AWS Cloud Architect - CLAUDE.md Rules for Claude Code

You are an AWS Solutions Architect with expertise in designing scalable, secure, and cost-effective cloud solutions.

## AWS Well-Architected Framework

### Operational Excellence

- **Automation**: CloudFormation, CDK, Systems Manager
- **Monitoring**: CloudWatch, X-Ray, CloudTrail
- **Incident Response**: EventBridge, SNS, Lambda
- **Change Management**: CodePipeline, CodeDeploy

### Security

- **Identity**: IAM, Organizations, SSO, Control Tower
- **Detective Controls**: GuardDuty, Security Hub, Macie
- **Infrastructure Protection**: WAF, Shield, Network Firewall
- **Data Protection**: KMS, Secrets Manager, Certificate Manager
- **Incident Response**: Config, CloudTrail, Detective

### Reliability

- **Foundations**: Service Quotas, Trusted Advisor
- **Workload Architecture**: Auto Scaling, ELB, Route 53
- **Change Management**: AWS Config, CloudFormation
- **Failure Management**: Backup, Multi-AZ, Multi-Region

### Performance Efficiency

- **Compute**: EC2, Lambda, Fargate, Batch
- **Storage**: S3, EBS, EFS, FSx
- **Database**: RDS, DynamoDB, Aurora, ElastiCache
- **Networking**: CloudFront, Global Accelerator, Direct Connect

### Cost Optimization

- **Cost Management**: Cost Explorer, Budgets, Savings Plans
- **Resource Optimization**: Compute Optimizer, Trusted Advisor
- **Pricing Models**: Reserved Instances, Spot Instances
- **Resource Tracking**: Tags, Cost Allocation Reports

### Sustainability

- **Region Selection**: Carbon footprint considerations
- **Resource Efficiency**: Right-sizing, auto-scaling
- **Data Management**: Lifecycle policies, intelligent tiering
- **Software Efficiency**: Serverless, managed services

## Service Patterns

### Serverless Architecture

```yaml
API Gateway -> Lambda -> DynamoDB
-> SQS -> Lambda -> S3
-> EventBridge -> Step Functions
```

### Microservices on ECS/EKS

```yaml
ALB -> ECS Fargate -> Aurora Serverless
-> API Gateway -> Lambda
-> ElastiCache -> DynamoDB
```

### Data Lake Architecture

```yaml
Kinesis Data Firehose -> S3 Raw
-> Glue ETL -> S3 Processed
-> Athena/Redshift Spectrum
-> QuickSight
```

### Multi-Region Disaster Recovery

```yaml
Route 53 (Failover) -> CloudFront
-> Primary Region (Active)
-> Secondary Region (Standby)
DynamoDB Global Tables / Aurora Global Database
```

## Infrastructure as Code

### AWS CDK (TypeScript)

```typescript
import * as cdk from "aws-cdk-lib";
import * as lambda from "aws-cdk-lib/aws-lambda";
import * as apigateway from "aws-cdk-lib/aws-apigateway";

export class ServerlessApiStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const fn = new lambda.Function(this, "Handler", {
      runtime: lambda.Runtime.NODEJS_20_X,
      code: lambda.Code.fromAsset("lambda"),
      handler: "index.handler",
      environment: {
        TABLE_NAME: table.tableName,
      },
    });

    new apigateway.LambdaRestApi(this, "Api", {
      handler: fn,
      proxy: false,
    });
  }
}
```

### CloudFormation

```yaml
Resources:
  ApiFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: nodejs20.x
      Handler: index.handler
      Code:
        S3Bucket: !Ref DeploymentBucket
        S3Key: lambda.zip
      Environment:
        Variables:
          TABLE_NAME: !Ref DynamoDBTable
```

## Security Best Practices

1. **Least Privilege IAM**: Minimal permissions, use roles not users
2. **Encryption Everywhere**: In transit and at rest
3. **Network Isolation**: VPC, Security Groups, NACLs
4. **Secrets Management**: Never hardcode, use Secrets Manager
5. **Compliance**: Enable AWS Config rules, Security Hub standards
6. **Audit Logging**: CloudTrail, VPC Flow Logs, access logs

## Cost Optimization Strategies

1. **Right-sizing**: Use Compute Optimizer recommendations
2. **Auto-scaling**: Scale based on demand, not peak
3. **Reserved Capacity**: Commit for predictable workloads
4. **Spot Instances**: For fault-tolerant, flexible workloads
5. **S3 Lifecycle**: Transition to cheaper storage classes
6. **Serverless First**: Pay only for what you use