How to Cut AWS Bill by 42% with Graviton4 and Spot Instances: Step-by-Step Guide

package main

import (
    "context"
    "crypto/rand"
    "encoding/json"
    "fmt"
    "log"
    "net/http"
    _ "net/http/pprof"
    "os"
    "os/signal"
    "runtime"
    "syscall"
    "time"
)

// BenchmarkConfig holds parameters for the workload benchmark
type BenchmarkConfig struct {
    Duration    time.Duration
    Concurrency int
    PayloadSize int // bytes
}

// BenchmarkResult stores benchmark metrics
type BenchmarkResult struct {
    Architecture string  `json:"architecture"`
    InstanceType string  `json:"instance_type"`
    AvgLatencyMs float64 `json:"avg_latency_ms"`
    P99LatencyMs float64 `json:"p99_latency_ms"`
    Throughput   int     `json:"throughput_req_per_sec"`
    CostPerHour  float64 `json:"cost_per_hour_usd"`
    PricePerf    float64 `json:"price_perf_ratio"` // throughput per $/hour
}

func main() {
    // Parse config from env vars with defaults
    duration := 5 * time.Minute
    if d := os.Getenv("BENCH_DURATION"); d != "" {
        if parsed, err := time.ParseDuration(d); err == nil {
            duration = parsed
        } else {
            log.Printf("invalid BENCH_DURATION %q, using default 5m: %v", d, err)
        }
    }
    concurrency := 100
    if c := os.Getenv("BENCH_CONCURRENCY"); c != "" {
        if parsed, err := fmt.Sscanf(c, "%d", &concurrency); err != nil || parsed != 1 {
            log.Printf("invalid BENCH_CONCURRENCY %q, using default 100: %v", c, err)
        }
    }
    payloadSize := 1024 // 1KB
    if p := os.Getenv("BENCH_PAYLOAD_SIZE"); p != "" {
        if parsed, err := fmt.Sscanf(p, "%d", &payloadSize); err != nil || parsed != 1 {
            log.Printf("invalid BENCH_PAYLOAD_SIZE %q, using default 1024: %v", p, err)
        }
    }

    cfg := BenchmarkConfig{
        Duration:    duration,
        Concurrency: concurrency,
        PayloadSize: payloadSize,
    }

    // Detect architecture and instance type (for AWS, read from IMDSv2)
    arch := runtime.GOARCH
    instanceType := "unknown"
    if metadata, err := getAWSInstanceType(); err == nil {
        instanceType = metadata
    } else {
        log.Printf("failed to fetch AWS instance type: %v", err)
    }

    // Run benchmark
    log.Printf("starting benchmark: arch=%s, instance=%s, duration=%s, concurrency=%d", arch, instanceType, cfg.Duration, cfg.Concurrency)
    result := runBenchmark(cfg, arch, instanceType)

    // Output results as JSON
    output, err := json.MarshalIndent(result, "", "  ")
    if err != nil {
        log.Fatalf("failed to marshal benchmark result: %v", err)
    }
    fmt.Println(string(output))

    // Keep process alive for pprof if needed
    sigChan := make(chan os.Signal, 1)
    signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)
    <-sigChan
}

// getAWSInstanceType fetches the instance type from AWS IMDSv2
func getAWSInstanceType() (string, error) {
    // Get IMDSv2 token
    client := &http.Client{Timeout: 2 * time.Second}
    tokenReq, err := http.NewRequest("PUT", "http://169.254.169.254/latest/api/token", nil)
    if err != nil {
        return "", fmt.Errorf("failed to create token request: %w", err)
    }
    tokenReq.Header.Set("X-aws-ec2-metadata-token-ttl-seconds", "21600")
    tokenResp, err := client.Do(tokenReq)
    if err != nil {
        return "", fmt.Errorf("failed to get IMDSv2 token: %w", err)
    }
    defer tokenResp.Body.Close()
    token := tokenResp.Header.Get("X-aws-ec2-metadata-token")
    if token == "" {
        return "", fmt.Errorf("no IMDSv2 token in response")
    }

    // Fetch instance type
    instanceReq, err := http.NewRequest("GET", "http://169.254.169.254/latest/meta-data/instance-type", nil)
    if err != nil {
        return "", fmt.Errorf("failed to create instance type request: %w", err)
    }
    instanceReq.Header.Set("X-aws-ec2-metadata-token", token)
    instanceResp, err := client.Do(instanceReq)
    if err != nil {
        return "", fmt.Errorf("failed to get instance type: %w", err)
    }
    defer instanceResp.Body.Close()

    var instanceType string
    if err := json.NewDecoder(instanceResp.Body).Decode(&instanceType); err != nil {
        // Fallback to reading raw body if JSON decode fails
        buf := make([]byte, 1024)
        n, _ := instanceResp.Body.Read(buf)
        instanceType = string(buf[:n])
    }
    return instanceType, nil
}

// runBenchmark executes the workload test and returns results
func runBenchmark(cfg BenchmarkConfig, arch string, instanceType string) BenchmarkResult {
    // TODO: implement actual benchmark logic (HTTP load test, CPU workload, etc.)
    // This is a simplified example that simulates latency and throughput
    start := time.Now()
    var totalLatency time.Duration
    latencies := make([]time.Duration, 0, cfg.Concurrency*int(cfg.Duration.Seconds()))

    for i := 0; i < cfg.Concurrency; i++ {
        go func() {
            for time.Since(start) < cfg.Duration {
                reqStart := time.Now()
                // Simulate workload: generate random payload, do CPU work
                payload := make([]byte, cfg.PayloadSize)
                rand.Read(payload)
                // Simulate 10ms of CPU work
                time.Sleep(10 * time.Millisecond)
                latency := time.Since(reqStart)
                latencies = append(latencies, latency)
                totalLatency += latency
            }
        }()
    }

    time.Sleep(cfg.Duration)
    // Calculate metrics
    avgLatency := totalLatency / time.Duration(len(latencies))
    // TODO: calculate P99 properly
    p99Latency := avgLatency * 2 // simplified
    throughput := len(latencies) / int(cfg.Duration.Seconds())
    // Cost per hour: example values, replace with actual AWS pricing
    costPerHour := 0.384 // m6i.2xlarge on-demand
    if arch == "arm64" {
        costPerHour = 0.268 // m7g.2xlarge on-demand
    }
    pricePerf := float64(throughput) / costPerHour

    return BenchmarkResult{
        Architecture: arch,
        InstanceType: instanceType,
        AvgLatencyMs: avgLatency.Seconds() * 1000,
        P99LatencyMs: p99Latency.Seconds() * 1000,
        Throughput:   throughput,
        CostPerHour:  costPerHour,
        PricePerf:    pricePerf,
    }
}

# terraform version >= 1.7.0 required for Graviton4 instance type support
terraform {
  required_version = ">= 1.7.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# Configure AWS provider with default region
provider "aws" {
  region = var.aws_region
}

# Variables
variable "aws_region" {
  type        = string
  description = "AWS region to deploy resources"
  default     = "us-east-1"
  validation {
    condition     = contains(["us-east-1", "us-west-2", "eu-west-1"], var.aws_region)
    error_message = "Supported regions: us-east-1, us-west-2, eu-west-1."
  }
}

variable "cluster_name" {
  type        = string
  description = "Name of the ECS cluster"
  default     = "graviton4-spot-cluster"
}

variable "vpc_cidr" {
  type        = string
  description = "CIDR block for the VPC"
  default     = "10.0.0.0/16"
}

variable "app_port" {
  type        = number
  description = "Port the containerized app listens on"
  default     = 8080
}

# Fetch latest Graviton4-optimized Amazon Linux 2023 ECS AMI
data "aws_ami" "ecs_optimized_arm64" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["amzn2-ami-ecs-hvm-*-arm64-gp2"]
  }

  filter {
    name   = "virtualization-type"
    values = ["hvm"]
  }
}

# VPC configuration
resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name = "${var.cluster_name}-vpc"
  }
}

resource "aws_subnet" "public" {
  count                   = 2
  vpc_id                  = aws_vpc.main.id
  cidr_block              = cidrsubnet(var.vpc_cidr, 8, count.index)
  availability_zone       = "${var.aws_region}${element(["a", "b"], count.index)}"
  map_public_ip_on_launch = true

  tags = {
    Name = "${var.cluster_name}-public-subnet-${count.index}"
  }
}

resource "aws_internet_gateway" "main" {
  vpc_id = aws_vpc.main.id

  tags = {
    Name = "${var.cluster_name}-igw"
  }
}

resource "aws_route_table" "public" {
  vpc_id = aws_vpc.main.id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = aws_internet_gateway.main.id
  }

  tags = {
    Name = "${var.cluster_name}-public-rt"
  }
}

resource "aws_route_table_association" "public" {
  count          = 2
  subnet_id      = aws_subnet.public[count.index].id
  route_table_id = aws_route_table.public.id
}

# ECS Cluster
resource "aws_ecs_cluster" "main" {
  name = var.cluster_name

  setting {
    name  = "containerInsights"
    value = "enabled"
  }

  tags = {
    Name = var.cluster_name
  }
}

# IAM role for ECS task execution
resource "aws_iam_role" "ecs_task_execution" {
  name = "${var.cluster_name}-task-execution-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "ecs-tasks.amazonaws.com"
        }
      }
    ]
  })

  tags = {
    Name = "${var.cluster_name}-task-execution-role"
  }
}

resource "aws_iam_role_policy_attachment" "ecs_task_execution" {
  role       = aws_iam_role.ecs_task_execution.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
}

# Security group for ECS tasks
resource "aws_security_group" "ecs_tasks" {
  name        = "${var.cluster_name}-ecs-tasks-sg"
  description = "Allow inbound traffic to ECS tasks"
  vpc_id      = aws_vpc.main.id

  ingress {
    from_port   = var.app_port
    to_port     = var.app_port
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"] # Restrict this in production!
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "${var.cluster_name}-ecs-tasks-sg"
  }
}

# ECS Task Definition for Graviton4
resource "aws_ecs_task_definition" "app" {
  family                   = "${var.cluster_name}-app"
  network_mode             = "awsvpc"
  requires_compatibilities = ["FARGATE"]
  cpu                      = "1024" # 1 vCPU
  memory                   = "2048" # 2GB
  execution_role_arn       = aws_iam_role.ecs_task_execution.arn

  container_definitions = jsonencode([
    {
      name      = "app"
      image     = "public.ecr.aws/docker/library/nginx:1.25-alpine-arm64v8" # ARM64-optimized image
      portMappings = [
        {
          containerPort = var.app_port
          hostPort      = var.app_port
        }
      ]
      logConfiguration = {
        logDriver = "awslogs"
        options = {
          "awslogs-group"         = "/ecs/${var.cluster_name}-app"
          "awslogs-region"        = var.aws_region
          "awslogs-stream-prefix" = "ecs"
        }
      }
    }
  ])

  tags = {
    Name = "${var.cluster_name}-app-task"
  }
}

# Outputs
output "ecs_cluster_name" {
  value = aws_ecs_cluster.main.name
}

output "ecs_cluster_arn" {
  value = aws_ecs_cluster.main.arn
}

output "task_definition_arn" {
  value = aws_ecs_task_definition.app.arn
}

package main

import (
    "context"
    "fmt"
    "log"
    "os"
    "time"

    "github.com/aws/aws-sdk-go-v2/aws"
    "github.com/aws/aws-sdk-go-v2/config"
    "github.com/aws/aws-sdk-go-v2/service/ec2"
    "github.com/aws/aws-sdk-go-v2/service/ec2/types"
    "github.com/aws/aws-sdk-go-v2/service/ecs"
)

// SpotFleetConfig holds configuration for the Spot Fleet request
type SpotFleetConfig struct {
    Region             string
    ClusterName        string
    TaskDefinitionARN  string
    SubnetIDs          []string
    SecurityGroupIDs   []string
    IAMRoleARN         string
    InstanceTypes      []string // Graviton4 instance types
    TargetCapacity     int
    SpotPrice          string // Max Spot price, empty for on-demand fallback
}

func main() {
    // Load config from env vars
    cfg := SpotFleetConfig{
        Region:            getEnv("AWS_REGION", "us-east-1"),
        ClusterName:       getEnv("ECS_CLUSTER_NAME", "graviton4-spot-cluster"),
        TaskDefinitionARN: getEnv("TASK_DEFINITION_ARN", ""),
        SubnetIDs:         []string{getEnv("SUBNET_ID_1", ""), getEnv("SUBNET_ID_2", "")},
        SecurityGroupIDs:  []string{getEnv("SECURITY_GROUP_ID", "")},
        IAMRoleARN:        getEnv("IAM_ROLE_ARN", ""),
        InstanceTypes:     []string{"m7g.medium", "m7g.large", "m7g.xlarge", "m7g.2xlarge"}, // Graviton4 instance types
        TargetCapacity:    4,
        SpotPrice:         getEnv("SPOT_PRICE", "0.30"), // Max $0.30 per hour for m7g.2xlarge
    }

    // Validate required config
    if cfg.TaskDefinitionARN == "" {
        log.Fatal("TASK_DEFINITION_ARN environment variable is required")
    }
    if len(cfg.SubnetIDs) < 2 {
        log.Fatal("At least 2 SUBNET_IDs are required")
    }
    if cfg.IAMRoleARN == "" {
        log.Fatal("IAM_ROLE_ARN environment variable is required")
    }

    // Load AWS config
    awsCfg, err := config.LoadDefaultConfig(context.TODO(), config.WithRegion(cfg.Region))
    if err != nil {
        log.Fatalf("failed to load AWS config: %v", err)
    }

    // Create EC2 and ECS clients
    ec2Client := ec2.NewFromConfig(awsCfg)
    ecsClient := ecs.NewFromConfig(awsCfg)

    // Create Spot Fleet request
    fleetID, err := createSpotFleet(ec2Client, ecsClient, cfg)
    if err != nil {
        log.Fatalf("failed to create Spot Fleet: %v", err)
    }
    fmt.Printf("Successfully created Spot Fleet: %s\n", fleetID)

    // Monitor fleet status for 5 minutes
    monitorFleet(ec2Client, fleetID)
}

// getEnv returns environment variable value or default
func getEnv(key string, defaultVal string) string {
    if val := os.Getenv(key); val != "" {
        return val
    }
    return defaultVal
}

// createSpotFleet creates a capacity-optimized Spot Fleet with fallback to on-demand
func createSpotFleet(ec2Client *ec2.Client, ecsClient *ecs.Client, cfg SpotFleetConfig) (string, error) {
    // Define Spot Fleet launch specifications for Graviton4 instances
    launchSpecs := make([]types.SpotFleetLaunchSpecification, 0, len(cfg.InstanceTypes))
    for _, instanceType := range cfg.InstanceTypes {
        launchSpecs = append(launchSpecs, types.SpotFleetLaunchSpecification{
            InstanceType: aws.String(instanceType),
            ImageId:      aws.String(getGravitonAMI(cfg.Region)), // Fetch latest Graviton4 ECS AMI
            SubnetId:     aws.String(cfg.SubnetIDs[0]), // Will use multiple subnets via fleet config
            SecurityGroups: []types.GroupIdentifier{
                {GroupId: aws.String(cfg.SecurityGroupIDs[0])},
            },
            IamInstanceProfile: &types.IamInstanceProfileSpecification{
                Arn: aws.String(cfg.IAMRoleARN),
            },
            UserData: aws.String(getUserData(cfg.ClusterName)), // ECS agent user data
        })
    }

    // Create Spot Fleet request
    input := &ec2.CreateSpotFleetInput{
        SpotFleetRequestConfig: &types.SpotFleetRequestConfigData{
            IamFleetRole: aws.String(cfg.IAMRoleARN), // IAM role for Spot Fleet to assume
            TargetCapacity: aws.Int32(int32(cfg.TargetCapacity)),
            SpotPrice:     aws.String(cfg.SpotPrice),
            AllocationStrategy: types.AllocationStrategyCapacityOptimized, // Minimize interruptions
            InstanceInterruptionBehavior: types.InstanceInterruptionBehaviorTerminate,
            ReplaceUnhealthyInstances: aws.Bool(true),
            LaunchSpecifications: launchSpecs,
            // Fallback to on-demand if Spot capacity is unavailable
            OnDemandTargetCapacity: aws.Int32(0),
            // Use multiple AZs for capacity
            AvailabilityZones: []string{fmt.Sprintf("%sa", cfg.Region), fmt.Sprintf("%sb", cfg.Region)},
        },
    }

    result, err := ec2Client.CreateSpotFleet(context.TODO(), input)
    if err != nil {
        return "", fmt.Errorf("failed to create Spot Fleet: %w", err)
    }

    return *result.SpotFleetRequestId, nil
}

// getGravitonAMI returns the latest Graviton4 ECS-optimized AMI for the region
func getGravitonAMI(region string) string {
    // In production, fetch this dynamically via DescribeImages API
    // Hardcoded for example (amzn2-ami-ecs-hvm-2.0.20240528-arm64-gp2 in us-east-1)
    amis := map[string]string{
        "us-east-1":      "ami-0a1234567890abcdef",
        "us-west-2":      "ami-0123456789abcdef0",
        "eu-west-1":      "ami-0fedcba9876543210",
    }
    if ami, ok := amis[region]; ok {
        return ami
    }
    return "ami-0a1234567890abcdef" // fallback
}

// getUserData returns the ECS agent user data to join the cluster
func getUserData(clusterName string) string {
    return fmt.Sprintf(`#!/bin/bash
echo ECS_CLUSTER=%s >> /etc/ecs/ecs.config
start ecs
`, clusterName)
}

// monitorFleet prints Spot Fleet status every 30 seconds for 5 minutes
func monitorFleet(ec2Client *ec2.Client, fleetID string) {
    ctx := context.TODO()
    ticker := time.NewTicker(30 * time.Second)
    defer ticker.Stop()
    timeout := time.After(5 * time.Minute)

    for {
        select {
        case <-ticker.C:
            input := &ec2.DescribeSpotFleetRequestsInput{
                SpotFleetRequestIds: []string{fleetID},
            }
            result, err := ec2Client.DescribeSpotFleetRequests(ctx, input)
            if err != nil {
                log.Printf("failed to describe Spot Fleet: %v", err)
                continue
            }
            if len(result.SpotFleetRequestConfigs) == 0 {
                log.Println("Spot Fleet not found")
                return
            }
            fleet := result.SpotFleetRequestConfigs[0]
            fmt.Printf("Fleet %s status: %s, target capacity: %d, fulfilled: %d\n",
                fleetID,
                *fleet.SpotFleetRequestState,
                *fleet.TargetCapacity,
                getFulfilledCapacity(fleet),
            )
        case <-timeout:
            fmt.Println("Stopped monitoring after 5 minutes")
            return
        }
    }
}

// getFulfilledCapacity returns the number of fulfilled instances in the fleet
func getFulfilledCapacity(fleet types.SpotFleetRequestConfig) int32 {
    if fleet.FulfilledCapacity != nil {
        return int32(*fleet.FulfilledCapacity)
    }
    return 0
}