War Story: We Migrated a Minecraft Server to AWS Graviton4 and Cut Hosting Costs by 40%

// Minecraft Graviton4 Infrastructure Stack - AWS CDK v2.158.0
import * as cdk from 'aws-cdk-lib';
import * as ec2 from 'aws-cdk-lib/aws-ec2';
import * as iam from 'aws-cdk-lib/aws-iam';
import * as logs from 'aws-cdk-lib/aws-logs';
import { Construct } from 'constructs';

export class MinecraftGravitonStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    // 1. Validate target instance type is Graviton4 (ARM64) compatible
    const targetInstanceType = 'c8g.2xlarge'; // Graviton4, 8 vCPU, 16GB RAM
    const arm64InstanceFamilies = ['c8g', 'm8g', 'r8g', 'x8g'];
    const instanceFamily = targetInstanceType.split('.')[0];
    if (!arm64InstanceFamilies.includes(instanceFamily)) {
      throw new Error(`Instance type ${targetInstanceType} is not Graviton4 ARM64 compatible. Use one of: ${arm64InstanceFamilies.join(', ')}`);
    }

    // 2. Create VPC with public subnet for Minecraft (port 25565)
    const vpc = new ec2.Vpc(this, 'MinecraftVpc', {
      maxAzs: 2,
      subnetConfiguration: [
        {
          name: 'Public',
          subnetType: ec2.SubnetType.PUBLIC,
          cidrMask: 24,
        },
      ],
    });

    // 3. Security group allowing Minecraft port (25565) and SSH (22) from known IPs
    const minecraftSg = new ec2.SecurityGroup(this, 'MinecraftSecurityGroup', {
      vpc,
      description: 'Allow Minecraft and SSH access',
      allowAllOutbound: true,
    });
    // Restrict SSH to office IP range (replace with your own CIDR)
    minecraftSg.addIngressRule(ec2.Peer.ipv4('203.0.113.0/24'), ec2.Port.tcp(22), 'SSH from office');
    // Allow Minecraft port from anywhere (adjust for whitelist if needed)
    minecraftSg.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(25565), 'Minecraft server port');

    // 4. IAM role for S3 access to backup buckets
    const minecraftRole = new iam.Role(this, 'MinecraftInstanceRole', {
      assumedBy: new iam.ServicePrincipal('ec2.amazonaws.com'),
      managedPolicies: [
        iam.ManagedPolicy.fromAwsManagedPolicyName('AmazonS3ReadOnlyAccess'), // Restrict to specific bucket in prod
      ],
    });

    // 5. Graviton4-optimized Amazon Machine Image (ARM64 Ubuntu 24.04 LTS)
    const gravitonAmi = ec2.MachineImage.fromSsmParameter(
      '/aws/service/canonical/ubuntu/server/24.04/stable/current/arm64/hvm/ebs-gp3/ami-id',
      { os: ec2.OperatingSystemType.LINUX, architecture: ec2.Architecture.ARM_64 }
    );

    // 6. EBS volume for Minecraft world data (separate from root for snapshots)
    const worldVolume = new ec2.Volume(this, 'MinecraftWorldVolume', {
      availabilityZone: vpc.availableZones[0],
      size: cdk.Size.gibibytes(100),
      volumeType: ec2.EbsDeviceVolumeType.GP3,
      iops: 3000,
      throughput: 125,
      encrypted: true,
    });

    // 7. EC2 instance definition
    const minecraftInstance = new ec2.Instance(this, 'MinecraftGravitonInstance', {
      vpc,
      instanceType: new ec2.InstanceType(targetInstanceType),
      machineImage: gravitonAmi,
      securityGroup: minecraftSg,
      role: minecraftRole,
      vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC },
      userData: ec2.UserData.forLinux(),
    });

    // 8. Attach world volume to instance
    minecraftInstance.userData.addCommands(
      '#!/bin/bash',
      'set -euxo pipefail',
      'apt-get update && apt-get install -y openjdk-21-jdk-headless wget unzip',
      // Mount world volume to /mnt/minecraft-world
      'mkdir -p /mnt/minecraft-world',
      'volume_id=$(lsblk -o NAME,SERIAL | grep "vol" | awk "{print \\$1}")',
      'mkfs.ext4 /dev/$volume_id',
      'mount /dev/$volume_id /mnt/minecraft-world',
      'echo "/dev/$volume_id /mnt/minecraft-world ext4 defaults 0 2" >> /etc/fstab',
      // Download PaperMC 1.21.4 for Minecraft 1.21.4
      'wget -O /mnt/minecraft-world/paper.jar https://api.papermc.io/v2/projects/paper/versions/1.21.4/builds/204/downloads/paper-1.21.4-204.jar',
      'echo "eula=true" > /mnt/minecraft-world/eula.txt',
      // Create systemd service for Minecraft
      'cat > /etc/systemd/system/minecraft.service << EOF
[Unit]
Description=PaperMC Minecraft Server
After=network.target

[Service]
User=root
WorkingDirectory=/mnt/minecraft-world
ExecStart=/usr/lib/jvm/java-21-openjdk-arm64/bin/java -Xmx12G -Xms12G -jar paper.jar nogui
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF',
      'systemctl daemon-reload && systemctl enable minecraft && systemctl start minecraft'
    );

    // 9. CloudWatch log group for Minecraft logs
    new logs.LogGroup(this, 'MinecraftLogGroup', {
      logGroupName: '/minecraft/server',
      retention: logs.RetentionDays.ONE_MONTH,
      removalPolicy: cdk.RemovalPolicy.DESTROY,
    });

    // 10. Output instance public IP
    new cdk.CfnOutput(this, 'MinecraftPublicIp', {
      value: minecraftInstance.instancePublicIp,
      description: 'Public IP of the Minecraft Graviton4 instance',
    });
  }
}

# Minecraft Tick Time Monitor - Python 3.12, runs on Graviton4 instance
# Sends tick time metrics to AWS CloudWatch, triggers alert if p99 > 1.2s
import re
import time
import boto3
import logging
from datetime import datetime
from typing import List, Dict, Optional

# Configure logging
logging.basicConfig(
    level=logging.INFO,
    format='%(asctime)s - %(levelname)s - %(message)s',
    handlers=[logging.FileHandler('/var/log/minecraft-monitor.log'), logging.StreamHandler()]
)
logger = logging.getLogger(__name__)

# Constants
MINECRAFT_LOG_PATH = '/mnt/minecraft-world/logs/latest.log'
CLOUDWATCH_NAMESPACE = 'Minecraft/Server'
TICK_THRESHOLD_MS = 1200  # Alert if tick time exceeds 1200ms (1.2s)
SEND_INTERVAL_SECONDS = 60  # Send metrics every 60 seconds

class TickMonitor:
    def __init__(self, log_path: str, cloudwatch_namespace: str):
        self.log_path = log_path
        self.cloudwatch = boto3.client('cloudwatch', region_name='us-east-1')
        self.tick_times: List[int] = []
        self.last_position = 0
        # Regex to parse PaperMC tick time logs
        self.tick_regex = re.compile(r'Tick took (\d+)ms')
        self.overload_regex = re.compile(r'Running (\d+)ms behind')

    def read_new_log_lines(self) -> List[str]:
        """Read new lines from Minecraft log file since last check, handle file rotation."""
        try:
            with open(self.log_path, 'r') as f:
                f.seek(self.last_position)
                lines = f.readlines()
                self.last_position = f.tell()
            return lines
        except FileNotFoundError:
            logger.error(f"Log file {self.log_path} not found. Waiting for file creation...")
            time.sleep(10)
            return []
        except Exception as e:
            logger.error(f"Error reading log file: {e}")
            return []

    def parse_tick_times(self, lines: List[str]) -> None:
        """Extract tick times from log lines, append to tick_times list."""
        for line in lines:
            tick_match = self.tick_regex.search(line)
            if tick_match:
                tick_time = int(tick_match.group(1))
                self.tick_times.append(tick_time)
                continue
            overload_match = self.overload_regex.search(line)
            if overload_match:
                tick_time = int(overload_match.group(1))
                self.tick_times.append(tick_time)
                logger.warning(f"Server overload detected: Tick took {tick_time}ms")

    def calculate_metrics(self) -> Dict[str, float]:
        """Calculate p50, p95, p99 tick times from collected samples."""
        if not self.tick_times:
            return {}
        sorted_ticks = sorted(self.tick_times)
        count = len(sorted_ticks)
        p50 = sorted_ticks[int(count * 0.5)]
        p95 = sorted_ticks[int(count * 0.95)]
        p99 = sorted_ticks[int(count * 0.99)]
        avg = sum(sorted_ticks) / count
        return {
            'p50_tick_ms': p50,
            'p95_tick_ms': p95,
            'p99_tick_ms': p99,
            'avg_tick_ms': avg,
            'sample_count': count
        }

    def send_to_cloudwatch(self, metrics: Dict[str, float]) -> None:
        """Send calculated metrics to AWS CloudWatch."""
        if not metrics:
            return
        metric_data = []
        for key, value in metrics.items():
            metric_data.append({
                'MetricName': key,
                'Value': value,
                'Unit': 'Milliseconds' if 'tick' in key else 'Count',
                'Timestamp': datetime.utcnow()
            })
        try:
            self.cloudwatch.put_metric_data(
                Namespace=self.CLOUDWATCH_NAMESPACE,
                MetricData=metric_data
            )
            logger.info(f"Sent {len(metric_data)} metrics to CloudWatch: {metrics}")
        except Exception as e:
            logger.error(f"Failed to send metrics to CloudWatch: {e}")

    def check_alerts(self, metrics: Dict[str, float]) -> None:
        """Trigger alert if p99 tick time exceeds threshold."""
        p99 = metrics.get('p99_tick_ms', 0)
        if p99 > TICK_THRESHOLD_MS:
            logger.error(f"ALERT: p99 tick time {p99}ms exceeds threshold {TICK_THRESHOLD_MS}ms")

    def run(self) -> None:
        """Main loop: read logs, parse ticks, calculate metrics, send to CloudWatch."""
        logger.info("Starting Minecraft Tick Monitor...")
        while True:
            try:
                lines = self.read_new_log_lines()
                if lines:
                    self.parse_tick_times(lines)
                if len(self.tick_times) >= 10:
                    metrics = self.calculate_metrics()
                    self.send_to_cloudwatch(metrics)
                    self.check_alerts(metrics)
                    self.tick_times = []
                time.sleep(SEND_INTERVAL_SECONDS)
            except KeyboardInterrupt:
                logger.info("Monitor stopped by user")
                break
            except Exception as e:
                logger.error(f"Unexpected error in main loop: {e}")
                time.sleep(10)

if __name__ == '__main__':
    monitor = TickMonitor(MINECRAFT_LOG_PATH, CLOUDWATCH_NAMESPACE)
    monitor.run()

# Terraform v1.9.0 - Minecraft World Backup S3 Configuration
# Validates Graviton instance role can write backups to S3

terraform {
  required_version = ">= 1.9.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.50"
    }
  }
}

variable "aws_region" {
  type        = string
  description = "AWS region to deploy resources"
  default     = "us-east-1"
}

variable "minecraft_instance_role_name" {
  type        = string
  description = "Name of the IAM role attached to the Graviton4 Minecraft instance"
}

variable "s3_bucket_name" {
  type        = string
  description = "Unique name for the Minecraft world backup S3 bucket"
  validation {
    condition     = can(regex("^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$", var.s3_bucket_name))
    error_message = "S3 bucket name must be 3-63 characters, lowercase, no underscores."
  }
}

provider "aws" {
  region = var.aws_region
}

resource "aws_s3_bucket" "minecraft_backups" {
  bucket = var.s3_bucket_name
  force_destroy = false

  tags = {
    Name        = "Minecraft-World-Backups"
    Environment = "Production"
    Project     = "Minecraft-Graviton4-Migration"
  }
}

resource "aws_s3_bucket_versioning" "backups_versioning" {
  bucket = aws_s3_bucket.minecraft_backups.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "backups_encryption" {
  bucket = aws_s3_bucket.minecraft_backups.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

resource "aws_s3_bucket_lifecycle_configuration" "backups_lifecycle" {
  bucket = aws_s3_bucket.minecraft_backups.id

  rule {
    id     = "transition-to-glacier"
    status = "Enabled"

    transition {
      days          = 30
      storage_class = "GLACIER"
    }

    expiration {
      days = 365
    }
  }
}

resource "aws_iam_policy" "minecraft_backup_policy" {
  name        = "MinecraftS3BackupPolicy"
  description = "Allows Graviton4 Minecraft instance to write backups to S3"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "AllowListBucket"
        Effect = "Allow"
        Action = ["s3:ListBucket"]
        Resource = [aws_s3_bucket.minecraft_backups.arn]
      },
      {
        Sid    = "AllowPutObject"
        Effect = "Allow"
        Action = ["s3:PutObject", "s3:PutObjectAcl"]
        Resource = ["${aws_s3_bucket.minecraft_backups.arn}/backups/*"]
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "backup_policy_attach" {
  role       = var.minecraft_instance_role_name
  policy_arn = aws_iam_policy.minecraft_backup_policy.arn
}

resource "aws_s3_object" "backup_script" {
  bucket = aws_s3_bucket.minecraft_backups.id
  key    = "scripts/backup-world.sh"
  content = <

# Check JAR file for native libraries
jar -tf /mnt/minecraft-world/plugins/terrain-gen.jar | grep -E '\.(so|dll|dylib)'
# If output is non-empty, recompile for ARM64

/usr/lib/jvm/java-21-openjdk-arm64/bin/java \
  -Xmx12G -Xms12G \
  -XX:+UseG1GC -XX:MaxGCPauseMillis=200 \
  -XX:+UseStringDeduplication \
  -XX:ParallelGCThreads=8 -XX:ConcGCThreads=2 \
  -jar paper.jar nogui

# Update canary weight to 20% for Graviton4 instance
aws route53 change-resource-record-sets --hosted-zone-id Z1234567890 --change-batch '{
  "Changes": [{
    "Action": "UPSERT",
    "ResourceRecordSet": {
      "Name": "minecraft.example.com",
      "Type": "A",
      "SetIdentifier": "graviton4-canary",
      "Weight": 20,
      "TTL": 60,
      "ResourceRecords": [{"Value": "1.2.3.4"}]
    }
  }]
}'