Defense-in-Depth Security

resource "aws_wafv2_web_acl" "govtech" {
  name  = "govtech-waf-prod"
  scope = "REGIONAL"

  # RULE 1: Amazon IP Reputation List
  # Blocks known malicious IPs (botnets, Tor exit nodes)
  rule {
    name     = "AmazonIpReputationList"
    priority = 1
    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesAmazonIpReputationList"
        vendor_name = "AWS"
      }
    }
  }

  # RULE 2: Common OWASP Top 10 protections
  # XSS, path traversal, SQL injection patterns
  rule {
    name     = "CommonRuleSet"
    priority = 2
    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }
  }

  # RULE 3: SQL Injection specific
  rule {
    name     = "SQLiRuleSet"
    priority = 3
    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesSQLiRuleSet"
        vendor_name = "AWS"
      }
    }
  }

  # RULE 4: Known bad inputs (Log4Shell, SSRF)
  rule {
    name     = "KnownBadInputsRuleSet"
    priority = 4
    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesKnownBadInputsRuleSet"
        vendor_name = "AWS"
      }
    }
  }

  # RULE 5: Rate limiting (2000 req/5min per IP)
  rule {
    name     = "RateLimitRule"
    priority = 5
    action {
      block {}
    }
    statement {
      rate_based_statement {
        limit              = 2000
        aggregate_key_type = "IP"
      }
    }
  }
}

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all
  namespace: govtech
spec:
  podSelector: {}  # Applies to ALL pods
  policyTypes:
    - Ingress   # Block all incoming traffic
    - Egress    # Block all outgoing traffic

apiVersion: v1
kind: ServiceAccount
metadata:
  name: govtech-backend
  namespace: govtech
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::835960996869:role/govtech-backend-role
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: govtech-backend-role
  namespace: govtech
rules:
  # Backend can only read ConfigMaps (not Secrets)
  - apiGroups: [""]
    resources: ["configmaps"]
    verbs: ["get", "list"]
  # Cannot create/delete/update anything

# IAM role for backend pods to access S3
resource "aws_iam_role" "backend_s3_access" {
  name = "govtech-backend-s3-access"

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Principal = {
        Federated = var.oidc_provider_arn
      }
      Action = "sts:AssumeRoleWithWebIdentity"
      Condition = {
        StringEquals = {
          "${var.oidc_provider_url}:sub" = "system:serviceaccount:govtech:govtech-backend"
        }
      }
    }]
  })
}

resource "aws_iam_role_policy" "backend_s3_policy" {
  role = aws_iam_role.backend_s3_access.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect = "Allow"
      Action = [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ]
      Resource = "arn:aws:s3:::govtech-documents-prod/*"
    }]
  })
}

resource "aws_secretsmanager_secret" "db_credentials" {
  name                    = "govtech/prod/db-credentials"
  description             = "PostgreSQL credentials for backend"
  kms_key_id              = aws_kms_key.govtech_main.arn
  recovery_window_in_days = 7
}

resource "aws_secretsmanager_secret_version" "db_credentials" {
  secret_id = aws_secretsmanager_secret.db_credentials.id
  
  secret_string = jsonencode({
    username = "govtech_admin"
    password = "POPULATED_AFTER_RDS_CREATION"
    host     = "rds-endpoint.us-east-1.rds.amazonaws.com"
    port     = "5432"
    dbname   = "govtech"
  })
}

securityContext:
  runAsNonRoot: true              # Never run as root
  runAsUser: 1000                 # Run as user ID 1000
  allowPrivilegeEscalation: false # Cannot gain more privileges
  readOnlyRootFilesystem: false   # Application needs write
  capabilities:
    drop:
    - ALL                         # Drop all Linux capabilities

- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: ${{ env.ECR_REGISTRY }}/govtech-backend:${{ github.sha }}
    format: 'table'
    exit-code: '1'  # Fail build if CRITICAL or HIGH found
    severity: 'CRITICAL,HIGH'

resource "aws_cloudtrail" "govtech_audit" {
  name                          = "govtech-audit-trail-prod"
  s3_bucket_name                = var.logs_bucket
  include_global_service_events = true
  is_multi_region_trail         = true
  enable_log_file_validation    = true  # Detect log tampering
  kms_key_id                    = aws_kms_key.govtech_main.arn

  event_selector {
    read_write_type           = "All"
    include_management_events = true

    # Log S3 data events (who accessed what file)
    data_resource {
      type   = "AWS::S3::Object"
      values = ["arn:aws:s3:::"]
    }
  }
}

resource "aws_guardduty_detector" "main" {
  enable = true

  datasources {
    s3_logs {
      enable = true  # Detect S3 data exfiltration
    }
    kubernetes {
      audit_logs {
        enable = true  # Detect suspicious EKS API calls
      }
    }
    malware_protection {
      scan_ec2_instance_with_findings {
        ebs_volumes {
          enable = true  # Scan volumes for malware
        }
      }
    }
  }
}