# Ejemplo declarativo con Terraform
resource "aws_instance" "web_server" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  tags = {
    Name = "WebServer"
  }
}

# Ejemplo imperativo con script
import boto3

ec2 = boto3.client('ec2')
ec2.run_instances(
    ImageId='ami-0c55b159cbfafe1f0',
    InstanceType='t2.micro',
    MinCount=1,
    MaxCount=1,
    TagSpecifications=[
        {
            'ResourceType': 'instance',
            'Tags': [
                {
                    'Key': 'Name',
                    'Value': 'WebServer'
                },
            ]
        },
    ]
)

# Ejemplo de arquitectura multi-tier con Terraform

# Configuración de proveedor
provider "aws" {
  region = "us-west-2"
}

# Red Virtual
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  tags = {
    Name = "Production-VPC"
  }
}

# Subredes
resource "aws_subnet" "public" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-west-2a"
  tags = {
    Name = "Public-Subnet"
  }
}

resource "aws_subnet" "private" {
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.2.0/24"
  availability_zone = "us-west-2b"
  tags = {
    Name = "Private-Subnet"
  }
}

# Grupo de seguridad
resource "aws_security_group" "web" {
  name        = "web-sg"
  description = "Allow web traffic"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# Instancia EC2
resource "aws_instance" "web" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  subnet_id     = aws_subnet.public.id
  vpc_security_group_ids = [aws_security_group.web.id]
  
  tags = {
    Name = "Web-Server"
  }
}

# Salida
output "web_server_ip" {
  value = aws_instance.web.public_ip
}

# Ejemplo de configuración de servidor web con Ansible

---
- name: Configurar servidor web
  hosts: webservers
  become: yes
  vars:
    http_port: 80
    https_port: 443
    app_name: "mi_aplicacion"
    app_version: "1.2.3"
    
  tasks:
    - name: Actualizar paquetes
      apt:
        update_cache: yes
        upgrade: dist
      when: ansible_os_family == "Debian"
    
    - name: Instalar Nginx
      package:
        name: nginx
        state: present
    
    - name: Crear directorio de aplicación
      file:
        path: "/var/www/{{ app_name }}"
        state: directory
        owner: www-data
        group: www-data
        mode: '0755'
    
    - name: Desplegar configuración de Nginx
      template:
        src: templates/nginx-site.conf.j2
        dest: "/etc/nginx/sites-available/{{ app_name }}.conf"
      notify: Reiniciar Nginx
    
    - name: Habilitar sitio
      file:
        src: "/etc/nginx/sites-available/{{ app_name }}.conf"
        dest: "/etc/nginx/sites-enabled/{{ app_name }}.conf"
        state: link
      notify: Reiniciar Nginx
    
    - name: Desplegar aplicación
      git:
        repo: "https://github.com/empresa/{{ app_name }}.git"
        version: "v{{ app_version }}"
        dest: "/var/www/{{ app_name }}"
      notify: Reiniciar aplicación
    
  handlers:
    - name: Reiniciar Nginx
      service:
        name: nginx
        state: restarted
    
    - name: Reiniciar aplicación
      systemd:
        name: "{{ app_name }}"
        state: restarted

// Ejemplo de Pulumi con TypeScript

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Crear un bucket de S3
const dataBucket = new aws.s3.Bucket("data-bucket", {
    acl: "private",
    versioning: {
        enabled: true,
    },
    serverSideEncryptionConfiguration: {
        rule: {
            applyServerSideEncryptionByDefault: {
                sseAlgorithm: "AES256",
            },
        },
    },
    tags: {
        Environment: "Production",
        Project: "DataLake",
    },
});

// Crear una tabla de DynamoDB
const userTable = new aws.dynamodb.Table("user-table", {
    attributes: [
        { name: "userId", type: "S" },
    ],
    hashKey: "userId",
    billingMode: "PAY_PER_REQUEST",
    pointInTimeRecovery: {
        enabled: true,
    },
    tags: {
        Environment: "Production",
        Project: "UserManagement",
    },
});

// Exportar información
export const bucketName = dataBucket.id;
export const tableName = userTable.name;

# Implementación de inmutabilidad con Packer + Terraform

# 1. Definición de imagen con Packer (packer.json)
{
  "builders": [{
    "type": "amazon-ebs",
    "region": "us-west-2",
    "source_ami_filter": {
      "filters": {
        "virtualization-type": "hvm",
        "name": "ubuntu/images/*ubuntu-focal-20.04-amd64-server-*",
        "root-device-type": "ebs"
      },
      "owners": ["099720109477"],
      "most_recent": true
    },
    "instance_type": "t2.micro",
    "ssh_username": "ubuntu",
    "ami_name": "app-{{timestamp}}",
    "tags": {
      "Application": "WebApp",
      "Version": "1.2.0"
    }
  }],
  "provisioners": [
    {
      "type": "shell",
      "inline": [
        "sudo apt-get update",
        "sudo apt-get install -y nginx nodejs npm",
        "sudo systemctl enable nginx"
      ]
    },
    {
      "type": "file",
      "source": "app/",
      "destination": "/tmp/app"
    },
    {
      "type": "shell",
      "inline": [
        "sudo mkdir -p /var/www/app",
        "sudo cp -R /tmp/app/* /var/www/app/",
        "sudo chown -R www-data:www-data /var/www/app"
      ]
    }
  ]
}

# 2. Uso de la AMI inmutable en Terraform
resource "aws_launch_template" "app" {
  name_prefix   = "app-"
  image_id      = "ami-1234567890abcdef0"  # AMI generada por Packer
  instance_type = "t2.micro"
  
  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_autoscaling_group" "app" {
  desired_capacity    = 3
  max_size            = 10
  min_size            = 1
  vpc_zone_identifier = [aws_subnet.private_a.id, aws_subnet.private_b.id]
  
  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }
  
  lifecycle {
    create_before_destroy = true
  }
}

# Estructura de módulos en Terraform

# modules/vpc/main.tf
resource "aws_vpc" "this" {
  cidr_block = var.cidr_block
  tags       = var.tags
}

resource "aws_subnet" "public" {
  count             = length(var.public_subnets)
  vpc_id            = aws_vpc.this.id
  cidr_block        = var.public_subnets[count.index]
  availability_zone = var.azs[count.index % length(var.azs)]
  
  tags = merge(
    var.tags,
    {
      Name = "Public-${count.index}"
    }
  )
}

# modules/vpc/variables.tf
variable "cidr_block" {
  description = "CIDR block for the VPC"
  type        = string
}

variable "public_subnets" {
  description = "List of public subnet CIDR blocks"
  type        = list(string)
}

variable "azs" {
  description = "List of availability zones"
  type        = list(string)
}

variable "tags" {
  description = "Tags to apply to resources"
  type        = map(string)
  default     = {}
}

# modules/vpc/outputs.tf
output "vpc_id" {
  description = "ID of the VPC"
  value       = aws_vpc.this.id
}

output "public_subnet_ids" {
  description = "IDs of the public subnets"
  value       = aws_subnet.public[*].id
}

# Uso del módulo
module "network" {
  source = "./modules/vpc"
  
  cidr_block     = "10.0.0.0/16"
  public_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
  azs            = ["us-west-2a", "us-west-2b"]
  
  tags = {
    Environment = "Production"
    Project     = "E-commerce"
  }
}

# Referencia a outputs del módulo
resource "aws_instance" "app" {
  ami           = "ami-0c55b159cbfafe1f0"
  instance_type = "t2.micro"
  subnet_id     = module.network.public_subnet_ids[0]
  
  tags = {
    Name = "App-Server"
  }
}

# Configuración de backend remoto en Terraform

terraform {
  backend "s3" {
    bucket         = "company-terraform-state"
    key            = "production/network/terraform.tfstate"
    region         = "us-west-2"
    dynamodb_table = "terraform-lock"
    encrypt        = true
    role_arn       = "arn:aws:iam::123456789012:role/TerraformStateManager"
  }
}

# Ejemplo de GitHub Actions para Terraform

name: Terraform CI/CD

on:
  push:
    branches: [ main ]
    paths:
      - 'terraform/**'
  pull_request:
    branches: [ main ]
    paths:
      - 'terraform/**'

jobs:
  validate:
    name: Validate
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.0.0

      - name: Terraform Format
        id: fmt
        run: terraform fmt -check -recursive
        working-directory: ./terraform

      - name: Terraform Init
        id: init
        run: terraform init -backend=false
        working-directory: ./terraform

      - name: Terraform Validate
        id: validate
        run: terraform validate
        working-directory: ./terraform
        
      - name: Run TFLint
        uses: terraform-linters/setup-tflint@v2
        with:
          tflint_version: v0.29.0
      - run: tflint --recursive
        working-directory: ./terraform

  plan:
    name: Plan
    needs: validate
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request'
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.0.0
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Terraform Init
        id: init
        run: terraform init
        working-directory: ./terraform

      - name: Terraform Plan
        id: plan
        run: terraform plan -no-color
        working-directory: ./terraform
        
      - name: Update Pull Request
        uses: actions/github-script@v5
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const output = `#### Terraform Plan 📝\`${{ steps.plan.outcome }}\`
            
            <details><summary>Show Plan</summary>
            
            \`\`\`terraform
            ${{ steps.plan.outputs.stdout }}
            \`\`\`
            
            </details>`;
              
            github.rest.issues.createComment({
              issue_number: context.issue.number,
              owner: context.repo.owner,
              repo: context.repo.repo,
              body: output
            })

  apply:
    name: Apply
    needs: validate
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    steps:
      - name: Checkout
        uses: actions/checkout@v3

      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: 1.0.0
          cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

      - name: Terraform Init
        id: init
        run: terraform init
        working-directory: ./terraform

      - name: Terraform Plan
        id: plan
        run: terraform plan -out=tfplan
        working-directory: ./terraform
        
      - name: Terraform Apply
        run: terraform apply -auto-approve tfplan
        working-directory: ./terraform

# Flux v2 para GitOps de infraestructura

# GitRepository que apunta al repositorio de infraestructura
apiVersion: source.toolkit.fluxcd.io/v1beta1
kind: GitRepository
metadata:
  name: infrastructure-repo
  namespace: flux-system
spec:
  interval: 1m
  url: https://github.com/empresa/infrastructure
  ref:
    branch: main
  secretRef:
    name: infra-repo-auth

---
# Terraform Controller para aplicar configuración
apiVersion: infra.contrib.fluxcd.io/v1alpha1
kind: Terraform
metadata:
  name: production-network
  namespace: flux-system
spec:
  interval: 15m
  path: ./environments/production/network
  sourceRef:
    kind: GitRepository
    name: infrastructure-repo
  approvePlan: auto
  varsFrom:
    - kind: Secret
      name: tf-secrets
  writeOutputsToSecret:
    name: network-outputs
    outputs:
      - vpc_id
      - subnet_ids

# Ejemplo de organización jerárquica en Terraform
.
├── environments/
│   ├── development/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   ├── outputs.tf
│   │   └── terraform.tfvars
│   ├── staging/
│   │   └── .
│   └── production/
│       └── .
├── modules/
│   ├── networking/
│   │   ├── main.tf
│   │   ├── variables.tf
│   │   └── outputs.tf
│   ├── compute/
│   │   └── .
│   └── database/
│       └── .
└── global/
    ├── iam/
    │   └── .
    └── dns/
        └── .

# Integración de Vault con Terraform

provider "vault" {
  address = "https://vault.ejemplo.com:8200"
}

data "vault_generic_secret" "db_credentials" {
  path = "secret/database/credentials"
}

resource "aws_db_instance" "database" {
  allocated_storage    = 10
  engine               = "mysql"
  engine_version       = "5.7"
  instance_class       = "db.t3.micro"
  name                 = "production"
  username             = data.vault_generic_secret.db_credentials.data["username"]
  password             = data.vault_generic_secret.db_credentials.data["password"]
  parameter_group_name = "default.mysql5.7"
  skip_final_snapshot  = true
}

# Estrategia blue-green con Terraform

# Infraestructura "Blue" (actual)
resource "aws_autoscaling_group" "blue" {
  name                 = "app-blue-${var.app_version}"
  launch_configuration = aws_launch_configuration.blue.id
  min_size             = var.blue_instances
  max_size             = var.blue_instances
  vpc_zone_identifier  = var.subnet_ids
  
  tag {
    key                 = "Name"
    value               = "Blue-${var.app_version}"
    propagate_at_launch = true
  }
}

# Infraestructura "Green" (nueva)
resource "aws_autoscaling_group" "green" {
  name                 = "app-green-${var.new_app_version}"
  launch_configuration = aws_launch_configuration.green.id
  min_size             = var.green_instances
  max_size             = var.green_instances
  vpc_zone_identifier  = var.subnet_ids
  
  tag {
    key                 = "Name"
    value               = "Green-${var.new_app_version}"
    propagate_at_launch = true
  }
  
  # Solo activar cuando esté listo
  count = var.enable_green ? 1 : 0
}

# Balanceador que cambia progresivamente
resource "aws_lb_target_group_attachment" "blue" {
  target_group_arn = aws_lb_target_group.main.arn
  target_id        = aws_autoscaling_group.blue.id
  port             = 80
}

resource "aws_lb_target_group_attachment" "green" {
  target_group_arn = aws_lb_target_group.main.arn
  target_id        = aws_autoscaling_group.green[0].id
  port             = 80
  count            = var.enable_green ? 1 : 0
}

# Ejemplo con Crossplane para ofrecer infraestructura como API

apiVersion: database.example.org/v1alpha1
kind: PostgreSQLInstance
metadata:
  name: app-database
spec:
  parameters:
    version: "13"
    size: "small"
    storageGB: 20
    highAvailability: true
  compositionSelector:
    matchLabels:
      provider: aws
      environment: production
---
# Uso por desarrolladores:
apiVersion: apps/v1
kind: Deployment
metadata:
  name: backend-app
spec:
  template:
    spec:
      containers:
      - name: app
        image: my-app:latest
        env:
        - name: DB_CONNECTION
          valueFrom:
            secretKeyRef:
              name: app-database-conn
              key: connection-string

# Ejemplo con Sentinel para políticas en Terraform Cloud

# Política: Todos los buckets S3 deben tener encriptación por defecto
s3_bucket_encryption = func() {
  violations = []
  
  for aws_s3_buckets as bucket {
    if not bucket.server_side_encryption_configuration {
      violations += {
        "address": bucket.address,
        "message": "Bucket must have encryption enabled"
      }
    }
  }
  
  return violations
}

# Política: Todas las instancias EC2 deben tener tags obligatorios
ec2_required_tags = func() {
  required_tags = ["Environment", "Department", "CostCenter"]
  violations = []
  
  for aws_instances as instance {
    tags = instance.tags else {}
    missing_tags = []
    
    for required_tags as tag {
      if not tags contains tag {
        missing_tags += [tag]
      }
    }
    
    if length(missing_tags) > 0 {
      violations += {
        "address": instance.address,
        "missing_tags": missing_tags
      }
    }
  }
  
  return violations
}

# Evaluación principal
main = rule {
  length(s3_bucket_encryption()) == 0 and
  length(ec2_required_tags()) == 0
}