AWSTemplateFormatVersion: '2010-09-09'
Description: 'Basic VPC with EC2 instance for web application'
 
Parameters:
  InstanceType:
    Type: String
    Default: t3.micro
    AllowedValues: [t3.micro, t3.small, t3.medium]
    Description: EC2 instance type
 
Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: ProductionVPC
 
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs '']
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: PublicSubnet1
 
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: MainIGW
 
  AttachGateway:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      VpcId: !Ref VPC
      InternetGatewayId: !Ref InternetGateway
 
  WebServerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Allow HTTP and SSH
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 10.0.0.0/16
      Tags:
        - Key: Name
          Value: WebServerSG
 
  WebServerInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: ami-0abcdef1234567890  # Amazon Linux 2023 AMI (region-specific)
      InstanceType: !Ref InstanceType
      SubnetId: !Ref PublicSubnet
      SecurityGroupIds:
        - !Ref WebServerSecurityGroup
      Tags:
        - Key: Name
          Value: WebServer
        - Key: Environment
          Value: Production
        - Key: CostCenter
          Value: Engineering
 
Outputs:
  InstanceId:
    Description: Instance ID of the web server
    Value: !Ref WebServerInstance
  PublicIP:
    Description: Public IP address
    Value: !GetAtt WebServerInstance.PublicIp

# Create the stack
aws cloudformation create-stack \
    --stack-name production-web-stack \
    --template-body file://web-infrastructure.yaml \
    --parameters ParameterKey=InstanceType,ParameterValue=t3.small \
    --tags Key=Project,Value=WebApp Key=Owner,Value=DevOps
 
# Monitor stack creation progress
aws cloudformation describe-stack-events \
    --stack-name production-web-stack \
    --query 'StackEvents[?ResourceStatus==`CREATE_IN_PROGRESS`].[Timestamp,ResourceType,ResourceStatus]' \
    --output table
 
# Get stack outputs once complete
aws cloudformation describe-stacks \
    --stack-name production-web-stack \
    --query 'Stacks[0].Outputs' \
    --output table

# Create an S3 bucket for Config snapshots
aws s3api create-bucket \
    --bucket my-org-config-snapshots-us-east-1 \
    --region us-east-1
 
# Create IAM role for Config (requires trust policy and permissions policy)
aws iam create-role \
    --role-name AWSConfigRole \
    --assume-role-policy-document file://config-trust-policy.json
 
aws iam attach-role-policy \
    --role-name AWSConfigRole \
    --policy-arn arn:aws:iam::aws:policy/service-role/ConfigRole
 
# Start the configuration recorder
aws configservice put-configuration-recorder \
    --configuration-recorder name=default,roleARN=arn:aws:iam::123456789012:role/AWSConfigRole \
    --recording-group allSupported=true,includeGlobalResourceTypes=true
 
aws configservice put-delivery-channel \
    --delivery-channel name=default,s3BucketName=my-org-config-snapshots-us-east-1
 
aws configservice start-configuration-recorder \
    --configuration-recorder-name default
 
# Deploy a managed Config rule to check for public S3 buckets
aws configservice put-config-rule \
    --config-rule '{
        "ConfigRuleName": "s3-bucket-public-read-prohibited",
        "Description": "Checks that S3 buckets do not allow public read access",
        "Source": {
            "Owner": "AWS",
            "SourceIdentifier": "S3_BUCKET_PUBLIC_READ_PROHIBITED"
        },
        "Scope": {
            "ComplianceResourceTypes": ["AWS::S3::Bucket"]
        }
    }'
 
# Deploy a rule to ensure EC2 instances don't have public IPs
aws configservice put-config-rule \
    --config-rule '{
        "ConfigRuleName": "ec2-instance-no-public-ip",
        "Description": "Checks that EC2 instances do not have public IP addresses",
        "Source": {
            "Owner": "AWS",
            "SourceIdentifier": "EC2_INSTANCE_NO_PUBLIC_IP"
        },
        "Scope": {
            "ComplianceResourceTypes": ["AWS::EC2::Instance"]
        }
    }'
 
# Check compliance status
aws configservice describe-compliance-by-config-rule \
    --config-rule-names s3-bucket-public-read-prohibited ec2-instance-no-public-ip \
    --query 'ComplianceByConfigRules[*].[ConfigRuleName,Compliance.ComplianceType]' \
    --output table

# Create S3 bucket for CloudTrail logs
aws s3api create-bucket \
    --bucket my-org-cloudtrail-logs-us-east-1 \
    --region us-east-1
 
# Apply bucket policy to allow CloudTrail to write logs
aws s3api put-bucket-policy \
    --bucket my-org-cloudtrail-logs-us-east-1 \
    --policy file://cloudtrail-bucket-policy.json
 
# Create the trail
aws cloudtrail create-trail \
    --name organization-audit-trail \
    --s3-bucket-name my-org-cloudtrail-logs-us-east-1 \
    --is-multi-region-trail \
    --enable-log-file-validation
 
# Start logging
aws cloudtrail start-logging \
    --name organization-audit-trail
 
# Query recent events - who launched EC2 instances in the last 24 hours?
aws cloudtrail lookup-events \
    --lookup-attributes AttributeKey=EventName,AttributeValue=RunInstances \
    --max-results 50 \
    --query 'Events[*].{Time:EventTime, User:Username, Instance:Resources[0].ResourceName, IP:SourceIPAddress}' \
    --output table
 
# Find all IAM policy changes
aws cloudtrail lookup-events \
    --lookup-attributes AttributeKey=ResourceType,AttributeValue=AWS::IAM::Policy \
    --max-results 50 \
    --query 'Events[*].{Time:EventTime, Event:EventName, User:Username}' \
    --output table

# Update all production web servers
aws ssm send-command \
    --document-name "AWS-RunShellScript" \
    --targets "Key=tag:Role,Values=WebServer" "Key=tag:Environment,Values=Production" \
    --parameters 'commands=["sudo yum update -y", "sudo systemctl restart nginx"]' \
    --comment "Monthly security updates for production web fleet" \
    --timeout-seconds 600 \
    --output-s3-bucket-name "my-ssm-command-outputs"
 
# Check command execution status
aws ssm list-commands \
    --command-id "abc123-def456-ghi789" \
    --query 'Commands[0].{Status:Status, Completed:CompletedCount, Failed:ErrorCount}' \
    --output table
 
# Get detailed output from a specific instance
aws ssm get-command-invocation \
    --command-id "abc123-def456-ghi789" \
    --instance-id "i-0123456789abcdef0" \
    --query '{Status:Status, Output:StandardOutputContent}' \
    --output text

# Create a patch baseline for Amazon Linux
aws ssm create-patch-baseline \
    --name "AmazonLinux2023-SecurityPatches" \
    --operating-system "AMAZON_LINUX_2023" \
    --approval-rules '{
        "PatchRules": [{
            "PatchFilterGroup": {
                "PatchFilters": [{
                    "Key": "CLASSIFICATION",
                    "Values": ["Security", "Bugfix"]
                }]
            },
            "ApproveAfterDays": 7,
            "ComplianceLevel": "CRITICAL"
        }]
    }'
 
# Create a maintenance window for patching
aws ssm create-maintenance-window \
    --name "Production-Patching-Window" \
    --schedule "cron(0 2 ? * SUN *)" \
    --duration 4 \
    --cutoff 1 \
    --allow-unassociated-targets \
    --description "Sunday 2 AM patching window for production servers"
 
# Register targets (instances to patch)
aws ssm register-target-with-maintenance-window \
    --window-id "mw-0123456789abcdef0" \
    --target-type "INSTANCE" \
    --targets "Key=tag:Environment,Values=Production" \
    --owner-information "Production Fleet"
 
# Register the patch task
aws ssm register-task-with-maintenance-window \
    --window-id "mw-0123456789abcdef0" \
    --task-type "RUN_COMMAND" \
    --targets "Key=WindowTargetIds,Values=abc123-def456" \
    --task-arn "AWS-RunPatchBaseline" \
    --service-role-arn "arn:aws:iam::123456789012:role/MaintenanceWindowRole" \
    --task-invocation-parameters '{
        "RunCommand": {
            "Parameters": {
                "Operation": ["Install"]
            }
        }
    }' \
    --priority 1 \
    --max-concurrency "50%" \
    --max-errors "10%"

# Enable inventory collection
aws ssm create-association \
    --name "AWS-GatherSoftwareInventory" \
    --targets "Key=InstanceIds,Values=*" \
    --schedule-expression "rate(12 hours)" \
    --parameters '{
        "applications": ["Enabled"],
        "awsComponents": ["Enabled"],
        "networkConfig": ["Enabled"],
        "instanceDetailedInformation": ["Enabled"]
    }'
 
# Query inventory data - find all instances with nginx installed
aws ssm get-inventory \
    --filters "Key=AWS:Application.Name,Values=nginx,Type=Equal" \
    --query 'Entities[*].{InstanceId:Id, Version:Data.AWS:Application.Content[0].Version}' \
    --output table

# Create an organization (run from the management account)
aws organizations create-organization \
    --feature-set ALL
 
# Create organizational units for different teams/environments
aws organizations create-organizational-unit \
    --parent-id r-abc123 \
    --name "Production"
 
aws organizations create-organizational-unit \
    --parent-id r-abc123 \
    --name "Development"
 
aws organizations create-organizational-unit \
    --parent-id r-abc123 \
    --name "Sandbox"
 
# Invite an existing account to join the organization
aws organizations invite-account-to-organization \
    --target '{
        "Id": "987654321098",
        "Type": "ACCOUNT"
    }' \
    --notes "Adding marketing team AWS account to organization"
 
# Create a new account directly in the organization
aws organizations create-account \
    --email "[email protected]" \
    --account-name "DataEngineering" \
    --iam-user-access-to-billing ALLOW

# Create an SCP to deny region usage outside approved regions
cat > deny-unapproved-regions.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "DenyUnapprovedRegions",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": [
            "us-east-1",
            "us-west-2",
            "eu-west-1"
          ]
        }
      }
    }
  ]
}
EOF
 
aws organizations create-policy \
    --name "RestrictRegions" \
    --description "Only allow operations in approved regions" \
    --type SERVICE_CONTROL_POLICY \
    --content file://deny-unapproved-regions.json
 
# Attach the policy to the Production OU
aws organizations attach-policy \
    --policy-id "p-abc123def456" \
    --target-id "ou-abc123-defghijk"
 
# Create an SCP to prevent disabling CloudTrail
cat > protect-cloudtrail.json <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ProtectCloudTrail",
      "Effect": "Deny",
      "Action": [
        "cloudtrail:StopLogging",
        "cloudtrail:DeleteTrail"
      ],
      "Resource": "*"
    }
  ]
}
EOF
 
aws organizations create-policy \
    --name "ProtectCloudTrail" \
    --description "Prevent disabling CloudTrail audit logs" \
    --type SERVICE_CONTROL_POLICY \
    --content file://protect-cloudtrail.json
 
# List all policies attached to an account
aws organizations list-policies-for-target \
    --target-id "123456789012" \
    --filter SERVICE_CONTROL_POLICY \
    --query 'Policies[*].[Name,Id]' \
    --output table

# Get total costs for the current month, grouped by service
aws ce get-cost-and-usage \
    --time-period Start=$(date -d "first day of this month" +%Y-%m-%d),End=$(date +%Y-%m-%d) \
    --granularity MONTHLY \
    --metrics "UnblendedCost" \
    --group-by Type=DIMENSION,Key=SERVICE \
    --query 'ResultsByTime[0].Groups[*].[Keys[0],Metrics.UnblendedCost.Amount]' \
    --output table
 
# Get daily costs for the last 30 days
aws ce get-cost-and-usage \
    --time-period Start=$(date -d "30 days ago" +%Y-%m-%d),End=$(date +%Y-%m-%d) \
    --granularity DAILY \
    --metrics "UnblendedCost" \
    --query 'ResultsByTime[*].[TimePeriod.Start,Total.UnblendedCost.Amount]' \
    --output table
 
# Get costs grouped by cost allocation tags (e.g., by team)
aws ce get-cost-and-usage \
    --time-period Start=2026-02-01,End=2026-03-01 \
    --granularity MONTHLY \
    --metrics "UnblendedCost" \
    --group-by Type=TAG,Key=Team \
    --query 'ResultsByTime[0].Groups[*].[Keys[0],Metrics.UnblendedCost.Amount]' \
    --output table
 
# Identify the top 10 most expensive resources
aws ce get-cost-and-usage \
    --time-period Start=$(date -d "first day of last month" +%Y-%m-%d),End=$(date -d "last day of last month" +%Y-%m-%d) \
    --granularity MONTHLY \
    --metrics "UnblendedCost" \
    --group-by Type=DIMENSION,Key=RESOURCE_ID \
    --query 'ResultsByTime[0].Groups | sort_by(@, &Metrics.UnblendedCost.Amount) | reverse(@) | [0:10].[Keys[0],Metrics.UnblendedCost.Amount]' \
    --output table
 
# Get forecast for the next 30 days
aws ce get-cost-forecast \
    --time-period Start=$(date +%Y-%m-%d),End=$(date -d "+30 days" +%Y-%m-%d) \
    --metric UNBLENDED_COST \
    --granularity MONTHLY \
    --query 'Total.Amount' \
    --output text

# Activate cost allocation tags (must be done via console or API)
aws ce list-cost-allocation-tags \
    --status Inactive \
    --query 'CostAllocationTags[*].TagKey' \
    --output table
 
# Tag existing resources for cost tracking
aws ec2 create-tags \
    --resources i-0123456789abcdef0 i-0987654321fedcba0 \
    --tags Key=Project,Value=WebsiteRedesign Key=CostCenter,Value=Marketing Key=Owner,[email protected]
 
aws s3api put-bucket-tagging \
    --bucket my-data-bucket \
    --tagging 'TagSet=[{Key=Project,Value=DataPipeline},{Key=CostCenter,Value=Engineering}]'
 
# Create a tagging policy for the organization
cat > tagging-policy.json <<EOF
{
  "tags": {
    "CostCenter": {
      "tag_key": {
        "@@assign": "CostCenter"
      },
      "enforced_for": {
        "@@assign": [
          "ec2:instance",
          "s3:bucket",
          "rds:db"
        ]
      }
    },
    "Project": {
      "tag_key": {
        "@@assign": "Project"
      },
      "enforced_for": {
        "@@assign": [
          "ec2:instance",
          "s3:bucket"
        ]
      }
    }
  }
}
EOF

# Get rightsizing recommendations from Compute Optimizer
aws compute-optimizer get-ec2-instance-recommendations \
    --instance-arns "arn:aws:ec2:us-east-1:123456789012:instance/i-0123456789abcdef0" \
    --query 'instanceRecommendations[0].{Current:currentInstanceType, Recommended:recommendationOptions[0].instanceType, Savings:recommendationOptions[0].estimatedMonthlySavings.value}' \
    --output table
 
# Get recommendations for all instances in the account
aws compute-optimizer get-ec2-instance-recommendations \
    --max-results 100 \
    --query 'instanceRecommendations[?finding==`OVER_PROVISIONED`].[instanceArn,currentInstanceType,recommendationOptions[0].instanceType,recommendationOptions[0].estimatedMonthlySavings.value]' \
    --output table

# Get Reserved Instance recommendations
aws ce get-reservation-purchase-recommendation \
    --service "Amazon Elastic Compute Cloud - Compute" \
    --lookback-period-in-days SIXTY_DAYS \
    --term-in-years ONE_YEAR \
    --payment-option NO_UPFRONT \
    --query 'Recommendations[*].{InstanceType:RecommendationDetails.AmazonEC2.InstanceDetails.InstanceType, EstimatedMonthlySavings:RecommendationDetails.EstimatedMonthlySavingsAmount}' \
    --output table
 
# Purchase a Reserved Instance (example - verify details before purchasing)
aws ec2 purchase-reserved-instances-offering \
    --reserved-instances-offering-id "abc12345-def6-7890-gh12-ijklmnop3456" \
    --instance-count 5

# Request Spot Instances with a maximum price
aws ec2 request-spot-instances \
    --spot-price "0.05" \
    --instance-count 3 \
    --type "one-time" \
    --launch-specification '{
        "ImageId": "ami-0abcdef1234567890",
        "InstanceType": "t3.medium",
        "KeyName": "my-key-pair",
        "SecurityGroupIds": ["sg-0123456789abcdef0"],
        "SubnetId": "subnet-abc123"
    }'
 
# Check Spot Instance pricing history
aws ec2 describe-spot-price-history \
    --instance-types t3.medium \
    --start-time $(date -u -d "7 days ago" +%Y-%m-%dT%H:%M:%S) \
    --product-descriptions "Linux/UNIX" \
    --query 'SpotPriceHistory[*].[Timestamp,SpotPrice,AvailabilityZone]' \
    --output table

# Create an Auto Scaling group
aws autoscaling create-auto-scaling-group \
    --auto-scaling-group-name web-asg \
    --launch-template LaunchTemplateId=lt-0123456789abcdef0,Version=1 \
    --min-size 2 \
    --max-size 10 \
    --desired-capacity 3 \
    --target-group-arns arn:aws:elasticloadbalancing:us-east-1:123456789012:targetgroup/web-tg/abc123 \
    --health-check-type ELB \
    --health-check-grace-period 300 \
    --vpc-zone-identifier "subnet-abc123,subnet-def456"
 
# Create scaling policies based on CPU utilization
aws autoscaling put-scaling-policy \
    --auto-scaling-group-name web-asg \
    --policy-name scale-up \
    --policy-type TargetTrackingScaling \
    --target-tracking-configuration '{
        "PredefinedMetricSpecification": {
            "PredefinedMetricType": "ASGAverageCPUUtilization"
        },
        "TargetValue": 70.0
    }'

# Create an S3 lifecycle policy to transition objects to cheaper storage tiers
cat > lifecycle-policy.json <<EOF
{
  "Rules": [
    {
      "Id": "TransitionOldLogs",
      "Status": "Enabled",
      "Filter": {
        "Prefix": "logs/"
      },
      "Transitions": [
        {
          "Days": 30,
          "StorageClass": "STANDARD_IA"
        },
        {
          "Days": 90,
          "StorageClass": "GLACIER_IR"
        },
        {
          "Days": 365,
          "StorageClass": "DEEP_ARCHIVE"
        }
      ],
      "Expiration": {
        "Days": 2555
      }
    }
  ]
}
EOF
 
aws s3api put-bucket-lifecycle-configuration \
    --bucket my-log-bucket \
    --lifecycle-configuration file://lifecycle-policy.json
 
# Enable S3 Intelligent-Tiering for automatic cost optimization
aws s3api put-bucket-intelligent-tiering-configuration \
    --bucket my-data-bucket \
    --id AutoArchive \
    --intelligent-tiering-configuration '{
        "Id": "AutoArchive",
        "Status": "Enabled",
        "Tierings": [
            {
                "Days": 90,
                "AccessTier": "ARCHIVE_ACCESS"
            },
            {
                "Days": 180,
                "AccessTier": "DEEP_ARCHIVE_ACCESS"
            }
        ]
    }'

# Find unattached EBS volumes
aws ec2 describe-volumes \
    --filters Name=status,Values=available \
    --query 'Volumes[*].[VolumeId,Size,CreateTime]' \
    --output table
 
# Find idle Elastic IPs (not associated with running instances)
aws ec2 describe-addresses \
    --query 'Addresses[?AssociationId==null].[PublicIp,AllocationId]' \
    --output table
 
# Find idle RDS instances (low CPU utilization)
aws cloudwatch get-metric-statistics \
    --namespace AWS/RDS \
    --metric-name CPUUtilization \
    --dimensions Name=DBInstanceIdentifier,Value=my-database \
    --start-time $(date -u -d "7 days ago" +%Y-%m-%dT%H:%M:%S) \
    --end-time $(date -u +%Y-%m-%dT%H:%M:%S) \
    --period 3600 \
    --statistics Average \
    --query 'Datapoints[*].Average' \
    --output text | awk '{sum+=$1; count++} END {print sum/count}'
 
# Find old snapshots that can be deleted
aws ec2 describe-snapshots \
    --owner-ids self \
    --query 'Snapshots[?StartTime<=`2025-01-01`].[SnapshotId,StartTime,VolumeSize]' \
    --output table

# Create a monthly cost budget with alerts at 80% and 100%
aws budgets create-budget \
    --account-id "123456789012" \
    --budget '{
        "BudgetName": "MonthlyTotalCostBudget",
        "BudgetType": "COST",
        "TimeUnit": "MONTHLY",
        "BudgetLimit": {
            "Amount": "10000",
            "Unit": "USD"
        },
        "CostFilters": {},
        "CostTypes": {
            "IncludeTax": true,
            "IncludeSubscription": true,
            "UseBlended": false,
            "IncludeRefund": false,
            "IncludeCredit": false,
            "IncludeUpfront": true,
            "IncludeRecurring": true,
            "IncludeOtherSubscription": true,
            "IncludeSupport": true,
            "IncludeDiscount": true,
            "UseAmortized": false
        }
    }' \
    --notifications-with-subscribers '[
        {
            "Notification": {
                "NotificationType": "ACTUAL",
                "ComparisonOperator": "GREATER_THAN",
                "Threshold": 80,
                "ThresholdType": "PERCENTAGE"
            },
            "Subscribers": [
                {
                    "SubscriptionType": "EMAIL",
                    "Address": "[email protected]"
                },
                {
                    "SubscriptionType": "SNS",
                    "Address": "arn:aws:sns:us-east-1:123456789012:CostAlertTopic"
                }
            ]
        },
        {
            "Notification": {
                "NotificationType": "FORECASTED",
                "ComparisonOperator": "GREATER_THAN",
                "Threshold": 100,
                "ThresholdType": "PERCENTAGE"
            },
            "Subscribers": [
                {
                    "SubscriptionType": "EMAIL",
                    "Address": "[email protected]"
                }
            ]
        }
    ]'
 
# Create a budget for a specific service (EC2 only)
aws budgets create-budget \
    --account-id "123456789012" \
    --budget '{
        "BudgetName": "EC2MonthlyCostBudget",
        "BudgetType": "COST",
        "TimeUnit": "MONTHLY",
        "BudgetLimit": {
            "Amount": "3000",
            "Unit": "USD"
        },
        "CostFilters": {
            "Service": ["Amazon Elastic Compute Cloud - Compute"]
        }
    }' \
    --notifications-with-subscribers '[
        {
            "Notification": {
                "NotificationType": "ACTUAL",
                "ComparisonOperator": "GREATER_THAN",
                "Threshold": 90,
                "ThresholdType": "PERCENTAGE"
            },
            "Subscribers": [
                {
                    "SubscriptionType": "EMAIL",
                    "Address": "[email protected]"
                }
            ]
        }
    ]'
 
# Create a usage budget (for tracking specific metrics)
aws budgets create-budget \
    --account-id "123456789012" \
    --budget '{
        "BudgetName": "EC2InstanceHoursBudget",
        "BudgetType": "USAGE",
        "TimeUnit": "MONTHLY",
        "BudgetLimit": {
            "Amount": "5000",
            "Unit": "Hours"
        },
        "CostFilters": {
            "Service": ["Amazon Elastic Compute Cloud - Compute"]
        }
    }' \
    --notifications-with-subscribers '[
        {
            "Notification": {
                "NotificationType": "ACTUAL",
                "ComparisonOperator": "GREATER_THAN",
                "Threshold": 85,
                "ThresholdType": "PERCENTAGE"
            },
            "Subscribers": [
                {
                    "SubscriptionType": "EMAIL",
                    "Address": "[email protected]"
                }
            ]
        }
    ]'
 
# List all budgets
aws budgets describe-budgets \
    --account-id "123456789012" \
    --query 'Budgets[*].[BudgetName,BudgetLimit.Amount,CalculatedSpend.ActualSpend.Amount]' \
    --output table

# Download and run the installation script
curl -fsSL https://install.opssqad.ai/install.sh | bash
 
# Install the node using your unique credentials from the dashboard
opssquad node install --node-id=node_abc123xyz --token=tok_def456uvw
 
# Start the node agent
opssquad node start
 
# Verify connection
opssquad node status

# Put custom application metrics
aws cloudwatch put-metric-data \
    --namespace "MyApp/Performance" \
    --metric-data '[
        {
            "MetricName": "RequestLatency",
            "Value": 145.5,
            "Unit": "Milliseconds",
            "Timestamp": "'$(date -u +%Y-%m-%dT%H:%M:%S)'",
            "Dimensions": [
                {"Name": "Environment", "Value": "Production"},
                {"Name": "Endpoint", "Value": "/api/users"}
            ]
        }
    ]'
 
# Put multiple data points in a batch
aws cloudwatch put-metric-data \
    --namespace "MyApp/Business" \
    --metric-data '[
        {"MetricName": "OrdersProcessed", "Value": 47, "Unit": "Count"},
        {"MetricName": "Revenue", "Value": 3847.25, "Unit": "None"},
        {"MetricName": "ActiveUsers", "Value": 1523, "Unit": "Count"}
    ]'

# Create alarm for high API latency
aws cloudwatch put-metric-alarm \
    --alarm-name "HighAPILatency-Production" \
    --alarm-description "Alert when API latency exceeds 500ms for 2 consecutive periods" \
    --metric-name "RequestLatency" \
    --namespace "MyApp/Performance" \
    --statistic Average \
    --period 300 \
    --threshold 500 \
    --comparison-operator GreaterThanThreshold \
    --evaluation-periods 2 \
    --datapoints-to-alarm 2 \
    --dimensions Name=Environment,Value=Production \
    --alarm-actions arn:aws:sns:us-east-1:123456789012:OnCallAlerts \
    --treat-missing-data notBreaching
 
# Create alarm for EC2 instance CPU utilization
aws cloudwatch put-metric-alarm \
    --alarm-name "HighCPU-WebServer-01" \
    --metric-name "CPUUtilization" \
    --namespace "AWS/EC2" \
    --statistic Average \
    --period 300 \
    --threshold 80 \
    --comparison-operator GreaterThanThreshold \
    --evaluation-periods 3 \
    --dimensions Name=InstanceId,Value=i-0123456789abcdef0 \
    --alarm-actions arn:aws:sns:us-east-1:123456789012:InfraAlerts
 
# Create composite alarm (triggers only if multiple conditions are met)
aws cloudwatch put-composite-alarm \
    --alarm-name "CriticalSystemFailure" \
    --alarm-description "Multiple critical systems are failing" \
    --alarm-rule "ALARM(HighAPILatency-Production) AND ALARM(DatabaseConnectionErrors)" \
    --actions-enabled \
    --alarm-actions arn:aws:sns:us-east-1:123456789012:PagerDutyIntegration
 
# Create alarm with anomaly detection
aws cloudwatch put-metric-alarm \
    --alarm-name "AnomalousTraffic" \
    --metric-name "RequestCount" \
    --namespace "AWS/ApplicationELB" \
    --statistic Average \
    --period 300 \
    --evaluation-periods 2 \
    --threshold-metric-id e1 \
    --comparison-operator LessThanLowerOrGreaterThanUpperThreshold \
    --alarm-actions arn:aws:sns:us-east-1:123456789012:SecurityTeam \
    --metrics '[
        {
            "Id": "m1",
            "ReturnData": true,
            "MetricStat": {
                "Metric": {
                    "Namespace": "AWS/ApplicationELB",
                    "MetricName": "RequestCount",
                    "Dimensions": [
                        {"Name": "LoadBalancer", "Value": "app/my-alb/abc123"}
                    ]
                },
                "Period": 300,
                "Stat": "Average"
            }
        },
        {
            "Id": "e1",
            "Expression": "ANOMALY_DETECTION_BAND(m1, 2)"
        }
    ]'

# Query application logs for errors in the last hour
aws logs start-query \
    --log-group-name "/aws/lambda/my-function" \
    --start-time $(date -d "1 hour ago" +%s) \
    --end-time $(date +%s) \
    --query-string 'fields @timestamp, @message
        | filter @message like /ERROR/
        | stats count() by bin(5m)
        | sort @timestamp desc'
 
# Get the query results (use query ID from previous command)
aws logs