AWS Storage and Databases

## Create bucket with versioning enabled
aws s3api create-bucket \
  --bucket prod-app-assets-ap-south-1 \
  --region ap-south-1 \
  --create-bucket-configuration LocationConstraint=ap-south-1

aws s3api put-bucket-versioning \
  --bucket prod-app-assets-ap-south-1 \
  --versioning-configuration Status=Enabled

## Block all public access (default should already be on)
aws s3api put-public-access-block \
  --bucket prod-app-assets-ap-south-1 \
  --public-access-block-configuration \
    BlockPublicAcls=true,IgnorePublicAcls=true,\
BlockPublicPolicy=true,RestrictPublicBuckets=true

## Enable server-side encryption by default
aws s3api put-bucket-encryption \
  --bucket prod-app-assets-ap-south-1 \
  --server-side-encryption-configuration '{
    "Rules": [{
      "ApplyServerSideEncryptionByDefault": {
        "SSEAlgorithm": "aws:kms",
        "KMSMasterKeyID": "arn:aws:kms:ap-south-1:123456789012:key/KEY-ID"
      }
    }]
  }'

aws s3api put-bucket-lifecycle-configuration \
  --bucket prod-app-logs \
  --lifecycle-configuration '{
    "Rules": [{
      "ID": "archive-logs-auto",
      "Status": "Enabled",
      "Transitions": [
        {"Days": 30, "StorageClass": "STANDARD_IA"},
        {"Days": 90, "StorageClass": "GLACIER_FLEXIBLE_RETRIEVAL"}
      ],
      "Expiration": {"Days": 365},
      "AbortIncompleteMultipartUpload": {
        "DaysAfterInitiation": 7
      }
    }]
  }' \
  --region ap-south-1

## Generate pre-signed URL (time-limited access)
aws s3 presign s3://prod-invoices/INV-2024-001.pdf \
  --expires-in 3600 \
  --region ap-south-1

## Create DB Subnet Group first
aws rds create-db-subnet-group \
  --db-subnet-group-name prod-db-subnet-group \
  --db-subnet-group-description "Production RDS subnets" \
  --subnet-ids subnet-data-1a subnet-data-1b \
  --region ap-south-1

## Create RDS instance with Multi-AZ
aws rds create-db-instance \
  --db-instance-identifier prod-postgres-primary \
  --db-instance-class db.t3.medium \
  --engine postgres \
  --engine-version 15.4 \
  --master-username dbadmin \
  --master-user-password "$(aws secretsmanager get-secret-value \
    --secret-id prod/db/master-password \
    --query SecretString --output text)" \
  --allocated-storage 100 \
  --storage-type gp3 \
  --storage-encrypted \
  --multi-az \
  --no-publicly-accessible \
  --db-subnet-group-name prod-db-subnet-group \
  --vpc-security-group-ids sg-rds-prod \
  --backup-retention-period 35 \
  --enable-performance-insights \
  --region ap-south-1

## Create Read Replica in same region
aws rds create-db-instance-read-replica \
  --db-instance-identifier prod-postgres-replica-1 \
  --source-db-instance-identifier prod-postgres-primary \
  --db-instance-class db.t3.medium \
  --availability-zone ap-south-1b \
  --region ap-south-1

## Create cross-region Read Replica for DR
aws rds create-db-instance-read-replica \
  --db-instance-identifier prod-postgres-replica-sg \
  --source-db-instance-identifier \
    arn:aws:rds:ap-south-1:123456789012:db:prod-postgres-primary \
  --db-instance-class db.t3.medium \
  --region ap-southeast-1

## Trigger Multi-AZ failover (reboot with failover)
aws rds reboot-db-instance \
  --db-instance-identifier prod-postgres-primary \
  --force-failover \
  --region ap-south-1

## Create table with composite key
aws dynamodb create-table \
  --table-name prod-sessions \
  --attribute-definitions \
    AttributeName=UserId,AttributeType=S \
    AttributeName=SessionId,AttributeType=S \
  --key-schema \
    AttributeName=UserId,KeyType=HASH \
    AttributeName=SessionId,KeyType=RANGE \
  --billing-mode PAY_PER_REQUEST \
  --stream-specification \
    StreamEnabled=true,StreamViewType=NEW_AND_OLD_IMAGES \
  --region ap-south-1

## Enable TTL for auto-expiry of sessions
aws dynamodb update-time-to-live \
  --table-name prod-sessions \
  --time-to-live-specification \
    Enabled=true,AttributeName=ExpTime \
  --region ap-south-1

## Enable PITR (restore to any second in last 35 days)
aws dynamodb update-continuous-backups \
  --table-name prod-sessions \
  --point-in-time-recovery-specification \
    PointInTimeRecoveryEnabled=true \
  --region ap-south-1

## Put item with TTL (expires in 24 hours)
aws dynamodb put-item \
  --table-name prod-sessions \
  --item '{
    "UserId": {"S": "user-98765"},
    "SessionId": {"S": "sess-abc123xyz"},
    "Token": {"S": "eyJhbGciOiJIUzI1NiJ9..."},
    "ExpTime": {"N": "'$(date -d "+24 hours" +%s)'"}
  }' \
  --region ap-south-1

## Query all sessions for a user
aws dynamodb query \
  --table-name prod-sessions \
  --key-condition-expression "UserId = :uid" \
  --expression-attribute-values '{":uid": {"S": "user-98765"}}' \
  --region ap-south-1

## Enable Global Tables (requires Streams)
aws dynamodb create-global-table \
  --global-table-name prod-sessions \
  --replication-group \
    RegionName=ap-south-1 \
    RegionName=ap-southeast-1 \
  --region ap-south-1

## Create Redis replication group with Multi-AZ
aws elasticache create-replication-group \
  --replication-group-id prod-redis-sessions \
  --replication-group-description "Session cache prod" \
  --cache-node-type cache.t3.medium \
  --engine redis \
  --engine-version 7.0 \
  --num-cache-clusters 2 \
  --multi-az-enabled \
  --automatic-failover-enabled \
  --cache-subnet-group-name prod-cache-subnet-group \
  --security-group-ids sg-redis-prod \
  --at-rest-encryption-enabled \
  --transit-encryption-enabled \
  --region ap-south-1

## Set a key with expiry (session token)
redis-cli \
  -h prod-redis-sessions.abc123.cache.amazonaws.com \
  -p 6379 --tls \
  SET "session:user-98765" '{"uid":"98765","role":"user"}' \
  EX 86400  ## expire in 24 hours