Best Practice: Encryption Strategy

# CMK for PII data
resource "aws_kms_key" "pii" {
  description             = "CMK for PII data (customer data, authentication)"
  deletion_window_in_days = 30   # At least 14 days

  # Automatic annual rotation of key material
  enable_key_rotation = true

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "EnableIAMUserPermissions"
        Effect = "Allow"
        Principal = {
          AWS = "arn:aws:iam::${var.account_id}:root"
        }
        Action   = "kms:*"
        Resource = "*"
      },
      {
        Sid    = "AllowAppUsage"
        Effect = "Allow"
        Principal = {
          AWS = aws_iam_role.app.arn
        }
        Action = [
          "kms:Decrypt",
          "kms:GenerateDataKey"
        ]
        Resource = "*"
      },
      {
        Sid    = "AllowCloudTrailUsage"
        Effect = "Allow"
        Principal = {
          Service = "cloudtrail.amazonaws.com"
        }
        Action = [
          "kms:GenerateDataKey*",
          "kms:DescribeKey"
        ]
        Resource = "*"
      }
    ]
  })

  tags = {
    data-class  = "pii"
    pillar      = "security"
    managed-by  = "terraform"
  }
}

resource "aws_kms_alias" "pii" {
  name          = "alias/cmk-pii"
  target_key_id = aws_kms_key.pii.key_id
}

resource "aws_s3_bucket" "customer_data" {
  bucket = "myorg-customer-data-prod"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "customer_data" {
  bucket = aws_s3_bucket.customer_data.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = aws_kms_key.pii.arn  # CMK, not AES256
    }
    bucket_key_enabled = true  # Reduces KMS API calls and costs
  }
}

# Non-Compliant: SSE-S3 (AES256) for PII data
# resource "aws_s3_bucket_server_side_encryption_configuration" "bad" {
#   rule {
#     apply_server_side_encryption_by_default {
#       sse_algorithm = "AES256"  # AWS-managed key – no CMK!
#     }
#   }
# }

resource "aws_db_instance" "main" {
  identifier        = "prod-db"
  engine            = "postgres"
  engine_version    = "15.4"
  instance_class    = "db.t3.medium"
  storage_encrypted = true              # Encryption enabled
  kms_key_id        = aws_kms_key.pii.arn  # CMK (not default KMS)

  # Additional security settings
  publicly_accessible    = false        # Never public
  deletion_protection    = true         # Protection against accidental deletion
  backup_retention_period = 7           # 7-day backup retention

  # IAM authentication instead of password (for apps)
  iam_database_authentication_enabled = true
}

# EBS encryption by default for the entire account
resource "aws_ebs_encryption_by_default" "enabled" {
  enabled = true
}

# Set default KMS key for EBS to CMK
resource "aws_ebs_default_kms_key" "main" {
  key_arn = aws_kms_key.general.arn
}

resource "aws_lb_listener" "https" {
  load_balancer_arn = aws_lb.main.arn
  port              = "443"
  protocol          = "HTTPS"

  # Modern TLS policy: TLS 1.2 and 1.3, strong cipher suites
  ssl_policy      = "ELBSecurityPolicy-TLS13-1-2-2021-06"
  certificate_arn = aws_acm_certificate.main.arn

  default_action {
    type             = "forward"
    target_group_arn = aws_lb_target_group.app.arn
  }
}

# HTTP → HTTPS redirect (no plain HTTP!)
resource "aws_lb_listener" "http_redirect" {
  load_balancer_arn = aws_lb.main.arn
  port              = "80"
  protocol          = "HTTP"

  default_action {
    type = "redirect"
    redirect {
      port        = "443"
      protocol    = "HTTPS"
      status_code = "HTTP_301"
    }
  }
}

resource "aws_cloudfront_distribution" "main" {
  viewer_certificate {
    acm_certificate_arn      = aws_acm_certificate.cdn.arn
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"  # No TLS 1.0 or 1.1
  }
}

# ACM certificate with automatic renewal
resource "aws_acm_certificate" "main" {
  domain_name               = "*.example.com"
  subject_alternative_names = ["example.com"]
  validation_method         = "DNS"

  lifecycle {
    create_before_destroy = true  # Zero-downtime renewal
  }
}

# DNS validation via Route 53
resource "aws_route53_record" "cert_validation" {
  for_each = {
    for dvo in aws_acm_certificate.main.domain_validation_options : dvo.domain_name => {
      name   = dvo.resource_record_name
      record = dvo.resource_record_value
      type   = dvo.resource_record_type
    }
  }

  zone_id = aws_route53_zone.main.zone_id
  name    = each.value.name
  type    = each.value.type
  records = [each.value.record]
  ttl     = 60
}