Enterprise E-Commerce Architecture Blueprint (ECS/EKS)

// Sample React API Client with Retry
const apiClient = axios.create({
  baseURL: process.env.API_URL,
  timeout: 5000,
  headers: {
    'Content-Type': 'application/json'
  }
});

apiClient.interceptors.response.use(null, (error) => {
  if (error.config && error.response && error.response.status >= 500) {
    return new Promise((resolve) => {
      setTimeout(() => resolve(apiClient(error.config)), 1000);
    });
  }
  return Promise.reject(error);
});

export const getProduct = (id) => 
  apiClient.get(`/products/${id}`, {
    headers: {
      'Cache-Control': 'max-age=60, stale-while-revalidate=3600'
    }
  });

# Terraform for API Gateway
resource "aws_api_gateway_rest_api" "ecommerce" {
  name        = "ecommerce-api"
  description = "Main API Gateway for E-Commerce Platform"

  endpoint_configuration {
    types = ["REGIONAL"]
  }
}

resource "aws_api_gateway_authorizer" "jwt" {
  name          = "jwt-authorizer"
  rest_api_id   = aws_api_gateway_rest_api.ecommerce.id
  authorizer_uri = aws_ecs_service.auth_service.invoke_arn
  type          = "TOKEN"
  identity_source = "method.request.header.Authorization"
}

resource "aws_wafv2_web_acl_association" "api" {
  resource_arn = aws_api_gateway_stage.prod.arn
  web_acl_arn  = aws_wafv2_web_acl.api.arn
}

// Sample Node.js Auth Service Handler
const jwt = require('jsonwebtoken');
const AWS = require('aws-sdk');
const kms = new AWS.KMS();

exports.handler = async (event) => {
  const token = event.headers.Authorization.replace('Bearer ', '');
  try {
    const jwks = await getCognitoJWKs(process.env.COGNITO_POOL_ID);
    const decoded = jwt.verify(token, jwks, { algorithms: ['RS256'] });
    
    // Validate with KMS
    const kmsParams = {
      KeyId: process.env.KMS_KEY_ID,
      CiphertextBlob: Buffer.from(decoded.signature, 'base64')
    };
    await kms.decrypt(kmsParams).promise();
    
    // Log to CloudWatch
    console.log(`Auth success for user: ${decoded.sub}`);
    
    return {
      principalId: decoded.sub,
      policyDocument: generatePolicy('Allow', event.methodArn),
      context: { scope: decoded.scope }
    };
  } catch (error) {
    console.error(`Auth failed: ${error.message}`);
    return {
      principalId: 'unauthorized',
      policyDocument: generatePolicy('Deny', event.methodArn)
    };
  }
};

function generatePolicy(effect, resource) {
  return {
    Version: '2012-10-17',
    Statement: [{
      Action: 'execute-api:Invoke',
      Effect: effect,
      Resource: resource
    }]
  };
}
                

-- PostgreSQL Schema
CREATE TABLE products (
  id UUID PRIMARY KEY,
  sku VARCHAR(32) UNIQUE,
  name VARCHAR(255) NOT NULL,
  description TEXT,
  price DECIMAL(10,2) CHECK (price >= 0),
  inventory_count INTEGER DEFAULT 0,
  categories JSONB,
  attributes JSONB,
  created_at TIMESTAMPTZ DEFAULT NOW(),
  updated_at TIMESTAMPTZ
);

-- DynamoDB Schema (for high-traffic reads)
{
  "TableName": "ProductCache",
  "KeySchema": [
    { "AttributeName": "pk", "KeyType": "HASH" },  // "PROD#123"
    { "AttributeName": "sk", "KeyType": "RANGE" }  // "METADATA"
  ],
  "GlobalSecondaryIndexes": [
    {
      "IndexName": "CategoryIndex",
      "KeySchema": [
        { "AttributeName": "category", "KeyType": "HASH" },
        { "AttributeName": "price", "KeyType": "RANGE" }
      ],
      "Projection": { "ProjectionType": "INCLUDE", "NonKeyAttributes": ["name","image"] }
    }
  ]
}

// Order Saga Compensation Handler
exports.handleCompensation = async (event) => {
  const { orderId, failureStep } = event;
  
  // 1. Update Order Status
  await dynamodb.update({
    TableName: 'Orders',
    Key: { id: orderId },
    UpdateExpression: 'SET #status = :status',
    ExpressionAttributeNames: { '#status': 'status' },
    ExpressionAttributeValues: { ':status': 'FAILED' }
  });

  // 2. Execute Compensation Based on Failure Point
  switch(failureStep) {
    case 'PAYMENT_FAILED':
      await inventoryService.releaseStock(orderId);
      break;
      
    case 'INVENTORY_UNAVAILABLE':
      await paymentService.refund(orderId);
      break;
      
    case 'SHIPPING_FAILED':
      await paymentService.refund(orderId);
      await inventoryService.releaseStock(orderId);
      break;
  }
  
  // 3. Notify User
  await sns.publish({
    TopicArn: process.env.NOTIFICATIONS_TOPIC,
    Message: JSON.stringify({
      type: 'ORDER_FAILED',
      orderId,
      reason: failureStep
    })
  });
};

# Terraform for PCI-Compliant Resources
resource "aws_vpc" "pci" {
  cidr_block = "10.1.0.0/16"
  enable_dns_hostnames = true
  tags = {
    Name = "PCI-VPC"
    Compliance = "PCI-DSS"
  }
}

resource "aws_cloudhsm_v2_cluster" "payment_hsm" {
  hsm_type   = "hsm1.medium"
  subnet_ids = aws_subnet.pci[*].id
  tags = {
    Purpose = "Card Data Tokenization"
  }
}

resource "aws_kms_key" "payment" {
  description             = "Payment Processing Key"
  deletion_window_in_days = 30
  enable_key_rotation     = true
  policy = data.aws_iam_policy_document.pci_kms.json
  tags = {
    Compliance = "PCI-DSS"
  }
}

-- DynamoDB Schema for Inventory
{
  "TableName": "Inventory",
  "KeySchema": [
    { "AttributeName": "productId", "KeyType": "HASH" },
    { "AttributeName": "warehouseId", "KeyType": "RANGE" }
  ],
  "AttributeDefinitions": [
    { "AttributeName": "productId", "AttributeType": "S" },
    { "AttributeName": "warehouseId", "AttributeType": "S" }
  ],
  "GlobalSecondaryIndexes": [
    {
      "IndexName": "StockLevelIndex",
      "KeySchema": [
        { "AttributeName": "warehouseId", "KeyType": "HASH" },
        { "AttributeName": "stockLevel", "KeyType": "RANGE" }
      ],
      "Projection": { "ProjectionType": "ALL" }
    }
  ],
  "BillingMode": "PAY_PER_REQUEST"
}
                

# Terraform for Analytics Resources
resource "aws_redshift_cluster" "analytics" {
  cluster_identifier = "ecommerce-analytics"
  database_name      = "analytics"
  master_username    = "admin"
  node_type          = "dc2.large"
  number_of_nodes    = 2
  publicly_accessible = false
  vpc_security_group_ids = [aws_security_group.redshift_sg.id]
}

resource "aws_s3_bucket" "analytics_raw" {
  bucket = "ecommerce-analytics-raw"
  acl    = "private"
  versioning {
    enabled = true
  }
}

resource "aws_athena_workgroup" "analytics" {
  name = "ecommerce-analytics"
  configuration {
    result_configuration {
      output_location = "s3://ecommerce-analytics-raw/athena-results/"
    }
  }
}
                

# Terraform for ECS Deployment of Catalog Service
provider "aws" {
  region = "us-west-2"
}

resource "aws_ecs_cluster" "ecommerce_cluster" {
  name = "ecommerce-cluster"
  tags = {
    Environment = "production"
  }
}

resource "aws_ecs_task_definition" "catalog_task" {
  family                   = "catalog-service"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "256"
  memory                   = "512"
  execution_role_arn       = aws_iam_role.ecs_task_execution_role.arn
  task_role_arn            = aws_iam_role.ecs_task_role.arn

  container_definitions = jsonencode([
    {
      name  = "catalog-container"
      image = "123456789012.dkr.ecr.us-west-2.amazonaws.com/catalog-service:latest"
      essential = true
      portMappings = [
        {
          containerPort = 8080
          hostPort      = 8080
          protocol      = "tcp"
        }
      ]
      environment = [
        { name = "DB_HOST", value = aws_rds_cluster.catalog_db.endpoint },
        { name = "REDIS_HOST", value = aws_elasticache_cluster.catalog_cache.cache_nodes[0].address }
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = "/ecs/catalog-service"
          "awslogs-region"        = "us-west-2"
          "awslogs-stream-prefix" = "catalog"
        }
      }
    }
  ])
}

resource "aws_ecs_service" "catalog_service" {
  name            = "catalog-service"
  cluster         = aws_ecs_cluster.ecommerce_cluster.id
  task_definition = aws_ecs_task_definition.catalog_task.arn
  desired_count   = 2
  launch_type     = "FARGATE"
  network_configuration {
    subnets         = ["subnet-12345678", "subnet-87654321"]
    security_groups = [aws_security_group.ecs_sg.id]
    assign_public_ip = false
  }
  load_balancer {
    target_group_arn = aws_lb_target_group.catalog_tg.arn
    container_name   = "catalog-container"
    container_port   = 8080
  }
}

resource "aws_lb" "catalog_alb" {
  name               = "catalog-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb_sg.id]
  subnets            = ["subnet-12345678", "subnet-87654321"]
}

resource "aws_lb_target_group" "catalog_tg" {
  name        = "catalog-tg"
  port        = 8080
  protocol    = "HTTP"
  vpc_id      = "vpc-1234567890abcdef0"
  target_type = "ip"
  health_check {
    path                = "/health"
    healthy_threshold   = 2
    unhealthy_threshold = 2
    timeout             = 5
    interval            = 30
  }
}

resource "aws_security_group" "ecs_sg" {
  name        = "ecs-sg"
  vpc_id      = "vpc-1234567890abcdef0"
  ingress {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    security_groups = [aws_security_group.alb_sg.id]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_security_group" "alb_sg" {
  name        = "alb-sg"
  vpc_id      = "vpc-1234567890abcdef0"
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_iam_role" "ecs_task_execution_role" {
  name = "ecs-task-execution-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ecs-tasks.amazonaws.com"
        }
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "ecs_task_execution_policy" {
  role       = aws_iam_role.ecs_task_execution_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}