// Auto-tag resources with default values if missing
public async Task HandleEvent(CloudWatchEvent<dynamic> evt)
{
    var resourceArn = evt.Detail.responseElements.resourceArn;

    var existingTags = await GetResourceTags(resourceArn);

    var requiredTags = new Dictionary<string, string>
    {
        { "environment", "dev" },  // Default to dev
        { "layer", "application" }, // Default to application
        { "domain", "unknown" }     // Flag for review
    };

    var tagsToAdd = requiredTags
        .Where(rt => !existingTags.ContainsKey(rt.Key))
        .ToList();

    if (tagsToAdd.Any())
    {
        await AddResourceTags(resourceArn, tagsToAdd);
        await SendNotification($"Auto-tagged {resourceArn} - Review required");
    }
}

public async Task RunDriftDetection()
{
    var stacksResponse = await _cloudFormation.ListStacksAsync(new ListStacksRequest
    {
        StackStatusFilter = new List<string>
        {
            "CREATE_COMPLETE",
            "UPDATE_COMPLETE"
        }
    });

    foreach (var stack in stacksResponse.StackSummaries)
    {
        try
        {
            var driftResponse = await _cloudFormation.DetectStackDriftAsync(
                new DetectStackDriftRequest
                {
                    StackName = stack.StackName
                });

            // Check drift status after detection completes
            var driftStatus = await WaitForDriftDetection(driftResponse.StackDriftDetectionId);

            if (driftStatus.StackDriftStatus == StackDriftStatus.DRIFTED)
            {
                await NotifyDrift(stack.StackName);
                await GetDriftDetails(stack.StackName);
            }
        }
        catch (Exception ex)
        {
            _logger.LogError($"Drift detection failed for {stack.StackName}: {ex.Message}");
        }
    }
}

public async Task<ComplianceType> EvaluateCompliance(string resourceId, string resourceType)
{
    // Query CloudFormation to see if resource is in any stack
    var stacksResponse = await _cloudFormation.ListStacksAsync(new ListStacksRequest());

    foreach (var stack in stacksResponse.StackSummaries)
    {
        var resourcesResponse = await _cloudFormation.ListStackResourcesAsync(
            new ListStackResourcesRequest { StackName = stack.StackName });

        var managedResource = resourcesResponse.StackResourceSummaries
            .FirstOrDefault(r => r.PhysicalResourceId == resourceId);

        if (managedResource != null)
        {
            return ComplianceType.COMPLIANT;
        }
    }

    // Resource not found in any stack
    return ComplianceType.NON_COMPLIANT;
}

public class RequireTagsHook : ICloudFormationHook
{
    private readonly string[] _requiredTags = { "environment", "layer", "domain" };

    public HookResponse PreCreate(HookContext context)
    {
        var resource = context.TargetModel;
        var tags = resource.Tags ?? new Dictionary<string, string>();

        var missingTags = _requiredTags
            .Where(rt => !tags.ContainsKey(rt))
            .ToList();

        if (missingTags.Any())
        {
            return new HookResponse
            {
                Status = HookStatus.FAILED,
                Message = $"Missing required tags: {string.Join(", ", missingTags)}"
            };
        }

        return new HookResponse { Status = HookStatus.SUCCESS };
    }
}

public async Task RemediateMissingTags(ConfigRuleEvaluationEvent evt)
{
    var resourceArn = evt.ConfigRuleInvokingEvent.ConfigurationItem.Arn;
    var resourceType = evt.ConfigRuleInvokingEvent.ConfigurationItem.ResourceType;

    // Add default tags
    var defaultTags = new Dictionary<string, string>
    {
        { "environment", "dev" },
        { "layer", "application" },
        { "domain", "unassigned-needs-review" }
    };

    await _tagClient.TagResourcesAsync(new TagResourcesRequest
    {
        ResourceARNList = new List<string> { resourceArn },
        Tags = defaultTags
    });

    // Notify for manual review
    await _sns.PublishAsync(new PublishRequest
    {
        TopicArn = _notificationTopicArn,
        Subject = "Auto-remediation: Missing tags added",
        Message = $"Resource {resourceArn} was auto-tagged. Please review and update."
    });
}

public async Task HandleDrift(CloudFormationDriftEvent evt)
{
    var stackName = evt.Detail.StackId;

    // Option 1: Update stack to fix drift
    await _cloudFormation.UpdateStackAsync(new UpdateStackRequest
    {
        StackName = stackName,
        UsePreviousTemplate = true,
        Capabilities = new List<string> { "CAPABILITY_IAM" }
    });

    // Option 2: Notify and require manual intervention
    await _sns.PublishAsync(new PublishRequest
    {
        TopicArn = _notificationTopicArn,
        Subject = $"Drift detected: {stackName}",
        Message = "Manual review required. Template may need updating."
    });
}

public async Task PublishGovernanceMetrics()
{
    // Count resources without tags
    var untaggedCount = await CountUntaggedResources();

    // Count drifted stacks
    var driftedCount = await CountDriftedStacks();

    // Count non-compliant resources
    var nonCompliantCount = await CountNonCompliantResources();

    await _cloudWatch.PutMetricDataAsync(new PutMetricDataRequest
    {
        Namespace = "CustomMetrics",
        MetricData = new List<MetricDatum>
        {
            new MetricDatum
            {
                MetricName = "ResourcesWithoutTags",
                Value = untaggedCount,
                Timestamp = DateTime.UtcNow
            },
            new MetricDatum
            {
                MetricName = "DriftedStacks",
                Value = driftedCount,
                Timestamp = DateTime.UtcNow
            },
            new MetricDatum
            {
                MetricName = "NonCompliantResources",
                Value = nonCompliantCount,
                Timestamp = DateTime.UtcNow
            }
        }
    });
}