import boto3

ec2 = boto3.client('ec2', region_name='us-east-1')

# 1. Create Customer Gateway (your on-premises router)
cgw_response = ec2.create_customer_gateway(
    BgpAsn=65000,  # Your BGP ASN (or use 65000 for static routing)
    PublicIp='203.0.113.10',  # Your on-premises router public IP
    Type='ipsec.1',
    TagSpecifications=[{
        'ResourceType': 'customer-gateway',
        'Tags': [{'Key': 'Name', 'Value': 'OnPrem-CGW'}]
    }]
)

cgw_id = cgw_response['CustomerGateway']['CustomerGatewayId']
print(f"Customer Gateway created: {cgw_id}")

# 2. Create Virtual Private Gateway (AWS side)
vgw_response = ec2.create_vpn_gateway(
    Type='ipsec.1',
    AmazonSideAsn=64512,  # AWS BGP ASN
    TagSpecifications=[{
        'ResourceType': 'vpn-gateway',
        'Tags': [{'Key': 'Name', 'Value': 'AWS-VGW'}]
    }]
)

vgw_id = vgw_response['VpnGateway']['VpnGatewayId']
print(f"Virtual Private Gateway created: {vgw_id}")

# 3. Attach VGW to VPC
ec2.attach_vpn_gateway(
    VpcId='vpc-0123456789abcdef0',
    VpnGatewayId=vgw_id
)

print(f"VGW {vgw_id} attached to VPC")

# 4. Create VPN Connection
vpn_response = ec2.create_vpn_connection(
    Type='ipsec.1',
    CustomerGatewayId=cgw_id,
    VpnGatewayId=vgw_id,
    Options={
        'StaticRoutesOnly': False,  # Use BGP for dynamic routing
        'TunnelOptions': [
            {
                'TunnelInsideCidr': '169.254.10.0/30',  # Tunnel 1 inside IPs
                'PreSharedKey': 'securePreSharedKey123!'
            },
            {
                'TunnelInsideCidr': '169.254.11.0/30',  # Tunnel 2 inside IPs
                'PreSharedKey': 'securePreSharedKey456!'
            }
        ]
    },
    TagSpecifications=[{
        'ResourceType': 'vpn-connection',
        'Tags': [{'Key': 'Name', 'Value': 'OnPrem-to-AWS-VPN'}]
    }]
)

vpn_id = vpn_response['VpnConnection']['VpnConnectionId']
print(f"VPN Connection created: {vpn_id}")

# 5. Download configuration for your on-premises router
vpn_config = ec2.describe_vpn_connections(
    VpnConnectionIds=[vpn_id]
)

# Apply configuration to your on-premises router (Cisco, Juniper, etc.)
print("Download configuration from AWS Console for your router vendor")

import boto3

dx = boto3.client('directconnect', region_name='us-east-1')

# Step 1: Create Direct Connect connection (Dedicated 10 Gbps)
connection_response = dx.create_connection(
    location='EqDC2',  # AWS Direct Connect location (e.g., Equinix DC2, Ashburn)
    bandwidth='10Gbps',
    connectionName='OnPrem-to-AWS-DX',
    lagId=None,  # Optional: Link Aggregation Group for multiple connections
    tags=[{'key': 'Environment', 'value': 'Production'}]
)

connection_id = connection_response['connectionId']
print(f"Direct Connect connection created: {connection_id}")
print(f"LOA-CFA (Letter of Authorization) will be available in AWS Console")
print("Provide LOA-CFA to colocation provider to establish cross-connect")

# Step 2: Create Virtual Interface (VIF) - Private VIF for VPC access
# (After physical connection is established)

vif_response = dx.create_private_virtual_interface(
    connectionId=connection_id,
    newPrivateVirtualInterface={
        'virtualInterfaceName': 'Production-VPC-VIF',
        'vlan': 100,  # VLAN tag (1-4094)
        'asn': 65000,  # Your BGP ASN
        'authKey': 'bgpAuthKey123',  # BGP MD5 authentication key
        'amazonAddress': '169.254.10.1/30',  # AWS side BGP IP
        'customerAddress': '169.254.10.2/30',  # Your side BGP IP
        'addressFamily': 'ipv4',
        'virtualGatewayId': 'vgw-0123456789abcdef0',  # Attach to VGW
        'tags': [{'key': 'Environment', 'value': 'Production'}]
    }
)

vif_id = vif_response['virtualInterface']['virtualInterfaceId']
print(f"Virtual Interface created: {vif_id}")

# Step 3: Configure BGP on your on-premises router
# - Advertise on-premises networks to AWS
# - Receive AWS VPC routes from AWS

# Example BGP configuration (Cisco):
# router bgp 65000
#   neighbor 169.254.10.1 remote-as 64512
#   neighbor 169.254.10.1 password bgpAuthKey123
#   network 10.0.0.0 mask 255.255.0.0  # Advertise on-prem network

# Create VPN over Direct Connect

# 1. Create Transit Gateway (modern approach, replaces VGW)
tgw_response = ec2.create_transit_gateway(
    Description='Hybrid Cloud TGW',
    Options={
        'AmazonSideAsn': 64512,
        'DefaultRouteTableAssociation': 'enable',
        'DefaultRouteTablePropagation': 'enable',
        'VpnEcmpSupport': 'enable',  # Equal-cost multi-path for VPN
        'DnsSupport': 'enable'
    }
)

tgw_id = tgw_response['TransitGateway']['TransitGatewayId']

# 2. Attach Direct Connect to TGW (via Direct Connect Gateway)
dx_gateway_response = dx.create_direct_connect_gateway(
    directConnectGatewayName='Hybrid-DXGW',
    amazonSideAsn=64512
)

dxgw_id = dx_gateway_response['directConnectGateway']['directConnectGatewayId']

# Associate Direct Connect Gateway with Transit Gateway
dx.create_direct_connect_gateway_association(
    directConnectGatewayId=dxgw_id,
    gatewayId=tgw_id
)

# 3. Create VPN connection to Transit Gateway (encrypted tunnel)
vpn_response = ec2.create_vpn_connection(
    Type='ipsec.1',
    CustomerGatewayId=cgw_id,
    TransitGatewayId=tgw_id,  # Attach to TGW instead of VGW
    Options={
        'TunnelInsideIpVersion': 'ipv4',
        'StaticRoutesOnly': False
    }
)

# Traffic flows: On-Prem → Direct Connect → TGW → VPN (encrypted) → VPC

import boto3

storagegateway = boto3.client('storagegateway', region_name='us-east-1')

# 1. Deploy File Gateway VM (download OVA, deploy to VMware/Hyper-V)
# 2. Activate gateway

gateway_response = storagegateway.activate_gateway(
    ActivationKey='ABCDE-12345-FGHIJ-67890',  # From gateway VM console
    GatewayName='OnPrem-FileGateway',
    GatewayTimezone='GMT-5:00',
    GatewayRegion='us-east-1',
    GatewayType='FILE_S3'  # File Gateway
)

gateway_arn = gateway_response['GatewayARN']

# 3. Create NFS file share backed by S3
file_share_response = storagegateway.create_nfs_file_share(
    ClientToken='unique-token-12345',
    GatewayARN=gateway_arn,
    Role='arn:aws:iam::123456789012:role/StorageGatewayS3Role',  # IAM role for S3 access
    LocationARN='arn:aws:s3:::my-file-gateway-bucket',  # S3 bucket
    DefaultStorageClass='S3_STANDARD_IA',  # Store in S3 Standard-IA
    ObjectACL='bucket-owner-full-control',
    ClientList=['10.0.0.0/16'],  # On-premises network CIDR
    Squash='RootSquash',
    ReadOnly=False,
    GuessMIMETypeEnabled=True,
    RequesterPays=False,
    Tags=[{'Key': 'Environment', 'Value': 'Production'}]
)

file_share_arn = file_share_response['FileShareARN']
print(f"NFS file share created: {file_share_arn}")

# 4. Mount on-premises (Linux)
# sudo mount -t nfs -o nolock,hard 10.0.1.100:/my-file-gateway-bucket /mnt/s3

# Create cached volume
volume_response = storagegateway.create_cached_iscsi_volume(
    GatewayARN=gateway_arn,
    VolumeSizeInBytes=1099511627776,  # 1TB
    TargetName='prod-database-vol',
    NetworkInterfaceId='10.0.1.100',  # Gateway IP
    ClientToken='unique-token-67890',
    SnapshotId=None,  # Optional: Create from EBS snapshot
    Tags=[{'Key': 'Application', 'Value': 'Database'}]
)

volume_arn = volume_response['VolumeARN']
target_arn = volume_response['TargetARN']

print(f"iSCSI volume created: {volume_arn}")
print(f"iSCSI target: {target_arn}")

# Mount on-premises (Linux)
# sudo iscsiadm -m discovery -t st -p 10.0.1.100
# sudo iscsiadm -m node -T iqn.1997-05.com.amazon:prod-database-vol -l

# Outposts provisioned via AWS Console/Sales (not API)
# High-level workflow:

# 1. Order Outposts (contact AWS Sales)
# 2. Site preparation (power, cooling, network, physical space)
# 3. AWS ships and installs Outposts rack
# 4. AWS manages hardware, patching, monitoring
# 5. You manage applications (EC2, containers, etc.)

# Example: Launch EC2 on Outposts
import boto3

ec2 = boto3.client('ec2', region_name='us-east-1')

# Launch instance on Outposts subnet
instance = ec2.run_instances(
    ImageId='ami-0abcdef1234567890',
    InstanceType='m5.large',
    SubnetId='subnet-outpost-0123456789abcdef0',  # Outposts subnet
    MinCount=1,
    MaxCount=1
)

print(f"EC2 instance launched on Outposts: {instance['Instances'][0]['InstanceId']}")

# Use hybrid load balancing
# On-premises F5/NGINX forwards overflow to AWS ALB

# AWS autoscaling based on on-premises metrics
cloudwatch = boto3.client('cloudwatch')

# Custom metric: On-Premises CPU
cloudwatch.put_metric_data(
    Namespace='Hybrid',
    MetricData=[{
        'MetricName': 'OnPremisesCPU',
        'Value': 85.0,  # From on-prem monitoring
        'Unit': 'Percent'
    }]
)

# Autoscaling policy: Scale AWS when on-prem CPU >80%
autoscaling = boto3.client('autoscaling')

autoscaling.put_scaling_policy(
    AutoScalingGroupName='hybrid-burst-asg',
    PolicyName='scale-on-onprem-cpu',
    PolicyType='TargetTrackingScaling',
    TargetTrackingConfiguration={
        'CustomizedMetricSpecification': {
            'MetricName': 'OnPremisesCPU',
            'Namespace': 'Hybrid',
            'Statistic': 'Average'
        },
        'TargetValue': 60.0  # Keep on-prem below 60% by scaling AWS
    }
)

# Continuous database replication (DMS)
dms = boto3.client('dms')

# Replicate on-prem database to AWS (CDC mode)
dms_task = dms.create_replication_task(
    ReplicationTaskIdentifier='dr-replication',
    SourceEndpointArn=onprem_db_arn,
    TargetEndpointArn=aws_rds_arn,
    MigrationType='cdc',  # Continuous replication
    # ... (table mappings, settings)
)

# Failover process (automated or manual)
def failover_to_aws():
    # 1. Stop DMS replication
    dms.stop_replication_task(ReplicationTaskArn=dms_task_arn)

    # 2. Promote RDS read replica to primary (if using)
    rds = boto3.client('rds')
    rds.promote_read_replica(DBInstanceIdentifier='dr-database')

    # 3. Update Route 53 to point to AWS
    route53 = boto3.client('route53')
    route53.change_resource_record_sets(
        HostedZoneId='Z1234567890ABC',
        ChangeBatch={
            'Changes': [{
                'Action': 'UPSERT',
                'ResourceRecordSet': {
                    'Name': 'app.company.com',
                    'Type': 'CNAME',
                    'TTL': 60,
                    'ResourceRecords': [{'Value': 'app-alb.us-east-1.elb.amazonaws.com'}]
                }
            }]
        }
    )

    print("Failover to AWS complete")

# Cost: DMS replication instance (~$140/month) + minimal AWS infrastructure (stopped EC2, small RDS)

# File Gateway uploads to S3
# Trigger Glue ETL on new files

s3 = boto3.client('s3')
glue = boto3.client('glue')

# S3 event notification → Lambda → Glue ETL
def lambda_handler(event, context):
    # Triggered when new file uploaded via File Gateway
    bucket = event['Records'][0]['s3']['bucket']['name']
    key = event['Records'][0]['s3']['object']['key']

    # Start Glue ETL job
    glue.start_job_run(
        JobName='process-iot-data',
        Arguments={
            '--input_path': f's3://{bucket}/{key}',
            '--output_path': 's3://processed-data/'
        }
    )

# Cost: File Gateway (free) + S3 storage + Glue ETL (pay-per-use)

# MACsec encryption for Direct Connect (Layer 2 encryption)
dx.associate_mac_sec_key(
    connectionId=connection_id,
    secretARN='arn:aws:secretsmanager:us-east-1:123456789012:secret:dx-macsec-key'
)

# Or: Run VPN over Direct Connect (Layer 3 encryption)

# Configure VPC endpoints for AWS services (avoid internet)
ec2.create_vpc_endpoint(
    VpcId='vpc-0123456789abcdef0',
    ServiceName='com.amazonaws.us-east-1.s3',  # S3 VPC endpoint
    RouteTableIds=['rtb-0123456789abcdef0']
)

# Access S3 from on-premises via Direct Connect + VPC endpoint (private)

# Separate VPCs for different security zones
# Production VPC (isolated)
# Development VPC (isolated)
# Shared Services VPC (Direct Connect attachment)

# Use Transit Gateway for hub-and-spoke routing
tgw = ec2.create_transit_gateway(
    Description='Hybrid Hub',
    Options={'DefaultRouteTableAssociation': 'disable'}  # Custom route tables
)

# Create separate route tables for production vs development
prod_rt = ec2.create_transit_gateway_route_table(
    TransitGatewayId=tgw_id,
    TagSpecifications=[{'ResourceType': 'transit-gateway-route-table', 'Tags': [{'Key': 'Name', 'Value': 'Production'}]}]
)

dev_rt = ec2.create_transit_gateway_route_table(
    TransitGatewayId=tgw_id,
    TagSpecifications=[{'ResourceType': 'transit-gateway-route-table', 'Tags': [{'Key': 'Name', 'Value': 'Development'}]}]
)

# Control which networks can communicate

# CloudWatch metrics for Direct Connect
cloudwatch = boto3.client('cloudwatch')

# Monitor connection state
cloudwatch.put_metric_alarm(
    AlarmName='DirectConnect-Down',
    MetricName='ConnectionState',
    Namespace='AWS/DX',
    Statistic='Minimum',
    Period=60,
    EvaluationPeriods=2,
    Threshold=1,  # 0 = down, 1 = up
    ComparisonOperator='LessThanThreshold',
    AlarmActions=['arn:aws:sns:us-east-1:123456789012:ops-alerts']
)

# Monitor VPN tunnel status
cloudwatch.put_metric_alarm(
    AlarmName='VPN-Tunnel-Down',
    MetricName='TunnelState',
    Namespace='AWS/VPN',
    Dimensions=[{'Name': 'VpnId', 'Value': vpn_id}],
    Statistic='Maximum',
    Period=60,
    EvaluationPeriods=2,
    Threshold=0,  # 0 = down, 1 = up
    ComparisonOperator='LessThanOrEqualToThreshold',
    AlarmActions=['arn:aws:sns:us-east-1:123456789012:ops-alerts']
)

# Test failover by shutting down Direct Connect VIF
dx.delete_virtual_interface(virtualInterfaceId=vif_id)

# Verify traffic fails over to VPN
# Monitor application performance

# Restore Direct Connect VIF
# Verify traffic returns to Direct Connect