interface IaCTechnicalDebt {
  financialImpact: {
    wastedCloudSpend: number;      // $2.3M annually from config drift
    incidentCosts: number;         // $1.8M from infrastructure failures
    productivityLoss: number;      // $900K from slow deployment cycles
    complianceRisk: number;        // $5M potential regulatory fines
  };
  operationalImpact: {
    meanTimeToRecovery: string;    // 4.5 hours average
    deploymentFailureRate: string; // 23% of deployments fail
    configurationDrift: string;    // 67% of resources drift from baseline
    developerProductivity: string; // 40% time spent on infrastructure issues
  };
}
 
const technicalDebtAssessment: IaCTechnicalDebt = {
  financialImpact: {
    wastedCloudSpend: 2_300_000,
    incidentCosts: 1_800_000,
    productivityLoss: 900_000,
    complianceRisk: 5_000_000
  },
  operationalImpact: {
    meanTimeToRecovery: "4.5 hours",
    deploymentFailureRate: "23%",
    configurationDrift: "67%",
    developerProductivity: "40% lost"
  }
};
 
// After implementing best practices
const postOptimizationResults = {
  costReduction: "68%",        // $6.8M total cost avoided
  deploymentSuccess: "97%",    // Deployment success rate
  mttr: "18 minutes",         // Mean time to recovery
  driftElimination: "99%"     // Configuration drift eliminated
};

# Recommended IaC directory structure
infrastructure/
├── modules/                    # Reusable infrastructure modules
│   ├── networking/
│   │   ├── vpc/
│   │   │   ├── main.tf
│   │   │   ├── variables.tf
│   │   │   ├── outputs.tf
│   │   │   └── versions.tf
│   │   ├── security-groups/
│   │   └── load-balancer/
│   ├── compute/
│   │   ├── ec2/
│   │   ├── eks/
│   │   └── lambda/
│   ├── data/
│   │   ├── rds/
│   │   ├── elasticache/
│   │   └── s3/
│   └── monitoring/
│       ├── cloudwatch/
│       └── alerts/
├── environments/               # Environment-specific configurations
│   ├── dev/
│   │   ├── main.tf
│   │   ├── terraform.tfvars
│   │   └── backend.tf
│   ├── staging/
│   └── prod/
├── policies/                   # Governance and compliance
│   ├── security-policies/
│   ├── cost-policies/
│   └── compliance-policies/
├── scripts/                    # Automation and utilities
│   ├── deploy.sh
│   ├── validate.sh
│   └── drift-detection.sh
└── docs/                      # Documentation
    ├── architecture/
    ├── runbooks/
    └── troubleshooting/

# modules/application-stack/main.tf
# Composable application stack module
 
terraform {
  required_version = ">= 1.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}
 
# Local values for consistent naming and tagging
locals {
  common_tags = merge(var.common_tags, {
    Module      = "application-stack"
    Environment = var.environment
    Project     = var.project_name
    ManagedBy   = "terraform"
    CreatedOn   = formatdate("YYYY-MM-DD", timestamp())
  })
  
  name_prefix = "${var.project_name}-${var.environment}"
}
 
# Network infrastructure
module "networking" {
  source = "../networking/vpc"
  
  vpc_cidr             = var.vpc_cidr
  availability_zones   = var.availability_zones
  enable_nat_gateway   = var.enable_nat_gateway
  enable_vpn_gateway   = var.enable_vpn_gateway
  
  tags = local.common_tags
}
 
# Security groups
module "security_groups" {
  source = "../networking/security-groups"
  
  vpc_id      = module.networking.vpc_id
  environment = var.environment
  
  # Application-specific security rules
  application_ports = var.application_ports
  database_ports    = var.database_ports
  
  tags = local.common_tags
}
 
# Compute infrastructure
module "compute" {
  source = "../compute/eks"
  
  cluster_name     = "${local.name_prefix}-cluster"
  cluster_version  = var.kubernetes_version
  
  vpc_id           = module.networking.vpc_id
  subnet_ids       = module.networking.private_subnet_ids
  
  node_groups = var.node_groups
  
  # Security configuration
  security_group_ids = [module.security_groups.cluster_security_group_id]
  
  tags = local.common_tags
}
 
# Data layer
module "database" {
  source = "../data/rds"
  
  identifier = "${local.name_prefix}-db"
  
  engine         = var.db_engine
  engine_version = var.db_engine_version
  instance_class = var.db_instance_class
  
  vpc_id     = module.networking.vpc_id
  subnet_ids = module.networking.database_subnet_ids
  
  # Security
  security_group_ids = [module.security_groups.database_security_group_id]
  
  # Backup and maintenance
  backup_retention_period = var.backup_retention_period
  backup_window          = var.backup_window
  maintenance_window     = var.maintenance_window
  
  tags = local.common_tags
}
 
# Monitoring and observability
module "monitoring" {
  source = "../monitoring/cloudwatch"
  
  environment = var.environment
  
  # Resources to monitor
  cluster_name = module.compute.cluster_name
  database_id  = module.database.database_identifier
  
  # Alerting configuration
  sns_topic_arn    = var.alerts_sns_topic_arn
  alert_thresholds = var.alert_thresholds
  
  tags = local.common_tags
}
 
# Output important values for other modules/stacks
output "cluster_endpoint" {
  description = "EKS cluster endpoint"
  value       = module.compute.cluster_endpoint
  sensitive   = true
}
 
output "database_endpoint" {
  description = "RDS database endpoint"
  value       = module.database.database_endpoint
  sensitive   = true
}
 
output "vpc_id" {
  description = "VPC ID for reference by other stacks"
  value       = module.networking.vpc_id
}

# modules/application-stack/variables.tf
# Comprehensive variable definitions with validation
 
variable "environment" {
  description = "Environment name (dev, staging, prod)"
  type        = string
  
  validation {
    condition     = contains(["dev", "staging", "prod"], var.environment)
    error_message = "Environment must be dev, staging, or prod."
  }
}
 
variable "project_name" {
  description = "Project name for resource naming"
  type        = string
  
  validation {
    condition     = can(regex("^[a-z][a-z0-9-]{1,61}[a-z0-9]$", var.project_name))
    error_message = "Project name must be lowercase, start with letter, and contain only letters, numbers, and hyphens."
  }
}
 
variable "vpc_cidr" {
  description = "CIDR block for VPC"
  type        = string
  default     = "10.0.0.0/16"
  
  validation {
    condition     = can(cidrhost(var.vpc_cidr, 0))
    error_message = "VPC CIDR must be a valid IPv4 CIDR block."
  }
}
 
variable "node_groups" {
  description = "EKS node groups configuration"
  type = map(object({
    desired_capacity = number
    max_capacity     = number
    min_capacity     = number
    instance_types   = list(string)
    disk_size        = number
    labels           = map(string)
    taints = list(object({
      key    = string
      value  = string
      effect = string
    }))
  }))
  
  default = {
    general = {
      desired_capacity = 2
      max_capacity     = 10
      min_capacity     = 1
      instance_types   = ["t3.medium"]
      disk_size        = 50
      labels = {
        role = "general"
      }
      taints = []
    }
  }
  
  validation {
    condition = alltrue([
      for k, v in var.node_groups : v.min_capacity <= v.desired_capacity && v.desired_capacity <= v.max_capacity
    ])
    error_message = "Node group capacities must satisfy: min <= desired <= max."
  }
}
 
variable "alert_thresholds" {
  description = "Monitoring alert thresholds"
  type = object({
    cpu_utilization    = number
    memory_utilization = number
    disk_utilization   = number
    error_rate         = number
    response_time      = number
  })
  
  default = {
    cpu_utilization    = 80
    memory_utilization = 85
    disk_utilization   = 90
    error_rate         = 5
    response_time      = 2000
  }
  
  validation {
    condition = alltrue([
      var.alert_thresholds.cpu_utilization > 0 && var.alert_thresholds.cpu_utilization <= 100,
      var.alert_thresholds.memory_utilization > 0 && var.alert_thresholds.memory_utilization <= 100,
      var.alert_thresholds.disk_utilization > 0 && var.alert_thresholds.disk_utilization <= 100,
      var.alert_thresholds.error_rate >= 0 && var.alert_thresholds.error_rate <= 100,
      var.alert_thresholds.response_time > 0
    ])
    error_message = "Alert thresholds must be within valid ranges."
  }
}

# Security-first infrastructure module
module "secure_infrastructure" {
  source = "./modules/secure-foundation"
  
  # Encryption at rest - mandatory
  encryption_config = {
    ebs_encryption     = true
    s3_encryption      = "AES256"
    rds_encryption     = true
    kms_key_rotation   = true
  }
  
  # Network security
  network_security = {
    enable_vpc_flow_logs    = true
    enable_guard_duty      = true
    enable_config_rules    = true
    restrict_public_access = true
  }
  
  # Access control
  iam_config = {
    enforce_mfa                = true
    password_policy_enabled    = true
    access_analyzer_enabled    = true
    unused_access_cleanup_days = 90
  }
  
  # Compliance frameworks
  compliance_frameworks = ["SOC2", "PCI-DSS", "GDPR"]
  
  tags = local.security_tags
}

# Security scanning automation
class InfrastructureSecurityScanner:
    def __init__(self):
        self.scanners = {
            'terraform': TerraformSecurityScanner(),
            'cloudformation': CloudFormationScanner(),
            'kubernetes': KubernetesSecurityScanner(),
            'docker': DockerImageScanner()
        }
        
    async def scan_infrastructure_code(self, code_path: str) -> SecurityScanResult:
        """Comprehensive security scanning of infrastructure code."""
        
        scan_results = {}
        
        # Detect infrastructure type
        infra_type = self.detect_infrastructure_type(code_path)
        
        if infra_type in self.scanners:
            scanner = self.scanners[infra_type]
            
            # Run comprehensive security scans
            scan_results = await scanner.scan({
                'static_analysis': True,      # SAST scanning
                'secrets_detection': True,    # Hardcoded secrets
                'policy_violations': True,    # Custom policy checks
                'compliance_check': True,     # Regulatory compliance
                'best_practices': True,       # Industry best practices
                'vulnerability_scan': True   # Known vulnerabilities
            })
        
        return SecurityScanResult(
            overall_score=self.calculate_security_score(scan_results),
            critical_issues=self.extract_critical_issues(scan_results),
            recommendations=self.generate_security_recommendations(scan_results),
            compliance_status=self.assess_compliance_status(scan_results)
        )
    
    def generate_security_policy(self, requirements: SecurityRequirements) -> SecurityPolicy:
        """Generate custom security policies based on requirements."""
        
        policies = []
        
        # Resource-level policies
        if requirements.encryption_required:
            policies.append(EncryptionPolicy(
                enforce_at_rest=True,
                enforce_in_transit=True,
                key_rotation_enabled=True
            ))
        
        # Access control policies
        if requirements.strict_access_control:
            policies.append(AccessControlPolicy(
                principle_of_least_privilege=True,
                mfa_required=True,
                session_timeout=3600  # 1 hour
            ))
        
        # Network security policies
        if requirements.network_isolation:
            policies.append(NetworkSecurityPolicy(
                default_deny_all=True,
                private_subnets_only=True,
                vpc_flow_logs_required=True
            ))
        
        return SecurityPolicy(
            policies=policies,
            enforcement_level='strict',
            audit_logging=True,
            continuous_monitoring=True
        )
 
# Usage in CI/CD pipeline
async def security_gate_check():
    scanner = InfrastructureSecurityScanner()
    
    # Scan infrastructure code
    scan_result = await scanner.scan_infrastructure_code('./infrastructure')
    
    # Fail build if critical security issues found
    if scan_result.critical_issues:
        print(f"SECURITY GATE FAILED: {len(scan_result.critical_issues)} critical issues found")
        for issue in scan_result.critical_issues:
            print(f"- {issue.severity}: {issue.description}")
        sys.exit(1)
    
    print("Security gate passed successfully")
    return scan_result

class InfrastructureTestSuite:
    def __init__(self):
        self.test_types = {
            'unit': UnitTestRunner(),           # Module-level tests  
            'integration': IntegrationTestRunner(), # Cross-module tests
            'security': SecurityTestRunner(),   # Security validation
            'compliance': ComplianceTestRunner(), # Policy compliance
            'performance': PerformanceTestRunner(), # Performance tests
            'chaos': ChaosTestRunner()         # Chaos engineering
        }
    
    async def run_comprehensive_tests(self, infrastructure_plan: str) -> TestResults:
        """Run comprehensive infrastructure testing."""
        
        test_results = {}
        
        # Unit tests - Test individual modules
        test_results['unit'] = await self.test_types['unit'].test_modules([
            'networking/vpc',
            'compute/eks', 
            'data/rds',
            'monitoring/cloudwatch'
        ])
        
        # Integration tests - Test module interactions
        test_results['integration'] = await self.test_types['integration'].test_scenarios([
            'application_can_connect_to_database',
            'load_balancer_routes_to_healthy_instances',
            'monitoring_alerts_trigger_correctly',
            'backup_and_restore_workflows'
        ])
        
        # Security tests - Validate security posture
        test_results['security'] = await self.test_types['security'].test_controls([
            'encryption_at_rest_enabled',
            'network_segmentation_enforced',
            'iam_permissions_least_privilege',
            'secrets_not_exposed'
        ])
        
        # Compliance tests - Check regulatory requirements
        test_results['compliance'] = await self.test_types['compliance'].test_frameworks([
            'SOC2_Type2',
            'PCI_DSS',
            'GDPR',
            'HIPAA'
        ])
        
        # Performance tests - Validate performance characteristics
        test_results['performance'] = await self.test_types['performance'].run_benchmarks([
            'application_response_time',
            'database_query_performance',
            'network_latency',
            'scaling_performance'
        ])
        
        # Chaos tests - Test resilience
        test_results['chaos'] = await self.test_types['chaos'].run_experiments([
            'random_instance_termination',
            'network_partition_simulation',
            'high_cpu_load_injection',
            'dependency_failure_simulation'
        ])
        
        return TestResults(
            results=test_results,
            overall_status=self.calculate_overall_status(test_results),
            recommendations=self.generate_test_recommendations(test_results)
        )
 
# Terratest integration for Go-based testing
func TestVPCModule(t *testing.T) {
    t.Parallel()
    
    // Define test configuration
    terraformOptions := &terraform.Options{
        TerraformDir: "../modules/networking/vpc",
        Vars: map[string]interface{}{
            "vpc_cidr": "10.0.0.0/16",
            "environment": "test",
            "availability_zones": []string{"us-west-2a", "us-west-2b"},
        },
    }
    
    // Clean up resources after test
    defer terraform.Destroy(t, terraformOptions)
    
    // Deploy infrastructure
    terraform.InitAndApply(t, terraformOptions)
    
    // Validate outputs
    vpcId := terraform.Output(t, terraformOptions, "vpc_id")
    assert.NotEmpty(t, vpcId)
    
    // Validate VPC configuration using AWS SDK
    awsSession := aws.NewSession(&aws.Config{Region: aws.String("us-west-2")})
    ec2Client := ec2.New(awsSession)
    
    vpc, err := ec2.DescribeVpcs(&ec2.DescribeVpcsInput{
        VpcIds: []*string{aws.String(vpcId)},
    })
    
    require.NoError(t, err)
    require.Len(t, vpc.Vpcs, 1)
    
    // Validate VPC CIDR
    assert.Equal(t, "10.0.0.0/16", *vpc.Vpcs[0].CidrBlock)
    
    // Validate tags
    tags := make(map[string]string)
    for _, tag := range vpc.Vpcs[0].Tags {
        tags[*tag.Key] = *tag.Value
    }
    
    assert.Equal(t, "test", tags["Environment"])
    assert.Equal(t, "terraform", tags["ManagedBy"])
}

# .github/workflows/infrastructure-ci.yml
name: Infrastructure CI/CD
 
on:
  push:
    branches: [main, develop]
    paths: ['infrastructure/**']
  pull_request:
    branches: [main]
    paths: ['infrastructure/**']
 
env:
  TF_VERSION: 1.5.0
  AWS_REGION: us-west-2
 
jobs:
  validate:
    name: Validate Infrastructure Code
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{ env.TF_VERSION }}
      
      - name: Terraform Format Check
        run: terraform fmt -check -recursive infrastructure/
      
      - name: Terraform Validate
        run: |
          cd infrastructure/
          terraform init -backend=false
          terraform validate
      
      - name: Security Scan
        uses: bridgecrewio/checkov-action@master
        with:
          directory: infrastructure/
          framework: terraform
          output_format: sarif
          output_file_path: reports/checkov.sarif
      
      - name: Upload Security Results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: reports/checkov.sarif
 
  test:
    name: Test Infrastructure
    runs-on: ubuntu-latest
    needs: validate
    
    strategy:
      matrix:
        environment: [dev, staging]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      
      - name: Setup Go
        uses: actions/setup-go@v3
        with:
          go-version: 1.19
      
      - name: Run Integration Tests
        run: |
          cd tests/
          go mod download
          go test -v -timeout 30m -tags=integration ./...
        env:
          ENVIRONMENT: ${{ matrix.environment }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
 
  plan:
    name: Terraform Plan
    runs-on: ubuntu-latest
    needs: [validate, test]
    if: github.event_name == 'pull_request'
    
    strategy:
      matrix:
        environment: [dev, staging, prod]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{ env.TF_VERSION }}
      
      - name: Terraform Plan
        run: |
          cd infrastructure/environments/${{ matrix.environment }}
          terraform init
          terraform plan -out=tfplan
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      
      - name: Save Plan
        uses: actions/upload-artifact@v3
        with:
          name: tfplan-${{ matrix.environment }}
          path: infrastructure/environments/${{ matrix.environment }}/tfplan
 
  deploy:
    name: Deploy Infrastructure
    runs-on: ubuntu-latest
    needs: [validate, test]
    if: github.ref == 'refs/heads/main'
    
    strategy:
      matrix:
        environment: [dev, staging]
        # Production requires manual approval
    
    environment:
      name: ${{ matrix.environment }}
      url: https://${{ matrix.environment }}.example.com
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{ env.TF_VERSION }}
      
      - name: Terraform Apply
        run: |
          cd infrastructure/environments/${{ matrix.environment }}
          terraform init
          terraform apply -auto-approve
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      
      - name: Post-Deployment Tests
        run: |
          cd tests/
          go test -v -tags=smoke ./smoke/
        env:
          ENVIRONMENT: ${{ matrix.environment }}
 
  drift-detection:
    name: Configuration Drift Detection
    runs-on: ubuntu-latest
    if: github.event_name == 'schedule'
    
    strategy:
      matrix:
        environment: [dev, staging, prod]
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      
      - name: Setup Terraform
        uses: hashicorp/setup-terraform@v2
        with:
          terraform_version: ${{ env.TF_VERSION }}
      
      - name: Detect Configuration Drift
        run: |
          cd infrastructure/environments/${{ matrix.environment }}
          terraform init
          terraform plan -detailed-exitcode
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
      
      - name: Alert on Drift
        if: failure()
        uses: 8398a7/action-slack@v3
        with:
          status: failure
          text: "Configuration drift detected in ${{ matrix.environment }} environment"
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}

# Lifecycle-aware resource management
resource "aws_s3_bucket_lifecycle_configuration" "data_lifecycle" {
  bucket = aws_s3_bucket.data_bucket.id
 
  rule {
    id     = "intelligent_tiering"
    status = "Enabled"
 
    filter {
      prefix = "data/"
    }
 
    transition {
      days          = 0
      storage_class = "INTELLIGENT_TIERING"
    }
  }
 
  rule {
    id     = "archive_old_data"
    status = "Enabled"
 
    filter {
      prefix = "logs/"
    }
 
    transition {
      days          = 30
      storage_class = "GLACIER"
    }
 
    transition {
      days          = 90
      storage_class = "DEEP_ARCHIVE"
    }
 
    expiration {
      days = 2555  # 7 years retention
    }
  }
 
  rule {
    id     = "cleanup_multipart_uploads"
    status = "Enabled"
 
    abort_incomplete_multipart_upload {
      days_after_initiation = 1
    }
  }
}
 
# Cost-optimized instance lifecycle
resource "aws_autoscaling_group" "app_asg" {
  name = "${local.name_prefix}-asg"
  
  vpc_zone_identifier = var.subnet_ids
  target_group_arns   = [aws_lb_target_group.app.arn]
  
  min_size         = var.min_capacity
  max_size         = var.max_capacity
  desired_capacity = var.desired_capacity
  
  # Mixed instances policy for cost optimization
  mixed_instances_policy {
    launch_template {
      launch_template_specification {
        launch_template_id = aws_launch_template.app.id
        version           = "$Latest"
      }
      
      override {
        instance_type     = "t3.medium"
        weighted_capacity = "1"
      }
      
      override {
        instance_type     = "t3.large"
        weighted_capacity = "2"
      }
    }
    
    instances_distribution {
      on_demand_base_capacity                  = 1
      on_demand_percentage_above_base_capacity = 20
      spot_allocation_strategy                 = "diversified"
      spot_instance_pools                      = 3
      spot_max_price                          = "0.10"
    }
  }
  
  # Lifecycle hooks for graceful handling
  initial_lifecycle_hook {
    name                 = "startup-hook"
    default_result       = "ABANDON"
    heartbeat_timeout    = 300
    lifecycle_transition = "autoscaling:EC2_INSTANCE_LAUNCHING"
    
    notification_target_arn = aws_sns_topic.lifecycle_notifications.arn
    role_arn               = aws_iam_role.autoscaling_lifecycle.arn
  }
  
  initial_lifecycle_hook {
    name                 = "shutdown-hook"
    default_result       = "CONTINUE"
    heartbeat_timeout    = 300
    lifecycle_transition = "autoscaling:EC2_INSTANCE_TERMINATING"
    
    notification_target_arn = aws_sns_topic.lifecycle_notifications.arn
    role_arn               = aws_iam_role.autoscaling_lifecycle.arn
  }
  
  tag {
    key                 = "Name"
    value               = "${local.name_prefix}-instance"
    propagate_at_launch = true
  }
  
  tag {
    key                 = "Environment"
    value               = var.environment
    propagate_at_launch = true
  }
}

class InfrastructureLifecycleManager:
    def __init__(self):
        self.cleanup_policies = {
            'unused_resources': UnusedResourceCleanup(),
            'expired_resources': ExpiredResourceCleanup(),
            'cost_optimization': CostOptimizationCleanup(),
            'compliance_cleanup': ComplianceCleanup()
        }
    
    async def manage_resource_lifecycle(self) -> LifecycleManagementResult:
        """Comprehensive infrastructure lifecycle management."""
        
        results = {}
        
        # Identify resources for cleanup
        cleanup_candidates = await self.identify_cleanup_candidates()
        
        # Process each cleanup policy
        for policy_name, policy in self.cleanup_policies.items():
            policy_results = await policy.execute_cleanup(cleanup_candidates)
            results[policy_name] = policy_results
        
        # Generate lifecycle report
        report = self.generate_lifecycle_report(results)
        
        return LifecycleManagementResult(
            cleaned_resources=self.calculate_cleaned_resources(results),
            cost_savings=self.calculate_cost_savings(results),
            report=report,
            recommendations=self.generate_recommendations(results)
        )
    
    async def identify_cleanup_candidates(self) -> List[ResourceCleanupCandidate]:
        """Identify resources that can be cleaned up."""
        
        candidates = []
        
        # Unused EBS volumes
        unused_volumes = await self.find_unused_ebs_volumes()
        candidates.extend([
            ResourceCleanupCandidate(
                resource_id=volume['VolumeId'],
                resource_type='EBS_VOLUME',
                last_used=self.get_last_attachment_time(volume),
                monthly_cost=self.calculate_ebs_cost(volume),
                cleanup_confidence=0.9
            ) for volume in unused_volumes
        ])
        
        # Orphaned snapshots
        orphaned_snapshots = await self.find_orphaned_snapshots()
        candidates.extend([
            ResourceCleanupCandidate(
                resource_id=snapshot['SnapshotId'],
                resource_type='EBS_SNAPSHOT',
                last_used=snapshot['StartTime'],
                monthly_cost=self.calculate_snapshot_cost(snapshot),
                cleanup_confidence=0.8
            ) for snapshot in orphaned_snapshots
        ])
        
        # Idle load balancers
        idle_load_balancers = await self.find_idle_load_balancers()
        candidates.extend([
            ResourceCleanupCandidate(
                resource_id=lb['LoadBalancerArn'],
                resource_type='LOAD_BALANCER',
                last_used=self.get_last_request_time(lb),
                monthly_cost=self.calculate_lb_cost(lb),
                cleanup_confidence=0.7
            ) for lb in idle_load_balancers
        ])
        
        return candidates
 
# Automated cleanup execution
async def automated_infrastructure_cleanup():
    lifecycle_manager = InfrastructureLifecycleManager()
    
    # Execute lifecycle management
    result = await lifecycle_manager.manage_resource_lifecycle()
    
    print(f"Cleaned up {len(result.cleaned_resources)} resources")
    print(f"Monthly cost savings: ${result.cost_savings:,.2f}")
    
    # Send report to stakeholders
    await send_lifecycle_report(result.report)
    
    return result

# Version-controlled module evolution
terraform {
  required_version = ">= 1.0"
  
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}
 
# Module versioning and backward compatibility
module "application_stack" {
  source = "git::https://github.com/company/terraform-modules.git//application-stack?ref=v2.1.0"
  
  # Version 2.x introduces new features while maintaining compatibility
  version = "2.1.0"
  
  # Required parameters (unchanged from v1.x)
  project_name = var.project_name
  environment  = var.environment
  
  # New optional parameters in v2.x
  enable_container_insights   = var.enable_container_insights
  enable_service_mesh        = var.enable_service_mesh
  enable_gitops_deployment   = var.enable_gitops_deployment
  
  # Backward compatibility for v1.x users
  legacy_mode = false  # Set to true for v1.x compatibility
}
 
# Module upgrade strategy
locals {
  # Feature flags for gradual rollout
  feature_flags = {
    enable_new_monitoring = var.environment != "prod"  # Enable in dev/staging first
    enable_enhanced_security = true
    enable_cost_optimization = var.environment == "prod"  # Production optimization
  }
}

class InfrastructureDocumentationGenerator:
    def __init__(self):
        self.doc_generators = {
            'architecture': ArchitectureDocGenerator(),
            'runbooks': RunbookGenerator(),
            'troubleshooting': TroubleshootingGuideGenerator(),
            'api_docs': APIDocumentationGenerator()
        }
    
    async def generate_comprehensive_docs(self, infrastructure_path: str) -> DocumentationSuite:
        """Generate comprehensive infrastructure documentation."""
        
        # Analyze infrastructure code
        infrastructure_analysis = await self.analyze_infrastructure(infrastructure_path)
        
        # Generate different types of documentation
        docs = {}
        
        # Architecture documentation
        docs['architecture'] = await self.doc_generators['architecture'].generate({
            'infrastructure_analysis': infrastructure_analysis,
            'include_diagrams': True,
            'include_data_flow': True,
            'include_security_zones': True
        })
        
        # Operational runbooks
        docs['runbooks'] = await self.doc_generators['runbooks'].generate({
            'deployment_procedures': True,
            'scaling_procedures': True,
            'disaster_recovery': True,
            'maintenance_procedures': True
        })
        
        # Troubleshooting guides
        docs['troubleshooting'] = await self.doc_generators['troubleshooting'].generate({
            'common_issues': infrastructure_analysis.common_issues,
            'monitoring_queries': infrastructure_analysis.monitoring_setup,
            'escalation_procedures': True
        })
        
        # API documentation
        docs['api_docs'] = await self.doc_generators['api_docs'].generate({
            'terraform_modules': infrastructure_analysis.modules,
            'input_variables': infrastructure_analysis.variables,
            'output_values': infrastructure_analysis.outputs
        })
        
        return DocumentationSuite(
            documents=docs,
            last_updated=datetime.utcnow(),
            infrastructure_version=infrastructure_analysis.version
        )
    
    def create_living_documentation(self, infrastructure_path: str) -> LivingDocumentation:
        """Create documentation that updates automatically with infrastructure changes."""
        
        return LivingDocumentation(
            source_path=infrastructure_path,
            update_triggers=[
                'terraform_plan_changes',
                'module_version_updates',
                'policy_changes',
                'security_updates'
            ],
            auto_generation_schedule='daily',
            notification_channels=['slack', 'email'],
            validation_rules=[
                'documentation_coverage > 90%',
                'architecture_diagrams_current',
                'runbook_procedures_tested'
            ]
        )
 
# Automated documentation pipeline
def generate_infrastructure_docs():
    """Generate and update infrastructure documentation."""
    
    doc_generator = InfrastructureDocumentationGenerator()
    
    # Generate comprehensive documentation
    docs = doc_generator.generate_comprehensive_docs('./infrastructure')
    
    # Update documentation repository
    update_documentation_repository(docs)
    
    # Generate architecture diagrams
    generate_infrastructure_diagrams('./infrastructure')
    
    # Validate documentation completeness
    validation_results = validate_documentation_coverage(docs)
    
    if validation_results.coverage < 0.9:
        print(f"Warning: Documentation coverage is {validation_results.coverage:.1%}")
        print("Missing documentation for:")
        for missing_item in validation_results.missing_items:
            print(f"  - {missing_item}")
    
    return docs

# Multi-cloud infrastructure with provider abstraction
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
    google = {
      source  = "hashicorp/google"
      version = "~> 4.0"
    }
  }
}
 
# Abstract cloud provider module
module "multi_cloud_application" {
  source = "./modules/multi-cloud-app"
  
  # Cloud provider configuration
  cloud_providers = {
    primary = {
      provider = "aws"
      region   = "us-west-2"
      config = {
        vpc_cidr = "10.0.0.0/16"
      }
    }
    
    secondary = {
      provider = "azure"
      region   = "East US"
      config = {
        vnet_cidr = "10.1.0.0/16"
      }
    }
    
    disaster_recovery = {
      provider = "gcp"
      region   = "us-central1"
      config = {
        vpc_cidr = "10.2.0.0/16"
      }
    }
  }
  
  # Application configuration
  application_config = {
    name         = "multi-cloud-app"
    environment  = "production"
    tier        = "web"
    
    # Cross-cloud networking
    enable_vpn_gateway   = true
    enable_peering      = true
    enable_load_balancing = true
  }
  
  # Disaster recovery configuration
  disaster_recovery = {
    enabled                = true
    recovery_time_objective = "1h"
    recovery_point_objective = "15m"
    replication_strategy    = "active_passive"
  }
}

# ArgoCD Application for Infrastructure GitOps
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: infrastructure-prod
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "1"  # Infrastructure deploys first
spec:
  project: infrastructure
  
  source:
    repoURL: https://github.com/company/infrastructure
    targetRevision: main
    path: environments/production
    
    plugin:
      name: terraform-plugin
      env:
        - name: TF_VAR_environment
          value: production
        - name: TF_VAR_auto_approve
          value: "true"
  
  destination:
    server: https://kubernetes.default.svc
    namespace: infrastructure
  
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    
    syncOptions:
      - CreateNamespace=true
      - PrunePropagationPolicy=foreground
      - PruneLast=true
    
    retry:
      limit: 5
      backoff:
        duration: 5s
        factor: 2
        maxDuration: 3m
  
  # Health checks
  ignoreDifferences:
    - group: apps
      kind: Deployment
      jsonPointers:
        - /spec/replicas
  
  # Rollback configuration
  revisionHistoryLimit: 10

class InfrastructureCostOptimizer:
    def __init__(self):
        self.optimizers = {
            'right_sizing': RightSizingOptimizer(),
            'reserved_instances': ReservedInstanceOptimizer(),
            'spot_instances': SpotInstanceOptimizer(),
            'storage_optimization': StorageOptimizer(),
            'network_optimization': NetworkOptimizer()
        }
    
    async def optimize_infrastructure_costs(self) -> CostOptimizationResult:
        """Comprehensive infrastructure cost optimization."""
        
        # Analyze current infrastructure costs
        cost_analysis = await self.analyze_infrastructure_costs()
        
        # Apply optimization strategies
        optimization_results = {}
        
        for optimizer_name, optimizer in self.optimizers.items():
            optimization_result = await optimizer.optimize(cost_analysis)
            optimization_results[optimizer_name] = optimization_result
        
        # Generate optimization plan
        optimization_plan = self.create_optimization_plan(optimization_results)
        
        # Execute high-confidence optimizations automatically
        auto_execution_results = await self.execute_auto_optimizations(optimization_plan)
        
        return CostOptimizationResult(
            current_monthly_cost=cost_analysis.total_monthly_cost,
            optimized_monthly_cost=optimization_plan.optimized_monthly_cost,
            potential_savings=optimization_plan.potential_monthly_savings,
            optimization_actions=optimization_plan.actions,
            auto_executed_actions=auto_execution_results.executed_actions,
            manual_review_required=optimization_plan.manual_review_actions
        )
    
    def create_optimization_plan(self, optimization_results: Dict) -> OptimizationPlan:
        """Create comprehensive optimization plan."""
        
        actions = []
        
        # Right-sizing actions
        for recommendation in optimization_results['right_sizing'].recommendations:
            if recommendation.confidence_score > 0.8:
                actions.append(OptimizationAction(
                    type='right_sizing',
                    resource_id=recommendation.resource_id,
                    action=f"Resize from {recommendation.current_size} to {recommendation.recommended_size}",
                    monthly_savings=recommendation.monthly_savings,
                    confidence=recommendation.confidence_score,
                    auto_executable=True
                ))
        
        # Reserved Instance actions
        for recommendation in optimization_results['reserved_instances'].recommendations:
            actions.append(OptimizationAction(
                type='reserved_instance',
                resource_type=recommendation.instance_type,
                action=f"Purchase {recommendation.quantity} {recommendation.term}-year RIs",
                monthly_savings=recommendation.monthly_savings,
                upfront_cost=recommendation.upfront_cost,
                auto_executable=False  # Requires approval for financial commitment
            ))
        
        return OptimizationPlan(
            actions=actions,
            total_potential_savings=sum(action.monthly_savings for action in actions),
            implementation_timeline=self.calculate_implementation_timeline(actions)
        )
 
# Automated cost optimization execution
async def run_cost_optimization():
    optimizer = InfrastructureCostOptimizer()
    
    # Execute cost optimization
    result = await optimizer.optimize_infrastructure_costs()
    
    print(f"Current monthly cost: ${result.current_monthly_cost:,.2f}")
    print(f"Potential monthly savings: ${result.potential_savings:,.2f}")
    print(f"Auto-executed optimizations: {len(result.auto_executed_actions)}")
    print(f"Manual review required: {len(result.manual_review_required)}")
    
    # Send optimization report
    await send_cost_optimization_report(result)
    
    return result

class EnterpriseMigrationFramework:
    def __init__(self):
        self.migration_phases = [
            'assessment_and_planning',
            'infrastructure_preparation',
            'pilot_migration',
            'bulk_migration',
            'optimization_and_cleanup'
        ]
        
        self.automation_tools = {
            'discovery': ApplicationDiscoveryTool(),
            'assessment': MigrationAssessmentTool(),
            'infrastructure': TerraformOrchestrator(),
            'data_migration': DataMigrationService(),
            'testing': AutomatedTestingSuite(),
            'monitoring': MigrationMonitoringDashboard()
        }
    
    async def execute_enterprise_migration(self) -> MigrationResult:
        """Execute comprehensive enterprise migration."""
        
        migration_results = {}
        
        # Phase 1: Assessment and Planning
        migration_results['assessment'] = await self.execute_assessment_phase()
        
        # Phase 2: Infrastructure Preparation
        migration_results['infrastructure'] = await self.prepare_target_infrastructure(
            migration_results['assessment']
        )
        
        # Phase 3: Pilot Migration
        migration_results['pilot'] = await self.execute_pilot_migration(
            migration_results['assessment'].pilot_applications
        )
        
        # Phase 4: Bulk Migration
        migration_results['bulk'] = await self.execute_bulk_migration(
            migration_results['assessment'].production_applications
        )
        
        # Phase 5: Optimization
        migration_results['optimization'] = await self.optimize_migrated_infrastructure()
        
        return MigrationResult(
            phases_completed=len(migration_results),
            applications_migrated=self.count_migrated_applications(migration_results),
            total_cost_savings=self.calculate_cost_savings(migration_results),
            compliance_status=self.verify_compliance_status(migration_results)
        )
    
    async def prepare_target_infrastructure(self, assessment: AssessmentResult) -> InfrastructureResult:
        """Prepare target cloud infrastructure based on assessment."""
        
        # Generate infrastructure code based on assessment
        infrastructure_code = self.generate_infrastructure_code(assessment)
        
        # Deploy infrastructure using Terraform
        terraform_result = await self.automation_tools['infrastructure'].deploy(
            infrastructure_code
        )
        
        # Validate infrastructure deployment
        validation_result = await self.validate_infrastructure_deployment(
            terraform_result
        )
        
        return InfrastructureResult(
            terraform_result=terraform_result,
            validation_result=validation_result,
            infrastructure_ready=validation_result.all_checks_passed
        )
 
# Migration results after 18 months
migration_results = {
    'applications_migrated': 247,  # Exceeded original scope
    'infrastructure_cost_reduction': '42%',  # $2.1M annual savings
    'deployment_frequency_improvement': '300%',  # From monthly to daily
    'mean_time_to_recovery_improvement': '85%',  # From hours to minutes
    'compliance_score': '98%',  # Exceeded compliance requirements
    'zero_data_loss_achieved': True,
    'average_downtime_per_app': '2.3 hours',  # Below 4-hour target
    'team_satisfaction_score': '4.2/5.0'
}

#!/bin/bash
# Phase 1: Establish IaC Foundation
 
# Month 1: Setup and Standards
establish_iac_foundation() {
    echo "Setting up IaC foundation..."
    
    # Setup version control and branching strategy
    setup_git_repository
    configure_branching_strategy
    
    # Establish coding standards
    create_terraform_standards
    setup_code_formatting_tools
    configure_linting_rules
    
    # Setup development environment
    install_terraform_tools
    configure_editor_plugins
    setup_local_testing_env
    
    echo "IaC foundation established"
}
 
# Month 2: Module Development
develop_core_modules() {
    echo "Developing core infrastructure modules..."
    
    # Create foundational modules
    create_networking_modules
    create_compute_modules
    create_storage_modules
    create_security_modules
    
    # Setup module testing
    create_module_tests
    setup_testing_pipeline
    
    # Documentation
    generate_module_documentation
    create_usage_examples
    
    echo "Core modules developed and tested"
}

class IaCImplementationPlan:
    def __init__(self):
        self.implementation_phases = [
            ImplementationPhase(
                name='Development Environment',
                duration_months=1,
                scope='Non-production infrastructure',
                risk_level='LOW',
                success_criteria=[
                    'All modules deployed successfully',
                    'Testing pipeline functional',
                    'Documentation complete'
                ]
            ),
            ImplementationPhase(
                name='Staging Environment',
                duration_months=1,
                scope='Pre-production infrastructure',
                risk_level='MEDIUM',
                success_criteria=[
                    'Production-like environment created',
                    'Security validation passed',
                    'Performance testing completed'
                ]
            ),
            ImplementationPhase(
                name='Production Deployment',
                duration_months=2,
                scope='Critical production infrastructure',
                risk_level='HIGH',
                success_criteria=[
                    'Zero downtime deployment',
                    'All compliance requirements met',
                    'Monitoring and alerting functional',
                    'Disaster recovery tested'
                ]
            )
        ]
    
    def execute_implementation(self) -> ImplementationResult:
        """Execute phased IaC implementation."""
        
        results = []
        
        for phase in self.implementation_phases:
            phase_result = self.execute_phase(phase)
            results.append(phase_result)
            
            # Gate check before proceeding
            if not self.validate_phase_completion(phase_result):
                return ImplementationResult(
                    success=False,
                    failed_phase=phase.name,
                    results=results
                )
        
        return ImplementationResult(
            success=True,
            results=results,
            final_metrics=self.calculate_success_metrics(results)
        )

interface IaCOptimizationPlan {
  costOptimization: CostOptimizationStrategy;
  performanceOptimization: PerformanceOptimizationStrategy;
  securityEnhancement: SecurityEnhancementStrategy;
  processImprovement: ProcessImprovementStrategy;
}
 
class IaCOptimizationEngine {
  async optimizeInfrastructure(): Promise<OptimizationResult> {
    const optimizations = await Promise.all([
      this.optimizeCosts(),
      this.optimizePerformance(),
      this.enhanceSecurity(),
      this.improveProcesses()
    ]);
    
    return new OptimizationResult(optimizations);
  }
  
  private async optimizeCosts(): Promise<CostOptimizationResult> {
    // Implement automated cost optimization
    const costAnalysis = await this.analyzeCosts();
    const optimizationActions = this.generateCostOptimizations(costAnalysis);
    
    return await this.executeCostOptimizations(optimizationActions);
  }
  
  private async optimizePerformance(): Promise<PerformanceOptimizationResult> {
    // Implement performance optimization
    const performanceMetrics = await this.collectPerformanceMetrics();
    const bottlenecks = this.identifyBottlenecks(performanceMetrics);
    
    return await this.resolvePerformanceBottlenecks(bottlenecks);
  }
}

interface IaCSuccessMetrics {
  // Deployment Metrics
  deploymentFrequency: number;          // Deployments per day
  deploymentSuccessRate: number;        // % successful deployments
  meanTimeToDeployment: number;         // Minutes from commit to production
  rollbackFrequency: number;            // Rollbacks per 100 deployments
  
  // Quality Metrics
  configurationDriftRate: number;       // % resources drifted from code
  infrastructureTestCoverage: number;   // % modules with tests
  documentationCoverage: number;        // % modules with documentation
  complianceScore: number;              // Compliance audit score (0-100)
  
  // Cost Metrics
  infrastructureCostTrend: number;      // Month-over-month cost change %
  resourceUtilizationRate: number;      // % average resource utilization
  wastedResourceCost: number;           // Monthly cost of unused resources
  
  // Operational Metrics
  meanTimeToRecovery: number;           // Minutes to recover from incidents
  incidentFrequency: number;            // Infrastructure incidents per month
  teamProductivity: number;             // Developer velocity improvement %
  knowledgeTransferScore: number;       // Team IaC competency score (0-100)
}
 
class IaCMetricsCollector {
  async collectMonthlyMetrics(): Promise<IaCSuccessMetrics> {
    const [
      deploymentMetrics,
      qualityMetrics,
      costMetrics,
      operationalMetrics
    ] = await Promise.all([
      this.collectDeploymentMetrics(),
      this.collectQualityMetrics(),
      this.collectCostMetrics(),
      this.collectOperationalMetrics()
    ]);
    
    return {
      ...deploymentMetrics,
      ...qualityMetrics,
      ...costMetrics,
      ...operationalMetrics
    };
  }
  
  generateIaCReport(metrics: IaCSuccessMetrics): IaCReport {
    return {
      executiveSummary: this.generateExecutiveSummary(metrics),
      trendsAnalysis: this.analyzeTrends(metrics),
      recommendedActions: this.generateRecommendations(metrics),
      benchmarkComparison: this.compareWithBenchmarks(metrics),
      nextMonthTargets: this.setNextMonthTargets(metrics)
    };
  }
}

# Wrong approach - monolithic
resource "aws_vpc" "main" { ... }
resource "aws_subnet" "public" { ... }
resource "aws_subnet" "private" { ... }
resource "aws_security_group" "web" { ... }
resource "aws_instance" "web" { ... }
resource "aws_rds_instance" "database" { ... }
# ... 500 more lines
 
# Right approach - modular
module "networking" {
  source = "./modules/networking"
  # configuration
}
 
module "compute" {
  source = "./modules/compute"  
  vpc_id = module.networking.vpc_id
  # configuration
}
 
module "database" {
  source = "./modules/database"
  vpc_id = module.networking.vpc_id
  # configuration
}

# Remote state configuration with locking
terraform {
  backend "s3" {
    bucket         = "company-terraform-state"
    key            = "environments/prod/terraform.tfstate"
    region         = "us-west-2"
    encrypt        = true
    dynamodb_table = "terraform-state-lock"
    
    # State versioning and backup
    versioning = true
    
    # Access control
    role_arn = "arn:aws:iam::123456789012:role/TerraformRole"
  }
}

# Comprehensive infrastructure testing
class InfrastructureTestStrategy:
    def __init__(self):
        self.test_levels = [
            'unit_tests',        # Individual module testing
            'integration_tests', # Cross-module testing
            'security_tests',    # Security validation
            'compliance_tests',  # Policy compliance
            'performance_tests', # Performance validation
            'chaos_tests'        # Resilience testing
        ]
    
    async def run_all_tests(self, infrastructure_code: str) -> TestResults:
        test_results = {}
        
        for test_level in self.test_levels:
            test_runner = self.get_test_runner(test_level)
            test_results[test_level] = await test_runner.run_tests(infrastructure_code)
            
            # Fail fast on critical test failures
            if test_results[test_level].has_critical_failures():
                return TestResults(
                    success=False,
                    failed_at=test_level,
                    results=test_results
                )
        
        return TestResults(success=True, results=test_results)