aws-skills

```hcl
# Terraform configuration for a serverless API backend with DynamoDB and Lambda
# Deployed in us-west-2 with cost optimization enabled

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"

  name = "api-backend-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["us-west-2a", "us-west-2b"]
  private_subnets = ["10.0.1.0/24", "10.0.2.0/24"]
  public_subnets  = ["10.0.101.0/24", "10.0.102.0/24"]

  enable_nat_gateway = true
  single_nat_gateway = true
  enable_dns_hostnames = true

  tags = {
    Environment = "production"
    CostCenter = "backend-services"
  }
}

resource "aws_security_group" "lambda_sg" {
  name        = "lambda-security-group"
  description = "Security group for Lambda functions"
  vpc_id      = module.vpc.vpc_id

  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "lambda-sg"
  }
}

resource "aws_dynamodb_table" "orders_table" {
  name           = "OrdersTable"
  billing_mode   = "PAY_PER_REQUEST"
  hash_key       = "orderId"

  attribute {
    name = "orderId"
    type = "S"
  }

  ttl {
    attribute_name = "expiryDate"
    enabled        = true
  }

  tags = {
    Environment = "production"
    CostCenter = "backend-services"
  }
}

resource "aws_lambda_function" "order_processor" {
  filename      = "lambda_function.zip"
  function_name = "order-processor"
  role          = aws_iam_role.lambda_exec.arn
  handler       = "index.handler"
  runtime       = "nodejs18.x"
  memory_size   = 256
  timeout       = 10
  ephemeral_storage {
    size = 512
  }

  vpc_config {
    subnet_ids         = module.vpc.private_subnets
    security_group_ids = [aws_security_group.lambda_sg.id]
  }

  environment {
    variables = {
      DYNAMODB_TABLE = aws_dynamodb_table.orders_table.name
    }
  }

  tags = {
    Environment = "production"
    CostCenter = "backend-services"
  }
}

resource "aws_iam_role" "lambda_exec" {
  name = "lambda-exec-role"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Action = "sts:AssumeRole"
        Effect = "Allow"
        Principal = {
          Service = "lambda.amazonaws.com"
        }
      }
    ]
  })

  tags = {
    Environment = "production"
    CostCenter = "backend-services"
  }
}

resource "aws_iam_role_policy_attachment" "lambda_basic" {
  role       = aws_iam_role.lambda_exec.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
}

resource "aws_iam_role_policy_attachment" "dynamodb_access" {
  role       = aws_iam_role.lambda_exec.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonDynamoDBFullAccess"
}

# Enable AWS Cost Explorer for cost monitoring
resource "aws_ce_cost_category" "backend_services" {
  name = "BackendServices"
  rule {
    type = "REGULAR"
    rule_expression {
      type = "DIMENSION"
      key  = "SERVICE"
      values = ["Amazon DynamoDB", "AWS Lambda"]
    }
  }
}
```

**Deployment Instructions:**
1. Save this configuration to `main.tf`
2. Initialize Terraform: `terraform init`
3. Review the execution plan: `terraform plan`
4. Apply the configuration: `terraform apply`
5. Monitor costs in AWS Cost Explorer under the 'BackendServices' cost category

**Cost Optimization Notes:**
- Using PAY_PER_REQUEST billing for DynamoDB
- Lambda configured with 256MB memory (optimal for this workload)
- Single NAT gateway reduces costs by ~40% compared to dual NAT
- VPC endpoints not included as Lambda doesn't need direct internet access