Common Patterns

import com.pulumi.aws.s3.*;
import com.pulumi.aws.s3.inputs.*;
import java.util.Map;

// Create bucket
var bucket = new Bucket("my-bucket", BucketArgs.builder()
    .bucket("my-unique-bucket-name")
    .build());

// Enable versioning
new BucketVersioningV2("bucket-versioning", BucketVersioningV2Args.builder()
    .bucket(bucket.id())
    .versioningConfiguration(BucketVersioningV2VersioningConfigurationArgs.builder()
        .status("Enabled")
        .build())
    .build());

// Enable encryption
new BucketServerSideEncryptionConfigurationV2("bucket-encryption",
    BucketServerSideEncryptionConfigurationV2Args.builder()
        .bucket(bucket.id())
        .rules(BucketServerSideEncryptionConfigurationV2RuleArgs.builder()
            .applyServerSideEncryptionByDefault(
                BucketServerSideEncryptionConfigurationV2RuleApplyServerSideEncryptionByDefaultArgs.builder()
                    .sseAlgorithm("AES256")
                    .build())
            .build())
        .build());

// Block public access
new BucketPublicAccessBlock("bucket-public-access", BucketPublicAccessBlockArgs.builder()
    .bucket(bucket.id())
    .blockPublicAcls(true)
    .blockPublicPolicy(true)
    .ignorePublicAcls(true)
    .restrictPublicBuckets(true)
    .build());

// Add lifecycle policy
new BucketLifecycleConfigurationV2("bucket-lifecycle",
    BucketLifecycleConfigurationV2Args.builder()
        .bucket(bucket.id())
        .rules(BucketLifecycleConfigurationV2RuleArgs.builder()
            .id("archive-old-versions")
            .status("Enabled")
            .noncurrentVersionTransitions(
                BucketLifecycleConfigurationV2RuleNoncurrentVersionTransitionArgs.builder()
                    .noncurrentDays(30)
                    .storageClass("GLACIER")
                    .build())
            .build())
        .build());

import com.pulumi.aws.ec2.*;
import com.pulumi.aws.ec2.inputs.*;
import java.util.List;
import java.util.Map;

// Create security group
var securityGroup = new SecurityGroup("web-sg", SecurityGroupArgs.builder()
    .description("Allow HTTP and SSH")
    .ingress(
        SecurityGroupIngressArgs.builder()
            .protocol("tcp")
            .fromPort(80)
            .toPort(80)
            .cidrBlocks(List.of("0.0.0.0/0"))
            .build(),
        SecurityGroupIngressArgs.builder()
            .protocol("tcp")
            .fromPort(22)
            .toPort(22)
            .cidrBlocks(List.of("YOUR_IP/32"))
            .build()
    )
    .egress(SecurityGroupEgressArgs.builder()
        .protocol("-1")
        .fromPort(0)
        .toPort(0)
        .cidrBlocks(List.of("0.0.0.0/0"))
        .build())
    .build());

// Get latest AMI
var ami = Ec2Functions.getAmi(GetAmiArgs.builder()
    .mostRecent(true)
    .owners(List.of("amazon"))
    .filters(List.of(GetAmiFilterArgs.builder()
        .name("name")
        .values(List.of("amzn2-ami-hvm-*-x86_64-gp2"))
        .build()))
    .build());

// Create instance
var instance = new Instance("web-server", InstanceArgs.builder()
    .instanceType("t2.micro")
    .ami(ami.applyValue(result -> result.id()))
    .vpcSecurityGroupIds(List.of(securityGroup.id()))
    .userData("""
        #!/bin/bash
        yum update -y
        yum install -y httpd
        systemctl start httpd
        echo "Hello World" > /var/www/html/index.html
        """)
    .tags(Map.of("Name", "web-server"))
    .build());

import com.pulumi.aws.iam.*;
import com.pulumi.aws.lambda.*;
import com.pulumi.asset.FileArchive;

// Create IAM role
var role = new Role("lambda-role", RoleArgs.builder()
    .assumeRolePolicy("""
        {
            "Version": "2012-10-17",
            "Statement": [{
                "Action": "sts:AssumeRole",
                "Principal": {"Service": "lambda.amazonaws.com"},
                "Effect": "Allow"
            }]
        }
        """)
    .build());

// Attach execution policy
new RolePolicyAttachment("lambda-policy", RolePolicyAttachmentArgs.builder()
    .role(role.name())
    .policyArn("arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole")
    .build());

// Create Lambda function
var lambda = new Function("my-function", FunctionArgs.builder()
    .runtime("python3.9")
    .role(role.arn())
    .handler("index.handler")
    .code(new FileArchive("./lambda-code"))
    .environment(FunctionEnvironmentArgs.builder()
        .variables(Map.of("ENV", "production"))
        .build())
    .timeout(30)
    .memorySize(256)
    .build());

// Create CloudWatch log group
import com.pulumi.aws.cloudwatch.*;

new LogGroup("lambda-logs", LogGroupArgs.builder()
    .name(lambda.name().apply(name -> "/aws/lambda/" + name))
    .retentionInDays(7)
    .build());

import com.pulumi.aws.rds.*;
import com.pulumi.aws.ec2.*;
import java.util.List;

// Create DB subnet group
var dbSubnetGroup = new SubnetGroup("db-subnet", SubnetGroupArgs.builder()
    .subnetIds(List.of(subnet1.id(), subnet2.id()))
    .tags(Map.of("Name", "db-subnet-group"))
    .build());

// Create security group for RDS
var dbSecurityGroup = new SecurityGroup("db-sg", SecurityGroupArgs.builder()
    .vpcId(vpc.id())
    .ingress(SecurityGroupIngressArgs.builder()
        .protocol("tcp")
        .fromPort(3306)
        .toPort(3306)
        .securityGroups(List.of(appSecurityGroup.id()))
        .build())
    .build());

// Create RDS instance
var db = new Instance("mysql-db", InstanceArgs.builder()
    .engine("mysql")
    .engineVersion("8.0")
    .instanceClass("db.t3.micro")
    .allocatedStorage(20)
    .dbName("myapp")
    .username("admin")
    .password(config.requireSecret("dbPassword"))
    .dbSubnetGroupName(dbSubnetGroup.name())
    .vpcSecurityGroupIds(List.of(dbSecurityGroup.id()))
    .skipFinalSnapshot(true)
    .backupRetentionPeriod(7)
    .multiAz(true)
    .storageEncrypted(true)
    .build());

import com.pulumi.aws.ec2.*;
import com.pulumi.aws.ec2.inputs.*;
import java.util.List;

// Create VPC
var vpc = new Vpc("main-vpc", VpcArgs.builder()
    .cidrBlock("10.0.0.0/16")
    .enableDnsHostnames(true)
    .enableDnsSupport(true)
    .tags(Map.of("Name", "main-vpc"))
    .build());

// Create Internet Gateway
var igw = new InternetGateway("igw", InternetGatewayArgs.builder()
    .vpcId(vpc.id())
    .build());

// Create public subnet
var publicSubnet = new Subnet("public-subnet", SubnetArgs.builder()
    .vpcId(vpc.id())
    .cidrBlock("10.0.1.0/24")
    .availabilityZone("us-west-2a")
    .mapPublicIpOnLaunch(true)
    .tags(Map.of("Name", "public-subnet"))
    .build());

// Create private subnet
var privateSubnet = new Subnet("private-subnet", SubnetArgs.builder()
    .vpcId(vpc.id())
    .cidrBlock("10.0.2.0/24")
    .availabilityZone("us-west-2a")
    .tags(Map.of("Name", "private-subnet"))
    .build());

// Create Elastic IP for NAT Gateway
var eip = new Eip("nat-eip", EipArgs.builder()
    .vpc(true)
    .build());

// Create NAT Gateway
var natGateway = new NatGateway("nat-gw", NatGatewayArgs.builder()
    .subnetId(publicSubnet.id())
    .allocationId(eip.id())
    .build());

// Create public route table
var publicRouteTable = new RouteTable("public-rt", RouteTableArgs.builder()
    .vpcId(vpc.id())
    .routes(RouteTableRouteArgs.builder()
        .cidrBlock("0.0.0.0/0")
        .gatewayId(igw.id())
        .build())
    .build());

// Create private route table
var privateRouteTable = new RouteTable("private-rt", RouteTableArgs.builder()
    .vpcId(vpc.id())
    .routes(RouteTableRouteArgs.builder()
        .cidrBlock("0.0.0.0/0")
        .natGatewayId(natGateway.id())
        .build())
    .build());

// Associate route tables
new RouteTableAssociation("public-rta", RouteTableAssociationArgs.builder()
    .subnetId(publicSubnet.id())
    .routeTableId(publicRouteTable.id())
    .build());

new RouteTableAssociation("private-rta", RouteTableAssociationArgs.builder()
    .subnetId(privateSubnet.id())
    .routeTableId(privateRouteTable.id())
    .build());

import com.pulumi.aws.iam.*;
import com.pulumi.core.Output;

// Create IAM role
var role = new Role("app-role", RoleArgs.builder()
    .assumeRolePolicy("""
        {
            "Version": "2012-10-17",
            "Statement": [{
                "Action": "sts:AssumeRole",
                "Principal": {"Service": "ec2.amazonaws.com"},
                "Effect": "Allow"
            }]
        }
        """)
    .build());

// Attach AWS managed policy
new RolePolicyAttachment("s3-readonly", RolePolicyAttachmentArgs.builder()
    .role(role.name())
    .policyArn("arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess")
    .build());

// Create custom inline policy
new RolePolicy("custom-policy", RolePolicyArgs.builder()
    .role(role.id())
    .policy(Output.format("""
        {
            "Version": "2012-10-17",
            "Statement": [{
                "Effect": "Allow",
                "Action": [
                    "dynamodb:GetItem",
                    "dynamodb:PutItem",
                    "dynamodb:Query"
                ],
                "Resource": "%s"
            }]
        }
        """, dynamoTable.arn()))
    .build());

// Create instance profile
var instanceProfile = new InstanceProfile("app-profile", InstanceProfileArgs.builder()
    .role(role.name())
    .build());

import com.pulumi.aws.dynamodb.*;
import com.pulumi.aws.dynamodb.inputs.*;
import java.util.List;

var table = new Table("users-table", TableArgs.builder()
    .name("users")
    .billingMode("PAY_PER_REQUEST")  // or "PROVISIONED"
    .hashKey("userId")
    .rangeKey("timestamp")
    .attributes(
        TableAttributeArgs.builder()
            .name("userId")
            .type("S")
            .build(),
        TableAttributeArgs.builder()
            .name("timestamp")
            .type("N")
            .build(),
        TableAttributeArgs.builder()
            .name("email")
            .type("S")
            .build()
    )
    .globalSecondaryIndexes(TableGlobalSecondaryIndexArgs.builder()
        .name("EmailIndex")
        .hashKey("email")
        .projectionType("ALL")
        .build())
    .pointInTimeRecovery(TablePointInTimeRecoveryArgs.builder()
        .enabled(true)
        .build())
    .serverSideEncryption(TableServerSideEncryptionArgs.builder()
        .enabled(true)
        .build())
    .tags(Map.of("Environment", "production"))
    .build());

import com.pulumi.aws.cloudwatch.*;
import com.pulumi.aws.sns.*;

// Create SNS topic for alerts
var alertTopic = new Topic("alerts", TopicArgs.builder()
    .name("cloudwatch-alerts")
    .build());

new TopicSubscription("alert-email", TopicSubscriptionArgs.builder()
    .topic(alertTopic.arn())
    .protocol("email")
    .endpoint("alerts@example.com")
    .build());

// Create CPU alarm
new MetricAlarm("high-cpu", MetricAlarmArgs.builder()
    .comparisonOperator("GreaterThanThreshold")
    .evaluationPeriods(2)
    .metricName("CPUUtilization")
    .namespace("AWS/EC2")
    .period(300)
    .statistic("Average")
    .threshold(80.0)
    .alarmDescription("Alert when CPU exceeds 80%")
    .alarmActions(List.of(alertTopic.arn()))
    .dimensions(Map.of("InstanceId", instance.id()))
    .build());

// Create Lambda error alarm
new MetricAlarm("lambda-errors", MetricAlarmArgs.builder()
    .comparisonOperator("GreaterThanThreshold")
    .evaluationPeriods(1)
    .metricName("Errors")
    .namespace("AWS/Lambda")
    .period(60)
    .statistic("Sum")
    .threshold(0.0)
    .alarmDescription("Alert on Lambda errors")
    .alarmActions(List.of(alertTopic.arn()))
    .dimensions(Map.of("FunctionName", lambda.name()))
    .build());

import com.pulumi.aws.ecs.*;
import com.pulumi.aws.ecs.inputs.*;
import com.pulumi.aws.iam.*;
import com.pulumi.aws.ec2.*;

// Create ECS cluster
var cluster = new Cluster("app-cluster", ClusterArgs.builder()
    .name("my-app-cluster")
    .build());

// Create task execution role
var executionRole = new Role("execution-role", RoleArgs.builder()
    .assumeRolePolicy("""
        {
            "Version": "2012-10-17",
            "Statement": [{
                "Action": "sts:AssumeRole",
                "Principal": {"Service": "ecs-tasks.amazonaws.com"},
                "Effect": "Allow"
            }]
        }
        """)
    .build());

new RolePolicyAttachment("execution-policy", RolePolicyAttachmentArgs.builder()
    .role(executionRole.name())
    .policyArn("arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy")
    .build());

// Create task definition
var taskDefinition = new TaskDefinition("app-task", TaskDefinitionArgs.builder()
    .family("my-app")
    .networkMode("awsvpc")
    .requiresCompatibilities(List.of("FARGATE"))
    .cpu("256")
    .memory("512")
    .executionRoleArn(executionRole.arn())
    .containerDefinitions(Output.format("""
        [{
            "name": "app",
            "image": "nginx:latest",
            "portMappings": [{
                "containerPort": 80,
                "protocol": "tcp"
            }],
            "logConfiguration": {
                "logDriver": "awslogs",
                "options": {
                    "awslogs-group": "/ecs/my-app",
                    "awslogs-region": "us-west-2",
                    "awslogs-stream-prefix": "ecs"
                }
            }
        }]
        """))
    .build());

// Create service
var service = new Service("app-service", ServiceArgs.builder()
    .cluster(cluster.id())
    .taskDefinition(taskDefinition.arn())
    .desiredCount(2)
    .launchType("FARGATE")
    .networkConfiguration(ServiceNetworkConfigurationArgs.builder()
        .subnets(List.of(subnet.id()))
        .securityGroups(List.of(securityGroup.id()))
        .assignPublicIp(true)
        .build())
    .build());

import com.pulumi.aws.lb.*;
import com.pulumi.aws.lb.inputs.*;
import java.util.List;

// Create ALB
var alb = new LoadBalancer("app-alb", LoadBalancerArgs.builder()
    .name("my-app-alb")
    .loadBalancerType("application")
    .subnets(List.of(publicSubnet1.id(), publicSubnet2.id()))
    .securityGroups(List.of(albSecurityGroup.id()))
    .build());

// Create target group
var targetGroup = new TargetGroup("app-tg", TargetGroupArgs.builder()
    .name("my-app-tg")
    .port(80)
    .protocol("HTTP")
    .vpcId(vpc.id())
    .targetType("ip")  // or "instance"
    .healthCheck(TargetGroupHealthCheckArgs.builder()
        .enabled(true)
        .path("/health")
        .interval(30)
        .timeout(5)
        .healthyThreshold(2)
        .unhealthyThreshold(2)
        .build())
    .build());

// Create listener
var listener = new Listener("http-listener", ListenerArgs.builder()
    .loadBalancerArn(alb.arn())
    .port(80)
    .protocol("HTTP")
    .defaultActions(ListenerDefaultActionArgs.builder()
        .type("forward")
        .targetGroupArn(targetGroup.arn())
        .build())
    .build());

// Register targets (for instance target type)
new TargetGroupAttachment("tg-attachment", TargetGroupAttachmentArgs.builder()
    .targetGroupArn(targetGroup.arn())
    .targetId(instance.id())
    .port(80)
    .build());

import com.pulumi.aws.sns.*;
import com.pulumi.aws.sqs.*;
import com.pulumi.core.Output;

// Create SNS topic
var topic = new Topic("notifications", TopicArgs.builder()
    .name("app-notifications")
    .build());

// Create SQS queue
var queue = new Queue("event-queue", QueueArgs.builder()
    .name("app-events")
    .visibilityTimeoutSeconds(300)
    .messageRetentionSeconds(86400)
    .receiveWaitTimeSeconds(10)
    .build());

// Create queue policy to allow SNS
new QueuePolicy("queue-policy", QueuePolicyArgs.builder()
    .queueUrl(queue.id())
    .policy(Output.tuple(queue.arn(), topic.arn()).apply(tuple -> {
        var queueArn = tuple.t1;
        var topicArn = tuple.t2;
        return String.format("""
            {
                "Version": "2012-10-17",
                "Statement": [{
                    "Effect": "Allow",
                    "Principal": {"Service": "sns.amazonaws.com"},
                    "Action": "sqs:SendMessage",
                    "Resource": "%s",
                    "Condition": {
                        "ArnEquals": {"aws:SourceArn": "%s"}
                    }
                }]
            }
            """, queueArn, topicArn);
    }))
    .build());

// Subscribe queue to topic
new TopicSubscription("queue-subscription", TopicSubscriptionArgs.builder()
    .topic(topic.arn())
    .protocol("sqs")
    .endpoint(queue.arn())
    .build());

import com.pulumi.aws.apigatewayv2.*;
import com.pulumi.aws.lambda.Permission;
import com.pulumi.aws.lambda.PermissionArgs;

// Create HTTP API
var api = new Api("http-api", ApiArgs.builder()
    .name("my-api")
    .protocolType("HTTP")
    .corsConfiguration(ApiCorsConfigurationArgs.builder()
        .allowOrigins(List.of("*"))
        .allowMethods(List.of("GET", "POST", "OPTIONS"))
        .allowHeaders(List.of("Content-Type", "Authorization"))
        .build())
    .build());

// Create Lambda integration
var integration = new Integration("lambda-integration", IntegrationArgs.builder()
    .apiId(api.id())
    .integrationType("AWS_PROXY")
    .integrationUri(lambda.arn())
    .integrationMethod("POST")
    .payloadFormatVersion("2.0")
    .build());

// Create routes
new Route("get-route", RouteArgs.builder()
    .apiId(api.id())
    .routeKey("GET /users")
    .target(integration.id().apply(id -> "integrations/" + id))
    .build());

// Create stage
new Stage("default-stage", StageArgs.builder()
    .apiId(api.id())
    .name("$default")
    .autoDeploy(true)
    .build());

// Grant API Gateway permission
new Permission("api-permission", PermissionArgs.builder()
    .action("lambda:InvokeFunction")
    .function(lambda.name())
    .principal("apigateway.amazonaws.com")
    .sourceArn(api.executionArn().apply(arn -> arn + "/*/*"))
    .build());

import com.pulumi.aws.cloudfront.*;
import com.pulumi.aws.cloudfront.inputs.*;

var distribution = new Distribution("cdn", DistributionArgs.builder()
    .enabled(true)
    .origins(DistributionOriginArgs.builder()
        .originId("s3-origin")
        .domainName(bucket.bucketRegionalDomainName())
        .s3OriginConfig(DistributionOriginS3OriginConfigArgs.builder()
            .originAccessIdentity(oai.cloudfrontAccessIdentityPath())
            .build())
        .build())
    .defaultCacheBehavior(DistributionDefaultCacheBehaviorArgs.builder()
        .targetOriginId("s3-origin")
        .viewerProtocolPolicy("redirect-to-https")
        .allowedMethods(List.of("GET", "HEAD", "OPTIONS"))
        .cachedMethods(List.of("GET", "HEAD"))
        .forwardedValues(DistributionDefaultCacheBehaviorForwardedValuesArgs.builder()
            .queryString(false)
            .cookies(DistributionDefaultCacheBehaviorForwardedValuesCookiesArgs.builder()
                .forward("none")
                .build())
            .build())
        .minTtl(0)
        .defaultTtl(3600)
        .maxTtl(86400)
        .compress(true)
        .build())
    .restrictions(DistributionRestrictionsArgs.builder()
        .geoRestriction(DistributionRestrictionsGeoRestrictionArgs.builder()
            .restrictionType("none")
            .build())
        .build())
    .viewerCertificate(DistributionViewerCertificateArgs.builder()
        .cloudfrontDefaultCertificate(true)
        .build())
    .build());

import com.pulumi.aws.secretsmanager.*;
import com.pulumi.core.Output;
import com.pulumi.serialization.internal.Serializer;

// Create secret
var secret = new Secret("db-credentials", SecretArgs.builder()
    .name("myapp/db/credentials")
    .description("Database credentials")
    .build());

// Store secret value
new SecretVersion("db-secret-version", SecretVersionArgs.builder()
    .secretId(secret.id())
    .secretString(Output.format("""
        {
            "username": "admin",
            "password": "%s",
            "host": "%s",
            "port": 3306,
            "database": "myapp"
        }
        """, config.requireSecret("dbPassword"), db.endpoint()))
    .build());

// Enable rotation (optional)
import com.pulumi.aws.lambda.Function;

new SecretRotation("db-rotation", SecretRotationArgs.builder()
    .secretId(secret.id())
    .rotationLambdaArn(rotationLambda.arn())
    .rotationRules(SecretRotationRotationRulesArgs.builder()
        .automaticallyAfterDays(30)
        .build())
    .build());

import com.pulumi.aws.rds.*;
import com.pulumi.aws.rds.inputs.*;

var cluster = new Cluster("aurora-cluster", ClusterArgs.builder()
    .clusterIdentifier("my-aurora-cluster")
    .engine("aurora-mysql")
    .engineMode("serverless")
    .engineVersion("5.7.mysql_aurora.2.10.1")
    .databaseName("myapp")
    .masterUsername("admin")
    .masterPassword(config.requireSecret("dbPassword"))
    .dbSubnetGroupName(dbSubnetGroup.name())
    .vpcSecurityGroupIds(List.of(dbSecurityGroup.id()))
    .scalingConfiguration(ClusterScalingConfigurationArgs.builder()
        .autoPause(true)
        .minCapacity(1)
        .maxCapacity(2)
        .secondsUntilAutoPause(300)
        .build())
    .enableHttpEndpoint(true)
    .backupRetentionPeriod(7)
    .skipFinalSnapshot(true)
    .storageEncrypted(true)
    .build());