# Paid Tier Deployment

This folder contains the **paid tier** configuration for the malware crawler application. This is the production-ready deployment with full features, security, and scalability.

## 🏗️ **Paid Tier Architecture**

```
┌─────────────────────────────────────────────────────────────┐
│                    AWS Paid Tier Deployment                 │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  ┌─────────────────┐    ┌─────────────────┐                │
│  │   Application   │    │   Application   │                │
│  │   Load Balancer │    │   Load Balancer │                │
│  │   (ALB)         │    │   (ALB)         │                │
│  └─────────────────┘    └─────────────────┘                │
│           │                       │                        │
│  ┌─────────────────┐    ┌─────────────────┐                │
│  │   ECS Fargate   │    │   ECS Fargate   │                │
│  │   (Multi-AZ)    │    │   (Multi-AZ)    │                │
│  └─────────────────┘    └─────────────────┘                │
│           │                       │                        │
│  ┌─────────────────┐    ┌─────────────────┐                │
│  │   RDS Postgres  │    │  ElastiCache    │                │
│  │   (Multi-AZ)    │    │  Redis (Multi-AZ)│               │
│  │   (Encrypted)   │    │  (Encrypted)    │                │
│  └─────────────────┘    └─────────────────┘                │
│           │                       │                        │
│  ┌─────────────────┐    ┌─────────────────┐                │
│  │   S3 Buckets    │    │   ECR Registry  │                │
│  │   (Encrypted)   │    │   (Encrypted)   │                │
│  └─────────────────┘    └─────────────────┘                │
│                                                             │
│  🔒 VPC with Private Subnets, NAT Gateway, Security Groups │
└─────────────────────────────────────────────────────────────┘
```

## 📁 **Folder Structure**

```
paid/
├── terraform/           # Terraform configuration for paid tier
│   ├── main.tf         # Main Terraform configuration
│   ├── variables.tf    # Variable definitions
│   ├── vpc.tf          # VPC and networking
│   ├── security.tf     # Security groups and IAM
│   ├── database.tf     # RDS and ElastiCache
│   ├── storage.tf      # S3 buckets
│   ├── ecs.tf          # ECS Fargate configuration
│   ├── alb.tf          # Application Load Balancer
│   ├── outputs.tf      # Output values
│   └── destroy.tf      # Destroy-time configurations
├── .github/workflows/  # GitHub Actions workflows
│   ├── deploy.yml      # Main deployment workflow
│   └── terraform-state.yml # Terraform state management
├── .aws/               # AWS-specific files
│   └── task-definition.json # ECS task definition
└── scripts/            # Utility scripts
    ├── teardown.sh     # Complete teardown script
    ├── teardown.ps1    # PowerShell teardown script
    ├── selective-teardown.sh # Interactive teardown
    ├── emergency-teardown.sh # Force teardown
    └── cost-monitor.sh # Cost monitoring script
```

## 🚀 **Key Features (Paid Tier)**

### **✅ Production-Ready Features**
- **Application Load Balancer** for high availability
- **Multi-AZ deployment** for fault tolerance
- **Encryption at rest** for all data
- **Encryption in transit** with SSL/TLS
- **Automatic backups** for databases
- **CloudWatch monitoring** and alerting
- **Auto-scaling** based on demand
- **Private networking** with NAT Gateway

### **✅ Security Features**
- **VPC with private subnets** for secure networking
- **Security groups** with least-privilege access
- **IAM roles** with minimal permissions
- **Secrets Manager** for sensitive data
- **WAF** for web application protection
- **Encrypted storage** for all data

### **✅ Scalability Features**
- **Auto-scaling groups** for ECS services
- **Load balancer** for traffic distribution
- **Multi-AZ** for high availability
- **ElastiCache** for performance
- **CloudWatch** for monitoring

## 💰 **Estimated Costs (Paid Tier)**

| Resource | Configuration | Monthly Cost |
|----------|---------------|--------------|
| Application Load Balancer | Standard | ~$20.00 |
| ECS Fargate | 2 vCPU, 4 GB RAM | ~$60.00 |
| RDS PostgreSQL | db.t3.medium, Multi-AZ | ~$80.00 |
| ElastiCache Redis | cache.t3.medium, Multi-AZ | ~$40.00 |
| S3 Storage | 100 GB | ~$3.00 |
| ECR Storage | 10 GB | ~$1.00 |
| CloudWatch | Logs and metrics | ~$10.00 |
| NAT Gateway | Data transfer | ~$45.00 |
| **Total** | **Production setup** | **~$260.00** |

## 🔧 **Deployment Options**

### **Option 1: GitHub Actions (Recommended)**
1. **Go to Actions tab** in your repository
2. **Select "Deploy to AWS" workflow**
3. **Click "Run workflow"**
4. **Choose "prod" environment**
5. **Wait 15-20 minutes** for deployment

### **Option 2: Manual Deployment**
```bash
cd paid/terraform
cp terraform.tfvars.example terraform.tfvars
# Edit terraform.tfvars with your settings
terraform init
terraform plan
terraform apply
```

## 🛠️ **Prerequisites**

### **AWS Account Requirements**
- **AWS account** with billing enabled
- **IAM user** with appropriate permissions
- **Domain name** (optional, for custom SSL)
- **SSL certificate** (optional, for HTTPS)

### **GitHub Repository Setup**
- **Repository secrets** configured:
  - `AWS_ACCESS_KEY_ID`
  - `AWS_SECRET_ACCESS_KEY`
  - `DOMAIN_NAME` (optional)
  - `SSL_CERTIFICATE_ARN` (optional)

## 📊 **Monitoring and Maintenance**

### **Health Checks**
- **Application Load Balancer** health checks
- **ECS service** health checks
- **RDS** automated backups
- **CloudWatch** alarms and metrics

### **Logs and Monitoring**
- **CloudWatch Logs** for application logs
- **CloudWatch Metrics** for performance
- **CloudWatch Alarms** for alerting
- **AWS X-Ray** for distributed tracing

### **Backup and Recovery**
- **RDS automated backups** (7-35 days)
- **S3 versioning** for file storage
- **ECS task definitions** versioned
- **Terraform state** backed up to S3

## 🔒 **Security Considerations**

### **Network Security**
- **VPC with private subnets** for application
- **Public subnets** only for load balancer
- **NAT Gateway** for outbound internet access
- **Security groups** with least-privilege access

### **Data Security**
- **Encryption at rest** for all storage
- **Encryption in transit** for all communication
- **Secrets Manager** for sensitive data
- **IAM roles** with minimal permissions

### **Application Security**
- **WAF** for web application protection
- **SSL/TLS** for secure communication
- **Security headers** in application
- **Input validation** and sanitization

## 🚨 **Important Notes**

### **Production Considerations**
- **High availability** with multi-AZ deployment
- **Auto-scaling** for traffic spikes
- **Monitoring** and alerting configured
- **Backup** and disaster recovery

### **Cost Management**
- **Monitor costs** in AWS Billing Dashboard
- **Set up billing alerts** for budget limits
- **Use cost allocation tags** for tracking
- **Review and optimize** regularly

### **Maintenance**
- **Regular updates** of container images
- **Security patches** for dependencies
- **Database maintenance** windows
- **Infrastructure updates** via Terraform

## 🎯 **Next Steps**

1. **Review the configuration** in `terraform/` folder
2. **Set up GitHub secrets** for deployment
3. **Deploy using GitHub Actions** or manually
4. **Configure monitoring** and alerting
5. **Set up backup** and recovery procedures
6. **Test the application** thoroughly
7. **Monitor costs** and optimize

## 📚 **Additional Resources**

- [AWS ECS Best Practices](https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/)
- [AWS RDS Best Practices](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/CHAP_BestPractices.html)
- [AWS Security Best Practices](https://aws.amazon.com/architecture/security-identity-compliance/)
- [Terraform AWS Provider](https://registry.terraform.io/providers/hashicorp/aws/latest/docs)

---

**For free tier deployment, use the files in the root directory instead of this paid folder.**
