B2B SaaS Platform on AWS
Mid-market, ~$4,200/month infrastructure

# Remove SSH ingress, add SSM managed policy
- ingress {
-   description = "SSH from office"
-   from_port   = 22
-   to_port     = 22
-   protocol    = "tcp"
-   cidr_blocks = ["1.2.3.4/32"]  # Your office IP
- }
+ # SSM Session Manager — IAM auth, fully audited, no port 22
+ resource "aws_iam_instance_profile" "ssm_profile" {
+   name = "ssm-managed-profile"
+   role = aws_iam_role.ssm_access.name
+ }
+ resource "aws_iam_role_policy_attachment" "ssm_managed" {
+   instance_profile = aws_iam_instance_profile.ssm_profile.name
+   policy_arn       = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
+ }
# Time to implement: ~30 minutes | Saves: $0/month | Risk reduced: Critical

+ resource "aws_cloudtrail" "main" {
+   name           = "security-trail"
+   s3_bucket_name = aws_s3_bucket.logs.id
+   is_multi_region_trail = true
+   enable_log_file_validation = true
+   include_global_service_events = true
+ }
+ resource "aws_flow_log" "vpc_logs" {
+   vpc_id         = aws_vpc.main.id
+   traffic_type    = "ALL"
+   log_destination = aws_cloudwatch_log_group.flow_logs.arn
+ }
# Estimated cost: ~$25–40/month | Time to implement: ~20 minutes

+ # S3 — enable by default (existing buckets, apply to all new objects)
+ resource "aws_s3_bucket_server_side_encryption_configuration" "app_uploads" {
+   bucket = aws_s3_bucket.app_uploads.id
+   rule {
+     apply_server_side_encryption_by_default {
+       sse_algorithm = "AES256"
+     }
+   }
+ }
# RDS: snapshot → encrypted restore → swap endpoint (maintenance window, ~45 min)
# S3 cost impact: negligible | Time to implement: ~30 minutes | Compliance impact: immediate

+ resource "aws_elasticache_replication_group" "sessions" {
+   replication_group_id       = "sessions-redis"
+   auth_token_enabled          = true
+   transit_encryption_enabled   = true
+   # Token stored in Secrets Manager — never in plaintext
+   num_node_groups              = 1
+   parameter_group_name         = "default.redis7"
+ }
# Enable AUTH on existing cluster: AWS Console → Modify → Auth Token → Apply immediately
# Time to implement: ~15 minutes | No downtime required

- # BEFORE: m5.2xlarge on-demand, 3 instances
- resource "aws_instance" "api_node" {
-   instance_type = "m5.2xlarge"
-   # ~$696/mo per instance × 3 = $2,088/mo
- }
+ # AFTER: m5.xlarge with Savings Plan, 3 instances
+ resource "aws_savings_plan" "compute" {
+   payment_option = "1_year"
+   plan_type      = "Compute"
+   commitment     = "696.0"  # 1-year, all upfront-equivalent hourly rate
+ }
+ resource "aws_instance" "api_node" {
+   instance_type = "m5.xlarge"  # 4 vCPU / 16 GiB — sufficient for this workload
+   # ~$174/mo per instance × 3 = $522/mo
+ }
# Right-sizing alone: $2,088 → $522/mo = -$1,566/mo
# With 1-year Savings Plan on remaining 2 instances: additional -$190/mo
# Total EC2 savings: ~$1,560–1,760/month | Time to implement: ~1 week (analyze first)

- # BEFORE: db.r5.2xlarge, on-demand
- resource "aws_db_instance" "prod_mysql" {
-   instance_class = "db.r5.2xlarge"  # $876/mo
-   allocated_storage = 500
-   storage_type       = "gp3"
- }
+ # AFTER: db.r6g.xlarge + 1-year Reserved Instance (no upfront)
+ resource "aws_db_instance" "prod_mysql" {
+   instance_class = "db.r6g.xlarge"  # $350/mo → $218/mo reserved
+   allocated_storage = 500
+   storage_type       = "gp3"
+   multi_az           = true  # Addresses the HA gap found in Architect Insights
+   monitoring_interval = 60
+   performance_insights_enabled = true
+ }
# On-demand cost: $876/mo → right-sized reserved: $218/mo
# Plus Multi-AZ enabled (kills two findings at once): ~+$265/mo
# Net savings: ~$393–530/mo | Time to implement: 2-week analysis + 1hr terraform

+ resource "aws_s3_bucket_lifecycle_configuration" "app_uploads_tiering" {
+   bucket = aws_s3_bucket.app_uploads.id
+   rule {
+     id     = "auto-tier-infrequent"
+     status = "Enabled"
+     filter { prefix = "" }  # applies to all objects
+     transition {
+       days          = 30
+       storage_class = "INTELLIGENT_TIERING"
+     }
+     transition {
+       days          = 90
+       storage_class = "GLACIER_INSTANT_RETRIEVAL"
+     }
+   }
+ }
# Intelligent-Tiering: auto-detects access patterns, moves objects as they age
# Estimated savings: $46/mo → $26/mo on existing 2TB = ~$20/mo + future growth savings
# Time to implement: ~20 minutes | Zero application changes

- # BEFORE: Single-AZ, no backup verification
- resource "aws_db_instance" "prod_mysql" {
-   multi_az               = false
-   backup_retention_period = 0  # backups disabled
-   skip_final_snapshot    = true
- }
+ # AFTER: Multi-AZ, 7-day retention, verified backups
+ resource "aws_db_instance" "prod_mysql" {
+   multi_az               = true
+   backup_retention_period = 7
+   backup_window           = "03:00-04:00"  # off-peak
+   maintenance_window     = "sun:04:00-sun:05:00"
+   copy_tags_to_snapshot   = true
+   monitoring_interval     = 60
+ }
# Run manual restore test: aws rds restore-db-instance-from-db-snapshot
# Time to implement: 30 minutes + monthly restore test | Cost: +$265/mo for Multi-AZ standby

+ resource "aws_autoscaling_group" "api_asg" {
+   name       = "api-cluster"
+   vpc_zone_identifier = [aws_subnet.private_1.id, aws_subnet.private_2.id]
+   min_size         = 2   # always-on baseline
+   max_size         = 6   # handle viral moments
+   desired_capacity = 3
+   health_check_type = "ELB"
+   launch_template { id = aws_launch_template.api.id, version = "$Latest" }
+   tag { key = "Name", value = "api-node", propagate_at_launch = true }
+ }
+ resource "aws_autoscaling_policy" "scale_up" {
+   scaling_adjustment   = 1
+   adjustment_type      = "ChangeInCapacity"
+   cooldown             = 300
+ }
# Estimated savings: $2,088/mo → $1,044/mo (2x right-sized + ASG)
# Time to implement: ~1–2 days | Resilience gain: critical

+ # S3 Cross-Region Replication — automatic, real-time
+ resource "aws_s3_bucket" "app_uploads_dr" {
+   bucket = "app-uploads-dr-us-west-2"
+   region = "us-west-2"
+ }
+ resource "aws_s3_bucket_replication_configuration" "app_uploads_crr" {
+   bucket = aws_s3_bucket.app_uploads.id
+   rule {
+     destination { bucket = aws_s3_bucket.app_uploads_dr.arn }
+     status = "Enabled"
+   }
+ }
# RDS: schedule cross-region snapshot copy via EventBridge + Lambda (or AWS Backup)
# Cost: ~$30–50/month | Time to implement: ~2 hours + runbook documentation