Security Module

# Create logs bucket first
resource "aws_s3_bucket" "logs" {
  bucket = "govtech-prod-logs-123456789012"
}

resource "aws_s3_bucket_policy" "cloudtrail_logs" {
  bucket = aws_s3_bucket.logs.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid    = "AWSCloudTrailAclCheck"
      Effect = "Allow"
      Principal = {
        Service = "cloudtrail.amazonaws.com"
      }
      Action   = "s3:GetBucketAcl"
      Resource = aws_s3_bucket.logs.arn
    }, {
      Sid    = "AWSCloudTrailWrite"
      Effect = "Allow"
      Principal = {
        Service = "cloudtrail.amazonaws.com"
      }
      Action   = "s3:PutObject"
      Resource = "${aws_s3_bucket.logs.arn}/*"
      Condition = {
        StringEquals = {
          "s3:x-amz-acl" = "bucket-owner-full-control"
        }
      }
    }]
  })
}

data "aws_caller_identity" "current" {}

module "security" {
  source = "./modules/security"

  project_name = "govtech"
  environment  = "prod"
  account_id   = data.aws_caller_identity.current.account_id
  aws_region   = "us-east-1"
  logs_bucket  = aws_s3_bucket.logs.id
}

# Use KMS key for RDS encryption
module "database" {
  source = "./modules/database"
  # ...
  kms_key_arn = module.security.kms_key_arn
}

fields @timestamp, userIdentity.principalId, eventName, requestParameters
| filter eventName = "RunInstances"
| sort @timestamp desc
| limit 20

fields @timestamp, eventName, sourceIPAddress, errorCode
| filter userIdentity.principalId = "AIDAI23ABC123EXAMPLE"
| sort @timestamp desc

fields @timestamp, eventName, sourceIPAddress, userIdentity.principalId
| filter errorCode = "AccessDenied" or errorCode = "UnauthorizedOperation"
| stats count() by sourceIPAddress
| sort count desc

fields @timestamp, userIdentity.principalId, requestParameters.bucketName, requestParameters.key
| filter eventName = "GetObject" or eventName = "PutObject"
| filter requestParameters.bucketName = "govtech-prod-app-storage-123456789012"

resource "aws_cloudwatch_event_rule" "guardduty_high" {
  name        = "guardduty-high-severity"
  description = "Trigger on high severity GuardDuty findings"

  event_pattern = jsonencode({
    source      = ["aws.guardduty"]
    detail-type = ["GuardDuty Finding"]
    detail = {
      severity = [{ numeric: [">", 7] }]  # High and Critical
    }
  })
}

resource "aws_cloudwatch_event_target" "sns" {
  rule      = aws_cloudwatch_event_rule.guardduty_high.name
  target_id = "SendToSNS"
  arn       = aws_sns_topic.security_alerts.arn
}

ALB_ARN=$(kubectl get ingress -n govtech app-ingress \
  -o jsonpath='{.status.loadBalancer.ingress[0].hostname}' | \
  xargs -I {} aws elbv2 describe-load-balancers \
    --query "LoadBalancers[?DNSName=='{}'].LoadBalancerArn" \
    --output text)

aws wafv2 associate-web-acl \
  --web-acl-arn $(terraform output -raw waf_web_acl_arn) \
  --resource-arn $ALB_ARN \
  --region us-east-1

resource "aws_wafv2_web_acl_association" "alb" {
  resource_arn = data.kubernetes_ingress.app.status[0].load_balancer[0].ingress[0].hostname
  web_acl_arn  = module.security.waf_web_acl_arn
}

aws wafv2 get-sampled-requests \
  --web-acl-arn $(terraform output -raw waf_web_acl_arn) \
  --rule-metric-name RateLimitRule \
  --scope REGIONAL \
  --time-window StartTime=2024-03-01T00:00:00Z,EndTime=2024-03-01T23:59:59Z \
  --max-items 100

rule {
  name     = "BlockCountries"
  priority = 0

  action {
    block {}
  }

  statement {
    geo_match_statement {
      country_codes = ["CN", "RU", "KP"]  # China, Russia, North Korea
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "BlockCountries"
    sampled_requests_enabled   = true
  }
}

DB_HOST=$(terraform output -raw db_instance_address)

aws secretsmanager put-secret-value \
  --secret-id govtech/prod/db-credentials \
  --secret-string "{
    \"username\": \"govtech_admin\",
    \"password\": \"$(openssl rand -base64 32)\",
    \"host\": \"$DB_HOST\",
    \"port\": \"5432\",
    \"dbname\": \"govtech\"
  }"

apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: aws-secretsmanager
  namespace: govtech
spec:
  provider:
    aws:
      service: SecretsManager
      region: us-east-1
      auth:
        jwt:
          serviceAccountRef:
            name: backend
---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-credentials
  namespace: govtech
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: aws-secretsmanager
    kind: SecretStore
  target:
    name: database-credentials
    creationPolicy: Owner
  data:
  - secretKey: username
    remoteRef:
      key: govtech/prod/db-credentials
      property: username
  - secretKey: password
    remoteRef:
      key: govtech/prod/db-credentials
      property: password
  - secretKey: host
    remoteRef:
      key: govtech/prod/db-credentials
      property: host

subscriber {
  type    = "EMAIL"
  address = "[email protected]"
}

# Add SNS topic for Slack/PagerDuty integration
subscriber {
  type    = "SNS"
  address = aws_sns_topic.cost_alerts.arn
}

aws securityhub get-findings \
  --filters '{"ComplianceStatus": [{"Value": "FAILED", "Comparison": "EQUALS"}]}' \
  --max-items 100 > security-findings.json

aws cloudtrail lookup-events \
  --start-time 2024-03-01T00:00:00Z \
  --end-time 2024-03-31T23:59:59Z \
  --max-results 1000 > audit-log-march-2024.json

aws s3api put-bucket-versioning \
  --bucket govtech-prod-logs-123456789012 \
  --versioning-configuration Status=Enabled,MFADelete=Enabled \
  --mfa "arn:aws:iam::123456789012:mfa/root-account-mfa-device 123456"