat(),
        "services": services,
        "total_checks": 0,
        "by_severity": {"HIGH": 0, "MEDIUM": 0, "LOW": 0},
        "categories": []
    }
    
    for service in services:
        if service not in SECURITY_CHECKS:
            continue
        
        service_data = SECURITY_CHECKS[service]
        checks = service_data["checks"]
        
        if severity_filter:
            checks = [c for c in checks if c["severity"] == severity_filter.upper()]
        
        if checks:
            category = {
                "name": service_data["category"],
                "checks": checks
            }
            checklist["categories"].append(category)
            
            for check in checks:
                checklist["total_checks"] += 1
                checklist["by_severity"][check["severity"]] += 1
    
    return checklist

def main():
    parser = argparse.ArgumentParser(description="Generate Security Review Checklist")
    parser.add_argument("--services", help="Comma-separated list of AWS services")
    parser.add_argument("--severity", choices=["HIGH", "MEDIUM", "LOW"], help="Filter by severity")
    parser.add_argument("--json", action="store_true", help="Output as JSON")
    args = parser.parse_args()
    
    # Get services from args or stdin
    if args.services:
        services = [s.strip() for s in args.services.split(",")]
    elif not sys.stdin.isatty():
        text = sys.stdin.read()
        services = detect_services(text)
    else:
        # Default to common serverless stack
        services = ["IAM", "Lambda", "API Gateway", "DynamoDB", "S3", "CloudWatch"]
    
    checklist = generate_checklist(services, args.severity)
    
    if args.json:
        print(json.dumps(checklist, indent=2))
    else:
        print(f"\n{'='*70}")
        print(f"SECURITY REVIEW CHECKLIST")
        print(f"Generated: {checklist['generated_at']}")
        print(f"Services: {', '.join(services)}")
        print(f"Total Checks: {checklist['total_checks']} (HIGH: {checklist['by_severity']['HIGH']}, MEDIUM: {checklist['by_severity']['MEDIUM']}, LOW: {checklist['by_severity']['LOW']})")
        print(f"{'='*70}")
        
        for category in checklist["categories"]:
            print(f"\n## {category['name']}\n")
            for check in category["checks"]:
                severity_icon = {"HIGH": "🔴", "MEDIUM": "🟡", "LOW": "🟢"}[check["severity"]]
                print(f"  [ ] {severity_icon} [{check['id']}] {check['check']}")
        
        print(f"\n{'='*70}")
        print("Legend: 🔴 HIGH | 🟡 MEDIUM | 🟢 LOW")
        print("Note: Use aws___search_documentation for implementation guidance.")
        print(f"{'='*70}\n")

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Well-Architected Review Generator

Generates relevant review questions based on architecture context.
Usage: python well_architected_review.py --services "Lambda,DynamoDB,API Gateway" --pillars "security,cost"
       python well_architected_review.py --all
       echo "serverless API with Lambda and DynamoDB" | python well_architected_review.py
"""

import argparse
import sys
import json

PILLARS = {
    "operational_excellence": {
        "name": "Operational Excellence",
        "questions": {
            "general": [
                "How do you determine priorities for operational activities?",
                "How do you design workloads to understand their state?",
                "How do you reduce defects, ease remediation, and improve flow?",
                "How do you mitigate deployment risks?",
                "How do you know your workload is healthy?",
            ],
            "Lambda": [
                "Are Lambda functions instrumented with X-Ray tracing?",
                "Are CloudWatch alarms configured for errors and throttles?",
                "Is there a deployment strategy (canary, linear)?",
                "Are Lambda versions and aliases used for safe deployments?",
            ],
            "ECS": [
                "Is container health check configured properly?",
                "Are deployment circuit breakers enabled?",
                "Is container insights enabled for monitoring?",
            ],
            "API Gateway": [
                "Are access logs enabled?",
                "Is there a deployment stage strategy?",
                "Are CloudWatch alarms on 4xx/5xx errors?",
            ],
        }
    },
    "security": {
        "name": "Security",
        "questions": {
            "general": [
                "How do you manage identities for workload resources?",
                "How do you manage permissions for humans and machines?",
                "How do you detect and investigate security events?",
                "How do you protect your network resources?",
                "How do you protect your compute resources?",
                "How do you classify your data?",
                "How do you protect your data at rest?",
                "How do you protect your data in transit?",
            ],
            "Lambda": [
                "Does the execution role follow least privilege?",
                "Are environment variables with secrets encrypted?",
                "Is the function in a VPC if accessing private resources?",
                "Are reserved concurrency limits set to prevent DoS?",
            ],
            "DynamoDB": [
                "Is encryption at rest enabled (KMS CMK if required)?",
                "Are IAM policies scoped to specific tables and actions?",
                "Is point-in-time recovery enabled?",
            ],
            "S3": [
                "Is Block Public Access enabled at account level?",
                "Are bucket policies reviewed for overly permissive access?",
                "Is server-side encryption enabled?",
                "Are access logs enabled for sensitive buckets?",
            ],
            "API Gateway": [
                "Is authentication configured (Cognito, IAM, Lambda authorizer)?",
                "Is throttling configured to prevent abuse?",
                "Is WAF attached for public APIs?",
            ],
            "RDS": [
                "Is encryption at rest enabled?",
                "Is the database in a private subnet?",
                "Are security groups restricting access to app tier only?",
                "Is IAM database authentication considered?",
            ],
            "ECS": [
                "Are container images scanned for vulnerabilities?",
                "Is the task role following least privilege?",
                "Are secrets injected via Secrets Manager?",
            ],
        }
    },
    "reliability": {
        "name": "Reliability",
        "questions": {
            "general": [
                "How do you manage service quotas and constraints?",
                "How do you plan your network topology?",
                "How do you design to prevent failures?",
                "How do you design to mitigate failures?",
                "How do you test reliability?",
                "How do you back up data?",
            ],
            "Lambda": [
                "Is reserved concurrency configured appropriately?",
                "Are retries and DLQ configured for async invocations?",
                "Is error handling implemented for all failure modes?",
            ],
            "DynamoDB": [
                "Is on-demand or provisioned with auto-scaling configured?",
                "Are Global Tables needed for multi-region?",
                "Is backup strategy defined (PITR, on-demand)?",
            ],
            "RDS": [
                "Is Multi-AZ enabled for production?",
                "Are automated backups configured?",
                "Is read replica needed for read scaling?",
            ],
            "ECS": [
                "Are tasks spread across multiple AZs?",
                "Is desired count >1 for production?",
                "Is health check grace period appropriate?",
            ],
            "API Gateway": [
                "Are throttling limits appropriate for downstream capacity?",
                "Is caching configured for applicable endpoints?",
            ],
        }
    },
    "performance": {
        "name": "Performance Efficiency",
        "questions": {
            "general": [
                "How do you select appropriate compute resources?",
                "How do you select appropriate storage solutions?",
                "How do you select appropriate database solutions?",
                "How do you configure networking solutions?",
                "How do you evolve to take advantage of new releases?",
            ],
            "Lambda": [
                "Is memory size optimized (use Lambda Power Tuning)?",
                "Is Graviton (ARM) architecture used for cost/performance?",
                "Is provisioned concurrency needed for latency-sensitive?",
                "Are dependencies optimized (layers, tree-shaking)?",
            ],
            "DynamoDB": [
                "Are access patterns well-defined for key design?",
                "Are GSIs optimized (projection, sparse indexes)?",
                "Is DAX needed for read-heavy microsecond latency?",
            ],
            "RDS": [
                "Is instance class right-sized for workload?",
                "Are Performance Insights enabled?",
                "Is connection pooling implemented (RDS Proxy)?",
            ],
            "API Gateway": [
                "Is HTTP API used instead of REST when features allow?",
                "Is caching configured appropriately?",
                "Is compression enabled?",
            ],
            "S3": [
                "Is S3 Transfer Acceleration needed for distant uploads?",
                "Is CloudFront used for read-heavy workloads?",
                "Is multipart upload used for large objects?",
            ],
        }
    },
    "cost": {
        "name": "Cost Optimization",
        "questions": {
            "general": [
                "How do you implement cloud financial management?",
                "How do you govern usage?",
                "How do you monitor usage and cost?",
                "How do you decommission resources?",
                "How do you evaluate cost when selecting services?",
            ],
            "Lambda": [
                "Is memory optimized for cost (not just performance)?",
                "Is Graviton architecture used (20% cheaper)?",
                "Are unused functions identified and removed?",
                "Is provisioned concurrency really needed?",
            ],
            "DynamoDB": [
                "Is on-demand vs provisioned evaluated based on pattern?",
                "Are reserved capacity units considered for steady-state?",
                "Are unused indexes removed?",
                "Is TTL configured for data that expires?",
            ],
            "RDS": [
                "Is instance right-sized (not over-provisioned)?",
                "Are Reserved Instances purchased for production?",
                "Is Aurora Serverless v2 suitable for variable load?",
            ],
            "ECS": [
                "Are Spot instances used for fault-tolerant workloads?",
                "Is Fargate Spot considered for batch/dev?",
                "Are Savings Plans purchased for steady-state?",
            ],
            "S3": [
                "Are lifecycle policies configured for old data?",
                "Is Intelligent-Tiering used for unknown patterns?",
                "Are incomplete multipart uploads cleaned up?",
            ],
            "NAT Gateway": [
                "Is NAT Gateway really needed (vs VPC endpoints)?",
                "Can workloads use VPC endpoints instead?",
            ],
        }
    },
    "sustainability": {
        "name": "Sustainability",
        "questions": {
            "general": [
                "How do you select Regions to support sustainability goals?",
                "How do you optimize software and architecture for sustainability?",
                "How do you optimize hardware patterns for sustainability?",
            ],
            "Lambda": [
                "Is Graviton (ARM) used (more energy efficient)?",
                "Is function memory right-sized (not over-provisioned)?",
            ],
            "EC2": [
                "Are Graviton instances used where possible?",
                "Are instances right-sized?",
                "Is auto-scaling configured to scale down?",
            ],
        }
    },
}

def detect_services(text: str) -> list:
    """Detect AWS services mentioned in text."""
    service_keywords = {
        "Lambda": ["lambda", "serverless function"],
        "DynamoDB": ["dynamodb", "dynamo"],
        "S3": ["s3", "bucket", "object storage"],
        "RDS": ["rds", "postgres", "mysql", "aurora", "database"],
        "API Gateway": ["api gateway", "apigateway", "rest api", "http api"],
        "ECS": ["ecs", "container", "fargate"],
        "EKS": ["eks", "kubernetes", "k8s"],
        "SQS": ["sqs", "queue"],
        "SNS": ["sns", "notification", "pub/sub"],
        "CloudFront": ["cloudfront", "cdn"],
        "NAT Gateway": ["nat gateway", "nat"],
        "EC2": ["ec2", "instance", "virtual machine"],
    }
    
    text_lower = text.lower()
    detected = []
    for service, keywords in service_keywords.items():
        if any(kw in text_lower for kw in keywords):
            detected.append(service)
    return detected if detected else ["general"]

def generate_review(services: list, pillars: list = None) -> dict:
    """Generate review questions for given services and pillars."""
    if pillars is None:
        pillars = list(PILLARS.keys())
    
    review = {}
    for pillar_key in pillars:
        if pillar_key not in PILLARS:
            continue
        pillar = PILLARS[pillar_key]
        questions = []
        
        # Always add general questions
        questions.extend(pillar["questions"].get("general", []))
        
        # Add service-specific questions
        for service in services:
            service_questions = pillar["questions"].get(service, [])
            questions.extend(service_questions)
        
        if questions:
            review[pillar["name"]] = questions
    
    return review

def main():
    parser = argparse.ArgumentParser(description="Generate Well-Architected Review questions")
    parser.add_argument("--services", help="Comma-separated list of AWS services")
    parser.add_argument("--pillars", help="Comma-separated list of pillars (security,cost,reliability,performance,operational_excellence,sustainability)")
    parser.add_argument("--all", action="store_true", help="Include all pillars")
    parser.add_argument("--json", action="store_true", help="Output as JSON")
    args = parser.parse_args()
    
    # Get services from args or stdin
    if args.services:
        services = [s.strip() for s in args.services.split(",")]
    elif not sys.stdin.isatty():
        text = sys.stdin.read()
        services = detect_services(text)
    else:
        services = ["general"]
    
    # Get pillars
    if args.all:
        pillars = list(PILLARS.keys())
    elif args.pillars:
        pillars = [p.strip().lower().replace(" ", "_") for p in args.pillars.split(",")]
    else:
        pillars = ["security", "reliability", "cost"]  # Default to most critical
    
    review = generate_review(services, pillars)
    
    if args.json:
        print(json.dumps(review, indent=2))
    else:
        print(f"\n{'='*60}")
        print(f"WELL-ARCHITECTED REVIEW")
        print(f"Services: {', '.join(services)}")
        print(f"{'='*60}\n")
        
        for pillar_name, questions in review.items():
            print(f"\n## {pillar_name}\n")
            for i, q in enumerate(questions, 1):
                print(f"  {i}. {q}")
        
        print(f"\n{'='*60}")
        print("Note: Search AWS documentation for detailed guidance on each question.")
        print(f"{'='*60}\n")

if __name__ == "__main__":
    main()