# Workflow: Infrastructure Maintainer SOP

## Core Mission
### Ensure Maximum System Reliability and Performance
- Maintain 99.9%+ uptime for critical services with comprehensive monitoring and alerting
- Implement performance optimization strategies with resource right-sizing and bottleneck elimination
- Create automated backup and disaster recovery systems with tested recovery procedures
- Build scalable infrastructure architecture that supports business growth and peak demand
- **Default requirement**: Include security hardening and compliance validation in all infrastructure changes

### Optimize Infrastructure Costs and Efficiency
- Design cost optimization strategies with usage analysis and right-sizing recommendations
- Implement infrastructure automation with Infrastructure as Code and deployment pipelines
- Create monitoring dashboards with capacity planning and resource utilization tracking
- Build multi-cloud strategies with vendor management and service optimization

### Maintain Security and Compliance Standards
- Establish security hardening procedures with vulnerability management and patch automation
- Create compliance monitoring systems with audit trails and regulatory requirement tracking
- Implement access control frameworks with least privilege and multi-factor authentication
- Build incident response procedures with security event monitoring and threat detection

## Critical Rules
### Reliability First Approach
- Implement comprehensive monitoring before making any infrastructure changes
- Create tested backup and recovery procedures for all critical systems
- Document all infrastructure changes with rollback procedures and validation steps
- Establish incident response procedures with clear escalation paths

### Security and Compliance Integration
- Validate security requirements for all infrastructure modifications
- Implement proper access controls and audit logging for all systems
- Ensure compliance with relevant standards (SOC2, ISO27001, etc.)
- Create security incident response and breach notification procedures

## Technical Deliverables
### Comprehensive Monitoring System
```yaml
# Prometheus Monitoring Configuration
global:
  scrape_interval: 15s
  evaluation_interval: 15s

rule_files:
  - "infrastructure_alerts.yml"
  - "application_alerts.yml"
  - "business_metrics.yml"

scrape_configs:
  # Infrastructure monitoring
  - job_name: 'infrastructure'
    static_configs:
      - targets: ['localhost:9100']  # Node Exporter
    scrape_interval: 30s
    metrics_path: /metrics
    
  # Application monitoring
  - job_name: 'application'
    static_configs:
      - targets: ['app:8080']
    scrape_interval: 15s
    
  # Database monitoring
  - job_name: 'database'
    static_configs:
      - targets: ['db:9104']  # PostgreSQL Exporter
    scrape_interval: 30s

# Critical Infrastructure Alerts
alerting:
  alertmanagers:
    - static_configs:
        - targets:
          - alertmanager:9093

# Infrastructure Alert Rules
groups:
  - name: infrastructure.rules
    rules:
      - alert: HighCPUUsage
        expr: 100 - (avg by(instance) (irate(node_cpu_seconds_total{mode="idle"}[5m])) * 100) > 80
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High CPU usage detected"
          description: "CPU usage is above 80% for 5 minutes on {{ $labels.instance }}"
          
      - alert: HighMemoryUsage
        expr: (1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100 > 90
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "High memory usage detected"
          description: "Memory usage is above 90% on {{ $labels.instance }}"
          
      - alert: DiskSpaceLow
        expr: 100 - ((node_filesystem_avail_bytes * 100) / node_filesystem_size_bytes) > 85
        for: 2m
        labels:
          severity: warning
        annotations:
          summary: "Low disk space"
          description: "Disk usage is above 85% on {{ $labels.instance }}"
          
      - alert: ServiceDown
        expr: up == 0
        for: 1m
        labels:
          severity: critical
        annotations:
          summary: "Service is down"
          description: "{{ $labels.job }} has been down for more than 1 minute"
```

### Infrastructure as Code Framework
```terraform
# AWS Infrastructure Configuration
terraform {
  required_version = ">= 1.0"
  backend "s3" {
    bucket = "company-terraform-state"
    key    = "infrastructure/terraform.tfstate"
    region = "us-west-2"
    encrypt = true
    dynamodb_table = "terraform-locks"
  }
}

# Network Infrastructure
resource "aws_vpc" "main" {
  cidr_block           = "10.0.0.0/16"
  enable_dns_hostnames = true
  enable_dns_support   = true
  
  tags = {
    Name        = "main-vpc"
    Environment = var.environment
    Owner       = "infrastructure-team"
  }
}

resource "aws_subnet" "private" {
  count             = length(var.availability_zones)
  vpc_id            = aws_vpc.main.id
  cidr_block        = "10.0.${count.index + 1}.0/24"
  availability_zone = var.availability_zones[count.index]
  
  tags = {
    Name = "private-subnet-${count.index + 1}"
    Type = "private"
  }
}

resource "aws_subnet" "public" {
  count                   = length(var.availability_zones)
  vpc_id                  = aws_vpc.main.id
  cidr_block              = "10.0.${count.index + 10}.0/24"
  availability_zone       = var.availability_zones[count.index]
  map_public_ip_on_launch = true
  
  tags = {
    Name = "public-subnet-${count.index + 1}"
    Type = "public"
  }
}

# Auto Scaling Infrastructure
resource "aws_launch_template" "app" {
  name_prefix   = "app-template-"
  image_id      = data.aws_ami.app.id
  instance_type = var.instance_type
  
  vpc_security_group_ids = [aws_security_group.app.id]
  
  user_data = base64encode(templatefile("${path.module}/user_data.sh", {
    app_environment = var.environment
  }))
  
  tag_specifications {
    resource_type = "instance"
    tags = {
      Name        = "app-server"
      Environment = var.environment
    }
  }
  
  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_autoscaling_group" "app" {
  name                = "app-asg"
  vpc_zone_identifier = aws_subnet.private[*].id
  target_group_arns   = [aws_lb_target_group.app.arn]
  health_check_type   = "ELB"
  
  min_size         = var.min_servers
  max_size         = var.max_servers
  desired_capacity = var.desired_servers
  
  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }
  
  # Auto Scaling Policies
  tag {
    key                 = "Name"
    value               = "app-asg"
    propagate_at_launch = false
  }
}

# Database Infrastructure
resource "aws_db_subnet_group" "main" {
  name       = "main-db-subnet-group"
  subnet_ids = aws_subnet.private[*].id
  
  tags = {
    Name = "Main DB subnet group"
  }
}

resource "aws_db_instance" "main" {
  allocated_storage      = var.db_allocated_storage
  max_allocated_storage  = var.db_max_allocated_storage
  storage_type          = "gp2"
  storage_encrypted     = true
  
  engine         = "postgres"
  engine_version = "13.7"
  instance_class = var.db_instance_class
  
  db_name  = var.db_name
  username = var.db_username
  password = var.db_password
  
  vpc_security_group_ids = [aws_security_group.db.id]
  db_subnet_group_name   = aws_db_subnet_group.main.name
  
  backup_retention_period = 7
  backup_window          = "03:00-04:00"
  maintenance_window     = "Sun:04:00-Sun:05:00"
  
  skip_final_snapshot = false
  final_snapshot_identifier = "main-db-final-snapshot-${formatdate("YYYY-MM-DD-hhmm", timestamp())}"
  
  performance_insights_enabled = true
  monitoring_interval         = 60
  monitoring_role_arn        = aws_iam_role.rds_monitoring.arn
  
  tags = {
    Name        = "main-database"
    Environment = var.environment
  }
}
```

### Automated Backup and Recovery System
```bash
#!/bin/bash
# Comprehensive Backup and Recovery Script

set -euo pipefail

# Configuration
BACKUP_ROOT="/backups"
LOG_FILE="/var/log/backup.log"
RETENTION_DAYS=30
ENCRYPTION_KEY="/etc/backup/backup.key"
S3_BUCKET="company-backups"
# IMPORTANT: This is a template example. Replace with your actual webhook URL before use.
# Never commit real webhook URLs to version control.
NOTIFICATION_WEBHOOK="${SLACK_WEBHOOK_URL:?Set SLACK_WEBHOOK_URL environment variable}"

# Logging function
log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" | tee -a "$LOG_FILE"
}

# Error handling
handle_error() {
    local error_message="$1"
    log "ERROR: $error_message"
    
    # Send notification
    curl -X POST -H 'Content-type: application/json' \
        --data "{\"text\":\"🚨 Backup Failed: $error_message\"}" \
        "$NOTIFICATION_WEBHOOK"
    
    exit 1
}

# Database backup function
backup_database() {
    local db_name="$1"
    local backup_file="${BACKUP_ROOT}/db/${db_name}_$(date +%Y%m%d_%H%M%S).sql.gz"
    
    log "Starting database backup for $db_name"
    
    # Create backup directory
    mkdir -p "$(dirname "$backup_file")"
    
    # Create database dump
    if ! pg_dump -h "$DB_HOST" -U "$DB_USER" -d "$db_name" | gzip > "$backup_file"; then
        handle_error "Database backup failed for $db_name"
    fi
    
    # Encrypt backup
    if ! gpg --cipher-algo AES256 --compress-algo 1 --s2k-mode 3 \
             --s2k-digest-algo SHA512 --s2k-count 65536 --symmetric \
             --passphrase-file "$ENCRYPTION_KEY" "$backup_file"; then
        handle_error "Database backup encryption failed for $db_name"
    fi
    
    # Remove unencrypted file
    rm "$backup_file"
    
    log "Database backup completed for $db_name"
    return 0
}

# File system backup function
backup_files() {
    local source_dir="$1"
    local backup_name="$2"
    local backup_file="${BACKUP_ROOT}/files/${backup_name}_$(date +%Y%m%d_%H%M%S).tar.gz.gpg"
    
    log "Starting file backup for $source_dir"
    
    # Create backup directory
    mkdir -p "$(dirname "$backup_file")"
    
    # Create compressed archive and encrypt
    if ! tar -czf - -C "$source_dir" . | \
         gpg --cipher-algo AES256 --compress-algo 0 --s2k-mode 3 \
             --s2k-digest-algo SHA512 --s2k-count 65536 --symmetric \
             --passphrase-file "$ENCRYPTION_KEY" \
             --output "$backup_file"; then
        handle_error "File backup failed for $source_dir"
    fi
    
    log "File backup completed for $source_dir"
    return 0
}

# Upload to S3
upload_to_s3() {
    local local_file="$1"
    local s3_path="$2"
    
    log "Uploading $local_file to S3"
    
    if ! aws s3 cp "$local_file" "s3://$S3_BUCKET/$s3_path" \
         --storage-class STANDARD_IA \
         --metadata "backup-date=$(date -u +%Y-%m-%dT%H:%M:%SZ)"; then
        handle_error "S3 upload failed for $local_file"
    fi
    
    log "S3 upload completed for $local_file"
}

# Cleanup old backups
cleanup_old_backups() {
    log "Starting cleanup of backups older than $RETENTION_DAYS days"
    
    # Local cleanup
    find "$BACKUP_ROOT" -name "*.gpg" -mtime +$RETENTION_DAYS -delete
    
    # S3 cleanup (lifecycle policy should handle this, but double-check)
    aws s3api list-objects-v2 --bucket "$S3_BUCKET" \
        --query "Contents[?LastModified<='$(date -d "$RETENTION_DAYS days ago" -u +%Y-%m-%dT%H:%M:%SZ)'].Key" \
        --output text | xargs -r -n1 aws s3 rm "s3://$S3_BUCKET/"
    
    log "Cleanup completed"
}

# Verify backup integrity
verify_backup() {
    local backup_file="$1"
    
    log "Verifying backup integrity for $backup_file"
    
    if ! gpg --quiet --batch --passphrase-file "$ENCRYPTION_KEY" \
             --decrypt "$backup_file" > /dev/null 2>&1; then
        handle_error "Backup integrity check failed for $backup_file"
    fi
    
    log "Backup integrity verified for $backup_file"
}

# Main backup execution
main() {
    log "Starting backup process"
    
    # Database backups
    backup_database "production"
    backup_database "analytics"
    
    # File system backups
    backup_files "/var/www/uploads" "uploads"
    backup_files "/etc" "system-config"
    backup_files "/var/log" "system-logs"
    
    # Upload all new backups to S3
    find "$BACKUP_ROOT" -name "*.gpg" -mtime -1 | while read -r backup_file; do
        relative_path=$(echo "$backup_file" | sed "s|$BACKUP_ROOT/||")
        upload_to_s3 "$backup_file" "$relative_path"
        verify_backup "$backup_file"
    done
    
    # Cleanup old backups
    cleanup_old_backups
    
    # Send success notification
    curl -X POST -H 'Content-type: application/json' \
        --data "{\"text\":\"✅ Backup completed successfully\"}" \
        "$NOTIFICATION_WEBHOOK"
    
    log "Backup process completed successfully"
}

# Execute main function
main "$@"
```

## Step 1: Infrastructure Assessment and Planning

```bash
# Assess current infrastructure health and performance
# Identify optimization opportunities and potential risks
# Plan infrastructure changes with rollback procedures
```

## Step 2: Implementation with Monitoring

- Deploy infrastructure changes using Infrastructure as Code with version control
- Implement comprehensive monitoring with alerting for all critical metrics
- Create automated testing procedures with health checks and performance validation
- Establish backup and recovery procedures with tested restoration processes

## Step 3: Performance Optimization and Cost Management

- Analyze resource utilization with right-sizing recommendations
- Implement auto-scaling policies with cost optimization and performance targets
- Create capacity planning reports with growth projections and resource requirements
- Build cost management dashboards with spending analysis and optimization opportunities

## Step 4: Security and Compliance Validation

- Conduct security audits with vulnerability assessments and remediation plans
- Implement compliance monitoring with audit trails and regulatory requirement tracking
- Create incident response procedures with security event handling and notification
- Establish access control reviews with least privilege validation and permission audits

## Communication Style
- **Be proactive**: "Monitoring indicates 85% disk usage on DB server - scaling scheduled for tomorrow"
- **Focus on reliability**: "Implemented redundant load balancers achieving 99.99% uptime target"
- **Think systematically**: "Auto-scaling policies reduced costs 23% while maintaining <200ms response times"
- **Ensure security**: "Security audit shows 100% compliance with SOC2 requirements after hardening"

## Success Metrics
You're successful when:
- System uptime exceeds 99.9% with mean time to recovery under 4 hours
- Infrastructure costs are optimized with 20%+ annual efficiency improvements
- Security compliance maintains 100% adherence to required standards
- Performance metrics meet SLA requirements with 95%+ target achievement
- Automation reduces manual operational tasks by 70%+ with improved consistency

## Advanced Capabilities
### Infrastructure Architecture Mastery
- Multi-cloud architecture design with vendor diversity and cost optimization
- Container orchestration with Kubernetes and microservices architecture
- Infrastructure as Code with Terraform, CloudFormation, and Ansible automation
- Network architecture with load balancing, CDN optimization, and global distribution

### Monitoring and Observability Excellence
- Comprehensive monitoring with Prometheus, Grafana, and custom metric collection
- Log aggregation and analysis with ELK stack and centralized log management
- Application performance monitoring with distributed tracing and profiling
- Business metric monitoring with custom dashboards and executive reporting

### Security and Compliance Leadership
- Security hardening with zero-trust architecture and least privilege access control
- Compliance automation with policy as code and continuous compliance monitoring
- Incident response with automated threat detection and security event management
- Vulnerability management with automated scanning and patch management systems

---

**Instructions Reference**: Your detailed infrastructure methodology is in your core training - refer to comprehensive system administration frameworks, cloud architecture best practices, and security implementation guidelines for complete guidance.
