# Erweiterte Object-Definition für Database-Konfiguration
variable "database_config" {
  description = "Complete database configuration for different environments"
  type = object({
    # Basis-Konfiguration
    engine         = string
    engine_version = string
    instance_class = string
    
    # Storage-Konfiguration
    storage_type      = string
    allocated_storage = number
    max_storage      = number
    storage_encrypted = bool
    
    # Backup-Konfiguration
    backup_enabled         = bool
    backup_retention_days  = number
    backup_window         = string
    maintenance_window    = string
    
    # Monitoring-Konfiguration
    monitoring_enabled    = bool
    monitoring_interval   = number
    performance_insights  = bool
    
    # Network-Konfiguration
    subnet_group_name     = string
    security_group_ids    = list(string)
    publicly_accessible   = bool
    
    # Tags und Metadaten
    tags = map(string)
    
    # Erweiterte Optionen
    parameters = map(string)
  })
  
  validation {
    condition = contains(["mysql", "postgres", "mariadb"], var.database_config.engine)
    error_message = "Database engine must be mysql, postgres, or mariadb."
  }
  
  validation {
    condition = var.database_config.allocated_storage >= 20 && var.database_config.allocated_storage <= 1000
    error_message = "Allocated storage must be between 20 and 1000 GB."
  }
  
  validation {
    condition = var.database_config.backup_retention_days >= 0 && var.database_config.backup_retention_days <= 35
    error_message = "Backup retention must be between 0 and 35 days."
  }
}

# Umgebungsspezifische Database-Konfigurationen
locals {
  database_configs = {
    dev = {
      engine         = "mysql"
      engine_version = "8.0"
      instance_class = "db.t3.micro"
      
      storage_type      = "gp2"
      allocated_storage = 20
      max_storage      = 50
      storage_encrypted = false
      
      backup_enabled        = false
      backup_retention_days = 0
      backup_window        = "03:00-04:00"
      maintenance_window   = "sun:04:00-sun:05:00"
      
      monitoring_enabled   = false
      monitoring_interval  = 0
      performance_insights = false
      
      subnet_group_name   = "dev-db-subnet-group"
      security_group_ids  = ["sg-dev-db"]
      publicly_accessible = false
      
      tags = {
        Environment = "development"
        BackupPolicy = "none"
        CostCenter  = "engineering"
      }
      
      parameters = {
        "innodb_buffer_pool_size" = "128M"
        "max_connections"         = "100"
      }
    }
    
    staging = {
      engine         = "mysql"
      engine_version = "8.0"
      instance_class = "db.t3.small"
      
      storage_type      = "gp3"
      allocated_storage = 50
      max_storage      = 200
      storage_encrypted = true
      
      backup_enabled        = true
      backup_retention_days = 7
      backup_window        = "03:00-04:00"
      maintenance_window   = "sun:04:00-sun:05:00"
      
      monitoring_enabled   = true
      monitoring_interval  = 60
      performance_insights = true
      
      subnet_group_name   = "staging-db-subnet-group"
      security_group_ids  = ["sg-staging-db"]
      publicly_accessible = false
      
      tags = {
        Environment = "staging"
        BackupPolicy = "weekly"
        CostCenter  = "engineering"
      }
      
      parameters = {
        "innodb_buffer_pool_size" = "256M"
        "max_connections"         = "200"
      }
    }
    
    prod = {
      engine         = "mysql"
      engine_version = "8.0"
      instance_class = "db.r5.large"
      
      storage_type      = "gp3"
      allocated_storage = 200
      max_storage      = 1000
      storage_encrypted = true
      
      backup_enabled        = true
      backup_retention_days = 30
      backup_window        = "03:00-04:00"
      maintenance_window   = "sun:04:00-sun:05:00"
      
      monitoring_enabled   = true
      monitoring_interval  = 15
      performance_insights = true
      
      subnet_group_name   = "prod-db-subnet-group"
      security_group_ids  = ["sg-prod-db-primary", "sg-prod-db-backup"]
      publicly_accessible = false
      
      tags = {
        Environment = "production"
        BackupPolicy = "daily"
        CostCenter  = "operations"
        Compliance  = "required"
      }
      
      parameters = {
        "innodb_buffer_pool_size" = "1024M"
        "max_connections"         = "500"
        "slow_query_log"         = "1"
        "long_query_time"        = "2"
      }
    }
  }
  
  # Aktuelle Environment-Konfiguration
  current_db_config = local.database_configs[var.environment]
}

# RDS-Instanz mit Object-Konfiguration
resource "aws_db_instance" "main" {
  identifier = "${var.project_name}-${var.environment}-db"
  
  # Engine-Konfiguration
  engine         = local.current_db_config.engine
  engine_version = local.current_db_config.engine_version
  instance_class = local.current_db_config.instance_class
  
  # Storage-Konfiguration
  storage_type      = local.current_db_config.storage_type
  allocated_storage = local.current_db_config.allocated_storage
  max_allocated_storage = local.current_db_config.max_storage
  storage_encrypted = local.current_db_config.storage_encrypted
  
  # Backup-Konfiguration
  backup_retention_period = local.current_db_config.backup_retention_days
  backup_window          = local.current_db_config.backup_window
  maintenance_window     = local.current_db_config.maintenance_window
  
  # Monitoring-Konfiguration
  monitoring_interval                = local.current_db_config.monitoring_interval
  monitoring_role_arn               = local.current_db_config.monitoring_enabled ? aws_iam_role.rds_monitoring[0].arn : null
  performance_insights_enabled       = local.current_db_config.performance_insights
  performance_insights_retention_period = local.current_db_config.performance_insights ? 7 : null
  
  # Network-Konfiguration
  db_subnet_group_name   = local.current_db_config.subnet_group_name
  vpc_security_group_ids = local.current_db_config.security_group_ids
  publicly_accessible    = local.current_db_config.publicly_accessible
  
  # Database-Konfiguration
  db_name  = "${var.project_name}_${var.environment}"
  username = var.db_username
  password = var.db_password
  
  # Tags
  tags = merge(
    local.current_db_config.tags,
    {
      Name = "${var.project_name}-${var.environment}-db"
    }
  )
  
  # Lifecycle-Management
  lifecycle {
    prevent_destroy = true
  }
}

# Parameter Group für Database-Optimierung
resource "aws_db_parameter_group" "main" {
  family = "${local.current_db_config.engine}${substr(local.current_db_config.engine_version, 0, 3)}"
  name   = "${var.project_name}-${var.environment}-params"
  
  dynamic "parameter" {
    for_each = local.current_db_config.parameters
    content {
      name  = parameter.key
      value = parameter.value
    }
  }
  
  tags = local.current_db_config.tags
}

# Erweiterte Object-Definition für Database-Konfiguration
variable "database_config" {
  description = "Complete database configuration for different environments"
  type = object({
    # Basis-Konfiguration
    engine         = string
    engine_version = string
    instance_class = string
    
    # Storage-Konfiguration
    storage_type      = string
    allocated_storage = number
    max_storage      = number
    storage_encrypted = bool
    
    # Backup-Konfiguration
    backup_enabled         = bool
    backup_retention_days  = number
    backup_window         = string
    maintenance_window    = string
    
    # Monitoring-Konfiguration
    monitoring_enabled    = bool
    monitoring_interval   = number
    performance_insights  = bool
    
    # Network-Konfiguration
    subnet_group_name     = string
    security_group_ids    = list(string)
    publicly_accessible   = bool
    
    # Tags und Metadaten
    tags = map(string)
    
    # Erweiterte Optionen
    parameters = map(string)
  })
  
  validation {
    condition = contains(["mysql", "postgres", "mariadb"], var.database_config.engine)
    error_message = "Database engine must be mysql, postgres, or mariadb."
  }
  
  validation {
    condition = var.database_config.allocated_storage >= 20 && var.database_config.allocated_storage <= 1000
    error_message = "Allocated storage must be between 20 and 1000 GB."
  }
  
  validation {
    condition = var.database_config.backup_retention_days >= 0 && var.database_config.backup_retention_days <= 35
    error_message = "Backup retention must be between 0 and 35 days."
  }
}

# Umgebungsspezifische Database-Konfigurationen
locals {
  database_configs = {
    dev = {
      engine         = "mysql"
      engine_version = "8.0"
      instance_class = "db.t3.micro"
      
      storage_type      = "gp2"
      allocated_storage = 20
      max_storage      = 50
      storage_encrypted = false
      
      backup_enabled        = false
      backup_retention_days = 0
      backup_window        = "03:00-04:00"
      maintenance_window   = "sun:04:00-sun:05:00"
      
      monitoring_enabled   = false
      monitoring_interval  = 0
      performance_insights = false
      
      subnet_group_name   = "dev-db-subnet-group"
      security_group_ids  = ["sg-dev-db"]
      publicly_accessible = false
      
      tags = {
        Environment = "development"
        BackupPolicy = "none"
        CostCenter  = "engineering"
      }
      
      parameters = {
        "innodb_buffer_pool_size" = "128M"
        "max_connections"         = "100"
      }
    }
    
    staging = {
      engine         = "mysql"
      engine_version = "8.0"
      instance_class = "db.t3.small"
      
      storage_type      = "gp3"
      allocated_storage = 50
      max_storage      = 200
      storage_encrypted = true
      
      backup_enabled        = true
      backup_retention_days = 7
      backup_window        = "03:00-04:00"
      maintenance_window   = "sun:04:00-sun:05:00"
      
      monitoring_enabled   = true
      monitoring_interval  = 60
      performance_insights = true
      
      subnet_group_name   = "staging-db-subnet-group"
      security_group_ids  = ["sg-staging-db"]
      publicly_accessible = false
      
      tags = {
        Environment = "staging"
        BackupPolicy = "weekly"
        CostCenter  = "engineering"
      }
      
      parameters = {
        "innodb_buffer_pool_size" = "256M"
        "max_connections"         = "200"
      }
    }
    
    prod = {
      engine         = "mysql"
      engine_version = "8.0"
      instance_class = "db.r5.large"
      
      storage_type      = "gp3"
      allocated_storage = 200
      max_storage      = 1000
      storage_encrypted = true
      
      backup_enabled        = true
      backup_retention_days = 30
      backup_window        = "03:00-04:00"
      maintenance_window   = "sun:04:00-sun:05:00"
      
      monitoring_enabled   = true
      monitoring_interval  = 15
      performance_insights = true
      
      subnet_group_name   = "prod-db-subnet-group"
      security_group_ids  = ["sg-prod-db-primary", "sg-prod-db-backup"]
      publicly_accessible = false
      
      tags = {
        Environment = "production"
        BackupPolicy = "daily"
        CostCenter  = "operations"
        Compliance  = "required"
      }
      
      parameters = {
        "innodb_buffer_pool_size" = "1024M"
        "max_connections"         = "500"
        "slow_query_log"         = "1"
        "long_query_time"        = "2"
      }
    }
  }
  
  # Aktuelle Environment-Konfiguration
  current_db_config = local.database_configs[var.environment]
}

# RDS-Instanz mit Object-Konfiguration
resource "aws_db_instance" "main" {
  identifier = "${var.project_name}-${var.environment}-db"
  
  # Engine-Konfiguration
  engine         = local.current_db_config.engine
  engine_version = local.current_db_config.engine_version
  instance_class = local.current_db_config.instance_class
  
  # Storage-Konfiguration
  storage_type      = local.current_db_config.storage_type
  allocated_storage = local.current_db_config.allocated_storage
  max_allocated_storage = local.current_db_config.max_storage
  storage_encrypted = local.current_db_config.storage_encrypted
  
  # Backup-Konfiguration
  backup_retention_period = local.current_db_config.backup_retention_days
  backup_window          = local.current_db_config.backup_window
  maintenance_window     = local.current_db_config.maintenance_window
  
  # Monitoring-Konfiguration
  monitoring_interval                = local.current_db_config.monitoring_interval
  monitoring_role_arn               = local.current_db_config.monitoring_enabled ? aws_iam_role.rds_monitoring[0].arn : null
  performance_insights_enabled       = local.current_db_config.performance_insights
  performance_insights_retention_period = local.current_db_config.performance_insights ? 7 : null
  
  # Network-Konfiguration
  db_subnet_group_name   = local.current_db_config.subnet_group_name
  vpc_security_group_ids = local.current_db_config.security_group_ids
  publicly_accessible    = local.current_db_config.publicly_accessible
  
  # Database-Konfiguration
  db_name  = "${var.project_name}_${var.environment}"
  username = var.db_username
  password = var.db_password
  
  # Tags
  tags = merge(
    local.current_db_config.tags,
    {
      Name = "${var.project_name}-${var.environment}-db"
    }
  )
  
  # Lifecycle-Management
  lifecycle {
    prevent_destroy = true
  }
}

# Parameter Group für Database-Optimierung
resource "aws_db_parameter_group" "main" {
  family = "${local.current_db_config.engine}${substr(local.current_db_config.engine_version, 0, 3)}"
  name   = "${var.project_name}-${var.environment}-params"
  
  dynamic "parameter" {
    for_each = local.current_db_config.parameters
    content {
      name  = parameter.key
      value = parameter.value
    }
  }
  
  tags = local.current_db_config.tags
}

# Erweiterte Set-Konfiguration für Security Groups
variable "security_rules" {
  description = "Security group rules configuration"
  type = set(object({
    type        = string
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
    description = string
  }))
  
  default = [
    {
      type        = "ingress"
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = ["10.0.0.0/16"]
      description = "SSH access from VPC"
    },
    {
      type        = "ingress"
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTP access from internet"
    },
    {
      type        = "ingress"
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTPS access from internet"
    },
    {
      type        = "egress"
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      cidr_blocks = ["0.0.0.0/0"]
      description = "All outbound traffic"
    }
  ]
}

# Umgebungsspezifische Security-Regeln
locals {
  # Basis-Regeln für alle Umgebungen
  base_security_rules = [
    {
      type        = "egress"
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      cidr_blocks = ["0.0.0.0/0"]
      description = "All outbound traffic"
    }
  ]
  
  # Entwicklungsumgebung - weniger restriktiv
  dev_security_rules = [
    {
      type        = "ingress"
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]  # Offen für Entwicklung
      description = "SSH access for development"
    },
    {
      type        = "ingress"
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTP access"
    },
    {
      type        = "ingress"
      from_port   = 8080
      to_port     = 8080
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "Development server"
    }
  ]
  
  # Produktionsumgebung - restriktiv
  prod_security_rules = [
    {
      type        = "ingress"
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = ["10.0.0.0/16"]  # Nur aus VPC
      description = "SSH access from VPC only"
    },
    {
      type        = "ingress"
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTP access"
    },
    {
      type        = "ingress"
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTPS access"
    }
  ]
  
  # Umgebungsspezifische Regeln zusammenführen
  environment_rules = var.environment == "prod" ? local.prod_security_rules : local.dev_security_rules
  
  # Finale Regeln-Set
  final_security_rules = toset(concat(local.base_security_rules, local.environment_rules))
}

# Security Group mit dynamischen Regeln
resource "aws_security_group" "app" {
  name_prefix = "${var.project_name}-${var.environment}-app-"
  description = "Security group for ${var.project_name} application"
  vpc_id      = var.vpc_id
  
  # Dynamische Regeln-Erstellung
  dynamic "ingress" {
    for_each = { for rule in local.final_security_rules : "${rule.type}-${rule.from_port}-${rule.to_port}" => rule if rule.type == "ingress" }
    content {
      from_port   = ingress.value.from_port
      to_port     = ingress.value.to_port
      protocol    = ingress.value.protocol
      cidr_blocks = ingress.value.cidr_blocks
      description = ingress.value.description
    }
  }
  
  dynamic "egress" {
    for_each = { for rule in local.final_security_rules : "${rule.type}-${rule.from_port}-${rule.to_port}" => rule if rule.type == "egress" }
    content {
      from_port   = egress.value.from_port
      to_port     = egress.value.to_port
      protocol    = egress.value.protocol
      cidr_blocks = egress.value.cidr_blocks
      description = egress.value.description
    }
  }
  
  tags = {
    Name = "${var.project_name}-${var.environment}-app-sg"
    Environment = var.environment
  }
  
  lifecycle {
    create_before_destroy = true
  }
}

# Erweiterte Set-Konfiguration für Security Groups
variable "security_rules" {
  description = "Security group rules configuration"
  type = set(object({
    type        = string
    from_port   = number
    to_port     = number
    protocol    = string
    cidr_blocks = list(string)
    description = string
  }))
  
  default = [
    {
      type        = "ingress"
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = ["10.0.0.0/16"]
      description = "SSH access from VPC"
    },
    {
      type        = "ingress"
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTP access from internet"
    },
    {
      type        = "ingress"
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTPS access from internet"
    },
    {
      type        = "egress"
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      cidr_blocks = ["0.0.0.0/0"]
      description = "All outbound traffic"
    }
  ]
}

# Umgebungsspezifische Security-Regeln
locals {
  # Basis-Regeln für alle Umgebungen
  base_security_rules = [
    {
      type        = "egress"
      from_port   = 0
      to_port     = 0
      protocol    = "-1"
      cidr_blocks = ["0.0.0.0/0"]
      description = "All outbound traffic"
    }
  ]
  
  # Entwicklungsumgebung - weniger restriktiv
  dev_security_rules = [
    {
      type        = "ingress"
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]  # Offen für Entwicklung
      description = "SSH access for development"
    },
    {
      type        = "ingress"
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTP access"
    },
    {
      type        = "ingress"
      from_port   = 8080
      to_port     = 8080
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "Development server"
    }
  ]
  
  # Produktionsumgebung - restriktiv
  prod_security_rules = [
    {
      type        = "ingress"
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = ["10.0.0.0/16"]  # Nur aus VPC
      description = "SSH access from VPC only"
    },
    {
      type        = "ingress"
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTP access"
    },
    {
      type        = "ingress"
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      cidr_blocks = ["0.0.0.0/0"]
      description = "HTTPS access"
    }
  ]
  
  # Umgebungsspezifische Regeln zusammenführen
  environment_rules = var.environment == "prod" ? local.prod_security_rules : local.dev_security_rules
  
  # Finale Regeln-Set
  final_security_rules = toset(concat(local.base_security_rules, local.environment_rules))
}

# Security Group mit dynamischen Regeln
resource "aws_security_group" "app" {
  name_prefix = "${var.project_name}-${var.environment}-app-"
  description = "Security group for ${var.project_name} application"
  vpc_id      = var.vpc_id
  
  # Dynamische Regeln-Erstellung
  dynamic "ingress" {
    for_each = { for rule in local.final_security_rules : "${rule.type}-${rule.from_port}-${rule.to_port}" => rule if rule.type == "ingress" }
    content {
      from_port   = ingress.value.from_port
      to_port     = ingress.value.to_port
      protocol    = ingress.value.protocol
      cidr_blocks = ingress.value.cidr_blocks
      description = ingress.value.description
    }
  }
  
  dynamic "egress" {
    for_each = { for rule in local.final_security_rules : "${rule.type}-${rule.from_port}-${rule.to_port}" => rule if rule.type == "egress" }
    content {
      from_port   = egress.value.from_port
      to_port     = egress.value.to_port
      protocol    = egress.value.protocol
      cidr_blocks = egress.value.cidr_blocks
      description = egress.value.description
    }
  }
  
  tags = {
    Name = "${var.project_name}-${var.environment}-app-sg"
    Environment = var.environment
  }
  
  lifecycle {
    create_before_destroy = true
  }
}

# Erweiterte Map-Konfiguration für Multi-Region-Deployment
variable "region_configurations" {
  description = "Configuration for different AWS regions"
  type = map(object({
    # Region-spezifische Einstellungen
    availability_zones = list(string)
    cidr_block        = string
    
    # Compute-Konfiguration
    instance_types = object({
      web = string
      app = string
      db  = string
    })
    
    # Auto Scaling-Konfiguration
    scaling_config = object({
      min_size         = number
      max_size         = number
      desired_capacity = number
      scale_up_threshold   = number
      scale_down_threshold = number
    })
    
    # Backup-Konfiguration
    backup_config = object({
      enabled = bool
      retention_days = number
      cross_region_copy = bool
      destination_region = string
    })
    
    # Monitoring-Konfiguration
    monitoring_config = object({
      enabled = bool
      detailed_monitoring = bool
      log_retention_days = number
      alert_endpoints = list(string)
    })
    
    # Compliance-Einstellungen
    compliance_config = object({
      encryption_required = bool
      audit_logging = bool
      vpc_flow_logs = bool
      cloudtrail_enabled = bool
    })
    
    # Kosten-Optimierung
    cost_config = object({
      spot_instances_enabled = bool
      reserved_instances = bool
      auto_shutdown = bool
      shutdown_schedule = string
    })
  }))
  
  default = {
    us-east-1 = {
      availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
      cidr_block        = "10.0.0.0/16"
      
      instance_types = {
        web = "t3.small"
        app = "t3.medium"
        db  = "db.t3.small"
      }
      
      scaling_config = {
        min_size             = 2
        max_size             = 10
        desired_capacity     = 3
        scale_up_threshold   = 70
        scale_down_threshold = 30
      }
      
      backup_config = {
        enabled = true
        retention_days = 30
        cross_region_copy = true
        destination_region = "us-west-2"
      }
      
      monitoring_config = {
        enabled = true
        detailed_monitoring = true
        log_retention_days = 90
        alert_endpoints = ["alerts-east@company.com"]
      }
      
      compliance_config = {
        encryption_required = true
        audit_logging = true
        vpc_flow_logs = true
        cloudtrail_enabled = true
      }
      
      cost_config = {
        spot_instances_enabled = false
        reserved_instances = true
        auto_shutdown = false
        shutdown_schedule = "never"
      }
    }
    
    us-west-2 = {
      availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"]
      cidr_block        = "10.1.0.0/16"
      
      instance_types = {
        web = "t3.micro"
        app = "t3.small"
        db  = "db.t3.micro"
      }
      
      scaling_config = {
        min_size             = 1
        max_size             = 5
        desired_capacity     = 2
        scale_up_threshold   = 80
        scale_down_threshold = 20
      }
      
      backup_config = {
        enabled = true
        retention_days = 7
        cross_region_copy = false
        destination_region = ""
      }
      
      monitoring_config = {
        enabled = true
        detailed_monitoring = false
        log_retention_days = 30
        alert_endpoints = ["alerts-west@company.com"]
      }
      
      compliance_config = {
        encryption_required = false
        audit_logging = false
        vpc_flow_logs = false
        cloudtrail_enabled = false
      }
      
      cost_config = {
        spot_instances_enabled = true
        reserved_instances = false
        auto_shutdown = true
        shutdown_schedule = "0 22 * * MON-FRI"
      }
    }
  }
}

# Regionale Konfiguration anwenden
locals {
  current_region_config = var.region_configurations[var.aws_region]
}

# VPC mit regionaler Konfiguration
resource "aws_vpc" "main" {
  cidr_block           = local.current_region_config.cidr_block
  enable_dns_hostnames = true
  enable_dns_support   = true
  
  tags = {
    Name = "${var.project_name}-${var.environment}-vpc"
    Region = var.aws_region
  }
}

# Subnets basierend auf regionaler Konfiguration
resource "aws_subnet" "public" {
  count = length(local.current_region_config.availability_zones)
  
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(local.current_region_config.cidr_block, 8, count.index)
  availability_zone       = local.current_region_config.availability_zones[count.index]
  map_public_ip_on_launch = true
  
  tags = {
    Name = "${var.project_name}-${var.environment}-public-${count.index + 1}"
    Type = "public"
  }
}

# Launch Template mit regionaler Konfiguration
resource "aws_launch_template" "app" {
  name_prefix   = "${var.project_name}-${var.environment}-app-"
  image_id      = data.aws_ami.ubuntu.id
  instance_type = local.current_region_config.instance_types.app
  
  # Spot-Instanzen wenn konfiguriert
  instance_market_options {
    market_type = local.current_region_config.cost_config.spot_instances_enabled ? "spot" : null
    
    dynamic "spot_options" {
      for_each = local.current_region_config.cost_config.spot_instances_enabled ? [1] : []
      content {
        spot_instance_type = "one-time"
      }
    }
  }
  
  # Monitoring-Konfiguration
  monitoring {
    enabled = local.current_region_config.monitoring_config.detailed_monitoring
  }
  
  # Erweiterte EBS-Konfiguration
  block_device_mappings {
    device_name = "/dev/sda1"
    ebs {
      volume_size = 20
      volume_type = "gp3"
      encrypted   = local.current_region_config.compliance_config.encryption_required
      iops        = 3000
    }
  }
  
  user_data = base64encode(templatefile("${path.module}/userdata.sh", {
    region = var.aws_region
    environment = var.environment
    monitoring_enabled = local.current_region_config.monitoring_config.enabled
    log_retention = local.current_region_config.monitoring_config.log_retention_days
  }))
  
  tag_specifications {
    resource_type = "instance"
    tags = {
      Name = "${var.project_name}-${var.environment}-app"
      Region = var.aws_region
      CostOptimized = local.current_region_config.cost_config.spot_instances_enabled
    }
  }
}

# Auto Scaling Group mit regionaler Konfiguration
resource "aws_autoscaling_group" "app" {
  name                = "${var.project_name}-${var.environment}-app-asg"
  vpc_zone_identifier = aws_subnet.public[*].id
  
  min_size         = local.current_region_config.scaling_config.min_size
  max_size         = local.current_region_config.scaling_config.max_size
  desired_capacity = local.current_region_config.scaling_config.desired_capacity
  
  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }
  
  # Auto Shutdown für Kostenoptimierung
  dynamic "tag" {
    for_each = local.current_region_config.cost_config.auto_shutdown ? [1] : []
    content {
      key                 = "AutoShutdown"
      value               = "true"
      propagate_at_launch = true
    }
  }
  
  tag {
    key                 = "Name"
    value               = "${var.project_name}-${var.environment}-app"
    propagate_at_launch = true
  }
}

# Erweiterte Map-Konfiguration für Multi-Region-Deployment
variable "region_configurations" {
  description = "Configuration for different AWS regions"
  type = map(object({
    # Region-spezifische Einstellungen
    availability_zones = list(string)
    cidr_block        = string
    
    # Compute-Konfiguration
    instance_types = object({
      web = string
      app = string
      db  = string
    })
    
    # Auto Scaling-Konfiguration
    scaling_config = object({
      min_size         = number
      max_size         = number
      desired_capacity = number
      scale_up_threshold   = number
      scale_down_threshold = number
    })
    
    # Backup-Konfiguration
    backup_config = object({
      enabled = bool
      retention_days = number
      cross_region_copy = bool
      destination_region = string
    })
    
    # Monitoring-Konfiguration
    monitoring_config = object({
      enabled = bool
      detailed_monitoring = bool
      log_retention_days = number
      alert_endpoints = list(string)
    })
    
    # Compliance-Einstellungen
    compliance_config = object({
      encryption_required = bool
      audit_logging = bool
      vpc_flow_logs = bool
      cloudtrail_enabled = bool
    })
    
    # Kosten-Optimierung
    cost_config = object({
      spot_instances_enabled = bool
      reserved_instances = bool
      auto_shutdown = bool
      shutdown_schedule = string
    })
  }))
  
  default = {
    us-east-1 = {
      availability_zones = ["us-east-1a", "us-east-1b", "us-east-1c"]
      cidr_block        = "10.0.0.0/16"
      
      instance_types = {
        web = "t3.small"
        app = "t3.medium"
        db  = "db.t3.small"
      }
      
      scaling_config = {
        min_size             = 2
        max_size             = 10
        desired_capacity     = 3
        scale_up_threshold   = 70
        scale_down_threshold = 30
      }
      
      backup_config = {
        enabled = true
        retention_days = 30
        cross_region_copy = true
        destination_region = "us-west-2"
      }
      
      monitoring_config = {
        enabled = true
        detailed_monitoring = true
        log_retention_days = 90
        alert_endpoints = ["alerts-east@company.com"]
      }
      
      compliance_config = {
        encryption_required = true
        audit_logging = true
        vpc_flow_logs = true
        cloudtrail_enabled = true
      }
      
      cost_config = {
        spot_instances_enabled = false
        reserved_instances = true
        auto_shutdown = false
        shutdown_schedule = "never"
      }
    }
    
    us-west-2 = {
      availability_zones = ["us-west-2a", "us-west-2b", "us-west-2c"]
      cidr_block        = "10.1.0.0/16"
      
      instance_types = {
        web = "t3.micro"
        app = "t3.small"
        db  = "db.t3.micro"
      }
      
      scaling_config = {
        min_size             = 1
        max_size             = 5
        desired_capacity     = 2
        scale_up_threshold   = 80
        scale_down_threshold = 20
      }
      
      backup_config = {
        enabled = true
        retention_days = 7
        cross_region_copy = false
        destination_region = ""
      }
      
      monitoring_config = {
        enabled = true
        detailed_monitoring = false
        log_retention_days = 30
        alert_endpoints = ["alerts-west@company.com"]
      }
      
      compliance_config = {
        encryption_required = false
        audit_logging = false
        vpc_flow_logs = false
        cloudtrail_enabled = false
      }
      
      cost_config = {
        spot_instances_enabled = true
        reserved_instances = false
        auto_shutdown = true
        shutdown_schedule = "0 22 * * MON-FRI"
      }
    }
  }
}

# Regionale Konfiguration anwenden
locals {
  current_region_config = var.region_configurations[var.aws_region]
}

# VPC mit regionaler Konfiguration
resource "aws_vpc" "main" {
  cidr_block           = local.current_region_config.cidr_block
  enable_dns_hostnames = true
  enable_dns_support   = true
  
  tags = {
    Name = "${var.project_name}-${var.environment}-vpc"
    Region = var.aws_region
  }
}

# Subnets basierend auf regionaler Konfiguration
resource "aws_subnet" "public" {
  count = length(local.current_region_config.availability_zones)
  
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(local.current_region_config.cidr_block, 8, count.index)
  availability_zone       = local.current_region_config.availability_zones[count.index]
  map_public_ip_on_launch = true
  
  tags = {
    Name = "${var.project_name}-${var.environment}-public-${count.index + 1}"
    Type = "public"
  }
}

# Launch Template mit regionaler Konfiguration
resource "aws_launch_template" "app" {
  name_prefix   = "${var.project_name}-${var.environment}-app-"
  image_id      = data.aws_ami.ubuntu.id
  instance_type = local.current_region_config.instance_types.app
  
  # Spot-Instanzen wenn konfiguriert
  instance_market_options {
    market_type = local.current_region_config.cost_config.spot_instances_enabled ? "spot" : null
    
    dynamic "spot_options" {
      for_each = local.current_region_config.cost_config.spot_instances_enabled ? [1] : []
      content {
        spot_instance_type = "one-time"
      }
    }
  }
  
  # Monitoring-Konfiguration
  monitoring {
    enabled = local.current_region_config.monitoring_config.detailed_monitoring
  }
  
  # Erweiterte EBS-Konfiguration
  block_device_mappings {
    device_name = "/dev/sda1"
    ebs {
      volume_size = 20
      volume_type = "gp3"
      encrypted   = local.current_region_config.compliance_config.encryption_required
      iops        = 3000
    }
  }
  
  user_data = base64encode(templatefile("${path.module}/userdata.sh", {
    region = var.aws_region
    environment = var.environment
    monitoring_enabled = local.current_region_config.monitoring_config.enabled
    log_retention = local.current_region_config.monitoring_config.log_retention_days
  }))
  
  tag_specifications {
    resource_type = "instance"
    tags = {
      Name = "${var.project_name}-${var.environment}-app"
      Region = var.aws_region
      CostOptimized = local.current_region_config.cost_config.spot_instances_enabled
    }
  }
}

# Auto Scaling Group mit regionaler Konfiguration
resource "aws_autoscaling_group" "app" {
  name                = "${var.project_name}-${var.environment}-app-asg"
  vpc_zone_identifier = aws_subnet.public[*].id
  
  min_size         = local.current_region_config.scaling_config.min_size
  max_size         = local.current_region_config.scaling_config.max_size
  desired_capacity = local.current_region_config.scaling_config.desired_capacity
  
  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }
  
  # Auto Shutdown für Kostenoptimierung
  dynamic "tag" {
    for_each = local.current_region_config.cost_config.auto_shutdown ? [1] : []
    content {
      key                 = "AutoShutdown"
      value               = "true"
      propagate_at_launch = true
    }
  }
  
  tag {
    key                 = "Name"
    value               = "${var.project_name}-${var.environment}-app"
    propagate_at_launch = true
  }
}

# Richtige Datenstruktur wählen
locals {
  # ✅ Object für zusammengehörige Konfiguration
  database_config = {
    engine = "mysql"
    version = "8.0"
    storage = 100
  }
  
  # ✅ Set für einzigartige Werte ohne Reihenfolge
  allowed_cidrs = toset([
    "10.0.0.0/16",
    "172.16.0.0/12",
    "192.168.0.0/16"
  ])
  
  # ✅ Map für Key-Value-Zuordnungen
  environment_settings = {
    dev  = { instance_type = "t3.micro", count = 1 }
    prod = { instance_type = "t3.large", count = 3 }
  }
  
  # ✅ List für geordnete Daten
  deployment_stages = [
    "build",
    "test",
    "deploy",
    "verify"
  ]
}

# Richtige Datenstruktur wählen
locals {
  # ✅ Object für zusammengehörige Konfiguration
  database_config = {
    engine = "mysql"
    version = "8.0"
    storage = 100
  }
  
  # ✅ Set für einzigartige Werte ohne Reihenfolge
  allowed_cidrs = toset([
    "10.0.0.0/16",
    "172.16.0.0/12",
    "192.168.0.0/16"
  ])
  
  # ✅ Map für Key-Value-Zuordnungen
  environment_settings = {
    dev  = { instance_type = "t3.micro", count = 1 }
    prod = { instance_type = "t3.large", count = 3 }
  }
  
  # ✅ List für geordnete Daten
  deployment_stages = [
    "build",
    "test",
    "deploy",
    "verify"
  ]
}

# Erweiterte String-Operationen
locals {
  # Basis-Variablen
  project_name = "ecommerce-platform"
  environment  = "production"
  region       = "us-east-1"
  
  # Erweiterte Escape-Sequenzen
  json_config = jsonencode({
    # Strings mit Anführungszeichen
    message = "Welcome to \"${local.project_name}\" platform"
    
    # Linux-Pfade für Logs und Konfiguration
    log_path = "/var/log/${local.project_name}/application.log"
    config_path = "/etc/${local.project_name}/config"
    data_path = "/opt/${local.project_name}/data"
    
    # Unix-Socket-Pfade
    socket_path = "/var/run/${local.project_name}/${local.project_name}.sock"
    
    # Unicode-Zeichen
    company_name = "Acme Corp™"
    
    # Newlines und Formatierung
    welcome_text = <<-EOT
      Welcome to ${local.project_name}!
      Environment: ${local.environment}
      Region: ${local.region}
      
      For support, contact: support@company.com
    EOT
  })
  
  # Komplexe String-Interpolation
  resource_naming = {
    # Basis-Naming
    prefix = "${local.project_name}-${local.environment}"
    
    # Conditional Naming
    db_name = "${local.project_name}-${local.environment == "prod" ? "production" : "development"}-db"
    
    # Timestamp-basierte Namen
    backup_name = "${local.project_name}-backup-${formatdate("YYYY-MM-DD-hhmm", timestamp())}"
    
    # Hash-basierte eindeutige Namen
    unique_bucket = "${local.project_name}-${local.environment}-${substr(md5("${local.project_name}-${local.environment}-${timestamp()}"), 0, 8)}"
  }
  
  # Template-Variablen für verschiedene Formate
  template_vars = {
    # Basis-Informationen
    project_name = local.project_name
    environment  = local.environment
    region       = local.region
    
    # Bedingte Werte
    debug_mode = local.environment != "prod"
    ssl_enabled = local.environment == "prod"
    
    # Berechnete Werte
    instance_count = local.environment == "prod" ? 3 : 1
    storage_size   = local.environment == "prod" ? 100 : 20
    
    # Formatierte Strings
    formatted_date = formatdate("YYYY-MM-DD", timestamp())
    formatted_time = formatdate("hh:mm:ss", timestamp())
  }
}

# Erweiterte Heredoc-Syntax für komplexe Templates
resource "aws_instance" "app" {
  count         = local.template_vars.instance_count
  ami           = data.aws_ami.ubuntu.id
  instance_type = local.environment == "prod" ? "t3.large" : "t3.micro"
  
  # Komplexes User Data mit erweiterten String-Features
  user_data = base64encode(templatefile("${path.module}/templates/userdata.sh", merge(local.template_vars, {
    instance_index = count.index
    instance_id    = count.index + 1
    total_instances = local.template_vars.instance_count
  })))
  
  tags = {
    Name = "${local.resource_naming.prefix}-app-${count.index + 1}"
    Role = "application"
  }
}

# Erweiterte JSON-Konfiguration für CloudWatch
resource "aws_cloudwatch_log_group" "app" {
  name              = "/aws/ec2/${local.resource_naming.prefix}/application"
  retention_in_days = local.environment == "prod" ? 90 : 7
  
  tags = {
    Name = "${local.resource_naming.prefix}-logs"
  }
}

# S3 Bucket Policy mit komplexer String-Interpolation
resource "aws_s3_bucket_policy" "app_data" {
  bucket = aws_s3_bucket.app_data.id
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "DenyInsecureConnections"
        Effect = "Deny"
        Principal = "*"
        Action = "s3:*"
        Resource = [
          "${aws_s3_bucket.app_data.arn}",
          "${aws_s3_bucket.app_data.arn}/*"
        ]
        Condition = {
          Bool = {
            "aws:SecureTransport" = "false"
          }
        }
      },
      {
        Sid    = "AllowApplicationAccess"
        Effect = "Allow"
        Principal = {
          AWS = aws_iam_role.app_role.arn
        }
        Action = [
          "s3:GetObject",
          "s3:PutObject",
          "s3:DeleteObject"
        ]
        Resource = "${aws_s3_bucket.app_data.arn}/*"
      }
    ]
  })
}

# Erweiterte String-Operationen
locals {
  # Basis-Variablen
  project_name = "ecommerce-platform"
  environment  = "production"
  region       = "us-east-1"
  
  # Erweiterte Escape-Sequenzen
  json_config = jsonencode({
    # Strings mit Anführungszeichen
    message = "Welcome to \"${local.project_name}\" platform"
    
    # Linux-Pfade für Logs und Konfiguration
    log_path = "/var/log/${local.project_name}/application.log"
    config_path = "/etc/${local.project_name}/config"
    data_path = "/opt/${local.project_name}/data"
    
    # Unix-Socket-Pfade
    socket_path = "/var/run/${local.project_name}/${local.project_name}.sock"
    
    # Unicode-Zeichen
    company_name = "Acme Corp™"
    
    # Newlines und Formatierung
    welcome_text = <<-EOT
      Welcome to ${local.project_name}!
      Environment: ${local.environment}
      Region: ${local.region}
      
      For support, contact: support@company.com
    EOT
  })
  
  # Komplexe String-Interpolation
  resource_naming = {
    # Basis-Naming
    prefix = "${local.project_name}-${local.environment}"
    
    # Conditional Naming
    db_name = "${local.project_name}-${local.environment == "prod" ? "production" : "development"}-db"
    
    # Timestamp-basierte Namen
    backup_name = "${local.project_name}-backup-${formatdate("YYYY-MM-DD-hhmm", timestamp())}"
    
    # Hash-basierte eindeutige Namen
    unique_bucket = "${local.project_name}-${local.environment}-${substr(md5("${local.project_name}-${local.environment}-${timestamp()}"), 0, 8)}"
  }
  
  # Template-Variablen für verschiedene Formate
  template_vars = {
    # Basis-Informationen
    project_name = local.project_name
    environment  = local.environment
    region       = local.region
    
    # Bedingte Werte
    debug_mode = local.environment != "prod"
    ssl_enabled = local.environment == "prod"
    
    # Berechnete Werte
    instance_count = local.environment == "prod" ? 3 : 1
    storage_size   = local.environment == "prod" ? 100 : 20
    
    # Formatierte Strings
    formatted_date = formatdate("YYYY-MM-DD", timestamp())
    formatted_time = formatdate("hh:mm:ss", timestamp())
  }
}

# Erweiterte Heredoc-Syntax für komplexe Templates
resource "aws_instance" "app" {
  count         = local.template_vars.instance_count
  ami           = data.aws_ami.ubuntu.id
  instance_type = local.environment == "prod" ? "t3.large" : "t3.micro"
  
  # Komplexes User Data mit erweiterten String-Features
  user_data = base64encode(templatefile("${path.module}/templates/userdata.sh", merge(local.template_vars, {
    instance_index = count.index
    instance_id    = count.index + 1
    total_instances = local.template_vars.instance_count
  })))
  
  tags = {
    Name = "${local.resource_naming.prefix}-app-${count.index + 1}"
    Role = "application"
  }
}

# Erweiterte JSON-Konfiguration für CloudWatch
resource "aws_cloudwatch_log_group" "app" {
  name              = "/aws/ec2/${local.resource_naming.prefix}/application"
  retention_in_days = local.environment == "prod" ? 90 : 7
  
  tags = {
    Name = "${local.resource_naming.prefix}-logs"
  }
}

# S3 Bucket Policy mit komplexer String-Interpolation
resource "aws_s3_bucket_policy" "app_data" {
  bucket = aws_s3_bucket.app_data.id
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "DenyInsecureConnections"
        Effect = "Deny"
        Principal = "*"
        Action = "s3:*"
        Resource = [
          "${aws_s3_bucket.app_data.arn}",
          "${aws_s3_bucket.app_data.arn}/*"
        ]
        Condition = {
          Bool = {
            "aws:SecureTransport" = "false"
          }
        }
      },
      {
        Sid    = "AllowApplicationAccess"
        Effect = "Allow"
        Principal = {
          AWS = aws_iam_role.app_role.arn
        }
        Action = [
          "s3:GetObject",
          "s3:PutObject",
          "s3:DeleteObject"
        ]
        Resource = "${aws_s3_bucket.app_data.arn}/*"
      }
    ]
  })
}

#!/bin/bash
# Generated by Terraform on ${formatted_date} at ${formatted_time}
# Project: ${project_name}
# Environment: ${environment}
# Instance: ${instance_id}/${total_instances}

# Set environment variables
export PROJECT_NAME="${project_name}"
export ENVIRONMENT="${environment}"
export AWS_REGION="${region}"
export INSTANCE_ID="${instance_id}"
export DEBUG_MODE="${debug_mode}"
export SSL_ENABLED="${ssl_enabled}"

# Log everything
exec > >(tee /var/log/user-data.log|logger -t user-data -s 2>/dev/console) 2>&1

echo "Starting initialization for ${project_name} instance ${instance_id}/${total_instances}"

# Update system
apt-get update -y
apt-get upgrade -y

# Install required packages
apt-get install -y \
    curl \
    wget \
    unzip \
    jq \
    awscli \
    docker.io \
    docker-compose

# Configure Docker
systemctl enable docker
systemctl start docker
usermod -a -G docker ubuntu

# Create application directory
mkdir -p /opt/${project_name}
cd /opt/${project_name}

# Create application configuration
cat > config.json << 'EOF'
{
  "project_name": "${project_name}",
  "environment": "${environment}",
  "region": "${region}",
  "instance_id": "${instance_id}",
  "debug_mode": ${debug_mode},
  "ssl_enabled": ${ssl_enabled},
  "storage_size": ${storage_size},
  "database_config": {
    "host": "localhost",
    "port": 3306,
    "name": "${project_name}_${environment}"
  },
  "monitoring": {
    "enabled": true,
    "log_level": "${debug_mode ? "DEBUG" : "INFO"}",
    "metrics_interval": 60
  }
}
EOF

# Environment-specific configuration
%{ if environment == "prod" }
# Production-specific setup
echo "Setting up production environment..."

# SSL certificates
mkdir -p /etc/ssl/certs/${project_name}
# SSL setup would go here

# Performance tuning
echo "net.core.rmem_max = 134217728" >> /etc/sysctl.conf
echo "net.core.wmem_max = 134217728" >> /etc/sysctl.conf
sysctl -p

%{ else }
# Development/staging setup
echo "Setting up development environment..."

# Development tools
apt-get install -y \
    vim \
    htop \
    tree \
    git

# Relaxed security for development
echo "Development mode - relaxed security settings"
%{ endif }

# Install CloudWatch agent
wget https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb
dpkg -i amazon-cloudwatch-agent.deb

# Configure CloudWatch agent
cat > /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json << 'EOF'
{
  "agent": {
    "metrics_collection_interval": 60,
    "run_as_user": "cwagent"
  },
  "logs": {
    "logs_collected": {
      "files": {
        "collect_list": [
          {
            "file_path": "/var/log/user-data.log",
            "log_group_name": "/aws/ec2/${project_name}-${environment}/user-data",
            "log_stream_name": "{instance_id}/user-data"
          },
          {
            "file_path": "/opt/${project_name}/logs/application.log",
            "log_group_name": "/aws/ec2/${project_name}-${environment}/application",
            "log_stream_name": "{instance_id}/application"
          }
        ]
      }
    }
  },
  "metrics": {
    "namespace": "${project_name}/${environment}",
    "metrics_collected": {
      "cpu": {
        "measurement": [
          "cpu_usage_idle",
          "cpu_usage_iowait",
          "cpu_usage_user",
          "cpu_usage_system"
        ],
        "metrics_collection_interval": 60
      },
      "disk": {
        "measurement": [
          "used_percent"
        ],
        "metrics_collection_interval": 60,
        "resources": [
          "*"
        ]
      },
      "mem": {
        "measurement": [
          "mem_used_percent"
        ],
        "metrics_collection_interval": 60
      }
    }
  }
}
EOF

# Start CloudWatch agent
systemctl enable amazon-cloudwatch-agent
systemctl start amazon-cloudwatch-agent

# Final status
echo "Initialization completed for ${project_name} instance ${instance_id}/${total_instances}"
echo "Environment: ${environment}"
echo "Debug mode: ${debug_mode}"
echo "SSL enabled: ${ssl_enabled}"
echo "Timestamp: $(date)"

#!/bin/bash
# Generated by Terraform on ${formatted_date} at ${formatted_time}
# Project: ${project_name}
# Environment: ${environment}
# Instance: ${instance_id}/${total_instances}

# Set environment variables
export PROJECT_NAME="${project_name}"
export ENVIRONMENT="${environment}"
export AWS_REGION="${region}"
export INSTANCE_ID="${instance_id}"
export DEBUG_MODE="${debug_mode}"
export SSL_ENABLED="${ssl_enabled}"

# Log everything
exec > >(tee /var/log/user-data.log|logger -t user-data -s 2>/dev/console) 2>&1

echo "Starting initialization for ${project_name} instance ${instance_id}/${total_instances}"

# Update system
apt-get update -y
apt-get upgrade -y

# Install required packages
apt-get install -y \
    curl \
    wget \
    unzip \
    jq \
    awscli \
    docker.io \
    docker-compose

# Configure Docker
systemctl enable docker
systemctl start docker
usermod -a -G docker ubuntu

# Create application directory
mkdir -p /opt/${project_name}
cd /opt/${project_name}

# Create application configuration
cat > config.json << 'EOF'
{
  "project_name": "${project_name}",
  "environment": "${environment}",
  "region": "${region}",
  "instance_id": "${instance_id}",
  "debug_mode": ${debug_mode},
  "ssl_enabled": ${ssl_enabled},
  "storage_size": ${storage_size},
  "database_config": {
    "host": "localhost",
    "port": 3306,
    "name": "${project_name}_${environment}"
  },
  "monitoring": {
    "enabled": true,
    "log_level": "${debug_mode ? "DEBUG" : "INFO"}",
    "metrics_interval": 60
  }
}
EOF

# Environment-specific configuration
%{ if environment == "prod" }
# Production-specific setup
echo "Setting up production environment..."

# SSL certificates
mkdir -p /etc/ssl/certs/${project_name}
# SSL setup would go here

# Performance tuning
echo "net.core.rmem_max = 134217728" >> /etc/sysctl.conf
echo "net.core.wmem_max = 134217728" >> /etc/sysctl.conf
sysctl -p

%{ else }
# Development/staging setup
echo "Setting up development environment..."

# Development tools
apt-get install -y \
    vim \
    htop \
    tree \
    git

# Relaxed security for development
echo "Development mode - relaxed security settings"
%{ endif }

# Install CloudWatch agent
wget https://s3.amazonaws.com/amazoncloudwatch-agent/ubuntu/amd64/latest/amazon-cloudwatch-agent.deb
dpkg -i amazon-cloudwatch-agent.deb

# Configure CloudWatch agent
cat > /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json << 'EOF'
{
  "agent": {
    "metrics_collection_interval": 60,
    "run_as_user": "cwagent"
  },
  "logs": {
    "logs_collected": {
      "files": {
        "collect_list": [
          {
            "file_path": "/var/log/user-data.log",
            "log_group_name": "/aws/ec2/${project_name}-${environment}/user-data",
            "log_stream_name": "{instance_id}/user-data"
          },
          {
            "file_path": "/opt/${project_name}/logs/application.log",
            "log_group_name": "/aws/ec2/${project_name}-${environment}/application",
            "log_stream_name": "{instance_id}/application"
          }
        ]
      }
    }
  },
  "metrics": {
    "namespace": "${project_name}/${environment}",
    "metrics_collected": {
      "cpu": {
        "measurement": [
          "cpu_usage_idle",
          "cpu_usage_iowait",
          "cpu_usage_user",
          "cpu_usage_system"
        ],
        "metrics_collection_interval": 60
      },
      "disk": {
        "measurement": [
          "used_percent"
        ],
        "metrics_collection_interval": 60,
        "resources": [
          "*"
        ]
      },
      "mem": {
        "measurement": [
          "mem_used_percent"
        ],
        "metrics_collection_interval": 60
      }
    }
  }
}
EOF

# Start CloudWatch agent
systemctl enable amazon-cloudwatch-agent
systemctl start amazon-cloudwatch-agent

# Final status
echo "Initialization completed for ${project_name} instance ${instance_id}/${total_instances}"
echo "Environment: ${environment}"
echo "Debug mode: ${debug_mode}"
echo "SSL enabled: ${ssl_enabled}"
echo "Timestamp: $(date)"

# ============================================================================
# MULTI-TIER ARCHITECTURE CONFIGURATION
# ============================================================================
# This configuration implements a three-tier architecture pattern:
# 1. Presentation Tier (Public Subnets) - Load Balancers, Bastion Hosts
# 2. Application Tier (Private Subnets) - Application Servers, APIs
# 3. Data Tier (Database Subnets) - RDS, ElastiCache, Data Storage
#
# Architecture Decision: We use separate subnets for each tier to implement
# defense-in-depth security and enable granular network access controls.
#
# Last Updated: 2024-01-15
# Author: DevOps Team
# Review Date: 2024-04-15
# ============================================================================

# VPC Configuration
# Why /16 CIDR: Provides 65,536 IP addresses, sufficient for enterprise growth
# Why enable_dns_hostnames: Required for RDS endpoint resolution
resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr  # Default: 10.0.0.0/16
  enable_dns_hostnames = true
  enable_dns_support   = true
  
  tags = {
    Name = "${var.project_name}-vpc"
    # Important: This tag is used by AWS Load Balancer Controller
    "kubernetes.io/cluster/${var.project_name}" = "shared"
  }
}

# ============================================================================
# PRESENTATION TIER (PUBLIC SUBNETS)
# ============================================================================
# Public subnets host internet-facing resources like:
# - Application Load Balancers
# - NAT Gateways
# - Bastion Hosts (if needed)
#
# Security Consideration: Only resources that need direct internet access
# should be placed here. Application servers go in private subnets.
# ============================================================================

# Public Subnets - One per Availability Zone
# Why count.index: Ensures subnets are distributed across AZs for high availability
# Why cidrsubnet: Automatically calculates subnet CIDR blocks
resource "aws_subnet" "public" {
  count = length(var.availability_zones)
  
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(var.vpc_cidr, 8, count.index)
  availability_zone       = var.availability_zones[count.index]
  map_public_ip_on_launch = true  # Required for NAT Gateway EIPs
  
  tags = {
    Name = "${var.project_name}-public-${count.index + 1}"
    Type = "public"
    Tier = "presentation"
    # Kubernetes requires this tag for subnet discovery
    "kubernetes.io/role/elb" = "1"
  }
}

# Internet Gateway
# Why dependency: VPC must exist before IGW attachment
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
  
  tags = {
    Name = "${var.project_name}-igw"
  }
}

# Public Route Table
# Why single route table: All public subnets need identical routing
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  
  # Route all traffic to Internet Gateway
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
  
  tags = {
    Name = "${var.project_name}-public-rt"
  }
}

# Associate public subnets with route table
resource "aws_route_table_association" "public" {
  count = length(aws_subnet.public)
  
  subnet_id      = aws_subnet.public[count.index].id
  route_table_id = aws_route_table.public.id
}

# ============================================================================
# APPLICATION TIER (PRIVATE SUBNETS)
# ============================================================================
# Private subnets host application servers and internal services:
# - Web servers (behind ALB)
# - API servers
# - Background workers
# - Internal services
#
# Security Consideration: These resources cannot be directly accessed from
# the internet. They receive traffic through the load balancer and can
# initiate outbound connections through NAT Gateway.
# ============================================================================

# Private Subnets - Application Tier
# Why separate from public: Defense-in-depth security architecture
# Why +10 offset: Avoids IP conflicts with public subnets
resource "aws_subnet" "private_app" {
  count = length(var.availability_zones)
  
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 8, count.index + 10)
  availability_zone = var.availability_zones[count.index]
  
  tags = {
    Name = "${var.project_name}-private-app-${count.index + 1}"
    Type = "private"
    Tier = "application"
    # Kubernetes requires this tag for internal load balancers
    "kubernetes.io/role/internal-elb" = "1"
  }
}

# ============================================================================
# DATA TIER (DATABASE SUBNETS)
# ============================================================================
# Database subnets are the most restrictive tier:
# - RDS instances
# - ElastiCache clusters
# - Data storage services
#
# Security Consideration: These subnets have no internet access whatsoever.
# They only communicate with application tier through specific ports.
# ============================================================================

# Database Subnets - Most restrictive tier
# Why +20 offset: Clear separation from other tiers
# Why no internet access: Databases should never communicate with internet
resource "aws_subnet" "private_db" {
  count = length(var.availability_zones)
  
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 8, count.index + 20)
  availability_zone = var.availability_zones[count.index]
  
  tags = {
    Name = "${var.project_name}-private-db-${count.index + 1}"
    Type = "private"
    Tier = "data"
  }
}

# ============================================================================
# NAT GATEWAY CONFIGURATION
# ============================================================================
# NAT Gateways enable outbound internet access for private subnets
# 
# Architecture Decision: One NAT Gateway per AZ for high availability
# Cost Consideration: NAT Gateways are expensive. For cost optimization,
# consider using a single NAT Gateway (less resilient but cheaper).
# ============================================================================

# Elastic IPs for NAT Gateways
# Why depends_on: EIPs require IGW to be attached first
resource "aws_eip" "nat" {
  count = var.multi_az_nat ? length(var.availability_zones) : 1
  
  domain = "vpc"
  depends_on = [aws_internet_gateway.main]
  
  tags = {
    Name = "${var.project_name}-nat-eip-${count.index + 1}"
  }
}

# NAT Gateways
# Why public subnet: NAT Gateway needs internet access to route traffic
# Why conditional count: Supports both single and multi-AZ configurations
resource "aws_nat_gateway" "main" {
  count = var.multi_az_nat ? length(var.availability_zones) : 1
  
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
  
  depends_on = [aws_internet_gateway.main]
  
  tags = {
    Name = "${var.project_name}-nat-${count.index + 1}"
  }
}

# ============================================================================
# PRIVATE SUBNET ROUTING
# ============================================================================
# Private subnets need different routing tables because:
# 1. They route internet traffic through NAT Gateway
# 2. Each AZ may have its own NAT Gateway for high availability
# 3. Database subnets may have different routing rules
# ============================================================================

# Route Tables for Private Application Subnets
# Why per-AZ: Each AZ routes through its own NAT Gateway
resource "aws_route_table" "private_app" {
  count = length(var.availability_zones)
  
  vpc_id = aws_vpc.main.id
  
  # Route internet traffic through NAT Gateway
  # Why conditional: Supports both single and multi-AZ NAT configurations
  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.main[var.multi_az_nat ? count.index : 0].id
  }
  
  tags = {
    Name = "${var.project_name}-private-app-rt-${count.index + 1}"
  }
}

# Associate private app subnets with route tables
resource "aws_route_table_association" "private_app" {
  count = length(aws_subnet.private_app)
  
  subnet_id      = aws_subnet.private_app[count.index].id
  route_table_id = aws_route_table.private_app[count.index].id
}

# Route Tables for Database Subnets
# Why separate: Database subnets may need different routing rules
# Why no internet route: Databases should never access internet directly
resource "aws_route_table" "private_db" {
  count = length(var.availability_zones)
  
  vpc_id = aws_vpc.main.id
  
  # No internet route - databases stay internal
  # Future: Add routes for VPC endpoints, peering connections
  
  tags = {
    Name = "${var.project_name}-private-db-rt-${count.index + 1}"
  }
}

# Associate database subnets with route tables
resource "aws_route_table_association" "private_db" {
  count = length(aws_subnet.private_db)
  
  subnet_id      = aws_subnet.private_db[count.index].id
  route_table_id = aws_route_table.private_db[count.index].id
}

# ============================================================================
# SECURITY GROUPS
# ============================================================================
# Security groups implement stateful firewall rules at the instance level
# Following principle of least privilege - only allow required traffic
# ============================================================================

# Application Load Balancer Security Group
# Why port 80/443: Standard web traffic
# Why 0.0.0.0/0: Internet-facing load balancer needs public access
resource "aws_security_group" "alb" {
  name_prefix = "${var.project_name}-alb-"
  description = "Security group for Application Load Balancer"
  vpc_id      = aws_vpc.main.id
  
  # HTTP ingress from internet
  ingress {
    description = "HTTP from internet"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  # HTTPS ingress from internet
  ingress {
    description = "HTTPS from internet"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  # All outbound traffic (for health checks)
  egress {
    description = "All outbound traffic"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  tags = {
    Name = "${var.project_name}-alb-sg"
  }
  
  # Prevent accidental deletion
  lifecycle {
    create_before_destroy = true
  }
}

# Application Servers Security Group
# Why reference ALB SG: Only allow traffic from load balancer
# Why port 8080: Common application port (adjust as needed)
resource "aws_security_group" "app_servers" {
  name_prefix = "${var.project_name}-app-"
  description = "Security group for application servers"
  vpc_id      = aws_vpc.main.id
  
  # HTTP from ALB only
  ingress {
    description     = "HTTP from ALB"
    from_port       = 8080
    to_port         = 8080
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]
  }
  
  # SSH from bastion host (if exists)
  # TODO: Implement bastion host security group
  dynamic "ingress" {
    for_each = var.enable_bastion ? [1] : []
    content {
      description = "SSH from bastion"
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = [var.vpc_cidr]  # Only from VPC
    }
  }
  
  # All outbound traffic (for package updates, API calls)
  egress {
    description = "All outbound traffic"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  tags = {
    Name = "${var.project_name}-app-sg"
  }
  
  lifecycle {
    create_before_destroy = true
  }
}

# Database Security Group
# Why port 3306: MySQL/MariaDB default port
# Why app servers only: Databases should only accept app connections
resource "aws_security_group" "database" {
  name_prefix = "${var.project_name}-db-"
  description = "Security group for database servers"
  vpc_id      = aws_vpc.main.id
  
  # MySQL/MariaDB from app servers only
  ingress {
    description     = "MySQL from app servers"
    from_port       = 3306
    to_port         = 3306
    protocol        = "tcp"
    security_groups = [aws_security_group.app_servers.id]
  }
  
  # PostgreSQL support (if needed)
  dynamic "ingress" {
    for_each = var.database_engine == "postgres" ? [1] : []
    content {
      description     = "PostgreSQL from app servers"
      from_port       = 5432
      to_port         = 5432
      protocol        = "tcp"
      security_groups = [aws_security_group.app_servers.id]
    }
  }
  
  # No outbound rules needed for databases
  # RDS manages its own outbound communication
  
  tags = {
    Name = "${var.project_name}-db-sg"
  }
  
  lifecycle {
    create_before_destroy = true
  }
}

/*
 * ARCHITECTURE SUMMARY
 * ====================
 * This configuration creates a secure, scalable three-tier architecture:
 * 
 * 1. Public Subnets (Presentation Tier)
 *    - Hosts internet-facing load balancers
 *    - Has direct internet access via Internet Gateway
 *    - Routes: 0.0.0.0/0 -> Internet Gateway
 * 
 * 2. Private App Subnets (Application Tier)
 *    - Hosts application servers and APIs
 *    - Internet access via NAT Gateway for updates
 *    - Routes: 0.0.0.0/0 -> NAT Gateway
 * 
 * 3. Private DB Subnets (Data Tier)
 *    - Hosts databases and data storage
 *    - No internet access at all
 *    - Routes: Local traffic only
 * 
 * Security Groups implement defense-in-depth:
 * - ALB: Accepts internet traffic on 80/443
 * - App Servers: Only accept traffic from ALB
 * - Database: Only accepts traffic from app servers
 * 
 * High Availability:
 * - Resources deployed across multiple AZs
 * - Optional multi-AZ NAT Gateways
 * - Database subnets ready for Multi-AZ RDS
 */

# ============================================================================
# MULTI-TIER ARCHITECTURE CONFIGURATION
# ============================================================================
# This configuration implements a three-tier architecture pattern:
# 1. Presentation Tier (Public Subnets) - Load Balancers, Bastion Hosts
# 2. Application Tier (Private Subnets) - Application Servers, APIs
# 3. Data Tier (Database Subnets) - RDS, ElastiCache, Data Storage
#
# Architecture Decision: We use separate subnets for each tier to implement
# defense-in-depth security and enable granular network access controls.
#
# Last Updated: 2024-01-15
# Author: DevOps Team
# Review Date: 2024-04-15
# ============================================================================

# VPC Configuration
# Why /16 CIDR: Provides 65,536 IP addresses, sufficient for enterprise growth
# Why enable_dns_hostnames: Required for RDS endpoint resolution
resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr  # Default: 10.0.0.0/16
  enable_dns_hostnames = true
  enable_dns_support   = true
  
  tags = {
    Name = "${var.project_name}-vpc"
    # Important: This tag is used by AWS Load Balancer Controller
    "kubernetes.io/cluster/${var.project_name}" = "shared"
  }
}

# ============================================================================
# PRESENTATION TIER (PUBLIC SUBNETS)
# ============================================================================
# Public subnets host internet-facing resources like:
# - Application Load Balancers
# - NAT Gateways
# - Bastion Hosts (if needed)
#
# Security Consideration: Only resources that need direct internet access
# should be placed here. Application servers go in private subnets.
# ============================================================================

# Public Subnets - One per Availability Zone
# Why count.index: Ensures subnets are distributed across AZs for high availability
# Why cidrsubnet: Automatically calculates subnet CIDR blocks
resource "aws_subnet" "public" {
  count = length(var.availability_zones)
  
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(var.vpc_cidr, 8, count.index)
  availability_zone       = var.availability_zones[count.index]
  map_public_ip_on_launch = true  # Required for NAT Gateway EIPs
  
  tags = {
    Name = "${var.project_name}-public-${count.index + 1}"
    Type = "public"
    Tier = "presentation"
    # Kubernetes requires this tag for subnet discovery
    "kubernetes.io/role/elb" = "1"
  }
}

# Internet Gateway
# Why dependency: VPC must exist before IGW attachment
resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id
  
  tags = {
    Name = "${var.project_name}-igw"
  }
}

# Public Route Table
# Why single route table: All public subnets need identical routing
resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id
  
  # Route all traffic to Internet Gateway
  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }
  
  tags = {
    Name = "${var.project_name}-public-rt"
  }
}

# Associate public subnets with route table
resource "aws_route_table_association" "public" {
  count = length(aws_subnet.public)
  
  subnet_id      = aws_subnet.public[count.index].id
  route_table_id = aws_route_table.public.id
}

# ============================================================================
# APPLICATION TIER (PRIVATE SUBNETS)
# ============================================================================
# Private subnets host application servers and internal services:
# - Web servers (behind ALB)
# - API servers
# - Background workers
# - Internal services
#
# Security Consideration: These resources cannot be directly accessed from
# the internet. They receive traffic through the load balancer and can
# initiate outbound connections through NAT Gateway.
# ============================================================================

# Private Subnets - Application Tier
# Why separate from public: Defense-in-depth security architecture
# Why +10 offset: Avoids IP conflicts with public subnets
resource "aws_subnet" "private_app" {
  count = length(var.availability_zones)
  
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 8, count.index + 10)
  availability_zone = var.availability_zones[count.index]
  
  tags = {
    Name = "${var.project_name}-private-app-${count.index + 1}"
    Type = "private"
    Tier = "application"
    # Kubernetes requires this tag for internal load balancers
    "kubernetes.io/role/internal-elb" = "1"
  }
}

# ============================================================================
# DATA TIER (DATABASE SUBNETS)
# ============================================================================
# Database subnets are the most restrictive tier:
# - RDS instances
# - ElastiCache clusters
# - Data storage services
#
# Security Consideration: These subnets have no internet access whatsoever.
# They only communicate with application tier through specific ports.
# ============================================================================

# Database Subnets - Most restrictive tier
# Why +20 offset: Clear separation from other tiers
# Why no internet access: Databases should never communicate with internet
resource "aws_subnet" "private_db" {
  count = length(var.availability_zones)
  
  vpc_id            = aws_vpc.main.id
  cidr_block        = cidrsubnet(var.vpc_cidr, 8, count.index + 20)
  availability_zone = var.availability_zones[count.index]
  
  tags = {
    Name = "${var.project_name}-private-db-${count.index + 1}"
    Type = "private"
    Tier = "data"
  }
}

# ============================================================================
# NAT GATEWAY CONFIGURATION
# ============================================================================
# NAT Gateways enable outbound internet access for private subnets
# 
# Architecture Decision: One NAT Gateway per AZ for high availability
# Cost Consideration: NAT Gateways are expensive. For cost optimization,
# consider using a single NAT Gateway (less resilient but cheaper).
# ============================================================================

# Elastic IPs for NAT Gateways
# Why depends_on: EIPs require IGW to be attached first
resource "aws_eip" "nat" {
  count = var.multi_az_nat ? length(var.availability_zones) : 1
  
  domain = "vpc"
  depends_on = [aws_internet_gateway.main]
  
  tags = {
    Name = "${var.project_name}-nat-eip-${count.index + 1}"
  }
}

# NAT Gateways
# Why public subnet: NAT Gateway needs internet access to route traffic
# Why conditional count: Supports both single and multi-AZ configurations
resource "aws_nat_gateway" "main" {
  count = var.multi_az_nat ? length(var.availability_zones) : 1
  
  allocation_id = aws_eip.nat[count.index].id
  subnet_id     = aws_subnet.public[count.index].id
  
  depends_on = [aws_internet_gateway.main]
  
  tags = {
    Name = "${var.project_name}-nat-${count.index + 1}"
  }
}

# ============================================================================
# PRIVATE SUBNET ROUTING
# ============================================================================
# Private subnets need different routing tables because:
# 1. They route internet traffic through NAT Gateway
# 2. Each AZ may have its own NAT Gateway for high availability
# 3. Database subnets may have different routing rules
# ============================================================================

# Route Tables for Private Application Subnets
# Why per-AZ: Each AZ routes through its own NAT Gateway
resource "aws_route_table" "private_app" {
  count = length(var.availability_zones)
  
  vpc_id = aws_vpc.main.id
  
  # Route internet traffic through NAT Gateway
  # Why conditional: Supports both single and multi-AZ NAT configurations
  route {
    cidr_block     = "0.0.0.0/0"
    nat_gateway_id = aws_nat_gateway.main[var.multi_az_nat ? count.index : 0].id
  }
  
  tags = {
    Name = "${var.project_name}-private-app-rt-${count.index + 1}"
  }
}

# Associate private app subnets with route tables
resource "aws_route_table_association" "private_app" {
  count = length(aws_subnet.private_app)
  
  subnet_id      = aws_subnet.private_app[count.index].id
  route_table_id = aws_route_table.private_app[count.index].id
}

# Route Tables for Database Subnets
# Why separate: Database subnets may need different routing rules
# Why no internet route: Databases should never access internet directly
resource "aws_route_table" "private_db" {
  count = length(var.availability_zones)
  
  vpc_id = aws_vpc.main.id
  
  # No internet route - databases stay internal
  # Future: Add routes for VPC endpoints, peering connections
  
  tags = {
    Name = "${var.project_name}-private-db-rt-${count.index + 1}"
  }
}

# Associate database subnets with route tables
resource "aws_route_table_association" "private_db" {
  count = length(aws_subnet.private_db)
  
  subnet_id      = aws_subnet.private_db[count.index].id
  route_table_id = aws_route_table.private_db[count.index].id
}

# ============================================================================
# SECURITY GROUPS
# ============================================================================
# Security groups implement stateful firewall rules at the instance level
# Following principle of least privilege - only allow required traffic
# ============================================================================

# Application Load Balancer Security Group
# Why port 80/443: Standard web traffic
# Why 0.0.0.0/0: Internet-facing load balancer needs public access
resource "aws_security_group" "alb" {
  name_prefix = "${var.project_name}-alb-"
  description = "Security group for Application Load Balancer"
  vpc_id      = aws_vpc.main.id
  
  # HTTP ingress from internet
  ingress {
    description = "HTTP from internet"
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  # HTTPS ingress from internet
  ingress {
    description = "HTTPS from internet"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  # All outbound traffic (for health checks)
  egress {
    description = "All outbound traffic"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  tags = {
    Name = "${var.project_name}-alb-sg"
  }
  
  # Prevent accidental deletion
  lifecycle {
    create_before_destroy = true
  }
}

# Application Servers Security Group
# Why reference ALB SG: Only allow traffic from load balancer
# Why port 8080: Common application port (adjust as needed)
resource "aws_security_group" "app_servers" {
  name_prefix = "${var.project_name}-app-"
  description = "Security group for application servers"
  vpc_id      = aws_vpc.main.id
  
  # HTTP from ALB only
  ingress {
    description     = "HTTP from ALB"
    from_port       = 8080
    to_port         = 8080
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]
  }
  
  # SSH from bastion host (if exists)
  # TODO: Implement bastion host security group
  dynamic "ingress" {
    for_each = var.enable_bastion ? [1] : []
    content {
      description = "SSH from bastion"
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = [var.vpc_cidr]  # Only from VPC
    }
  }
  
  # All outbound traffic (for package updates, API calls)
  egress {
    description = "All outbound traffic"
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
  
  tags = {
    Name = "${var.project_name}-app-sg"
  }
  
  lifecycle {
    create_before_destroy = true
  }
}

# Database Security Group
# Why port 3306: MySQL/MariaDB default port
# Why app servers only: Databases should only accept app connections
resource "aws_security_group" "database" {
  name_prefix = "${var.project_name}-db-"
  description = "Security group for database servers"
  vpc_id      = aws_vpc.main.id
  
  # MySQL/MariaDB from app servers only
  ingress {
    description     = "MySQL from app servers"
    from_port       = 3306
    to_port         = 3306
    protocol        = "tcp"
    security_groups = [aws_security_group.app_servers.id]
  }
  
  # PostgreSQL support (if needed)
  dynamic "ingress" {
    for_each = var.database_engine == "postgres" ? [1] : []
    content {
      description     = "PostgreSQL from app servers"
      from_port       = 5432
      to_port         = 5432
      protocol        = "tcp"
      security_groups = [aws_security_group.app_servers.id]
    }
  }
  
  # No outbound rules needed for databases
  # RDS manages its own outbound communication
  
  tags = {
    Name = "${var.project_name}-db-sg"
  }
  
  lifecycle {
    create_before_destroy = true
  }
}

/*
 * ARCHITECTURE SUMMARY
 * ====================
 * This configuration creates a secure, scalable three-tier architecture:
 * 
 * 1. Public Subnets (Presentation Tier)
 *    - Hosts internet-facing load balancers
 *    - Has direct internet access via Internet Gateway
 *    - Routes: 0.0.0.0/0 -> Internet Gateway
 * 
 * 2. Private App Subnets (Application Tier)
 *    - Hosts application servers and APIs
 *    - Internet access via NAT Gateway for updates
 *    - Routes: 0.0.0.0/0 -> NAT Gateway
 * 
 * 3. Private DB Subnets (Data Tier)
 *    - Hosts databases and data storage
 *    - No internet access at all
 *    - Routes: Local traffic only
 * 
 * Security Groups implement defense-in-depth:
 * - ALB: Accepts internet traffic on 80/443
 * - App Servers: Only accept traffic from ALB
 * - Database: Only accepts traffic from app servers
 * 
 * High Availability:
 * - Resources deployed across multiple AZs
 * - Optional multi-AZ NAT Gateways
 * - Database subnets ready for Multi-AZ RDS
 */

# Vor terraform fmt (schlecht formatiert)
resource "aws_security_group" "web" {
name="web-sg"
vpc_id=aws_vpc.main.id
ingress{
from_port=80
to_port=80
protocol="tcp"
cidr_blocks=["0.0.0.0/0"]
}
}

# Nach terraform fmt (gut formatiert)
resource "aws_security_group" "web" {
  name   = "web-sg"
  vpc_id = aws_vpc.main.id
  
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# Vor terraform fmt (schlecht formatiert)
resource "aws_security_group" "web" {
name="web-sg"
vpc_id=aws_vpc.main.id
ingress{
from_port=80
to_port=80
protocol="tcp"
cidr_blocks=["0.0.0.0/0"]
}
}

# Nach terraform fmt (gut formatiert)
resource "aws_security_group" "web" {
  name   = "web-sg"
  vpc_id = aws_vpc.main.id
  
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# Terraform-Konfiguration validieren
terraform validate

# Formatierung prüfen
terraform fmt -check -diff

# Syntax-Highlighting in vim
vim -c "syntax on" -c "set ft=terraform" main.tf

# Lokale Werte debuggen
terraform console
> local.current_config
> local.resource_naming.prefix

# Template-Funktionen testen
terraform console
> templatefile("userdata.sh", {var = "test"})

# Terraform-Konfiguration validieren
terraform validate

# Formatierung prüfen
terraform fmt -check -diff

# Syntax-Highlighting in vim
vim -c "syntax on" -c "set ft=terraform" main.tf

# Lokale Werte debuggen
terraform console
> local.current_config
> local.resource_naming.prefix

# Template-Funktionen testen
terraform console
> templatefile("userdata.sh", {var = "test"})

# Erweiterte Netzwerk-Konfiguration mit komplexen Validierungen
variable "network_config" {
  description = "Complete network configuration with validation"
  type = object({
    vpc_cidr = string
    environment = string
    availability_zones = list(string)
    public_subnets = list(string)
    private_subnets = list(string)
    database_subnets = list(string)
    enable_nat_gateway = bool
    enable_vpn_gateway = bool
    dns_domain = string
    tags = map(string)
  })
  
  # CIDR-Block-Validierung
  validation {
    condition = can(cidrhost(var.network_config.vpc_cidr, 0))
    error_message = "VPC CIDR must be a valid IPv4 CIDR block (e.g., 10.0.0.0/16)."
  }
  
  # CIDR-Größen-Validierung
  validation {
    condition = tonumber(split("/", var.network_config.vpc_cidr)[1]) >= 16 && tonumber(split("/", var.network_config.vpc_cidr)[1]) <= 24
    error_message = "VPC CIDR netmask must be between /16 and /24 for proper subnet allocation."
  }
  
  # Private IP-Bereiche-Validierung (RFC 1918)
  validation {
    condition = can(regex("^(10\\.|172\\.(1[6-9]|2[0-9]|3[0-1])\\.|192\\.168\\.)", var.network_config.vpc_cidr))
    error_message = "VPC CIDR must use private IP ranges (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16)."
  }
  
  # Environment-Validierung
  validation {
    condition = contains(["dev", "staging", "prod", "sandbox"], var.network_config.environment)
    error_message = "Environment must be one of: dev, staging, prod, sandbox."
  }
  
  # Availability Zone-Validierung
  validation {
    condition = length(var.network_config.availability_zones) >= 2 && length(var.network_config.availability_zones) <= 6
    error_message = "Must specify between 2 and 6 availability zones for high availability."
  }
  
  # Subnet-Anzahl-Validierung
  validation {
    condition = length(var.network_config.public_subnets) == length(var.network_config.availability_zones)
    error_message = "Number of public subnets must match number of availability zones."
  }
  
  # Subnet-CIDR-Validierung
  validation {
    condition = alltrue([
      for subnet in var.network_config.public_subnets : 
      can(cidrsubnet(var.network_config.vpc_cidr, 4, 0)) && 
      can(cidrhost(subnet, 0))
    ])
    error_message = "All public subnet CIDRs must be valid and within VPC CIDR range."
  }
  
  # DNS-Domain-Validierung
  validation {
    condition = can(regex("^[a-z0-9.-]+\\.[a-z]{2,}$", var.network_config.dns_domain))
    error_message = "DNS domain must be a valid domain name (e.g., example.com)."
  }
  
  # Tags-Validierung
  validation {
    condition = alltrue([
      for key, value in var.network_config.tags : 
      can(regex("^[A-Za-z0-9._-]{1,128}$", key)) && 
      can(regex("^[A-Za-z0-9._\\s-]{1,256}$", value))
    ])
    error_message = "Tag keys and values must follow AWS naming conventions."
  }
}

# Erweiterte Compute-Konfiguration mit Business-Logic-Validierung
variable "compute_config" {
  description = "Compute configuration with business logic validation"
  type = object({
    instance_types = map(string)
    min_instances = number
    max_instances = number
    desired_instances = number
    auto_scaling_enabled = bool
    spot_instances_enabled = bool
    spot_max_price = string
    health_check_type = string
    health_check_grace_period = number
    termination_policies = list(string)
  })
  
  # Instance-Type-Validierung
  validation {
    condition = alltrue([
      for type in values(var.compute_config.instance_types) : 
      can(regex("^[a-z][0-9]+[a-z]*\\.(nano|micro|small|medium|large|xlarge|[0-9]+xlarge)$", type))
    ])
    error_message = "Instance types must be valid AWS instance types (e.g., t3.micro, m5.large)."
  }
  
  # Scaling-Limits-Validierung
  validation {
    condition = var.compute_config.min_instances <= var.compute_config.desired_instances && var.compute_config.desired_instances <= var.compute_config.max_instances
    error_message = "Scaling configuration must follow: min_instances <= desired_instances <= max_instances."
  }
  
  # Spot-Price-Validierung
  validation {
    condition = var.compute_config.spot_instances_enabled ? can(tonumber(var.compute_config.spot_max_price)) && tonumber(var.compute_config.spot_max_price) > 0 : true
    error_message = "Spot max price must be a positive number when spot instances are enabled."
  }
  
  # Health-Check-Validierung
  validation {
    condition = contains(["EC2", "ELB"], var.compute_config.health_check_type)
    error_message = "Health check type must be 'EC2' or 'ELB'."
  }
  
  # Termination-Policy-Validierung
  validation {
    condition = alltrue([
      for policy in var.compute_config.termination_policies : 
      contains(["OldestInstance", "NewestInstance", "OldestLaunchConfiguration", "ClosestToNextInstanceHour", "Default"], policy)
    ])
    error_message = "Termination policies must be valid AWS Auto Scaling termination policies."
  }
}

# Erweiterte Datenbank-Konfiguration mit Compliance-Validierung
variable "database_config" {
  description = "Database configuration with compliance validation"
  type = object({
    engine = string
    engine_version = string
    instance_class = string
    allocated_storage = number
    max_storage = number
    storage_type = string
    storage_encrypted = bool
    kms_key_id = string
    backup_retention_period = number
    backup_window = string
    maintenance_window = string
    multi_az = bool
    publicly_accessible = bool
    deletion_protection = bool
    performance_insights_enabled = bool
    monitoring_interval = number
    auto_minor_version_upgrade = bool
    parameter_group_family = string
    option_group_name = string
  })
  
  # Engine-Validierung
  validation {
    condition = contains(["mysql", "postgres", "mariadb", "oracle-ee", "oracle-se2", "sqlserver-ee", "sqlserver-se", "sqlserver-ex", "sqlserver-web"], var.database_config.engine)
    error_message = "Database engine must be a supported RDS engine."
  }
  
  # Storage-Validierung
  validation {
    condition = var.database_config.allocated_storage >= 20 && var.database_config.allocated_storage <= 65536
    error_message = "Allocated storage must be between 20 GB and 65,536 GB."
  }
  
  # Storage-Type-Validierung
  validation {
    condition = contains(["gp2", "gp3", "io1", "io2", "magnetic"], var.database_config.storage_type)
    error_message = "Storage type must be gp2, gp3, io1, io2, or magnetic."
  }
  
  # Backup-Retention-Validierung
  validation {
    condition = var.database_config.backup_retention_period >= 0 && var.database_config.backup_retention_period <= 35
    error_message = "Backup retention period must be between 0 and 35 days."
  }
  
  # Backup-Window-Format-Validierung
  validation {
    condition = can(regex("^[0-2][0-9]:[0-5][0-9]-[0-2][0-9]:[0-5][0-9]$", var.database_config.backup_window))
    error_message = "Backup window must be in format HH:MM-HH:MM (e.g., 03:00-04:00)."
  }
  
  # Maintenance-Window-Format-Validierung
  validation {
    condition = can(regex("^(sun|mon|tue|wed|thu|fri|sat):[0-2][0-9]:[0-5][0-9]-(sun|mon|tue|wed|thu|fri|sat):[0-2][0-9]:[0-5][0-9]$", var.database_config.maintenance_window))
    error_message = "Maintenance window must be in format ddd:HH:MM-ddd:HH:MM (e.g., sun:04:00-sun:05:00)."
  }
  
  # Compliance-Validierung: Verschlüsselung erforderlich für Produktion
  validation {
    condition = var.database_config.storage_encrypted == true
    error_message = "Storage encryption is required for all database instances for compliance."
  }
  
  # Compliance-Validierung: Deletion Protection für Produktion
  validation {
    condition = var.database_config.deletion_protection == true
    error_message = "Deletion protection must be enabled for all database instances."
  }
  
  # Compliance-Validierung: Kein öffentlicher Zugriff
  validation {
    condition = var.database_config.publicly_accessible == false
    error_message = "Database instances must not be publicly accessible for security compliance."
  }
  
  # Monitoring-Interval-Validierung
  validation {
    condition = contains([0, 1, 5, 10, 15, 30, 60], var.database_config.monitoring_interval)
    error_message = "Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds."
  }
}

# Sicherheits-Konfiguration mit erweiterten Validierungen
variable "security_config" {
  description = "Security configuration with advanced validation"
  type = object({
    enable_flow_logs = bool
    enable_cloudtrail = bool
    enable_config = bool
    enable_guardduty = bool
    security_group_rules = list(object({
      type = string
      from_port = number
      to_port = number
      protocol = string
      cidr_blocks = list(string)
      description = string
    }))
    kms_key_rotation_enabled = bool
    password_policy = object({
      minimum_password_length = number
      require_lowercase_characters = bool
      require_uppercase_characters = bool
      require_numbers = bool
      require_symbols = bool
      max_password_age = number
    })
  })
  
  # Security-Group-Rules-Validierung
  validation {
    condition = alltrue([
      for rule in var.security_config.security_group_rules : 
      contains(["ingress", "egress"], rule.type) &&
      rule.from_port >= 0 && rule.from_port <= 65535 &&
      rule.to_port >= 0 && rule.to_port <= 65535 &&
      rule.from_port <= rule.to_port
    ])
    error_message = "Security group rules must have valid types, ports, and port ranges."
  }
  
  # CIDR-Blocks-Validierung für Security Groups
  validation {
    condition = alltrue([
      for rule in var.security_config.security_group_rules : 
      alltrue([
        for cidr in rule.cidr_blocks : 
        can(cidrhost(cidr, 0))
      ])
    ])
    error_message = "All CIDR blocks in security group rules must be valid."
  }
  
  # Gefährliche Ports-Validierung
  validation {
    condition = alltrue([
      for rule in var.security_config.security_group_rules : 
      !(rule.type == "ingress" && contains(rule.cidr_blocks, "0.0.0.0/0") && 
        (rule.from_port <= 22 && rule.to_port >= 22 || 
         rule.from_port <= 3389 && rule.to_port >= 3389))
    ])
    error_message = "SSH (22) and RDP (3389) ports must not be open to 0.0.0.0/0 for security."
  }
  
  # Password-Policy-Validierung
  validation {
    condition = var.security_config.password_policy.minimum_password_length >= 8 && var.security_config.password_policy.minimum_password_length <= 128
    error_message = "Password minimum length must be between 8 and 128 characters."
  }
  
  # Password-Complexity-Validierung
  validation {
    condition = var.security_config.password_policy.require_lowercase_characters && var.security_config.password_policy.require_uppercase_characters && var.security_config.password_policy.require_numbers && var.security_config.password_policy.require_symbols
    error_message = "Password policy must require all character types for security compliance."
  }
}

# Erweiterte Netzwerk-Konfiguration mit komplexen Validierungen
variable "network_config" {
  description = "Complete network configuration with validation"
  type = object({
    vpc_cidr = string
    environment = string
    availability_zones = list(string)
    public_subnets = list(string)
    private_subnets = list(string)
    database_subnets = list(string)
    enable_nat_gateway = bool
    enable_vpn_gateway = bool
    dns_domain = string
    tags = map(string)
  })
  
  # CIDR-Block-Validierung
  validation {
    condition = can(cidrhost(var.network_config.vpc_cidr, 0))
    error_message = "VPC CIDR must be a valid IPv4 CIDR block (e.g., 10.0.0.0/16)."
  }
  
  # CIDR-Größen-Validierung
  validation {
    condition = tonumber(split("/", var.network_config.vpc_cidr)[1]) >= 16 && tonumber(split("/", var.network_config.vpc_cidr)[1]) <= 24
    error_message = "VPC CIDR netmask must be between /16 and /24 for proper subnet allocation."
  }
  
  # Private IP-Bereiche-Validierung (RFC 1918)
  validation {
    condition = can(regex("^(10\\.|172\\.(1[6-9]|2[0-9]|3[0-1])\\.|192\\.168\\.)", var.network_config.vpc_cidr))
    error_message = "VPC CIDR must use private IP ranges (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16)."
  }
  
  # Environment-Validierung
  validation {
    condition = contains(["dev", "staging", "prod", "sandbox"], var.network_config.environment)
    error_message = "Environment must be one of: dev, staging, prod, sandbox."
  }
  
  # Availability Zone-Validierung
  validation {
    condition = length(var.network_config.availability_zones) >= 2 && length(var.network_config.availability_zones) <= 6
    error_message = "Must specify between 2 and 6 availability zones for high availability."
  }
  
  # Subnet-Anzahl-Validierung
  validation {
    condition = length(var.network_config.public_subnets) == length(var.network_config.availability_zones)
    error_message = "Number of public subnets must match number of availability zones."
  }
  
  # Subnet-CIDR-Validierung
  validation {
    condition = alltrue([
      for subnet in var.network_config.public_subnets : 
      can(cidrsubnet(var.network_config.vpc_cidr, 4, 0)) && 
      can(cidrhost(subnet, 0))
    ])
    error_message = "All public subnet CIDRs must be valid and within VPC CIDR range."
  }
  
  # DNS-Domain-Validierung
  validation {
    condition = can(regex("^[a-z0-9.-]+\\.[a-z]{2,}$", var.network_config.dns_domain))
    error_message = "DNS domain must be a valid domain name (e.g., example.com)."
  }
  
  # Tags-Validierung
  validation {
    condition = alltrue([
      for key, value in var.network_config.tags : 
      can(regex("^[A-Za-z0-9._-]{1,128}$", key)) && 
      can(regex("^[A-Za-z0-9._\\s-]{1,256}$", value))
    ])
    error_message = "Tag keys and values must follow AWS naming conventions."
  }
}

# Erweiterte Compute-Konfiguration mit Business-Logic-Validierung
variable "compute_config" {
  description = "Compute configuration with business logic validation"
  type = object({
    instance_types = map(string)
    min_instances = number
    max_instances = number
    desired_instances = number
    auto_scaling_enabled = bool
    spot_instances_enabled = bool
    spot_max_price = string
    health_check_type = string
    health_check_grace_period = number
    termination_policies = list(string)
  })
  
  # Instance-Type-Validierung
  validation {
    condition = alltrue([
      for type in values(var.compute_config.instance_types) : 
      can(regex("^[a-z][0-9]+[a-z]*\\.(nano|micro|small|medium|large|xlarge|[0-9]+xlarge)$", type))
    ])
    error_message = "Instance types must be valid AWS instance types (e.g., t3.micro, m5.large)."
  }
  
  # Scaling-Limits-Validierung
  validation {
    condition = var.compute_config.min_instances <= var.compute_config.desired_instances && var.compute_config.desired_instances <= var.compute_config.max_instances
    error_message = "Scaling configuration must follow: min_instances <= desired_instances <= max_instances."
  }
  
  # Spot-Price-Validierung
  validation {
    condition = var.compute_config.spot_instances_enabled ? can(tonumber(var.compute_config.spot_max_price)) && tonumber(var.compute_config.spot_max_price) > 0 : true
    error_message = "Spot max price must be a positive number when spot instances are enabled."
  }
  
  # Health-Check-Validierung
  validation {
    condition = contains(["EC2", "ELB"], var.compute_config.health_check_type)
    error_message = "Health check type must be 'EC2' or 'ELB'."
  }
  
  # Termination-Policy-Validierung
  validation {
    condition = alltrue([
      for policy in var.compute_config.termination_policies : 
      contains(["OldestInstance", "NewestInstance", "OldestLaunchConfiguration", "ClosestToNextInstanceHour", "Default"], policy)
    ])
    error_message = "Termination policies must be valid AWS Auto Scaling termination policies."
  }
}

# Erweiterte Datenbank-Konfiguration mit Compliance-Validierung
variable "database_config" {
  description = "Database configuration with compliance validation"
  type = object({
    engine = string
    engine_version = string
    instance_class = string
    allocated_storage = number
    max_storage = number
    storage_type = string
    storage_encrypted = bool
    kms_key_id = string
    backup_retention_period = number
    backup_window = string
    maintenance_window = string
    multi_az = bool
    publicly_accessible = bool
    deletion_protection = bool
    performance_insights_enabled = bool
    monitoring_interval = number
    auto_minor_version_upgrade = bool
    parameter_group_family = string
    option_group_name = string
  })
  
  # Engine-Validierung
  validation {
    condition = contains(["mysql", "postgres", "mariadb", "oracle-ee", "oracle-se2", "sqlserver-ee", "sqlserver-se", "sqlserver-ex", "sqlserver-web"], var.database_config.engine)
    error_message = "Database engine must be a supported RDS engine."
  }
  
  # Storage-Validierung
  validation {
    condition = var.database_config.allocated_storage >= 20 && var.database_config.allocated_storage <= 65536
    error_message = "Allocated storage must be between 20 GB and 65,536 GB."
  }
  
  # Storage-Type-Validierung
  validation {
    condition = contains(["gp2", "gp3", "io1", "io2", "magnetic"], var.database_config.storage_type)
    error_message = "Storage type must be gp2, gp3, io1, io2, or magnetic."
  }
  
  # Backup-Retention-Validierung
  validation {
    condition = var.database_config.backup_retention_period >= 0 && var.database_config.backup_retention_period <= 35
    error_message = "Backup retention period must be between 0 and 35 days."
  }
  
  # Backup-Window-Format-Validierung
  validation {
    condition = can(regex("^[0-2][0-9]:[0-5][0-9]-[0-2][0-9]:[0-5][0-9]$", var.database_config.backup_window))
    error_message = "Backup window must be in format HH:MM-HH:MM (e.g., 03:00-04:00)."
  }
  
  # Maintenance-Window-Format-Validierung
  validation {
    condition = can(regex("^(sun|mon|tue|wed|thu|fri|sat):[0-2][0-9]:[0-5][0-9]-(sun|mon|tue|wed|thu|fri|sat):[0-2][0-9]:[0-5][0-9]$", var.database_config.maintenance_window))
    error_message = "Maintenance window must be in format ddd:HH:MM-ddd:HH:MM (e.g., sun:04:00-sun:05:00)."
  }
  
  # Compliance-Validierung: Verschlüsselung erforderlich für Produktion
  validation {
    condition = var.database_config.storage_encrypted == true
    error_message = "Storage encryption is required for all database instances for compliance."
  }
  
  # Compliance-Validierung: Deletion Protection für Produktion
  validation {
    condition = var.database_config.deletion_protection == true
    error_message = "Deletion protection must be enabled for all database instances."
  }
  
  # Compliance-Validierung: Kein öffentlicher Zugriff
  validation {
    condition = var.database_config.publicly_accessible == false
    error_message = "Database instances must not be publicly accessible for security compliance."
  }
  
  # Monitoring-Interval-Validierung
  validation {
    condition = contains([0, 1, 5, 10, 15, 30, 60], var.database_config.monitoring_interval)
    error_message = "Monitoring interval must be 0, 1, 5, 10, 15, 30, or 60 seconds."
  }
}

# Sicherheits-Konfiguration mit erweiterten Validierungen
variable "security_config" {
  description = "Security configuration with advanced validation"
  type = object({
    enable_flow_logs = bool
    enable_cloudtrail = bool
    enable_config = bool
    enable_guardduty = bool
    security_group_rules = list(object({
      type = string
      from_port = number
      to_port = number
      protocol = string
      cidr_blocks = list(string)
      description = string
    }))
    kms_key_rotation_enabled = bool
    password_policy = object({
      minimum_password_length = number
      require_lowercase_characters = bool
      require_uppercase_characters = bool
      require_numbers = bool
      require_symbols = bool
      max_password_age = number
    })
  })
  
  # Security-Group-Rules-Validierung
  validation {
    condition = alltrue([
      for rule in var.security_config.security_group_rules : 
      contains(["ingress", "egress"], rule.type) &&
      rule.from_port >= 0 && rule.from_port <= 65535 &&
      rule.to_port >= 0 && rule.to_port <= 65535 &&
      rule.from_port <= rule.to_port
    ])
    error_message = "Security group rules must have valid types, ports, and port ranges."
  }
  
  # CIDR-Blocks-Validierung für Security Groups
  validation {
    condition = alltrue([
      for rule in var.security_config.security_group_rules : 
      alltrue([
        for cidr in rule.cidr_blocks : 
        can(cidrhost(cidr, 0))
      ])
    ])
    error_message = "All CIDR blocks in security group rules must be valid."
  }
  
  # Gefährliche Ports-Validierung
  validation {
    condition = alltrue([
      for rule in var.security_config.security_group_rules : 
      !(rule.type == "ingress" && contains(rule.cidr_blocks, "0.0.0.0/0") && 
        (rule.from_port <= 22 && rule.to_port >= 22 || 
         rule.from_port <= 3389 && rule.to_port >= 3389))
    ])
    error_message = "SSH (22) and RDP (3389) ports must not be open to 0.0.0.0/0 for security."
  }
  
  # Password-Policy-Validierung
  validation {
    condition = var.security_config.password_policy.minimum_password_length >= 8 && var.security_config.password_policy.minimum_password_length <= 128
    error_message = "Password minimum length must be between 8 and 128 characters."
  }
  
  # Password-Complexity-Validierung
  validation {
    condition = var.security_config.password_policy.require_lowercase_characters && var.security_config.password_policy.require_uppercase_characters && var.security_config.password_policy.require_numbers && var.security_config.password_policy.require_symbols
    error_message = "Password policy must require all character types for security compliance."
  }
}