graph TB
    subgraph "Preventive Controls"
        SCP[Service Control Policies]
        Budget[AWS Budgets]
        Quotas[Service Quotas]
    end
    
    subgraph "Detective Controls"
        CUR[Cost & Usage Reports]
        Tags[Cost Allocation Tags]
        Alerts[Budget Alerts]
    end
    
    subgraph "Actions"
        Review[Cost Review]
        Optimize[Right-sizing]
        Reserved[Reserved Instances]
    end
    
    Preventive --> Actions
    Detective --> Actions

# AWS Budget with alerts
resource "aws_budgets_budget" "monthly" {
  name         = "${local.name_prefix}-monthly-budget"
  budget_type  = "COST"
  limit_amount = var.monthly_budget_limit
  limit_unit   = "USD"
  time_unit    = "MONTHLY"

  cost_filter {
    name   = "TagKeyValue"
    values = ["user:Environment$${var.environment}"]
  }

  notification {
    comparison_operator = "GREATER_THAN"
    threshold           = 80
    threshold_type      = "PERCENTAGE"
    notification_type   = "ACTUAL"
    subscriber_email_addresses = var.budget_alert_emails
  }

  notification {
    comparison_operator = "GREATER_THAN"
    threshold           = 100
    threshold_type      = "PERCENTAGE"
    notification_type   = "FORECASTED"
    subscriber_email_addresses = var.budget_alert_emails
  }
}

# SCP to block expensive instances in non-prod
resource "aws_organizations_policy" "deny_large_instances" {
  name        = "deny-large-instances-non-prod"
  description = "Deny creation of large EC2 instances in non-production"
  type        = "SERVICE_CONTROL_POLICY"

  content = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid       = "DenyLargeInstances"
      Effect    = "Deny"
      Action    = "ec2:RunInstances"
      Resource  = "arn:aws:ec2:*:*:instance/*"
      Condition = {
        StringLike = {
          "ec2:InstanceType" = ["*.4xlarge", "*.8xlarge", "*.12xlarge", "*.16xlarge", "*.24xlarge"]
        }
      }
    }]
  })
}

// Create budget with multiple thresholds
new budgets.CfnBudget(this, 'MonthlyBudget', {
  budget: {
    budgetName: `${props.projectName}-${props.environment}-monthly`,
    budgetType: 'COST',
    timeUnit: 'MONTHLY',
    budgetLimit: {
      amount: props.monthlyBudgetLimit,
      unit: 'USD',
    },
    costFilters: {
      TagKeyValue: [`user:Project$${props.projectName}`],
    },
  },
  notificationsWithSubscribers: [
    {
      notification: {
        comparisonOperator: 'GREATER_THAN',
        threshold: 50,
        thresholdType: 'PERCENTAGE',
        notificationType: 'ACTUAL',
      },
      subscribers: props.alertEmails.map(email => ({
        subscriptionType: 'EMAIL',
        address: email,
      })),
    },
    {
      notification: {
        comparisonOperator: 'GREATER_THAN',
        threshold: 80,
        thresholdType: 'PERCENTAGE',
        notificationType: 'ACTUAL',
      },
      subscribers: props.alertEmails.map(email => ({
        subscriptionType: 'EMAIL',
        address: email,
      })),
    },
  ],
});