Retrospective: 2 Years Using AWS Graviton4 Instances – 40% Cost Savings, Compatibility Issues

#!/usr/bin/env python3
"""
Graviton Compatibility Scanner v1.2
Scans Docker images for x86-only binaries, dynamic links, and known incompatible packages
before migration to AWS Graviton4 (ARM64) instances.
Requires: docker, requests, pyyaml
"""

import docker
import subprocess
import sys
import json
from typing import List, Dict, Optional

class GravitonCompatScanner:
    def __init__(self, image_tag: str):
        self.image_tag = image_tag
        self.client = docker.from_env()
        self.incompatible_findings: List[Dict] = []
        self.compat_score = 100  # Start with perfect score, deduct for issues

    def _run_docker_cmd(self, cmd: List[str]) -> Optional[str]:
        """Execute Docker CLI commands with error handling"""
        try:
            result = subprocess.run(
                cmd,
                capture_output=True,
                text=True,
                check=True
            )
            return result.stdout.strip()
        except subprocess.CalledProcessError as e:
            self.incompatible_findings.append({
                "type": "docker_error",
                "detail": f"Docker cmd failed: {e.stderr}",
                "severity": "critical"
            })
            self.compat_score -= 20
            return None

    def check_architecture(self) -> None:
        """Verify image is built for linux/arm64"""
        inspect_output = self._run_docker_cmd([
            "docker", "inspect", self.image_tag,
            "--format", "{{.Architecture}}"
        ])
        if inspect_output and inspect_output != "arm64":
            self.incompatible_findings.append({
                "type": "architecture_mismatch",
                "detail": f"Image built for {inspect_output}, requires arm64 for Graviton4",
                "severity": "critical"
            })
            self.compat_score -= 40

    def scan_dynamic_links(self) -> None:
        """Check for x86-only shared libraries in image layers"""
        # Extract image to temp dir and scan for ELF binaries
        container = self.client.containers.create(self.image_tag, command="sleep 3600")
        try:
            # Get list of all files in container
            exec_result = container.exec_run("find / -type f -executable 2>/dev/null")
            executables = exec_result.output.decode().split("\n")

            for exe in executables[:500]:  # Limit to 500 files to avoid timeout
                if not exe:
                    continue
                # Check ELF header for x86-64
                file_check = self._run_docker_cmd([
                    "docker", "exec", container.id, "file", exe
                ])
                if file_check and "x86-64" in file_check:
                    self.incompatible_findings.append({
                        "type": "x86_binary",
                        "detail": f"Executable {exe} is x86-64 only",
                        "severity": "high"
                    })
                    self.compat_score -= 5
        except Exception as e:
            self.incompatible_findings.append({
                "type": "scan_error",
                "detail": f"Failed to scan executables: {str(e)}",
                "severity": "medium"
            })
        finally:
            container.remove(force=True)

    def generate_report(self) -> None:
        """Print final compatibility report"""
        print(f"=== Graviton Compatibility Report for {self.image_tag} ===")
        print(f"Compatibility Score: {max(0, self.compat_score)}/100")
        print(f"Total Findings: {len(self.incompatible_findings)}")
        print("\nFindings:")
        for finding in self.incompatible_findings:
            print(f"[{finding['severity'].upper()}] {finding['type']}: {finding['detail']}")

        if self.compat_score < 70:
            print("\n❌ Image is NOT compatible with Graviton4. Fix findings before migration.")
            sys.exit(1)
        else:
            print("\n✅ Image is likely compatible with Graviton4.")
            sys.exit(0)

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("Usage: python3 scan_graviton_compat.py ")
        sys.exit(1)

    scanner = GravitonCompatScanner(sys.argv[1])
    scanner.check_architecture()
    scanner.scan_dynamic_links()
    scanner.generate_report()

#!/usr/bin/env java --source 17
/**
 * Graviton4 Java Performance Benchmark
 * Compares throughput and GC pause times for Java 17 on Graviton4 (ARM64) vs x86
 * Requires: AWS Corretto 17.0.9+, JMH 1.36
 */

import java.util.concurrent.TimeUnit;
import java.util.ArrayList;
import java.util.List;
import java.lang.management.GarbageCollectorMXBean;
import java.lang.management.ManagementFactory;
import java.io.FileWriter;
import java.io.IOException;

public class GravitonJavaBenchmark {
    private static final int WARMUP_ITERATIONS = 5;
    private static final int MEASUREMENT_ITERATIONS = 10;
    private static final int LIST_SIZE = 1_000_000;
    private static final String OUTPUT_CSV = "graviton_benchmark_results.csv";

    // Custom error handler for GC metric collection
    static class GcMetricException extends Exception {
        public GcMetricException(String message) { super(message); }
    }

    static class GcMetrics {
        long minorGcCount;
        long minorGcTimeMs;
        long majorGcCount;
        long majorGcTimeMs;

        void collect() throws GcMetricException {
            List gcBeans = ManagementFactory.getGarbageCollectorMXBeans();
            minorGcCount = 0;
            minorGcTimeMs = 0;
            majorGcCount = 0;
            majorGcTimeMs = 0;

            for (GarbageCollectorMXBean bean : gcBeans) {
                String name = bean.getName().toLowerCase();
                if (name.contains("g1") || name.contains("minor")) {
                    minorGcCount += bean.getCollectionCount();
                    minorGcTimeMs += bean.getCollectionTime();
                } else if (name.contains("full") || name.contains("major")) {
                    majorGcCount += bean.getCollectionCount();
                    majorGcTimeMs += bean.getCollectionTime();
                }
            }

            if (minorGcCount == 0 && majorGcCount == 0) {
                throw new GcMetricException("No GC metrics collected – check JVM GC configuration");
            }
        }
    }

    static double runThroughputBenchmark() {
        List results = new ArrayList<>();
        // Warmup phase
        for (int i = 0; i < WARMUP_ITERATIONS; i++) {
            List tempList = new ArrayList<>(LIST_SIZE);
            for (int j = 0; j < LIST_SIZE; j++) {
                tempList.add(j);
            }
            tempList.clear();
        }

        // Measurement phase
        long totalTimeNs = 0;
        for (int i = 0; i < MEASUREMENT_ITERATIONS; i++) {
            List tempList = new ArrayList<>(LIST_SIZE);
            long start = System.nanoTime();
            for (int j = 0; j < LIST_SIZE; j++) {
                tempList.add(j);
            }
            long end = System.nanoTime();
            totalTimeNs += (end - start);
            tempList.clear();
        }

        double avgTimeMs = TimeUnit.NANOSECONDS.toMillis(totalTimeNs) / (double) MEASUREMENT_ITERATIONS;
        return avgTimeMs;
    }

    public static void main(String[] args) {
        GcMetrics gcMetrics = new GcMetrics();
        try {
            gcMetrics.collect(); // Collect initial GC metrics
        } catch (GcMetricException e) {
            System.err.println("Failed to collect initial GC metrics: " + e.getMessage());
            System.exit(1);
        }

        double avgThroughputMs = runThroughputBenchmark();

        try {
            gcMetrics.collect(); // Collect post-benchmark GC metrics
        } catch (GcMetricException e) {
            System.err.println("Failed to collect post-benchmark GC metrics: " + e.getMessage());
        }

        // Write results to CSV
        try (FileWriter writer = new FileWriter(OUTPUT_CSV, true)) {
            String arch = System.getProperty("os.arch");
            String line = String.format("%s,%.2f,%d,%d,%d,%d%n",
                arch,
                avgThroughputMs,
                gcMetrics.minorGcCount,
                gcMetrics.minorGcTimeMs,
                gcMetrics.majorGcCount,
                gcMetrics.majorGcTimeMs
            );
            writer.write(line);
            System.out.println("Benchmark complete. Results written to " + OUTPUT_CSV);
            System.out.println("Architecture: " + arch);
            System.out.println("Avg Throughput (1M adds): " + avgThroughputMs + "ms");
            System.out.println("Minor GC Count: " + gcMetrics.minorGcCount);
            System.out.println("Minor GC Time: " + gcMetrics.minorGcTimeMs + "ms");
        } catch (IOException e) {
            System.err.println("Failed to write results: " + e.getMessage());
            System.exit(1);
        }
    }
}

# Graviton4 EC2 Deployment Module v2.1
# Deploys c7g (Graviton4) instances with cost allocation tags, CloudWatch monitoring
# Requires: Terraform 1.6+, AWS Provider 5.0+

terraform {
  required_version = ">= 1.6.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 5.0.0"
    }
  }
}

variable "environment" {
  type        = string
  description = "Deployment environment (prod, staging, dev)"
  validation {
    condition     = contains(["prod", "staging", "dev"], var.environment)
    error_message = "Environment must be prod, staging, or dev."
  }
}

variable "instance_count" {
  type        = number
  description = "Number of Graviton4 instances to deploy"
  default     = 2
  validation {
    condition     = var.instance_count > 0 && var.instance_count <= 10
    error_message = "Instance count must be between 1 and 10."
  }
}

variable "vpc_id" {
  type        = string
  description = "VPC ID to deploy instances into"
}

variable "subnet_ids" {
  type        = list(string)
  description = "List of subnet IDs for instance deployment"
}

data "aws_ami" "graviton4_ami" {
  most_recent = true
  owners      = ["amazon"]

  filter {
    name   = "name"
    values = ["al2023-ami-2023.07.20240701.0-kernel-6.1-arm64*"]
  }

  filter {
    name   = "architecture"
    values = ["arm64"]
  }

  filter {
    name   = "root-device-type"
    values = ["ebs"]
  }
}

resource "aws_instance" "graviton4_worker" {
  count                  = var.instance_count
  ami                    = data.aws_ami.graviton4_ami.id
  instance_type          = "c7g.4xlarge" # Graviton4 compute optimized
  subnet_id              = element(var.subnet_ids, count.index % length(var.subnet_ids))
  vpc_security_group_ids = [aws_security_group.worker_sg.id]
  key_name               = aws_key_pair.worker_key.key_name

  # Cost allocation tags (required for FinOps tracking)
  tags = {
    Name                = "graviton4-worker-${var.environment}-${count.index + 1}"
    Environment         = var.environment
    CostCenter          = "cloud-compute"
    GravitonGeneration  = "4"
    ManagedBy           = "terraform"
  }

  # User data to install CloudWatch agent for cost/performance monitoring
  user_data = <<-EOF
    #!/bin/bash
    yum update -y
    yum install -y amazon-cloudwatch-agent
    cat > /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json <<-CONFIG
    {
      "metrics": {
        "metrics_collected": {
          "cpu": { "measurement": ["cpu_usage_idle", "cpu_usage_user"] },
          "mem": { "measurement": ["mem_used_percent"] },
          "disk": { "measurement": ["disk_used_percent"], "resources": ["/"] }
        },
        "append_dimensions": {
          "InstanceId": "${aws:InstanceId}",
          "Environment": "${var.environment}"
        }
      }
    }
    CONFIG
    systemctl start amazon-cloudwatch-agent
  EOF

  lifecycle {
    create_before_destroy = true
    prevent_destroy       = false
  }
}

resource "aws_security_group" "worker_sg" {
  name        = "graviton4-worker-sg-${var.environment}"
  vpc_id      = var.vpc_id
  description = "Allow inbound traffic for Graviton4 workers"

  ingress {
    from_port   = 8080
    to_port     = 8080
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/16"] # Internal VPC only
    description = "Allow app traffic from internal VPC"
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
    description = "Allow all outbound traffic"
  }
}

resource "aws_key_pair" "worker_key" {
  key_name   = "graviton4-worker-key-${var.environment}"
  public_key = file("~/.ssh/graviton_worker.pub") # Error handling: ensure key exists
}

output "instance_ids" {
  description = "IDs of deployed Graviton4 instances"
  value       = aws_instance.graviton4_worker[*].id
}

output "instance_public_ips" {
  description = "Public IPs of deployed Graviton4 instances"
  value       = aws_instance.graviton4_worker[*].public_ip
}

# Build for ARM64 explicitly, even on x86 CI runners
FROM --platform=linux/arm64 eclipse-temurin:17-jre AS builder
WORKDIR /app
COPY . .
RUN ./gradlew build

FROM --platform=linux/arm64 eclipse-temurin:17-jre
COPY --from=builder /app/build/libs/*.jar app.jar
ENTRYPOINT ["java", "-jar", "app.jar"]

# Optimal JVM flags for Graviton4 (Java 17+)
JAVA_OPTS="-XX:+UseG1GC \
  -XX:MaxGCPauseMillis=200 \
  -XX:G1HeapRegionSize=4M \
  -XX:+UseStringDeduplication \
  -XX:+FlightRecorder \
  -XX:FlightRecorderOptions=disk=true,maxage=1d,maxsize=1g \
  -Djava.awt.headless=true"

# AWS CLI command to get Graviton4 monthly spend (us-east-1)
aws ce get-cost-and-usage \
  --time-period Start=2023-01-01,End=2023-12-31 \
  --granularity MONTHLY \
  --metrics BlendedCost \
  --group-by Type=TAG,Key=GravitonGeneration \
  --filter '{"Tags": {"Key": "GravitonGeneration", "Values": ["4"]}}'