# main.tf — EKM compliance fixture
# Produces zero EKM policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# EKM-001 + EKM-002 — Rotation enabled, 30 day deletion window
resource "aws_kms_key" "good_key" {
  description              = "good key"
  customer_master_key_spec = "SYMMETRIC_DEFAULT"
  enable_key_rotation      = true
  deletion_window_in_days  = 30
}

# EKM-003 — KMS permissions scoped to specific key
resource "aws_iam_policy" "good_kms_policy" {
  name = "good-kms-policy"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["kms:Decrypt"]
      Resource = "arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd"
    }]
  })
}

# EKM-004 — KMS key policy grants kms:* to root WITH a condition
resource "aws_kms_key" "good_root_key" {
  description              = "good root key"
  customer_master_key_spec = "SYMMETRIC_DEFAULT"
  enable_key_rotation      = true
  deletion_window_in_days  = 30
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { AWS = "arn:aws:iam::123456789012:root" }
      Action    = "kms:*"
      Resource  = "*"
      Condition = {
        StringEquals = {
          "kms:CallerAccount" = "123456789012"
        }
      }
    }]
  })
}

# EKM-005 — S3 encryption using KMS CMK
resource "aws_s3_bucket" "good_bucket" {
  bucket = "good-ekm-bucket"
}

resource "aws_s3_bucket_server_side_encryption_configuration" "good_sse" {
  bucket = aws_s3_bucket.good_bucket.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm     = "aws:kms"
      kms_master_key_id = "arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd"
    }
    bucket_key_enabled = true
  }
}

# STR passthrough — needed to avoid STR violations on the bucket
resource "aws_s3_bucket_public_access_block" "good_pab" {
  bucket                  = aws_s3_bucket.good_bucket.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_ownership_controls" "good_ownership" {
  bucket = aws_s3_bucket.good_bucket.id
  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}

resource "aws_s3_bucket_policy" "good_policy" {
  bucket = aws_s3_bucket.good_bucket.id
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Sid       = "DenyNonTLS"
      Effect    = "Deny"
      Principal = "*"
      Action    = "s3:*"
      Resource = [
        "arn:aws:s3:::good-ekm-bucket",
        "arn:aws:s3:::good-ekm-bucket/*"
      ]
      Condition = {
        Bool = {
          "aws:SecureTransport" = "false"
        }
      }
    }]
  })
}

# EKM-006 — EBS default encryption enabled with CMK
resource "aws_ebs_encryption_by_default" "good_ebs" {
  enabled = true
}

resource "aws_ebs_default_kms_key" "good_ebs_kms" {
  key_arn = "arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd"
}

# EKM-007 — Secret with rotation configured
resource "aws_secretsmanager_secret" "good_secret" {
  name = "good-secret"
}

resource "aws_secretsmanager_secret_rotation" "good_rotation" {
  secret_id           = aws_secretsmanager_secret.good_secret.name
  rotation_lambda_arn = "arn:aws:lambda:ap-south-1:123456789012:function:rotate-secret"

  rotation_rules {
    automatically_after_days = 60
  }
}

# EKM-008 — Strong RSA key
resource "aws_acm_certificate" "good_cert" {
  domain_name       = "good.example.com"
  validation_method = "DNS"
  key_algorithm     = "RSA_2048"
}