VPC & Networking

# ══ 1. TẠO VPC ══════════════════════════════════════
VPC_ID=$(aws ec2 create-vpc \
  --cidr-block 10.0.0.0/16 \
  --tag-specifications 'ResourceType=vpc,Tags=[{Key=Name,Value=prod-vpc}]' \
  --query 'Vpc.VpcId' --output text)
# Bật DNS hostname cho VPC
aws ec2 modify-vpc-attribute --vpc-id $VPC_ID --enable-dns-hostnames

# ══ 2. TẠO INTERNET GATEWAY & ATTACH VÀO VPC ═══════
IGW_ID=$(aws ec2 create-internet-gateway \
  --query 'InternetGateway.InternetGatewayId' --output text)
aws ec2 attach-internet-gateway --internet-gateway-id $IGW_ID --vpc-id $VPC_ID

# ══ 3. TẠO SUBNETS ══════════════════════════════════
# Public Subnet AZ-a
PUB_A=$(aws ec2 create-subnet \
  --vpc-id $VPC_ID \
  --cidr-block 10.0.1.0/24 \
  --availability-zone ap-southeast-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=public-1a}]' \
  --query 'Subnet.SubnetId' --output text)
# Bật auto-assign Public IP cho Public Subnet
aws ec2 modify-subnet-attribute --subnet-id $PUB_A --map-public-ip-on-launch

# Private Subnet AZ-a
PRIV_A=$(aws ec2 create-subnet \
  --vpc-id $VPC_ID \
  --cidr-block 10.0.11.0/24 \
  --availability-zone ap-southeast-1a \
  --tag-specifications 'ResourceType=subnet,Tags=[{Key=Name,Value=private-1a}]' \
  --query 'Subnet.SubnetId' --output text)

# ══ 4. ROUTE TABLE CHO PUBLIC SUBNET ════════════════
PUB_RT=$(aws ec2 create-route-table --vpc-id $VPC_ID \
  --query 'RouteTable.RouteTableId' --output text)
# Thêm route đến IGW
aws ec2 create-route --route-table-id $PUB_RT \
  --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW_ID
# Associate với Public Subnet
aws ec2 associate-route-table --route-table-id $PUB_RT --subnet-id $PUB_A

# ══ 5. NAT GATEWAY (đặt trong Public Subnet) ════════
EIP=$(aws ec2 allocate-address --domain vpc \
  --query 'AllocationId' --output text)
NAT_ID=$(aws ec2 create-nat-gateway \
  --subnet-id $PUB_A \
  --allocation-id $EIP \
  --query 'NatGateway.NatGatewayId' --output text)
echo "Đợi NAT Gateway available..."
aws ec2 wait nat-gateway-available --nat-gateway-ids $NAT_ID

# ══ 6. ROUTE TABLE CHO PRIVATE SUBNET ═══════════════
PRIV_RT=$(aws ec2 create-route-table --vpc-id $VPC_ID \
  --query 'RouteTable.RouteTableId' --output text)
aws ec2 create-route --route-table-id $PRIV_RT \
  --destination-cidr-block 0.0.0.0/0 --nat-gateway-id $NAT_ID
aws ec2 associate-route-table --route-table-id $PRIV_RT --subnet-id $PRIV_A

# ══ 7. SECURITY GROUP CHO WEB SERVER ════════════════
SG_WEB=$(aws ec2 create-security-group \
  --group-name sg-webserver \
  --description "Web Server SG" \
  --vpc-id $VPC_ID \
  --query 'GroupId' --output text)
# Inbound: HTTPS từ mọi nơi
aws ec2 authorize-security-group-ingress \
  --group-id $SG_WEB --protocol tcp --port 443 --cidr 0.0.0.0/0
# Inbound: SSH chỉ từ IP văn phòng
aws ec2 authorize-security-group-ingress \
  --group-id $SG_WEB --protocol tcp --port 22 --cidr 203.0.113.10/32

# ══ 8. SECURITY GROUP CHO DATABASE ══════════════════
SG_DB=$(aws ec2 create-security-group \
  --group-name sg-database \
  --description "Database SG – only from web" \
  --vpc-id $VPC_ID \
  --query 'GroupId' --output text)
# Inbound: MySQL chỉ từ Web Server SG (reference SG!)
aws ec2 authorize-security-group-ingress \
  --group-id $SG_DB --protocol tcp --port 3306 \
  --source-group $SG_WEB

echo "✅ VPC production đã sẵn sàng!"
echo "VPC: $VPC_ID | Public Subnet: $PUB_A | Private Subnet: $PRIV_A"