05 · AWS 进阶 & 博彩专项

官方文档：https://docs.aws.amazon.com/ 博彩架构参考：https://docs.aws.amazon.com/architecture-diagrams/latest/sports-betting-architecture/ iGaming 重点：数据驻留合规 · 多地区低延迟 · Kafka 实时流 · EKS 容器化

---

1. Route 53 高级路由

官方文档：https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/

路由策略对比

简单路由    → 单一后端，无特殊逻辑
加权路由    → A/B 测试，流量按比例分（weight=70/30）
延迟路由    → 自动路由到最近 AWS Region（博彩多地区必用）
地理路由    → 按用户地理位置路由（合规封锁）
地理邻近路由 → 按物理距离，可手动偏移
故障转移    → Primary/Secondary，健康检查失败自动切换
多值回答    → 返回多个 IP，客户端选择

延迟路由（低延迟投注）

# 在 ap-southeast-1（新加坡）和 eu-west-1（爱尔兰）各部署一套
# 东南亚用户自动路由到新加坡，欧洲用户到爱尔兰

aws route53 change-resource-record-sets --hosted-zone-id $ZONE_ID \
  --change-batch '{
    "Changes": [{
      "Action": "CREATE",
      "ResourceRecordSet": {
        "Name": "api.example.com",
        "Type": "A",
        "SetIdentifier": "singapore",
        "Region": "ap-southeast-1",
        "AliasTarget": {
          "HostedZoneId": "Z1LMS91P8CMLE5",
          "DNSName": "alb-sg.ap-southeast-1.elb.amazonaws.com",
          "EvaluateTargetHealth": true
        }
      }
    }]
  }'

---

2. AWS WAF（应用层防护）

官方文档：https://docs.aws.amazon.com/waf/latest/developerguide/

# Terraform 配置 AWS WAF v2
resource "aws_wafv2_web_acl" "igaming_waf" {
  name  = "igaming-waf"
  scope = "REGIONAL"  # 或 CLOUDFRONT

  default_action { allow {} }

  # AWS 托管规则（推荐启用）
  rule {
    name     = "AWSManagedRulesCommonRuleSet"
    priority = 10
    override_action { none {} }
    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "CommonRuleSet"
      sampled_requests_enabled   = true
    }
  }

  # 自定义速率限制规则
  rule {
    name     = "LoginRateLimit"
    priority = 20
    action { block {} }
    statement {
      rate_based_statement {
        limit              = 100  # 5分钟内100次
        aggregate_key_type = "IP"
        scope_down_statement {
          byte_match_statement {
            field_to_match { uri_path {} }
            positional_constraint = "STARTS_WITH"
            search_string         = "/auth/login"
            text_transformation { priority = 0; type = "NONE" }
          }
        }
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "LoginRateLimit"
      sampled_requests_enabled   = true
    }
  }
}

---

3. Amazon MSK（托管 Kafka）

官方文档：https://docs.aws.amazon.com/msk/latest/developerguide/

博彩场景使用

赔率引擎 → Kafka Topic: odds-updates → WebSocket 服务 → 客户端
结算系统 → Kafka Topic: bet-results  → 账户服务（扣款/加款）
用户行为 → Kafka Topic: user-events  → 风控系统 · 分析系统

创建 MSK 集群

aws kafka create-cluster \
  --cluster-name "igaming-kafka" \
  --broker-node-group-info '{
    "InstanceType": "kafka.m5.xlarge",
    "ClientSubnets": ["subnet-a", "subnet-b", "subnet-c"],
    "SecurityGroups": ["sg-kafka"],
    "StorageInfo": {"EbsStorageInfo": {"VolumeSize": 1000}}
  }' \
  --kafka-version "3.5.1" \
  --number-of-broker-nodes 3 \
  --encryption-info '{
    "EncryptionInTransit": {"ClientBroker": "TLS", "InCluster": true}
  }'

Python 生产者/消费者

from kafka import KafkaProducer, KafkaConsumer
import json

# 生产者（赔率引擎推送）
producer = KafkaProducer(
    bootstrap_servers=['b-1.kafka.region.amazonaws.com:9092'],
    security_protocol='SSL',
    value_serializer=lambda v: json.dumps(v).encode()
)
producer.send('odds-updates', {
    'match_id': '12345',
    'market': 'match_winner',
    'home': 1.85,
    'away': 3.20,
    'draw': 3.50,
    'timestamp': time.time()
})

# 消费者（WebSocket 服务订阅）
consumer = KafkaConsumer(
    'odds-updates',
    bootstrap_servers=['b-1.kafka.region.amazonaws.com:9092'],
    group_id='websocket-service',
    auto_offset_reset='latest',
    value_deserializer=lambda m: json.loads(m.decode())
)
for message in consumer:
    odds = message.value
    await broadcast_to_subscribers(odds['match_id'], odds)

---

4. AWS Outposts & Local Zones（合规数据驻留）

官方文档

• Outposts：https://docs.aws.amazon.com/outposts/latest/userguide/
• Local Zones：https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-regions-availability-zones.html#concepts-local-zones

使用场景

Local Zones（推荐大多数场景）：
  AWS 在主要城市部署的小型基础设施扩展
  延迟 < 10ms 到最终用户
  支持：EC2、EBS、VPC、ALB
  适合：低延迟投注处理、地理合规

Outposts（严格合规场景）：
  AWS 机架放在你的数据中心
  完全本地运行，数据不离境
  适合：对数据出境有严格要求的市场（印度、中国等）

---

5. EKS（托管 Kubernetes）

官方文档：https://docs.aws.amazon.com/eks/latest/userguide/

创建 EKS 集群

# 使用 eksctl（推荐）
# 安装：https://eksctl.io/installation/

eksctl create cluster \
  --name igaming-prod \
  --region ap-southeast-1 \
  --nodegroup-name standard-workers \
  --node-type m7i.xlarge \
  --nodes 3 \
  --nodes-min 2 \
  --nodes-max 20 \
  --managed

# 更新 kubeconfig
aws eks update-kubeconfig --name igaming-prod --region ap-southeast-1

# 验证
kubectl get nodes

Node Group 自动扩容

# Cluster Autoscaler（官方文档：https://github.com/kubernetes/autoscaler/tree/master/cluster-autoscaler）
kubectl apply -f https://raw.githubusercontent.com/kubernetes/autoscaler/master/cluster-autoscaler/cloudprovider/aws/examples/cluster-autoscaler-autodiscover.yaml

---

6. CloudFront CDN

官方文档：https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/

# Terraform 配置 CloudFront
resource "aws_cloudfront_distribution" "igaming" {
  origin {
    domain_name = aws_s3_bucket.assets.bucket_regional_domain_name
    origin_id   = "S3-assets"
  }

  origin {
    domain_name = aws_alb.main.dns_name
    origin_id   = "ALB-api"
    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
    }
  }

  enabled             = true
  default_root_object = "index.html"
  aliases             = ["www.example.com"]

  # 静态资源（长期缓存）
  default_cache_behavior {
    target_origin_id       = "S3-assets"
    viewer_protocol_policy = "redirect-to-https"
    compress               = true
    min_ttl                = 0
    default_ttl            = 86400
    max_ttl                = 31536000
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    forwarded_values {
      query_string = false
      cookies { forward = "none" }
    }
  }

  # API（不缓存）
  ordered_cache_behavior {
    path_pattern           = "/api/*"
    target_origin_id       = "ALB-api"
    viewer_protocol_policy = "https-only"
    min_ttl                = 0
    default_ttl            = 0
    max_ttl                = 0
    allowed_methods        = ["DELETE", "GET", "HEAD", "OPTIONS", "PATCH", "POST", "PUT"]
    cached_methods         = ["GET", "HEAD"]
    forwarded_values {
      query_string = true
      headers      = ["Authorization", "Origin", "Host"]
      cookies { forward = "all" }
    }
  }

  viewer_certificate {
    acm_certificate_arn      = aws_acm_certificate.main.arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }
}

---

官方文档汇总

服务	官方文档链接
Route 53	https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/
AWS WAF v2	https://docs.aws.amazon.com/waf/latest/developerguide/
Amazon MSK	https://docs.aws.amazon.com/msk/latest/developerguide/
EKS	https://docs.aws.amazon.com/eks/latest/userguide/
CloudFront	https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/
Local Zones	https://aws.amazon.com/about-aws/global-infrastructure/localzones/
AWS 博彩架构	https://docs.aws.amazon.com/architecture-diagrams/latest/sports-betting-architecture/

---

最后更新：2025-04