{
  "Routes": [
    {
      "Destination": "10.0.0.0/16",
      "Target": "local",
      "Status": "active"
    },
    {
      "Destination": "0.0.0.0/0",
      "Target": "igw-0abc1234def56789",
      "Status": "active"
    }
  ]
}

aws ec2 create-vpc-endpoint \
  --vpc-id vpc-0abc1234def56789 \
  --service-name com.amazonaws.us-east-1.s3 \
  --route-table-ids rtb-0private123

aws ec2 create-vpc-endpoint \
  --vpc-id vpc-0abc1234def56789 \
  --service-name com.amazonaws.us-east-1.redshift \
  --subnet-ids subnet-0private456 \
  --private-dns-enabled

aws ec2 authorize-security-group-ingress \
  --group-id sg-0abc1234 \
  --protocol tcp \
  --port 5439 \
  --source-group sg-0abcd5678

# Redshift SG - Allow only from Airflow SG
aws ec2 authorize-security-group-ingress \
  --group-id sg-redshift \
  --protocol tcp \
  --port 5439 \
  --source-group sg-airflow

# Airflow SG - Allow from ALB SG
aws ec2 authorize-security-group-ingress \
  --group-id sg-airflow \
  --protocol tcp \
  --port 443 \
  --source-group sg-alb

# Glue SG - Allow outbound to Redshift
aws ec2 authorize-security-group-egress \
  --group-id sg-glue \
  --protocol tcp \
  --port 5439 \
  --source-group sg-redshift

import boto3
import json
from botocore.exceptions import ClientError

class VPCManager:
    """Manages VPC infrastructure for data engineering pipelines."""

    def __init__(self, region='us-east-1'):
        self.region = region
        self.ec2 = boto3.client('ec2', region_name=region)

    def create_data_platform_vpc(self, cidr_block='10.0.0.0/16'):
        """Create VPC with DNS support for data engineering."""
        try:
            vpc = self.ec2.create_vpc(CidrBlock=cidr_block)
            vpc_id = vpc['Vpc']['VpcId']

            self.ec2.create_tags(
                Resources=[vpc_id],
                Tags=[{'Key': 'Name', 'Value': 'data-platform-vpc'}]
            )

            self.ec2.modify_vpc_attribute(
                VpcId=vpc_id,
                EnableDnsSupport={'Value': True}
            )
            self.ec2.modify_vpc_attribute(
                VpcId=vpc_id,
                EnableDnsHostnames={'Value': True}
            )

            return vpc_id
        except ClientError as e:
            print(f"Error creating VPC: {e.response['Error']['Message']}")
            raise

    def create_subnets(self, vpc_id, availability_zones):
        """Create public, private app, and private data subnets."""
        subnet_configs = {
            'public': {'offset': 0, 'map_public_ip': True},
            'private_app': {'offset': 10, 'map_public_ip': False},
            'private_data': {'offset': 20, 'map_public_ip': False}
        }

        subnets = {}
        for az_index, az in enumerate(availability_zones):
            for subnet_type, config in subnet_configs.items():
                third_octet = (az_index * 30) + config['offset']
                cidr = f"10.0.{third_octet}.0/24"

                subnet = self.ec2.create_subnet(
                    VpcId=vpc_id,
                    CidrBlock=cidr,
                    AvailabilityZone=f"{self.region}{az}",
                    TagSpecifications=[{
                        'ResourceType': 'subnet',
                        'Tags': [
                            {'Key': 'Name', 'Value': f'{subnet_type}-{az}'},
                            {'Key': 'Type', 'Value': subnet_type}
                        ]
                    }]
                )

                subnet_id = subnet['Subnet']['SubnetId']

                self.ec2.modify_subnet_attribute(
                    SubnetId=subnet_id,
                    MapPublicIpOnLaunch={'Value': config['map_public_ip']}
                )

                subnets[f"{subnet_type}_{az}"] = subnet_id

        return subnets

    def create_gateway_endpoint(self, vpc_id, service_name, route_table_ids):
        """Create a Gateway VPC endpoint (free for S3 and DynamoDB)."""
        try:
            response = self.ec2.create_vpc_endpoint(
                VpcId=vpc_id,
                ServiceName=service_name,
                RouteTableIds=route_table_ids,
                VpcEndpointType='Gateway'
            )
            endpoint_id = response['VpcEndpoint']['VpcEndpointId']
            print(f"Created Gateway Endpoint: {endpoint_id} for {service_name}")
            return endpoint_id
        except ClientError as e:
            print(f"Error creating gateway endpoint: {e.response['Error']['Message']}")
            raise

    def create_interface_endpoint(self, vpc_id, service_name, subnet_ids):
        """Create an Interface VPC endpoint (~$0.01/hr per AZ)."""
        try:
            response = self.ec2.create_vpc_endpoint(
                VpcId=vpc_id,
                ServiceName=service_name,
                SubnetIds=subnet_ids,
                VpcEndpointType='Interface',
                PrivateDnsEnabled=True
            )
            endpoint_id = response['VpcEndpoint']['VpcEndpointId']
            print(f"Created Interface Endpoint: {endpoint_id} for {service_name}")
            return endpoint_id
        except ClientError as e:
            print(f"Error creating interface endpoint: {e.response['Error']['Message']}")
            raise

    def create_security_group(self, vpc_id, group_name, description):
        """Create a security group for data engineering resources."""
        try:
            response = self.ec2.create_security_group(
                VpcId=vpc_id,
                GroupName=group_name,
                Description=description
            )
            group_id = response['GroupId']
            self.ec2.create_tags(
                Resources=[group_id],
                Tags=[{'Key': 'Name', 'Value': group_name}]
            )
            return group_id
        except ClientError as e:
            print(f"Error creating security group: {e.response['Error']['Message']}")
            raise

    def add_sg_rule(self, group_id, protocol, port, source_sg):
        """Add ingress rule to security group from source security group."""
        try:
            self.ec2.authorize_security_group_ingress(
                GroupId=group_id,
                IpPermissions=[{
                    'IpProtocol': protocol,
                    'FromPort': port,
                    'ToPort': port,
                    'UserIdGroupPairs': [{'GroupId': source_sg}]
                }]
            )
            print(f"Added rule: {protocol}/{port} from {source_sg} to {group_id}")
        except ClientError as e:
            if 'InvalidPermission.Duplicate' in str(e):
                print(f"Rule already exists: {protocol}/{port} from {source_sg}")
            else:
                print(f"Error adding rule: {e.response['Error']['Message']}")
                raise

    def enable_flow_logs(self, vpc_id, log_group_name):
        """Enable VPC Flow Logs for network monitoring."""
        try:
            iam = boto3.client('iam')
            role_name = 'VPCFlowLogsRole'
            trust_policy = {
                "Version": "2012-10-17",
                "Statement": [{
                    "Effect": "Allow",
                    "Principal": {"Service": "vpc-flow-logs.amazonaws.com"},
                    "Action": "sts:AssumeRole"
                }]
            }

            role = iam.create_role(
                RoleName=role_name,
                AssumeRolePolicyDocument=json.dumps(trust_policy)
            )

            iam.put_role_policy(
                RoleName=role_name,
                PolicyName='FlowLogsPolicy',
                PolicyDocument=json.dumps({
                    "Version": "2012-10-17",
                    "Statement": [{
                        "Effect": "Allow",
                        "Action": [
                            "logs:CreateLogGroup",
                            "logs:CreateLogStream",
                            "logs:PutLogEvents",
                            "logs:DescribeLogGroups",
                            "logs:DescribeLogStreams"
                        ],
                        "Resource": "*"
                    }]
                })
            )

            response = self.ec2.create_flow_logs(
                ResourceIds=[vpc_id],
                ResourceType='VPC',
                LogDestinationType='cloud-watch-logs',
                LogGroupName=log_group_name,
                DeliverLogsPermissionArn=role['Role']['Arn'],
                TrafficType='ALL'
            )

            return response['FlowLogIds']
        except ClientError as e:
            print(f"Error enabling flow logs: {e.response['Error']['Message']}")
            raise

if __name__ == '__main__':
    manager = VPCManager(region='us-east-1')

    vpc_id = manager.create_data_platform_vpc()
    print(f"Created VPC: {vpc_id}")

    subnets = manager.create_subnets(vpc_id, ['a', 'b', 'c'])
    print(f"Created subnets: {list(subnets.keys())}")

    manager.create_gateway_endpoint(
        vpc_id,
        'com.amazonaws.us-east-1.s3',
        [subnets['private_data_a']]
    )

    manager.enable_flow_logs(vpc_id, '/aws/vpc/flowlogs')

def calculate_nat_cost(gb_per_month, hours_per_month=730):
    """
    Calculate monthly NAT Gateway cost.

    Formula: Total Cost = (Hours * $0.045) + (GB * $0.045)
    """
    hourly_cost = hours_per_month * 0.045
    data_processing = gb_per_month * 0.045
    total = hourly_cost + data_processing

    return round(total, 2)

# Example: 1 TB/month through NAT Gateway
monthly_cost = calculate_nat_cost(1024)
print(f"NAT Gateway monthly cost: ${monthly_cost}")
# Output: $91.30 (hourly) + $46.08 (data) = $137.38

def calculate_endpoint_savings(data_gb_monthly, service='s3'):
    """
    Calculate savings using VPC endpoints vs NAT Gateway.

    NAT: $0.045/GB data processing
    Gateway Endpoint: Free
    Interface Endpoint: ~$0.01/hr per AZ
    """
    nat_cost = data_gb_monthly * 0.045

    if service == 's3':
        endpoint_cost = 0
    else:
        endpoint_cost = 0.01 * 730

    savings = nat_cost - endpoint_cost
    return round(savings, 2)

# S3 with 5 TB/month: save $225/month with Gateway Endpoint
savings = calculate_endpoint_savings(5120, 's3')
print(f"Monthly savings with S3 Gateway Endpoint: ${savings}")