┌─────────────────────────────────────────────────────────────────────────────┐
│                              AWS Cloud                                       │
│  ┌─────────────┐     ┌─────────────┐     ┌─────────────────────────────┐   │
│  │   GitHub    │────▶│    ECR      │     │          VPC                │   │
│  │   Actions   │     │  (Images)   │     │  ┌─────────────────────┐   │   │
│  └─────────────┘     └──────┬──────┘     │  │    EC2 Instance     │   │   │
│                             │            │  │  ┌───────────────┐  │   │   │
│                             │            │  │  │   FastAPI     │  │   │   │
│                             ▼            │  │  │   (Docker)    │  │   │   │
│                      Pull Image          │  │  └───────┬───────┘  │   │   │
│                             │            │  └──────────┼──────────┘   │   │
│                             ▼            │             │              │   │
│                      ┌──────────────┐    │             ▼              │   │
│                      │   Deploy     │────┼───▶  ┌─────────────┐      │   │
│                      └──────────────┘    │      │    RDS      │      │   │
│                                          │      │ (PostgreSQL)│      │   │
│  ┌─────────────┐                         │      └─────────────┘      │   │
│  │     S3      │◀────────────────────────┼──────────────────────────┘    │
│  │  (Storage)  │                         │                               │
│  └─────────────┘                         └───────────────────────────────┘
│                                                                           │
│  ┌─────────────┐                                                          │
│  │    IAM      │  (Access Control for all services)                       │
│  └─────────────┘                                                          │
└───────────────────────────────────────────────────────────────────────────┘

aws configure
# Enter your Access Key ID, Secret Access Key, Region (ap-southeast-1), Output format (json)

import os
from sqlalchemy.ext.asyncio import create_async_engine, AsyncSession
from sqlalchemy.orm import sessionmaker

# Use environment variables for database connection
DATABASE_URL = os.getenv(
    "DATABASE_URL",
    "postgresql+asyncpg://postgres:password@localhost:5432/fastapi_prod"
)

engine = create_async_engine(DATABASE_URL, echo=True)

AsyncSessionLocal = sessionmaker(
    engine, expire_on_commit=False, class_=AsyncSession
)

async def get_db_connection():
    db = AsyncSessionLocal()
    try:
        yield db
    finally:
        await db.close()

# Using psql
psql -h <rds-endpoint> -U postgres -d fastapi_prod

# Or using Python
python -c "import asyncio; from db import engine; asyncio.run(engine.connect())"

# s3_service.py
import boto3
from botocore.exceptions import ClientError
import os

class S3Service:
    def __init__(self):
        self.s3_client = boto3.client(
            "s3",
            region_name=os.getenv("AWS_REGION", "ap-southeast-1"),
            aws_access_key_id=os.getenv("AWS_ACCESS_KEY_ID"),
            aws_secret_access_key=os.getenv("AWS_SECRET_ACCESS_KEY"),
        )
        self.bucket_name = os.getenv("S3_BUCKET_NAME")

    async def upload_file(self, file_path: str, object_name: str) -> bool:
        try:
            self.s3_client.upload_file(file_path, self.bucket_name, object_name)
            return True
        except ClientError as e:
            print(f"Upload failed: {e}")
            return False

    async def download_file(self, object_name: str, file_path: str) -> bool:
        try:
            self.s3_client.download_file(self.bucket_name, object_name, file_path)
            return True
        except ClientError as e:
            print(f"Download failed: {e}")
            return False

    def get_presigned_url(self, object_name: str, expiration: int = 3600) -> str:
        try:
            url = self.s3_client.generate_presigned_url(
                'get_object',
                Params={'Bucket': self.bucket_name, 'Key': object_name},
                ExpiresIn=expiration
            )
            return url
        except ClientError:
            return None

# In main.py
from fastapi import UploadFile, File
from s3_service import S3Service
import tempfile

s3_service = S3Service()

@app.post("/files/upload")
async def upload_file(file: UploadFile = File(...)):
    # Save temporarily
    with tempfile.NamedTemporaryFile(delete=False) as tmp:
        content = await file.read()
        tmp.write(content)
        tmp_path = tmp.name

    # Upload to S3
    object_name = f"uploads/{file.filename}"
    success = await s3_service.upload_file(tmp_path, object_name)

    if success:
        url = s3_service.get_presigned_url(object_name)
        return {"message": "File uploaded", "url": url}
    return {"error": "Upload failed"}

aws ecr create-repository \
    --repository-name fastapi-app \
    --region ap-southeast-1

# Dockerfile
FROM python:3.11-slim

WORKDIR /app

# Install dependencies
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

# Copy application code
COPY . .

# Expose port
EXPOSE 8000

# Run with uvicorn
CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

# docker-compose.yml
version: '3.8'

services:
  fastapi:
    build: .
    ports:
      - '8000:8000'
    environment:
      - DATABASE_URL=${DATABASE_URL}
      - AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
      - AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
      - AWS_REGION=${AWS_REGION}
      - S3_BUCKET_NAME=${S3_BUCKET_NAME}
    restart: unless-stopped

# Authenticate Docker with ECR
aws ecr get-login-password --region ap-southeast-1 | \
    docker login --username AWS --password-stdin <account-id>.dkr.ecr.ap-southeast-1.amazonaws.com

# Build image
docker build -t fastapi-app .

# Tag image
docker tag fastapi-app:latest <account-id>.dkr.ecr.ap-southeast-1.amazonaws.com/fastapi-app:latest

# Push image
docker push <account-id>.dkr.ecr.ap-southeast-1.amazonaws.com/fastapi-app:latest

# Connect to EC2
ssh -i your-key.pem ec2-user@<ec2-public-ip>

# Install Docker (Amazon Linux 2023)
sudo yum update -y
sudo yum install -y docker
sudo systemctl start docker
sudo systemctl enable docker
sudo usermod -aG docker ec2-user

# Install AWS CLI (if not pre-installed)
curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip"
unzip awscliv2.zip
sudo ./aws/install

# Configure AWS credentials
aws configure

# Authenticate with ECR
aws ecr get-login-password --region ap-southeast-1 | \
    docker login --username AWS --password-stdin <account-id>.dkr.ecr.ap-southeast-1.amazonaws.com

# Pull image
docker pull <account-id>.dkr.ecr.ap-southeast-1.amazonaws.com/fastapi-app:latest

# Run container
docker run -d \
    --name fastapi-app \
    -p 8000:8000 \
    -e DATABASE_URL="postgresql+asyncpg://postgres:password@<rds-endpoint>:5432/fastapi_prod" \
    -e AWS_ACCESS_KEY_ID="<your-access-key>" \
    -e AWS_SECRET_ACCESS_KEY="<your-secret-key>" \
    -e AWS_REGION="ap-southeast-1" \
    -e S3_BUCKET_NAME="fastapi-app-files-<your-id>" \
    <account-id>.dkr.ecr.ap-southeast-1.amazonaws.com/fastapi-app:latest

# Test health endpoint
curl http://<ec2-public-ip>:8000/

# Test API endpoints
curl http://<ec2-public-ip>:8000/users/
curl -X POST http://<ec2-public-ip>:8000/users/ \
    -H "Content-Type: application/json" \
    -d '{"name": "Test User", "email": "test@example.com"}'

name: Deploy to AWS

on:
  push:
    branches:
      - main

env:
  AWS_REGION: ap-southeast-1
  ECR_REPOSITORY: fastapi-app

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: ${{ env.AWS_REGION }}

      - name: Login to Amazon ECR
        run: |
          aws ecr get-login-password --region ${{ env.AWS_REGION }} | \
            docker login --username AWS --password-stdin ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com

      - name: Build and push Docker image
        run: |
          docker build -t ${{ env.ECR_REPOSITORY }} .
          docker tag ${{ env.ECR_REPOSITORY }}:latest ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ env.ECR_REPOSITORY }}:latest
          docker tag ${{ env.ECR_REPOSITORY }}:latest ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ env.ECR_REPOSITORY }}:${{ github.sha }}
          docker push ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ env.ECR_REPOSITORY }}:latest
          docker push ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ env.ECR_REPOSITORY }}:${{ github.sha }}

      - name: Deploy to EC2
        uses: appleboy/ssh-action@v1.0.0
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ec2-user
          key: ${{ secrets.EC2_SSH_KEY }}
          script: |
            aws ecr get-login-password --region ${{ env.AWS_REGION }} | \
              docker login --username AWS --password-stdin ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com

            docker pull ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ env.ECR_REPOSITORY }}:latest

            docker stop fastapi-app || true
            docker rm fastapi-app || true

            docker run -d \
              --name fastapi-app \
              -p 8000:8000 \
              -e DATABASE_URL="${{ secrets.DATABASE_URL }}" \
              -e AWS_ACCESS_KEY_ID="${{ secrets.AWS_ACCESS_KEY_ID }}" \
              -e AWS_SECRET_ACCESS_KEY="${{ secrets.AWS_SECRET_ACCESS_KEY }}" \
              -e AWS_REGION="${{ env.AWS_REGION }}" \
              -e S3_BUCKET_NAME="${{ secrets.S3_BUCKET_NAME }}" \
              ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ env.ECR_REPOSITORY }}:latest

            docker image prune -f