# main.tf — CMP violations fixture
# Triggers all 11 CMP policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# CMP-001 + CMP-002 + CMP-003 — No IMDSv2, hop limit not 1, public IP
resource "aws_instance" "bad_instance" {
  ami           = "ami-0abcdef1234567890"
  instance_type = "t3.micro"

  associate_public_ip_address = true

  metadata_options {
    http_tokens                 = "optional"
    http_put_response_hop_limit = 2
  }

  ebs_block_device {
    device_name = "/dev/xvdb"
    encrypted   = false
  }
}

# CMP-004 — Subnet auto-assigns public IPs
resource "aws_subnet" "bad_subnet" {
  vpc_id                  = "vpc-12345678"
  cidr_block              = "10.0.1.0/24"
  map_public_ip_on_launch = true
}

# CMP-005 + CMP-006 + CMP-007 — Unrestricted SSH, RDP, and high-risk ports
resource "aws_security_group" "bad_sg" {
  name   = "bad-sg"
  vpc_id = "vpc-12345678"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 3389
    to_port     = 3389
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# CMP-008 — Default security group has rules
resource "aws_default_security_group" "bad_default_sg" {
  vpc_id = "vpc-12345678"

  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# CMP-009 — Unencrypted EBS volume
resource "aws_ebs_volume" "bad_volume" {
  availability_zone = "ap-south-1a"
  size              = 20
  encrypted         = false
}

# CMP-010 — EBS default encryption disabled
resource "aws_ebs_encryption_by_default" "bad_ebs_default" {
  enabled = false
}

# CMP-011 — Privileged ECS container
resource "aws_ecs_task_definition" "bad_task" {
  family = "bad-task"
  container_definitions = jsonencode([{
    name       = "bad-container"
    image      = "nginx:latest"
    privileged = true
  }])
}