☁️ Migración a AWS — Social Bot Scheduler#

graph TB
    subgraph "🖥️ Host Único (Docker Compose)"
        N[n8n :5678]
        D[Dashboards :8081-8100]
        DB1[(MySQL/MariaDB/PG/...)]
        OBS[Prometheus + Grafana]
        N --> DB1
        D --> DB1
        N -.-> OBS
    end

graph TB
    U[👤 Usuarios] --> R53[Route 53]
    R53 --> CF[CloudFront + WAF]
    CF --> ALB[Application Load Balancer]

    subgraph "VPC Multi-AZ"
        subgraph "Public Subnets"
            ALB
            NAT[NAT Gateway]
        end
        subgraph "Private Subnets - Compute"
            ECS1[ECS Fargate: n8n]
            ECS2[ECS Fargate: Dashboards]
            ECS3[ECS Fargate: Receptores]
        end
        subgraph "Private Subnets - Data"
            RDS[(RDS/Aurora Multi-AZ<br/>PostgreSQL/MySQL<br/>+ pgvector/Timescale/RLS)]
            DDB[(DynamoDB<br/>Mnesia/Firestore)]
            REDIS[(ElastiCache Redis)]
            DOCDB[(DocumentDB)]
            KEYS[(Keyspaces - Cassandra)]
            NEP[(Neptune - Neo4j)]
            TS[(Timestream - InfluxDB)]
            MSK[[Amazon MSK - Kafka]]
            IOT[[IoT Core - MQTT]]
        end
        ALB --> ECS1
        ALB --> ECS2
        ALB --> ECS3
        ECS1 --> RDS
        ECS2 --> RDS
        ECS3 --> DDB
        ECS3 --> REDIS
        ECS3 --> NEP
        ECS3 --> TS
        IOT --> MSK --> ECS3
    end

    ECS1 -.-> SM[Secrets Manager]
    ECS1 -.-> CW[CloudWatch Logs/Metrics]
    ECS1 -.-> XR[X-Ray]

graph LR
    DEV[👨‍💻 Dev] -->|git push| GH[GitHub]
    GH -->|Actions| ECR[ECR Registry]
    ECR --> ECS[ECS Fargate Cluster]

    subgraph "VPC"
        ALB[ALB] --> ECS
        ECS --> RDS[(Aurora PostgreSQL)]
        ECS --> EC[(ElastiCache)]
        ECS --> EFS[(EFS - n8n data)]
    end

    ECS --> CW[CloudWatch]
    ECS -.-> SM[Secrets Manager]

graph LR
    GH[GitHub Actions] --> ECR
    ECR --> EKS[EKS Cluster Multi-AZ]
    EKS --> NS1[Namespace: n8n]
    EKS --> NS2[Namespace: receivers]
    EKS --> NS3[Namespace: observability]
    NS1 --> RDS[(RDS)]
    NS2 --> DDB[(DynamoDB)]
    NS3 --> AMP[Amazon Managed Prometheus]
    NS3 --> AMG[Amazon Managed Grafana]

graph LR
    SCH[EventBridge Scheduler] --> LAMBDA1[λ Emisor]
    LAMBDA1 --> SF[Step Functions Workflow]
    SF --> LAMBDA2[λ Idempotency Check]
    SF --> SQS[SQS DLQ]
    SF --> LAMBDA3[λ Social API Caller]
    SF --> DDB[(DynamoDB)]
    SF --> APIGW[API Gateway] --> DASH[CloudFront + S3 Dashboards]

graph LR
    subgraph "Local Docker — Núcleo (01-09)"
        L1[MySQL]
        L2[MariaDB]
        L3[PostgreSQL]
        L4[SQLite]
        L5[MongoDB]
        L6[Redis]
        L7[Cassandra]
        L8[SQL Server]
        L9[DuckDB]
    end

    subgraph "Local Docker — Matriz (10-20)"
        M1[Mnesia]
        M2[pgvector]
        M3[ClickHouse]
        M4[Postgres+RLS]
        M5[CockroachDB]
        M6[TimescaleDB]
        M7[InfluxDB]
        M8[Neo4j]
        M9[Firestore emu]
        M10[Kafka]
    end

    subgraph "AWS Managed"
        A1[RDS / Aurora MySQL]
        A2[RDS / Aurora PostgreSQL<br/>+pgvector/Timescale/RLS]
        A3[DocumentDB]
        A4[ElastiCache Redis]
        A5[Keyspaces]
        A6[RDS SQL Server]
        A7[Athena + S3 Parquet]
        A8[DynamoDB]
        A9[ClickHouse self-managed]
        A10[CockroachDB Cloud]
        A11[Timestream]
        A12[Neptune]
        A13[Amazon MSK]
    end

    L1 --> A1
    L2 --> A1
    L3 --> A2
    L4 --> A2
    L5 --> A3
    L6 --> A4
    L7 --> A5
    L8 --> A6
    L9 --> A7
    M1 --> A8
    M9 --> A8
    M2 --> A2
    M4 --> A2
    M6 --> A2
    M3 --> A9
    M5 --> A10
    M7 --> A11
    M8 --> A12
    M10 --> A13

# 1. Configurar credenciales
aws configure --profile sbs-prod

# 2. Crear bucket de estado de Terraform
aws s3 mb s3://sbs-terraform-state --region us-east-1
aws s3api put-bucket-versioning \
  --bucket sbs-terraform-state \
  --versioning-configuration Status=Enabled

# 3. Crear tabla DynamoDB para locking
aws dynamodb create-table \
  --table-name sbs-tf-lock \
  --attribute-definitions AttributeName=LockID,AttributeType=S \
  --key-schema AttributeName=LockID,KeyType=HASH \
  --billing-mode PAY_PER_REQUEST

# infra/vpc.tf
module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.5"

  name = "sbs-vpc"
  cidr = "10.20.0.0/16"

  azs             = ["us-east-1a", "us-east-1b", "us-east-1c"]
  public_subnets  = ["10.20.1.0/24", "10.20.2.0/24", "10.20.3.0/24"]
  private_subnets = ["10.20.10.0/24", "10.20.20.0/24", "10.20.30.0/24"]

  enable_nat_gateway     = true
  single_nat_gateway     = false   # Multi-AZ NAT
  enable_dns_hostnames   = true
  enable_flow_log        = true
}

# Crear un repo por servicio
for svc in n8n case01-emisor case01-receptor case02-emisor ...; do
  aws ecr create-repository --repository-name sbs/$svc \
    --image-scanning-configuration scanOnPush=true \
    --encryption-configuration encryptionType=KMS
done

# Login + build + push
aws ecr get-login-password | docker login --username AWS \
  --password-stdin <account>.dkr.ecr.us-east-1.amazonaws.com

docker build -t sbs/case01-emisor cases/case01/emisor/
docker tag  sbs/case01-emisor <account>.dkr.ecr.us-east-1.amazonaws.com/sbs/case01-emisor:v4.9.0
docker push <account>.dkr.ecr.us-east-1.amazonaws.com/sbs/case01-emisor:v4.9.0

resource "aws_rds_cluster" "aurora_pg" {
  cluster_identifier      = "sbs-aurora-pg"
  engine                  = "aurora-postgresql"
  engine_version          = "15.5"
  database_name           = "n8n"
  master_username         = "sbs_admin"
  master_password         = random_password.db.result
  storage_encrypted       = true
  kms_key_id              = aws_kms_key.rds.arn
  backup_retention_period = 14
  deletion_protection     = true
  vpc_security_group_ids  = [aws_security_group.rds.id]
  db_subnet_group_name    = aws_db_subnet_group.private.name
}

resource "aws_ecs_cluster" "main" {
  name = "sbs-cluster"
  setting {
    name  = "containerInsights"
    value = "enabled"
  }
}

resource "aws_ecs_task_definition" "n8n" {
  family                   = "sbs-n8n"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = 1024
  memory                   = 2048
  execution_role_arn       = aws_iam_role.ecs_exec.arn
  task_role_arn            = aws_iam_role.n8n_task.arn

  container_definitions = jsonencode([{
    name  = "n8n"
    image = "${aws_ecr_repository.n8n.repository_url}:v4.9.0"
    portMappings = [{ containerPort = 5678 }]
    secrets = [
      { name = "DB_POSTGRESDB_PASSWORD",
        valueFrom = aws_secretsmanager_secret.n8n_db.arn }
    ]
    logConfiguration = {
      logDriver = "awslogs"
      options = {
        "awslogs-group"         = "/ecs/sbs-n8n"
        "awslogs-region"        = "us-east-1"
        "awslogs-stream-prefix" = "n8n"
      }
    }
  }])
}

aws secretsmanager create-secret \
  --name sbs/n8n/db \
  --secret-string '{"username":"sbs_admin","password":"***"}' \
  --kms-key-id alias/sbs-secrets

aws secretsmanager create-secret \
  --name sbs/social/twitter-api \
  --secret-string '{"bearer_token":"***"}'

# Ejemplo: PostgreSQL local → Aurora
pg_dump -h localhost -U sbs sbs_db | \
  psql -h sbs-aurora-pg.cluster-xxx.us-east-1.rds.amazonaws.com -U sbs_admin sbs_db

# Validación
python verify_n8n.py --remote https://n8n.sbs.example.com

graph LR
    APP[ECS Tasks] -->|logs| CWL[CloudWatch Logs]
    APP -->|metrics| CWM[CloudWatch Metrics]
    APP -->|traces| XR[X-Ray]
    APP -->|prom scrape| AMP[Amazon Managed Prometheus]
    AMP --> AMG[Amazon Managed Grafana]
    CWL --> SUB[Subscription Filter]
    SUB --> OS[OpenSearch Service]
    CWM --> ALARM[CloudWatch Alarms]
    ALARM --> SNS[SNS] --> PD[PagerDuty/Email]

# .github/workflows/deploy-aws.yml
name: Deploy to AWS
on:
  push:
    branches: [main]
jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write   # OIDC
      contents: read
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::<acct>:role/gha-deploy
          aws-region: us-east-1
      - uses: aws-actions/amazon-ecr-login@v2
      - name: Build & Push
        run: |
          docker build -t $ECR/sbs/n8n:${{ github.sha }} .
          docker push   $ECR/sbs/n8n:${{ github.sha }}
      - uses: aws-actions/amazon-ecs-render-task-definition@v1
        with:
          task-definition: infra/ecs/n8n.json
          container-name: n8n
          image: $ECR/sbs/n8n:${{ github.sha }}
      - uses: aws-actions/amazon-ecs-deploy-task-definition@v2
        with:
          service: sbs-n8n
          cluster: sbs-cluster
          wait-for-service-stability: true