Chaos Engineering for Resilience Testing in Cloud-Native Microservices

// Order Service with Chaos Engineering (C#)
using Amazon.CloudWatch;
using Amazon.CloudWatch.Model;
using Amazon.XRay.Recorder.Core;
using Amazon.KMS;
using Amazon.KMS.Model;
using Amazon.S3;
using Amazon.S3.Model;
using Confluent.Kafka;
using Microsoft.AspNetCore.Mvc;
using Microsoft.IdentityModel.Tokens;
using OpenTelemetry;
using OpenTelemetry.Resources;
using OpenTelemetry.Trace;
using Polly;
using Serilog;
using System;
using System.Diagnostics;
using System.IdentityModel.Tokens.Jwt;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;

namespace OrderContext
{
    [ApiController]
    [Route("v1/orders")]
    public class OrderController : ControllerBase
    {
        private readonly IHttpClientFactory _clientFactory;
        private readonly IProducer<Null, string> _kafkaProducer;
        private readonly IAsyncPolicy<HttpResponseMessage> _resiliencyPolicy;
        private readonly Tracer _tracer;
        private readonly AmazonCloudWatchClient _cloudWatchClient;
        private readonly AmazonKMSClient _kmsClient;
        private readonly AmazonS3Client _s3Client;

        public OrderController(IHttpClientFactory clientFactory, IProducer<Null, string> kafkaProducer)
        {
            _clientFactory = clientFactory;
            _kafkaProducer = kafkaProducer;

            // Initialize AWS clients with IAM role
            _cloudWatchClient = new AmazonCloudWatchClient();
            _kmsClient = new AmazonKMSClient();
            _s3Client = new AmazonS3Client();

            // Initialize X-Ray for Distributed Tracing
            AWSSDKHandler.RegisterXRayForAllServices();

            // Initialize OpenTelemetry for Tracing
            _tracer = Sdk.CreateTracerProviderBuilder()
                .AddSource("OrderService")
                .SetResourceBuilder(ResourceBuilder.CreateDefault().AddService("OrderService"))
                .AddXRayTraceExporter(options => { options.Region = "us-east-1"; })
                .AddJaegerExporter(options =>
                {
                    options.AgentHost = Environment.GetEnvironmentVariable("JAEGER_AGENT_HOST");
                    options.AgentPort = 6831;
                })
                .Build()
                .GetTracer("OrderService");

            // Resiliency: Circuit Breaker, Retry, Timeout
            _resiliencyPolicy = Policy.WrapAsync(
                Policy<HttpResponseMessage>
                    .HandleTransientHttpError()
                    .Or<Exception>(ex => ex.Message.Contains("ChaosTest")) // Handle chaos-induced failures
                    .CircuitBreakerAsync(5, TimeSpan.FromSeconds(30)),
                Policy<HttpResponseMessage>
                    .HandleTransientHttpError()
                    .Or<Exception>(ex => ex.Message.Contains("ChaosTest"))
                    .WaitAndRetryAsync(3, retryAttempt => TimeSpan.FromMilliseconds(100 * Math.Pow(2, retryAttempt))),
                Policy.TimeoutAsync<HttpResponseMessage>(TimeSpan.FromMilliseconds(500))
            );

            // Serilog with CloudWatch sink (12-Factor Logs)
            Log.Logger = new LoggerConfiguration()
                .WriteTo.Console()
                .WriteTo.AmazonCloudWatch(
                    logGroup: "/ecs/order-service",
                    logStreamPrefix: "ecs",
                    cloudWatchClient: _cloudWatchClient)
                .CreateLogger();
        }

        [HttpPost]
        public async Task<IActionResult> CreateOrder([FromBody] Order order, [FromHeader(Name = "Authorization")] string authHeader, [FromHeader(Name = "X-HMAC-Signature")] string hmacSignature, [FromHeader(Name = "X-Request-Timestamp")] string timestamp, [FromHeader(Name = "X-Device-ID")] string deviceId)
        {
            using var span = _tracer.StartActiveSpan("CreateOrder");
            span.SetAttribute("orderId", order.OrderId);
            span.SetAttribute("userId", order.UserId);
            span.SetAttribute("deviceId", deviceId);

            // Start X-Ray segment
            AWSXRayRecorder.Instance.BeginSegment("OrderService", order.OrderId);

            // Simulate chaos: Random failure for testing
            if (Environment.GetEnvironmentVariable("CHAOS_ENABLED") == "true" && new Random().Next(0, 100) < 10)
            {
                Log.Error("Chaos test: Simulating service failure for Order {OrderId}", order.OrderId);
                span.RecordException(new Exception("ChaosTest: Simulated failure"));
                span.SetStatus(Status.Error);
                await LogMetricAsync("ChaosFailure", 1);
                throw new Exception("ChaosTest: Simulated service failure");
            }

            // Verify Device (Zero Trust)
            using var deviceSpan = _tracer.StartSpan("VerifyDevice");
            if (!await VerifyDeviceAsync(deviceId))
            {
                Log.Error("Invalid device {DeviceId} for Order {OrderId}", deviceId, order.OrderId);
                span.RecordException(new Exception("Invalid device"));
                span.SetStatus(Status.Error);
                await LogMetricAsync("DeviceVerificationFailed", 1);
                return Unauthorized("Invalid device");
            }
            deviceSpan.End();

            // Rate Limiting (Zero Trust)
            using var rateLimitSpan = _tracer.StartSpan("CheckRateLimit");
            if (!await CheckRateLimitAsync(order.UserId, deviceId))
            {
                Log.Error("Rate limit exceeded for User {UserId}, Device {DeviceId}", order.UserId, deviceId);
                span.RecordException(new Exception("Rate limit exceeded"));
                span.SetStatus(Status.Error);
                await LogMetricAsync("RateLimitExceeded", 1);
                return StatusCode(429, "Too Many Requests");
            }
            rateLimitSpan.End();

            // Validate JWT (Zero Trust)
            using var jwtSpan = _tracer.StartSpan("ValidateJwt");
            if (!await ValidateJwtAsync(authHeader))
            {
                Log.Error("Invalid or missing JWT for Order {OrderId}", order.OrderId);
                span.RecordException(new Exception("Invalid JWT"));
                span.SetStatus(Status.Error);
                await LogMetricAsync("JwtValidationFailed", 1);
                return Unauthorized();
            }
            jwtSpan.End();

            // Validate HMAC-SHA256 (Zero Trust)
            using var hmacSpan = _tracer.StartSpan("ValidateHmac");
            if (!await ValidateHmacAsync(order, hmacSignature, timestamp))
            {
                Log.Error("Invalid HMAC for Order {OrderId}", order.OrderId);
                span.RecordException(new Exception("Invalid HMAC"));
                span.SetStatus(Status.Error);
                await LogMetricAsync("HmacValidationFailed", 1);
                return BadRequest("Invalid HMAC signature");
            }
            hmacSpan.End();

            // Idempotency check with Snowflake ID
            var requestId = Guid.NewGuid().ToString(); // Simplified Snowflake ID
            using var idempotencySpan = _tracer.StartSpan("CheckIdempotency");
            if (await IsProcessedAsync(requestId))
            {
                Log.Information("Order {OrderId} already processed", order.OrderId);
                span.SetAttribute("idempotent", true);
                await LogMetricAsync("IdempotentRequest", 1);
                return Ok("Order already processed");
            }
            idempotencySpan.End();

            // Encrypt order amount with AWS KMS (Zero Trust)
            using var encryptionSpan = _tracer.StartSpan("EncryptOrder");
            var encryptResponse = await _kmsClient.EncryptAsync(new EncryptRequest
            {
                KeyId = Environment.GetEnvironmentVariable("KMS_KEY_ARN"),
                Plaintext = Encoding.UTF8.GetBytes(order.Amount.ToString())
            });
            var encryptedAmount = Convert.ToBase64String(encryptResponse.CiphertextBlob);
            encryptionSpan.End();

            // Compute SHA-256 checksum (Zero Trust)
            using var checksumSpan = _tracer.StartSpan("ComputeChecksum");
            var checksum = ComputeChecksum(encryptedAmount);
            checksumSpan.End();

            // Store encrypted data in S3
            using var storageSpan = _tracer.StartSpan("StoreOrder");
            var putRequest = new PutObjectRequest
            {
                BucketName = Environment.GetEnvironmentVariable("S3_BUCKET"),
                Key = $"orders/{requestId}",
                ContentBody = System.Text.Json.JsonSerializer.Serialize(new { order.OrderId, encryptedAmount, checksum }),
                ServerSideEncryptionMethod = ServerSideEncryptionMethod.AWSKMS,
                ServerSideEncryptionKeyManagementServiceKeyId = Environment.GetEnvironmentVariable("KMS_KEY_ARN")
            };
            try
            {
                await _s3Client.PutObjectAsync(putRequest);
            }
            catch (AmazonS3Exception ex)
            {
                Log.Error("S3 storage failed for Order {OrderId}: {Error}", order.OrderId, ex.Message);
                span.RecordException(ex);
                span.SetStatus(Status.Error);
                await LogMetricAsync("S3StorageFailed", 1);
                throw;
            }
            storageSpan.End();

            // Call Payment Service via Service Mesh (mTLS)
            using var paymentSpan = _tracer.StartSpan("CallPaymentService");
            var client = _clientFactory.CreateClient("PaymentService");
            var payload = System.Text.Json.JsonSerializer.Serialize(new
            {
                order_id = order.OrderId,
                encrypted_amount = encryptedAmount,
                checksum = checksum
            });
            var response = await _resiliencyPolicy.ExecuteAsync(async () =>
            {
                var request = new HttpRequestMessage(HttpMethod.Post, Environment.GetEnvironmentVariable("PAYMENT_SERVICE_URL"))
                {
                    Content = new StringContent(payload, Encoding.UTF8, "application/json"),
                    Headers = { { "Authorization", authHeader }, { "X-HMAC-Signature", hmacSignature }, { "X-Request-Timestamp", timestamp }, { "X-Device-ID", deviceId } }
                };
                var result = await client.SendAsync(request);
                result.EnsureSuccessStatusCode();
                return result;
            });
            paymentSpan.End();

            // Publish event for EDA/CDC
            using var eventSpan = _tracer.StartSpan("PublishEvent");
            var @event = new OrderCreatedEvent
            {
                EventId = requestId,
                OrderId = order.OrderId,
                EncryptedAmount = encryptedAmount,
                Checksum = checksum
            };
            try
            {
                await _kafkaProducer.ProduceAsync(Environment.GetEnvironmentVariable("KAFKA_TOPIC"), new Message<Null, string>
                {
                    Value = System.Text.Json.JsonSerializer.Serialize(@event)
                });
            }
            catch (ProduceException<Null, string> ex)
            {
                Log.Error("Kafka publish failed for Order {OrderId}: {Error}", order.OrderId, ex.Message);
                span.RecordException(ex);
                span.SetStatus(Status.Error);
                await LogMetricAsync("KafkaPublishFailed", 1);
                throw;
            }
            eventSpan.End();

            // Log metrics
            await LogMetricAsync("OrderProcessed", 1);

            Log.Information("Order {OrderId} processed successfully for Device {DeviceId}", order.OrderId, deviceId);
            AWSXRayRecorder.Instance.EndSegment();
            return Ok(order);
        }

        private async Task<bool> VerifyDeviceAsync(string deviceId)
        {
            // Simulated device verification
            return await Task.FromResult(!string.IsNullOrEmpty(deviceId));
        }

        private async Task<bool> CheckRateLimitAsync(string userId, string deviceId)
        {
            // Simulated Redis-based rate limiting (token bucket, 1,000 req/s)
            return await Task.FromResult(true);
        }

        private async Task<bool> ValidateJwtAsync(string authHeader)
        {
            if (string.IsNullOrEmpty(authHeader) || !authHeader.StartsWith("Bearer "))
                return false;

            var token = authHeader.Substring("Bearer ".Length).Trim();
            var handler = new JwtSecurityTokenHandler();
            try
            {
                var jwt = handler.ReadJwtToken(token);
                var issuer = Environment.GetEnvironmentVariable("COGNITO_ISSUER");
                var jwksUrl = $"{issuer}/.well-known/jwks.json";

                var jwks = await GetJwksAsync(jwksUrl);
                var validationParameters = new TokenValidationParameters
                {
                    IssuerSigningKeys = jwks.Keys,
                    ValidIssuer = issuer,
                    ValidAudience = Environment.GetEnvironmentVariable("COGNITO_CLIENT_ID"),
                    ValidateIssuer = true,
                    ValidateAudience = true,
                    ValidateLifetime = true
                };

                handler.ValidateToken(token, validationParameters, out var validatedToken);
                await LogMetricAsync("JwtValidationSuccess", 1);
                return true;
            }
            catch (Exception ex)
            {
                Log.Error("JWT validation failed: {Error}", ex.Message);
                return false;
            }
        }

        private async Task<bool> ValidateHmacAsync(Order order, string hmacSignature, string timestamp)
        {
            var secret = Environment.GetEnvironmentVariable("API_SECRET");
            var payload = $"{order.OrderId}:{order.Amount}:{timestamp}";
            var computedHmac = ComputeHmac(payload, secret);
            var isValid = hmacSignature == computedHmac;

            if (isValid)
                await LogMetricAsync("HmacValidationSuccess", 1);
            return await Task.FromResult(isValid);
        }

        private async Task<JsonWebKeySet> GetJwksAsync(string jwksUrl)
        {
            var client = _clientFactory.CreateClient();
            var response = await client.GetStringAsync(jwksUrl);
            return new JsonWebKeySet(response);
        }

        private async Task<bool> IsProcessedAsync(string requestId)
        {
            // Simulated idempotency check (e.g., Redis)
            return await Task.FromResult(false);
        }

        private async Task LogMetricAsync(string metricName, double value)
        {
            var request = new PutMetricDataRequest
            {
                Namespace = "Ecommerce/OrderService",
                MetricData = new List<MetricDatum>
                {
                    new MetricDatum
                    {
                        MetricName = metricName,
                        Value = value,
                        Unit = StandardUnit.Count,
                        Timestamp = DateTime.UtcNow
                    }
                }
            };
            try
            {
                await _cloudWatchClient.PutMetricDataAsync(request);
            }
            catch (AmazonCloudWatchException ex)
            {
                Log.Error("Failed to log metric {MetricName}: {Error}", metricName, ex.Message);
            }
        }

        private string ComputeHmac(string data, string secret)
        {
            using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
            var bytes = Encoding.UTF8.GetBytes(data);
            var hash = hmac.ComputeHash(bytes);
            return Convert.ToBase64String(hash);
        }

        private string ComputeChecksum(string data)
        {
            using var sha256 = SHA256.Create();
            var bytes = Encoding.UTF8.GetBytes(data);
            var hash = sha256.ComputeHash(bytes);
            return Convert.ToBase64String(hash);
        }
    }

    public class Order
    {
        public string OrderId { get; set; }
        public double Amount { get; set; }
        public string UserId { get; set; }
    }

    public class OrderCreatedEvent
    {
        public string EventId { get; set; }
        public string OrderId { get; set; }
        public string EncryptedAmount { get; set; }
        public string Checksum { get; set; }
    }
}

// Order Service with Chaos Engineering (C#)
using Amazon.CloudWatch;
using Amazon.CloudWatch.Model;
using Amazon.XRay.Recorder.Core;
using Amazon.KMS;
using Amazon.KMS.Model;
using Amazon.S3;
using Amazon.S3.Model;
using Confluent.Kafka;
using Microsoft.AspNetCore.Mvc;
using Microsoft.IdentityModel.Tokens;
using OpenTelemetry;
using OpenTelemetry.Resources;
using OpenTelemetry.Trace;
using Polly;
using Serilog;
using System;
using System.Diagnostics;
using System.IdentityModel.Tokens.Jwt;
using System.Net.Http;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;

namespace OrderContext
{
    [ApiController]
    [Route("v1/orders")]
    public class OrderController : ControllerBase
    {
        private readonly IHttpClientFactory _clientFactory;
        private readonly IProducer<Null, string> _kafkaProducer;
        private readonly IAsyncPolicy<HttpResponseMessage> _resiliencyPolicy;
        private readonly Tracer _tracer;
        private readonly AmazonCloudWatchClient _cloudWatchClient;
        private readonly AmazonKMSClient _kmsClient;
        private readonly AmazonS3Client _s3Client;

        public OrderController(IHttpClientFactory clientFactory, IProducer<Null, string> kafkaProducer)
        {
            _clientFactory = clientFactory;
            _kafkaProducer = kafkaProducer;

            // Initialize AWS clients with IAM role
            _cloudWatchClient = new AmazonCloudWatchClient();
            _kmsClient = new AmazonKMSClient();
            _s3Client = new AmazonS3Client();

            // Initialize X-Ray for Distributed Tracing
            AWSSDKHandler.RegisterXRayForAllServices();

            // Initialize OpenTelemetry for Tracing
            _tracer = Sdk.CreateTracerProviderBuilder()
                .AddSource("OrderService")
                .SetResourceBuilder(ResourceBuilder.CreateDefault().AddService("OrderService"))
                .AddXRayTraceExporter(options => { options.Region = "us-east-1"; })
                .AddJaegerExporter(options =>
                {
                    options.AgentHost = Environment.GetEnvironmentVariable("JAEGER_AGENT_HOST");
                    options.AgentPort = 6831;
                })
                .Build()
                .GetTracer("OrderService");

            // Resiliency: Circuit Breaker, Retry, Timeout
            _resiliencyPolicy = Policy.WrapAsync(
                Policy<HttpResponseMessage>
                    .HandleTransientHttpError()
                    .Or<Exception>(ex => ex.Message.Contains("ChaosTest")) // Handle chaos-induced failures
                    .CircuitBreakerAsync(5, TimeSpan.FromSeconds(30)),
                Policy<HttpResponseMessage>
                    .HandleTransientHttpError()
                    .Or<Exception>(ex => ex.Message.Contains("ChaosTest"))
                    .WaitAndRetryAsync(3, retryAttempt => TimeSpan.FromMilliseconds(100 * Math.Pow(2, retryAttempt))),
                Policy.TimeoutAsync<HttpResponseMessage>(TimeSpan.FromMilliseconds(500))
            );

            // Serilog with CloudWatch sink (12-Factor Logs)
            Log.Logger = new LoggerConfiguration()
                .WriteTo.Console()
                .WriteTo.AmazonCloudWatch(
                    logGroup: "/ecs/order-service",
                    logStreamPrefix: "ecs",
                    cloudWatchClient: _cloudWatchClient)
                .CreateLogger();
        }

        [HttpPost]
        public async Task<IActionResult> CreateOrder([FromBody] Order order, [FromHeader(Name = "Authorization")] string authHeader, [FromHeader(Name = "X-HMAC-Signature")] string hmacSignature, [FromHeader(Name = "X-Request-Timestamp")] string timestamp, [FromHeader(Name = "X-Device-ID")] string deviceId)
        {
            using var span = _tracer.StartActiveSpan("CreateOrder");
            span.SetAttribute("orderId", order.OrderId);
            span.SetAttribute("userId", order.UserId);
            span.SetAttribute("deviceId", deviceId);

            // Start X-Ray segment
            AWSXRayRecorder.Instance.BeginSegment("OrderService", order.OrderId);

            // Simulate chaos: Random failure for testing
            if (Environment.GetEnvironmentVariable("CHAOS_ENABLED") == "true" && new Random().Next(0, 100) < 10)
            {
                Log.Error("Chaos test: Simulating service failure for Order {OrderId}", order.OrderId);
                span.RecordException(new Exception("ChaosTest: Simulated failure"));
                span.SetStatus(Status.Error);
                await LogMetricAsync("ChaosFailure", 1);
                throw new Exception("ChaosTest: Simulated service failure");
            }

            // Verify Device (Zero Trust)
            using var deviceSpan = _tracer.StartSpan("VerifyDevice");
            if (!await VerifyDeviceAsync(deviceId))
            {
                Log.Error("Invalid device {DeviceId} for Order {OrderId}", deviceId, order.OrderId);
                span.RecordException(new Exception("Invalid device"));
                span.SetStatus(Status.Error);
                await LogMetricAsync("DeviceVerificationFailed", 1);
                return Unauthorized("Invalid device");
            }
            deviceSpan.End();

            // Rate Limiting (Zero Trust)
            using var rateLimitSpan = _tracer.StartSpan("CheckRateLimit");
            if (!await CheckRateLimitAsync(order.UserId, deviceId))
            {
                Log.Error("Rate limit exceeded for User {UserId}, Device {DeviceId}", order.UserId, deviceId);
                span.RecordException(new Exception("Rate limit exceeded"));
                span.SetStatus(Status.Error);
                await LogMetricAsync("RateLimitExceeded", 1);
                return StatusCode(429, "Too Many Requests");
            }
            rateLimitSpan.End();

            // Validate JWT (Zero Trust)
            using var jwtSpan = _tracer.StartSpan("ValidateJwt");
            if (!await ValidateJwtAsync(authHeader))
            {
                Log.Error("Invalid or missing JWT for Order {OrderId}", order.OrderId);
                span.RecordException(new Exception("Invalid JWT"));
                span.SetStatus(Status.Error);
                await LogMetricAsync("JwtValidationFailed", 1);
                return Unauthorized();
            }
            jwtSpan.End();

            // Validate HMAC-SHA256 (Zero Trust)
            using var hmacSpan = _tracer.StartSpan("ValidateHmac");
            if (!await ValidateHmacAsync(order, hmacSignature, timestamp))
            {
                Log.Error("Invalid HMAC for Order {OrderId}", order.OrderId);
                span.RecordException(new Exception("Invalid HMAC"));
                span.SetStatus(Status.Error);
                await LogMetricAsync("HmacValidationFailed", 1);
                return BadRequest("Invalid HMAC signature");
            }
            hmacSpan.End();

            // Idempotency check with Snowflake ID
            var requestId = Guid.NewGuid().ToString(); // Simplified Snowflake ID
            using var idempotencySpan = _tracer.StartSpan("CheckIdempotency");
            if (await IsProcessedAsync(requestId))
            {
                Log.Information("Order {OrderId} already processed", order.OrderId);
                span.SetAttribute("idempotent", true);
                await LogMetricAsync("IdempotentRequest", 1);
                return Ok("Order already processed");
            }
            idempotencySpan.End();

            // Encrypt order amount with AWS KMS (Zero Trust)
            using var encryptionSpan = _tracer.StartSpan("EncryptOrder");
            var encryptResponse = await _kmsClient.EncryptAsync(new EncryptRequest
            {
                KeyId = Environment.GetEnvironmentVariable("KMS_KEY_ARN"),
                Plaintext = Encoding.UTF8.GetBytes(order.Amount.ToString())
            });
            var encryptedAmount = Convert.ToBase64String(encryptResponse.CiphertextBlob);
            encryptionSpan.End();

            // Compute SHA-256 checksum (Zero Trust)
            using var checksumSpan = _tracer.StartSpan("ComputeChecksum");
            var checksum = ComputeChecksum(encryptedAmount);
            checksumSpan.End();

            // Store encrypted data in S3
            using var storageSpan = _tracer.StartSpan("StoreOrder");
            var putRequest = new PutObjectRequest
            {
                BucketName = Environment.GetEnvironmentVariable("S3_BUCKET"),
                Key = $"orders/{requestId}",
                ContentBody = System.Text.Json.JsonSerializer.Serialize(new { order.OrderId, encryptedAmount, checksum }),
                ServerSideEncryptionMethod = ServerSideEncryptionMethod.AWSKMS,
                ServerSideEncryptionKeyManagementServiceKeyId = Environment.GetEnvironmentVariable("KMS_KEY_ARN")
            };
            try
            {
                await _s3Client.PutObjectAsync(putRequest);
            }
            catch (AmazonS3Exception ex)
            {
                Log.Error("S3 storage failed for Order {OrderId}: {Error}", order.OrderId, ex.Message);
                span.RecordException(ex);
                span.SetStatus(Status.Error);
                await LogMetricAsync("S3StorageFailed", 1);
                throw;
            }
            storageSpan.End();

            // Call Payment Service via Service Mesh (mTLS)
            using var paymentSpan = _tracer.StartSpan("CallPaymentService");
            var client = _clientFactory.CreateClient("PaymentService");
            var payload = System.Text.Json.JsonSerializer.Serialize(new
            {
                order_id = order.OrderId,
                encrypted_amount = encryptedAmount,
                checksum = checksum
            });
            var response = await _resiliencyPolicy.ExecuteAsync(async () =>
            {
                var request = new HttpRequestMessage(HttpMethod.Post, Environment.GetEnvironmentVariable("PAYMENT_SERVICE_URL"))
                {
                    Content = new StringContent(payload, Encoding.UTF8, "application/json"),
                    Headers = { { "Authorization", authHeader }, { "X-HMAC-Signature", hmacSignature }, { "X-Request-Timestamp", timestamp }, { "X-Device-ID", deviceId } }
                };
                var result = await client.SendAsync(request);
                result.EnsureSuccessStatusCode();
                return result;
            });
            paymentSpan.End();

            // Publish event for EDA/CDC
            using var eventSpan = _tracer.StartSpan("PublishEvent");
            var @event = new OrderCreatedEvent
            {
                EventId = requestId,
                OrderId = order.OrderId,
                EncryptedAmount = encryptedAmount,
                Checksum = checksum
            };
            try
            {
                await _kafkaProducer.ProduceAsync(Environment.GetEnvironmentVariable("KAFKA_TOPIC"), new Message<Null, string>
                {
                    Value = System.Text.Json.JsonSerializer.Serialize(@event)
                });
            }
            catch (ProduceException<Null, string> ex)
            {
                Log.Error("Kafka publish failed for Order {OrderId}: {Error}", order.OrderId, ex.Message);
                span.RecordException(ex);
                span.SetStatus(Status.Error);
                await LogMetricAsync("KafkaPublishFailed", 1);
                throw;
            }
            eventSpan.End();

            // Log metrics
            await LogMetricAsync("OrderProcessed", 1);

            Log.Information("Order {OrderId} processed successfully for Device {DeviceId}", order.OrderId, deviceId);
            AWSXRayRecorder.Instance.EndSegment();
            return Ok(order);
        }

        private async Task<bool> VerifyDeviceAsync(string deviceId)
        {
            // Simulated device verification
            return await Task.FromResult(!string.IsNullOrEmpty(deviceId));
        }

        private async Task<bool> CheckRateLimitAsync(string userId, string deviceId)
        {
            // Simulated Redis-based rate limiting (token bucket, 1,000 req/s)
            return await Task.FromResult(true);
        }

        private async Task<bool> ValidateJwtAsync(string authHeader)
        {
            if (string.IsNullOrEmpty(authHeader) || !authHeader.StartsWith("Bearer "))
                return false;

            var token = authHeader.Substring("Bearer ".Length).Trim();
            var handler = new JwtSecurityTokenHandler();
            try
            {
                var jwt = handler.ReadJwtToken(token);
                var issuer = Environment.GetEnvironmentVariable("COGNITO_ISSUER");
                var jwksUrl = $"{issuer}/.well-known/jwks.json";

                var jwks = await GetJwksAsync(jwksUrl);
                var validationParameters = new TokenValidationParameters
                {
                    IssuerSigningKeys = jwks.Keys,
                    ValidIssuer = issuer,
                    ValidAudience = Environment.GetEnvironmentVariable("COGNITO_CLIENT_ID"),
                    ValidateIssuer = true,
                    ValidateAudience = true,
                    ValidateLifetime = true
                };

                handler.ValidateToken(token, validationParameters, out var validatedToken);
                await LogMetricAsync("JwtValidationSuccess", 1);
                return true;
            }
            catch (Exception ex)
            {
                Log.Error("JWT validation failed: {Error}", ex.Message);
                return false;
            }
        }

        private async Task<bool> ValidateHmacAsync(Order order, string hmacSignature, string timestamp)
        {
            var secret = Environment.GetEnvironmentVariable("API_SECRET");
            var payload = $"{order.OrderId}:{order.Amount}:{timestamp}";
            var computedHmac = ComputeHmac(payload, secret);
            var isValid = hmacSignature == computedHmac;

            if (isValid)
                await LogMetricAsync("HmacValidationSuccess", 1);
            return await Task.FromResult(isValid);
        }

        private async Task<JsonWebKeySet> GetJwksAsync(string jwksUrl)
        {
            var client = _clientFactory.CreateClient();
            var response = await client.GetStringAsync(jwksUrl);
            return new JsonWebKeySet(response);
        }

        private async Task<bool> IsProcessedAsync(string requestId)
        {
            // Simulated idempotency check (e.g., Redis)
            return await Task.FromResult(false);
        }

        private async Task LogMetricAsync(string metricName, double value)
        {
            var request = new PutMetricDataRequest
            {
                Namespace = "Ecommerce/OrderService",
                MetricData = new List<MetricDatum>
                {
                    new MetricDatum
                    {
                        MetricName = metricName,
                        Value = value,
                        Unit = StandardUnit.Count,
                        Timestamp = DateTime.UtcNow
                    }
                }
            };
            try
            {
                await _cloudWatchClient.PutMetricDataAsync(request);
            }
            catch (AmazonCloudWatchException ex)
            {
                Log.Error("Failed to log metric {MetricName}: {Error}", metricName, ex.Message);
            }
        }

        private string ComputeHmac(string data, string secret)
        {
            using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secret));
            var bytes = Encoding.UTF8.GetBytes(data);
            var hash = hmac.ComputeHash(bytes);
            return Convert.ToBase64String(hash);
        }

        private string ComputeChecksum(string data)
        {
            using var sha256 = SHA256.Create();
            var bytes = Encoding.UTF8.GetBytes(data);
            var hash = sha256.ComputeHash(bytes);
            return Convert.ToBase64String(hash);
        }
    }

    public class Order
    {
        public string OrderId { get; set; }
        public double Amount { get; set; }
        public string UserId { get; set; }
    }

    public class OrderCreatedEvent
    {
        public string EventId { get; set; }
        public string OrderId { get; set; }
        public string EncryptedAmount { get; set; }
        public string Checksum { get; set; }
    }
}

# main.tf
provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "ecommerce_vpc" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
}

resource "aws_subnet" "subnet_a" {
  vpc_id            = aws_vpc.ecommerce_vpc.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-east-1a"
}

resource "aws_subnet" "subnet_b" {
  vpc_id            = aws_vpc.ecommerce_vpc.id
  cidr_block        = "10.0.2.0/24"
  availability_zone = "us-east-1b"
}

resource "aws_security_group" "ecommerce_sg" {
  vpc_id = aws_vpc.ecommerce_vpc.id
  ingress {
    protocol    = "tcp"
    from_port   = 443
    to_port     = 443
    cidr_blocks = ["0.0.0.0/0"]
  }
  ingress {
    protocol    = "udp"
    from_port   = 6831
    to_port     = 6831
    cidr_blocks = ["10.0.0.0/16"]
  }
}

resource "aws_iam_role" "order_service_role" {
  name = "order-service-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ecs-tasks.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_role_policy" "order_service_policy" {
  name = "order-service-policy"
  role = aws_iam_role.order_service_role.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "cloudwatch:PutMetricData",
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "cognito-idp:AdminInitiateAuth",
          "kms:Encrypt",
          "kms:Decrypt",
          "s3:PutObject",
          "s3:GetObject",
          "sqs:SendMessage",
          "xray:PutTraceSegments",
          "xray:PutTelemetryRecords",
          "fis:StartExperiment",
          "fis:StopExperiment"
        ],
        Resource = [
          "arn:aws:cloudwatch:us-east-1:123456789012:metric/*",
          "arn:aws:logs:us-east-1:123456789012:log-group:/ecs/order-service:*",
          "arn:aws:cognito-idp:us-east-1:123456789012:userpool/*",
          "arn:aws:kms:us-east-1:123456789012:key/*",
          "arn:aws:s3:::ecommerce-bucket/*",
          "arn:aws:sqs:*:123456789012:dead-letter-queue",
          "arn:aws:xray:us-east-1:123456789012:*",
          "arn:aws:fis:us-east-1:123456789012:experiment/*"
        ]
      }
    ]
  })
}

resource "aws_kms_key" "kms_key" {
  description = "KMS key for ecommerce encryption"
  enable_key_rotation = true
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = { AWS = aws_iam_role.order_service_role.arn }
        Action = ["kms:Encrypt", "kms:Decrypt"]
        Resource = "*"
      }
    ]
  })
}

resource "aws_s3_bucket" "ecommerce_bucket" {
  bucket = "ecommerce-bucket"
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = aws_kms_key.kms_key.arn
        sse_algorithm     = "aws:kms"
      }
    }
  }
}

resource "aws_cognito_user_pool" "ecommerce_user_pool" {
  name = "ecommerce-user-pool"
  password_policy {
    minimum_length = 8
    require_numbers = true
    require_symbols = true
    require_uppercase = true
  }
  mfa_configuration = "REQUIRED"
  software_token_mfa_configuration {
    enabled = true
  }
}

resource "aws_cognito_user_pool_client" "ecommerce_client" {
  name                = "ecommerce-client"
  user_pool_id        = aws_cognito_user_pool.ecommerce_user_pool.id
  allowed_oauth_flows = ["code"]
  allowed_oauth_scopes = ["orders/read", "orders/write"]
  callback_urls       = ["https://ecommerce.example.com/callback"]
  supported_identity_providers = ["COGNITO"]
}

resource "aws_api_gateway_rest_api" "ecommerce_api" {
  name = "ecommerce-api"
}

resource "aws_api_gateway_resource" "orders_resource" {
  rest_api_id = aws_api_gateway_rest_api.ecommerce_api.id
  parent_id   = aws_api_gateway_rest_api.ecommerce_api.root_resource_id
  path_part   = "orders"
}

resource "aws_api_gateway_method" "orders_post" {
  rest_api_id   = aws_api_gateway_rest_api.ecommerce_api.id
  resource_id   = aws_api_gateway_resource.orders_resource.id
  http_method   = "POST"
  authorization = "COGNITO_USER_POOLS"
  authorizer_id = aws_api_gateway_authorizer.cognito_authorizer.id
}

resource "aws_api_gateway_authorizer" "cognito_authorizer" {
  name                   = "cognito-authorizer"
  rest_api_id            = aws_api_gateway_rest_api.ecommerce_api.id
  type                   = "COGNITO_USER_POOLS"
  provider_arns          = [aws_cognito_user_pool.ecommerce_user_pool.arn]
}

resource "aws_api_gateway_method_settings" "orders_settings" {
  rest_api_id = aws_api_gateway_rest_api.ecommerce_api.id
  stage_name  = "prod"
  method_path = "${aws_api_gateway_resource.orders_resource.path_part}/POST"
  settings {
    throttling_rate_limit  = 1000
    throttling_burst_limit = 10000
    metrics_enabled       = true
    logging_level         = "INFO"
  }
}

resource "aws_api_gateway_deployment" "ecommerce_deployment" {
  rest_api_id = aws_api_gateway_rest_api.ecommerce_api.id
  stage_name  = "prod"
  depends_on  = [aws_api_gateway_method.orders_post]
}

resource "aws_ecs_cluster" "ecommerce_cluster" {
  name = "ecommerce-cluster"
}

resource "aws_ecs_service" "order_service" {
  name            = "order-service"
  cluster         = aws_ecs_cluster.ecommerce_cluster.id
  task_definition = aws_ecs_task_definition.order_task.arn
  desired_count   = 5
  launch_type     = "FARGATE"
  network_configuration {
    subnets         = [aws_subnet.subnet_a.id, aws_subnet.subnet_b.id]
    security_groups = [aws_security_group.ecommerce_sg.id]
  }
}

resource "aws_ecs_task_definition" "order_task" {
  family                   = "order-service"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = aws_iam_role.order_service_role.arn
  container_definitions = jsonencode([
    {
      name  = "order-service"
      image = "<your-ecr-repo>:latest"
      essential = true
      portMappings = [
        {
          containerPort = 443
          hostPort      = 443
        }
      ]
      environment = [
        { name = "KAFKA_BOOTSTRAP_SERVERS", value = "kafka:9092" },
        { name = "KAFKA_TOPIC", value = "orders" },
        { name = "PAYMENT_SERVICE_URL", value = "https://payment-service:8080/v1/payments" },
        { name = "JAEGER_AGENT_HOST", value = "jaeger-agent" },
        { name = "COGNITO_ISSUER", value = aws_cognito_user_pool.ecommerce_user_pool.endpoint },
        { name = "COGNITO_CLIENT_ID", value = aws_cognito_user_pool_client.ecommerce_client.id },
        { name = "KMS_KEY_ARN", value = aws_kms_key.kms_key.arn },
        { name = "S3_BUCKET", value = aws_s3_bucket.ecommerce_bucket.bucket },
        { name = "API_SECRET", value = "<your-api-secret>" },
        { name = "CHAOS_ENABLED", value = "true" }
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = "/ecs/order-service"
          "awslogs-region"        = "us-east-1"
          "awslogs-stream-prefix" = "ecs"
        }
      }
    },
    {
      name  = "istio-proxy"
      image = "istio/proxyv2:latest"
      essential = true
      environment = [
        { name = "ISTIO_META_WORKLOAD_NAME", value = "order-service" }
      ]
    }
  ])
}

resource "aws_sqs_queue" "dead_letter_queue" {
  name = "dead-letter-queue"
}

resource "aws_lb" "ecommerce_alb" {
  name               = "ecommerce-alb"
  load_balancer_type = "application"
  subnets            = [aws_subnet.subnet_a.id, aws_subnet.subnet_b.id]
  security_groups    = [aws_security_group.ecommerce_sg.id]
  enable_http2       = true
}

resource "aws_lb_target_group" "order_tg" {
  name        = "order-tg"
  port        = 443
  protocol    = "HTTPS"
  vpc_id      = aws_vpc.ecommerce_vpc.id
  health_check {
    path     = "/health"
    interval = 5
    timeout  = 3
    protocol = "HTTPS"
  }
}

resource "aws_lb_listener" "order_listener" {
  load_balancer_arn = aws_lb.ecommerce_alb.arn
  port              = 443
  protocol          = "HTTPS"
  certificate_arn   = "<your-acm-certificate-arn>"
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.order_tg.arn
  }
}

resource "aws_cloudwatch_log_group" "order_log_group" {
  name              = "/ecs/order-service"
  retention_in_days = 30
}

resource "aws_cloudwatch_metric_alarm" "chaos_failure_alarm" {
  alarm_name          = "ChaosFailure"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 2
  metric_name         = "ChaosFailure"
  namespace           = "Ecommerce/OrderService"
  period              = 60
  statistic           = "Sum"
  threshold           = 1
  alarm_description   = "Triggers when chaos test failures are detected"
  alarm_actions       = [aws_sns_topic.alerts.arn]
}

resource "aws_sns_topic" "alerts" {
  name = "ecommerce-alerts"
}

resource "aws_xray_group" "ecommerce_xray_group" {
  group_name = "ecommerce-xray-group"
  filter_expression = "service(order-service)"
}

resource "aws_ecs_service" "jaeger_service" {
  name            = "jaeger-service"
  cluster         = aws_ecs_cluster.ecommerce_cluster.id
  task_definition = aws_ecs_task_definition.jaeger_task.arn
  desired_count   = 1
  launch_type     = "FARGATE"
  network_configuration {
    subnets         = [aws_subnet.subnet_a.id, aws_subnet.subnet_b.id]
    security_groups = [aws_security_group.ecommerce_sg.id]
  }
}

resource "aws_ecs_task_definition" "jaeger_task" {
  family                   = "jaeger-service"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = aws_iam_role.order_service_role.arn
  container_definitions = jsonencode([
    {
      name  = "jaeger-agent"
      image = "jaegertracing/all-in-one:latest"
      essential = true
      portMappings = [
        {
          containerPort = 6831
          hostPort      = 6831
          protocol      = "udp"
        },
        {
          containerPort = 16686
          hostPort      = 16686
        }
      ]
      environment = [
        { name = "COLLECTOR_ZIPKIN_HTTP_PORT", value = "9411" }
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = "/ecs/jaeger-service"
          "awslogs-region"        = "us-east-1"
          "awslogs-stream-prefix" = "ecs"
        }
      }
    }
  ])
}

resource "aws_cloudwatch_log_group" "jaeger_log_group" {
  name              = "/ecs/jaeger-service"
  retention_in_days = 30
}

resource "aws_fis_experiment_template" "ecs_task_termination" {
  description = "Simulate ECS task termination for order-service"
  role_arn    = aws_iam_role.order_service_role.arn
  stop_conditions {
    source = "aws:cloudwatch:metric"
    value  = "aws:cloudwatch:metric:ChaosFailure>1"
  }
  action {
    name        = "terminate-task"
    action_id   = "aws:ecs:terminate-task"
    target {
      key   = "Cluster"
      value = aws_ecs_cluster.ecommerce_cluster.name
    }
    parameters = {
      taskCount = "1"
    }
  }
  target {
    resource_type = "aws:ecs:task"
    resource_tag {
      key   = "aws:ecs:service-name"
      value = aws_ecs_service.order_service.name
    }
    selection_mode = "COUNT(1)"
  }
}

resource "aws_fis_experiment_template" "network_latency" {
  description = "Simulate network latency for order-service"
  role_arn    = aws_iam_role.order_service_role.arn
  stop_conditions {
    source = "aws:cloudwatch:metric"
    value  = "aws:cloudwatch:metric:ChaosFailure>1"
  }
  action {
    name        = "network-latency"
    action_id   = "aws:network:inject-latency"
    target {
      key   = "VPC"
      value = aws_vpc.ecommerce_vpc.id
    }
    parameters = {
      latencyMilliseconds = "500"
      durationSeconds     = "60"
    }
  }
}

output "alb_endpoint" {
  value = aws_lb.ecommerce_alb.dns_name
}

output "api_gateway_endpoint" {
  value = aws_api_gateway_deployment.ecommerce_deployment.invoke_url
}

output "kms_key_arn" {
  value = aws_kms_key.kms_key.arn
}

output "s3_bucket_name" {
  value = aws_s3_bucket.ecommerce_bucket.bucket
}

output "jaeger_endpoint" {
  value = "http://jaeger-service:16686"
}

# main.tf
provider "aws" {
  region = "us-east-1"
}

resource "aws_vpc" "ecommerce_vpc" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
}

resource "aws_subnet" "subnet_a" {
  vpc_id            = aws_vpc.ecommerce_vpc.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "us-east-1a"
}

resource "aws_subnet" "subnet_b" {
  vpc_id            = aws_vpc.ecommerce_vpc.id
  cidr_block        = "10.0.2.0/24"
  availability_zone = "us-east-1b"
}

resource "aws_security_group" "ecommerce_sg" {
  vpc_id = aws_vpc.ecommerce_vpc.id
  ingress {
    protocol    = "tcp"
    from_port   = 443
    to_port     = 443
    cidr_blocks = ["0.0.0.0/0"]
  }
  ingress {
    protocol    = "udp"
    from_port   = 6831
    to_port     = 6831
    cidr_blocks = ["10.0.0.0/16"]
  }
}

resource "aws_iam_role" "order_service_role" {
  name = "order-service-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ecs-tasks.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_role_policy" "order_service_policy" {
  name = "order-service-policy"
  role = aws_iam_role.order_service_role.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Action = [
          "cloudwatch:PutMetricData",
          "logs:CreateLogStream",
          "logs:PutLogEvents",
          "cognito-idp:AdminInitiateAuth",
          "kms:Encrypt",
          "kms:Decrypt",
          "s3:PutObject",
          "s3:GetObject",
          "sqs:SendMessage",
          "xray:PutTraceSegments",
          "xray:PutTelemetryRecords",
          "fis:StartExperiment",
          "fis:StopExperiment"
        ],
        Resource = [
          "arn:aws:cloudwatch:us-east-1:123456789012:metric/*",
          "arn:aws:logs:us-east-1:123456789012:log-group:/ecs/order-service:*",
          "arn:aws:cognito-idp:us-east-1:123456789012:userpool/*",
          "arn:aws:kms:us-east-1:123456789012:key/*",
          "arn:aws:s3:::ecommerce-bucket/*",
          "arn:aws:sqs:*:123456789012:dead-letter-queue",
          "arn:aws:xray:us-east-1:123456789012:*",
          "arn:aws:fis:us-east-1:123456789012:experiment/*"
        ]
      }
    ]
  })
}

resource "aws_kms_key" "kms_key" {
  description = "KMS key for ecommerce encryption"
  enable_key_rotation = true
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = { AWS = aws_iam_role.order_service_role.arn }
        Action = ["kms:Encrypt", "kms:Decrypt"]
        Resource = "*"
      }
    ]
  })
}

resource "aws_s3_bucket" "ecommerce_bucket" {
  bucket = "ecommerce-bucket"
  server_side_encryption_configuration {
    rule {
      apply_server_side_encryption_by_default {
        kms_master_key_id = aws_kms_key.kms_key.arn
        sse_algorithm     = "aws:kms"
      }
    }
  }
}

resource "aws_cognito_user_pool" "ecommerce_user_pool" {
  name = "ecommerce-user-pool"
  password_policy {
    minimum_length = 8
    require_numbers = true
    require_symbols = true
    require_uppercase = true
  }
  mfa_configuration = "REQUIRED"
  software_token_mfa_configuration {
    enabled = true
  }
}

resource "aws_cognito_user_pool_client" "ecommerce_client" {
  name                = "ecommerce-client"
  user_pool_id        = aws_cognito_user_pool.ecommerce_user_pool.id
  allowed_oauth_flows = ["code"]
  allowed_oauth_scopes = ["orders/read", "orders/write"]
  callback_urls       = ["https://ecommerce.example.com/callback"]
  supported_identity_providers = ["COGNITO"]
}

resource "aws_api_gateway_rest_api" "ecommerce_api" {
  name = "ecommerce-api"
}

resource "aws_api_gateway_resource" "orders_resource" {
  rest_api_id = aws_api_gateway_rest_api.ecommerce_api.id
  parent_id   = aws_api_gateway_rest_api.ecommerce_api.root_resource_id
  path_part   = "orders"
}

resource "aws_api_gateway_method" "orders_post" {
  rest_api_id   = aws_api_gateway_rest_api.ecommerce_api.id
  resource_id   = aws_api_gateway_resource.orders_resource.id
  http_method   = "POST"
  authorization = "COGNITO_USER_POOLS"
  authorizer_id = aws_api_gateway_authorizer.cognito_authorizer.id
}

resource "aws_api_gateway_authorizer" "cognito_authorizer" {
  name                   = "cognito-authorizer"
  rest_api_id            = aws_api_gateway_rest_api.ecommerce_api.id
  type                   = "COGNITO_USER_POOLS"
  provider_arns          = [aws_cognito_user_pool.ecommerce_user_pool.arn]
}

resource "aws_api_gateway_method_settings" "orders_settings" {
  rest_api_id = aws_api_gateway_rest_api.ecommerce_api.id
  stage_name  = "prod"
  method_path = "${aws_api_gateway_resource.orders_resource.path_part}/POST"
  settings {
    throttling_rate_limit  = 1000
    throttling_burst_limit = 10000
    metrics_enabled       = true
    logging_level         = "INFO"
  }
}

resource "aws_api_gateway_deployment" "ecommerce_deployment" {
  rest_api_id = aws_api_gateway_rest_api.ecommerce_api.id
  stage_name  = "prod"
  depends_on  = [aws_api_gateway_method.orders_post]
}

resource "aws_ecs_cluster" "ecommerce_cluster" {
  name = "ecommerce-cluster"
}

resource "aws_ecs_service" "order_service" {
  name            = "order-service"
  cluster         = aws_ecs_cluster.ecommerce_cluster.id
  task_definition = aws_ecs_task_definition.order_task.arn
  desired_count   = 5
  launch_type     = "FARGATE"
  network_configuration {
    subnets         = [aws_subnet.subnet_a.id, aws_subnet.subnet_b.id]
    security_groups = [aws_security_group.ecommerce_sg.id]
  }
}

resource "aws_ecs_task_definition" "order_task" {
  family                   = "order-service"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = aws_iam_role.order_service_role.arn
  container_definitions = jsonencode([
    {
      name  = "order-service"
      image = "<your-ecr-repo>:latest"
      essential = true
      portMappings = [
        {
          containerPort = 443
          hostPort      = 443
        }
      ]
      environment = [
        { name = "KAFKA_BOOTSTRAP_SERVERS", value = "kafka:9092" },
        { name = "KAFKA_TOPIC", value = "orders" },
        { name = "PAYMENT_SERVICE_URL", value = "https://payment-service:8080/v1/payments" },
        { name = "JAEGER_AGENT_HOST", value = "jaeger-agent" },
        { name = "COGNITO_ISSUER", value = aws_cognito_user_pool.ecommerce_user_pool.endpoint },
        { name = "COGNITO_CLIENT_ID", value = aws_cognito_user_pool_client.ecommerce_client.id },
        { name = "KMS_KEY_ARN", value = aws_kms_key.kms_key.arn },
        { name = "S3_BUCKET", value = aws_s3_bucket.ecommerce_bucket.bucket },
        { name = "API_SECRET", value = "<your-api-secret>" },
        { name = "CHAOS_ENABLED", value = "true" }
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = "/ecs/order-service"
          "awslogs-region"        = "us-east-1"
          "awslogs-stream-prefix" = "ecs"
        }
      }
    },
    {
      name  = "istio-proxy"
      image = "istio/proxyv2:latest"
      essential = true
      environment = [
        { name = "ISTIO_META_WORKLOAD_NAME", value = "order-service" }
      ]
    }
  ])
}

resource "aws_sqs_queue" "dead_letter_queue" {
  name = "dead-letter-queue"
}

resource "aws_lb" "ecommerce_alb" {
  name               = "ecommerce-alb"
  load_balancer_type = "application"
  subnets            = [aws_subnet.subnet_a.id, aws_subnet.subnet_b.id]
  security_groups    = [aws_security_group.ecommerce_sg.id]
  enable_http2       = true
}

resource "aws_lb_target_group" "order_tg" {
  name        = "order-tg"
  port        = 443
  protocol    = "HTTPS"
  vpc_id      = aws_vpc.ecommerce_vpc.id
  health_check {
    path     = "/health"
    interval = 5
    timeout  = 3
    protocol = "HTTPS"
  }
}

resource "aws_lb_listener" "order_listener" {
  load_balancer_arn = aws_lb.ecommerce_alb.arn
  port              = 443
  protocol          = "HTTPS"
  certificate_arn   = "<your-acm-certificate-arn>"
  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.order_tg.arn
  }
}

resource "aws_cloudwatch_log_group" "order_log_group" {
  name              = "/ecs/order-service"
  retention_in_days = 30
}

resource "aws_cloudwatch_metric_alarm" "chaos_failure_alarm" {
  alarm_name          = "ChaosFailure"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 2
  metric_name         = "ChaosFailure"
  namespace           = "Ecommerce/OrderService"
  period              = 60
  statistic           = "Sum"
  threshold           = 1
  alarm_description   = "Triggers when chaos test failures are detected"
  alarm_actions       = [aws_sns_topic.alerts.arn]
}

resource "aws_sns_topic" "alerts" {
  name = "ecommerce-alerts"
}

resource "aws_xray_group" "ecommerce_xray_group" {
  group_name = "ecommerce-xray-group"
  filter_expression = "service(order-service)"
}

resource "aws_ecs_service" "jaeger_service" {
  name            = "jaeger-service"
  cluster         = aws_ecs_cluster.ecommerce_cluster.id
  task_definition = aws_ecs_task_definition.jaeger_task.arn
  desired_count   = 1
  launch_type     = "FARGATE"
  network_configuration {
    subnets         = [aws_subnet.subnet_a.id, aws_subnet.subnet_b.id]
    security_groups = [aws_security_group.ecommerce_sg.id]
  }
}

resource "aws_ecs_task_definition" "jaeger_task" {
  family                   = "jaeger-service"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = aws_iam_role.order_service_role.arn
  container_definitions = jsonencode([
    {
      name  = "jaeger-agent"
      image = "jaegertracing/all-in-one:latest"
      essential = true
      portMappings = [
        {
          containerPort = 6831
          hostPort      = 6831
          protocol      = "udp"
        },
        {
          containerPort = 16686
          hostPort      = 16686
        }
      ]
      environment = [
        { name = "COLLECTOR_ZIPKIN_HTTP_PORT", value = "9411" }
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = "/ecs/jaeger-service"
          "awslogs-region"        = "us-east-1"
          "awslogs-stream-prefix" = "ecs"
        }
      }
    }
  ])
}

resource "aws_cloudwatch_log_group" "jaeger_log_group" {
  name              = "/ecs/jaeger-service"
  retention_in_days = 30
}

resource "aws_fis_experiment_template" "ecs_task_termination" {
  description = "Simulate ECS task termination for order-service"
  role_arn    = aws_iam_role.order_service_role.arn
  stop_conditions {
    source = "aws:cloudwatch:metric"
    value  = "aws:cloudwatch:metric:ChaosFailure>1"
  }
  action {
    name        = "terminate-task"
    action_id   = "aws:ecs:terminate-task"
    target {
      key   = "Cluster"
      value = aws_ecs_cluster.ecommerce_cluster.name
    }
    parameters = {
      taskCount = "1"
    }
  }
  target {
    resource_type = "aws:ecs:task"
    resource_tag {
      key   = "aws:ecs:service-name"
      value = aws_ecs_service.order_service.name
    }
    selection_mode = "COUNT(1)"
  }
}

resource "aws_fis_experiment_template" "network_latency" {
  description = "Simulate network latency for order-service"
  role_arn    = aws_iam_role.order_service_role.arn
  stop_conditions {
    source = "aws:cloudwatch:metric"
    value  = "aws:cloudwatch:metric:ChaosFailure>1"
  }
  action {
    name        = "network-latency"
    action_id   = "aws:network:inject-latency"
    target {
      key   = "VPC"
      value = aws_vpc.ecommerce_vpc.id
    }
    parameters = {
      latencyMilliseconds = "500"
      durationSeconds     = "60"
    }
  }
}

output "alb_endpoint" {
  value = aws_lb.ecommerce_alb.dns_name
}

output "api_gateway_endpoint" {
  value = aws_api_gateway_deployment.ecommerce_deployment.invoke_url
}

output "kms_key_arn" {
  value = aws_kms_key.kms_key.arn
}

output "s3_bucket_name" {
  value = aws_s3_bucket.ecommerce_bucket.bucket
}

output "jaeger_endpoint" {
  value = "http://jaeger-service:16686"
}

# .github/workflows/chaos-engineering.yml
name: Chaos Engineering Pipeline
on:
  schedule:
    - cron: "0 0 * * 0" # Weekly chaos tests
  workflow_dispatch:
jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2
      with:
        terraform_version: 1.3.0
    - name: Terraform Init
      run: terraform init
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    - name: Terraform Plan
      run: terraform plan
    - name: Terraform Apply
      if: github.event_name == 'workflow_dispatch'
      run: terraform apply -auto-approve
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    - name: Scan for Misconfigurations
      run: terraform fmt -check -recursive
  chaos_test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Run AWS FIS Experiment
      run: |
        aws fis start-experiment --experiment-template-id $(aws fis list-experiment-templates --query 'experimentTemplates[?description==`Simulate ECS task termination for order-service`].id' --output text)
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    - name: Verify Chaos Metrics
      run: |
        aws cloudwatch get-metric-statistics --namespace Ecommerce/OrderService --metric-name ChaosFailure --start-time $(date -u -Iseconds -d '-5 minutes') --end-time $(date -u -Iseconds) --period 60 --statistics Sum
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  container_scan:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Run Trivy Scanner
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: "<your-ecr-repo>:latest"
        format: "table"
        exit-code: "1"
        severity: "CRITICAL,HIGH"
  security_scan:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Run AWS Security Hub Scan
      run: aws securityhub batch-import-findings --findings file://security-findings.json
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

# .github/workflows/chaos-engineering.yml
name: Chaos Engineering Pipeline
on:
  schedule:
    - cron: "0 0 * * 0" # Weekly chaos tests
  workflow_dispatch:
jobs:
  terraform:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Setup Terraform
      uses: hashicorp/setup-terraform@v2
      with:
        terraform_version: 1.3.0
    - name: Terraform Init
      run: terraform init
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    - name: Terraform Plan
      run: terraform plan
    - name: Terraform Apply
      if: github.event_name == 'workflow_dispatch'
      run: terraform apply -auto-approve
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    - name: Scan for Misconfigurations
      run: terraform fmt -check -recursive
  chaos_test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Run AWS FIS Experiment
      run: |
        aws fis start-experiment --experiment-template-id $(aws fis list-experiment-templates --query 'experimentTemplates[?description==`Simulate ECS task termination for order-service`].id' --output text)
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    - name: Verify Chaos Metrics
      run: |
        aws cloudwatch get-metric-statistics --namespace Ecommerce/OrderService --metric-name ChaosFailure --start-time $(date -u -Iseconds -d '-5 minutes') --end-time $(date -u -Iseconds) --period 60 --statistics Sum
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
  container_scan:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Run Trivy Scanner
      uses: aquasecurity/trivy-action@master
      with:
        image-ref: "<your-ecr-repo>:latest"
        format: "table"
        exit-code: "1"
        severity: "CRITICAL,HIGH"
  security_scan:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Run AWS Security Hub Scan
      run: aws securityhub batch-import-findings --findings file://security-findings.json
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}