# AWS CLI — provisioning the building blocks
# for a payments microservice (illustrative)

# 1. Confirm identity and region
aws sts get-caller-identity
aws configure set region ap-south-1   # India region for data residency

# 2. Create an encrypted S3 bucket for settlement reports
aws s3api create-bucket \
  --bucket bank-settlement-reports \
  --create-bucket-configuration LocationConstraint=ap-south-1

aws s3api put-bucket-encryption \
  --bucket bank-settlement-reports \
  --server-side-encryption-configuration \
  '{"Rules":[{"ApplyServerSideEncryptionByDefault":{"SSEAlgorithm":"aws:kms"}}]}'

# 3. List running ECS services in the payments cluster
aws ecs list-services --cluster payments-prod

# 4. Tail recent CloudWatch logs
aws logs tail /aws/ecs/payments-api --follow

# In production, every action is gated by IAM,
# audited in CloudTrail, and reviewed quarterly.

# Terraform — a three-tier VPC with private subnets
# and encryption defaults (a banking baseline)

provider "aws" {
  region = "ap-south-1"
}

resource "aws_vpc" "bank" {
  cidr_block           = "10.20.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
}

resource "aws_subnet" "private" {
  count             = 2
  vpc_id            = aws_vpc.bank.id
  cidr_block        = cidrsubnet("10.20.0.0/16", 8, count.index)
  availability_zone = element(["ap-south-1a", "ap-south-1b"], count.index)
}

# Egress goes through NAT — no public IPs by default
resource "aws_eip" "nat" {
  domain = "vpc"
}

resource "aws_nat_gateway" "egress" {
  allocation_id = aws_eip.nat.id
  subnet_id     = aws_subnet.private[0].id
}

# In a real bank:
# - VPC flow logs are forwarded to a SIEM
# - Every resource is tagged for audit and cost
# - Changes go through change-management review
# - Terraform state is encrypted and access-controlled

# Python — a fraud-scoring Lambda handler
# Triggered by a streaming service (Kinesis / MSK)
# and backed by a managed ML endpoint.

import json
import os
import boto3

sagemaker = boto3.client("sagemaker-runtime")
ENDPOINT = os.environ["FRAUD_ENDPOINT"]

def handler(event, context):
    txn = json.loads(event["body"])

    response = sagemaker.invoke_endpoint(
        EndpointName=ENDPOINT,
        ContentType="application/json",
        Body=json.dumps(txn),
    )
    score = float(response["Body"].read())

    return {
        "statusCode": 200,
        "body": json.dumps({
            "transaction_id": txn["id"],
            "fraud_score": round(score, 4),
            "action": "block" if score > 0.85 else "allow",
        }),
    }

# In production:
# - Endpoint is VPC-isolated
# - Every call is logged for audit
# - Models are versioned and validated by risk teams
# - Thresholds are tuned with fraud + business teams

# GitHub Actions — build, scan, and deploy
# a payments service with security gates.

name: Payments API

on:
  push:
    branches: [main]

jobs:
  build-and-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t payments-api:${{ github.sha }} .

      - name: Scan image for vulnerabilities
        run: |
          pip install trivy
          trivy image --exit-code 1 \
            --severity HIGH,CRITICAL \
            payments-api:${{ github.sha }}

      - name: Push to private registry
        env:
          TOKEN: ${{ secrets.REGISTRY_TOKEN }}
        run: |
          echo "$TOKEN" | docker login ${{ secrets.REGISTRY }} \
            -u ${{ secrets.REGISTRY_USER }} --password-stdin
          docker tag payments-api:${{ github.sha }} \
            ${{ secrets.REGISTRY }}/payments-api:${{ github.sha }}
          docker push ${{ secrets.REGISTRY }}/payments-api:${{ github.sha }}

  deploy:
    needs: build-and-scan
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to ECS
        run: |
          aws ecs update-service \
            --cluster payments-prod \
            --service payments-api \
            --force-new-deployment

# In a bank, this pipeline also includes:
# - Change ticket validation
# - Segregation-of-duties approval
# - Automated compliance evidence capture

Realistic migration phases (illustrative):

Phase 1 — Foundations (1-3 months)
  - Landing zone, IAM, logging, network
  - Security review + regulator sign-off
  - First non-critical workload planned

Phase 2 — First workloads (4-6 months)
  - Analytics and reporting on cloud
  - Non-critical internal apps
  - Cost baseline established

Phase 3 — Payments & fraud (7-9 months)
  - Streaming + ML services
  - Sub-100ms scoring
  - Business impact measured against baseline

Phase 4 — Customer channels (10-12 months)
  - Mobile/API layers
  - Personalisation
  - New products launched from cloud-native services

Phase 5 — Core modernization (12-18+ months)
  - Strangler pattern around legacy core
  - No big-bang rewrite
  - Continuous business continuity checks

Key principle: every phase must ship
business value, not just infrastructure.