WAF-AGN-090 – Cost & Performance Monitoring

resource "aws_cloudwatch_metric_alarm" "token_usage" {
  alarm_name          = "agent-token-spike"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = 1
  metric_name         = "InputTokenCount"
  namespace           = "AWS/Bedrock"
  period              = 300
  statistic           = "Sum"
  threshold           = 50000
  unit                = "Count"
  alarm_description   = "Agent token usage anomaly detected"
}

resource "aws_cloudwatch_dashboard" "agent_dashboard" {
  dashboard_name = "agent-metrics"

  dashboard_body = jsonencode({
    widgets = [{
      type   = "metric"
      x      = 0
      y      = 0
      width  = 12
      height = 6
      properties = {
        metrics = [
          ["AWS/Bedrock", "InputTokenCount", "AgentName", "customer-agent"]
        ]
        period = 300
        stat   = "Sum"
        region = "us-east-1"
      }
    }]
  })
}

# No token monitoring configured
# WAF-AGN-090 Violation
# Cannot track or control costs

resource "aws_budgets_budget" "agent_budget" {
  budget_name = "agent-monthly-budget"

  budget_type      = "COST"
  limit_amount     = "500"
  limit_unit       = "USD"
  time_unit        = "MONTHLY"

  cost_types {
    include_tax           = true
    include_subscription  = true
    include_recurring     = true
    include_other_subscription = true
    include_discounts     = true
    use_amortized         = false
    use_blended           = false
  }

  time_period_start = "2026-01-01_00:00"
  time_period_end   = "2026-12-31_23:59"

  notification {
    notification_type       = "ACTUAL"
    comparison_operator     = "GREATER_THAN"
    threshold               = 50
    threshold_type          = "PERCENTAGE"
    notification_state      = "ALARM"
    subscriber_email_addresses = ["team-ops@example.com"]
  }

  notification {
    notification_type       = "ACTUAL"
    comparison_operator     = "GREATER_THAN"
    threshold               = 75
    threshold_type          = "PERCENTAGE"
    notification_state      = "ALARM"
    subscriber_email_addresses = ["team-ops@example.com", "finance@example.com"]
  }

  notification {
    notification_type       = "ACTUAL"
    comparison_operator     = "GREATER_THAN"
    threshold               = 90
    threshold_type          = "PERCENTAGE"
    notification_state      = "ALARM"
    subscriber_email_addresses = ["team-ops@example.com", "finance@example.com"]
  }

  notification {
    notification_type       = "ACTUAL"
    comparison_operator     = "GREATER_THAN"
    threshold               = 100
    threshold_type          = "PERCENTAGE"
    notification_state      = "ALARM"
    subscriber_email_addresses = ["team-ops@example.com", "finance@example.com", "management@example.com"]
  }
}

# No budget alerts configured
# WAF-AGN-090 Violation
# Cost overruns not detected

# Documented model selection criteria
# - Simple queries: Claude Instant (cheapest)
# - Moderate complexity: Claude Sonnet (balanced)
# - High complexity: Claude Opus (best quality)
# Review model performance quarterly

resource "aws_bedrock_foundation_model" "model_selection" {
  model_id = "anthropic.claude-3-haiku-20240307-v1:0"  # Cost-optimized choice
  # Model selection documented in architecture decision record
}

# Using expensive models for simple tasks
# WAF-AGN-090 Violation
# Cost-performance not optimized

resource "aws_dynamodb_table" "agent_cache" {
  name         = "agent-response-cache"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "cache_key"

  attribute {
    name = "cache_key"
    type = "S"
  }

  ttl {
    attribute_name = "expires_at"
    enabled        = true
  }

  # Cache keys based on input hash
  # TTL based on data freshness needs
}

resource "aws_lambda_function" "cache_middleware" {
  function_name = "agent-cache-middleware"
  # Middleware checks cache before API call
}

# No caching implemented
# WAF-AGN-090 Violation
# All queries hit API directly

resource "azurerm_consumption_budget_subscription" "agent_budget" {
  name            = "agent-spend-budget"
  subscription_id = data.azurerm_subscription.current.id

  amount     = 1000
  time_grain = "Monthly"

  time_period {
    start_date = "2026-01-01T00:00:00Z"
    end_date   = "2026-12-31T23:59:59Z"
  }

  notification {
    enabled   = true
    threshold = 75
    operator  = "EqualTo"
    contact_emails = ["team-ops@example.com"]
  }

  notification {
    enabled   = true
    threshold = 90
    operator  = "EqualTo"
    contact_emails = ["team-ops@example.com", "finance@example.com"]
  }
}

resource "azurerm_cognitive_account" "ai" {
  name = "ai-services"
  # No spending budget or alert configured
  # WAF-AGN-090 Violation
}

resource "google_billing_budget" "agent_budget" {
  billing_account = data.google_billing_account.account.id
  display_name    = "Agent Operations Budget"

  amount {
    specified_amount {
      currency_code = "EUR"
      units = "1000"
    }
  }

  threshold_rules {
    threshold_percent = 75
  }

  threshold_rules {
    threshold_percent = 90
  }

  all_updates_rule {
    monitoring_notification_channels = [google_monitoring_notification_channel.agent_budget.id]
  }
}

resource "google_cloud_run_service" "agent" {
  name = "agent-service"
  # No billing budget configured
  # WAF-AGN-090 Violation
}

resource "stackit_project" "example" {
  labels = {
    agentic-efficiency-reviewed = "true"
  }
}

resource "stackit_project" "example" {
  # Missing agentic-efficiency-reviewed labels
}

resource "ovh_cloud_project" "example" {
  tags = {
    agentic-efficiency-reviewed = "true"
  }
}

resource "ovh_cloud_project" "example" {
  # Missing agentic-efficiency-reviewed tags
}

resource "hcloud_server" "example" {
  labels = {
    agentic-efficiency-reviewed = "true"
  }
}

resource "hcloud_server" "example" {
  # Missing agentic-efficiency-reviewed labels
}