# main.tf — GAC new policy violations fixture
# Triggers GAC-003, GAC-008, GAC-012, GAC-013, GAC-014,
# GAC-015, GAC-016, GAC-022, GAC-023, GAC-025, GAC-026

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

# GAC-025 — No default_tags
provider "aws" {
  region = "ap-south-1"
}

# GAC-026 — Resources do not have the baseline tags attached
# Fires once per taggable resource in this file

# GAC-003 — S3 bucket with versioning disabled
resource "aws_s3_bucket" "bad_bucket" {
  bucket = "bad-gac-bucket"
}

resource "aws_s3_bucket_versioning" "bad_versioning" {
  bucket = aws_s3_bucket.bad_bucket.id
  versioning_configuration {
    status = "Suspended"
  }
}

# GAC-008 — EBS snapshot shared publicly
# Cannot be checked without actual snapshot
# Will be injected manually in the fixture

# GAC-012 — RDS with insufficient backup retention
resource "aws_db_instance" "bad_rds" {
  identifier              = "bad-gac-rds"
  engine                  = "mysql"
  engine_version          = "8.0"
  instance_class          = "db.t3.micro"
  allocated_storage       = 20
  username                = "admin"
  password                = "Badpassword123"
  skip_final_snapshot     = true
  backup_retention_period = 7
}

# GAC-013 — RDS snapshot shared publicly
# Cannot be checked without actual snapshot
# Will be injected manually in the fixture

# GAC-014 — IAM policy with admin wildcard
resource "aws_iam_policy" "bad_admin_policy" {
  name = "bad-admin-policy"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = "*"
      Resource = "*"
    }]
  })
}

# GAC-015 — IAM role with wildcard principal
resource "aws_iam_role" "bad_role" {
  name = "bad-gac-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = "sts:AssumeRole"
    }]
  })
}

# GAC-016 — Weak password policy
resource "aws_iam_account_password_policy" "bad_password_policy" {
  minimum_password_length      = 8
  require_symbols              = false
  require_numbers              = false
  require_uppercase_characters = false
  require_lowercase_characters = false
  password_reuse_prevention    = 5
  max_password_age             = 180
}

# GAC-022 — CloudFront with old TLS
resource "aws_cloudfront_distribution" "bad_cf" {
  enabled = true

  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "bad-origin"
    viewer_protocol_policy = "redirect-to-https"
    forwarded_values {
      query_string = false
      cookies { forward = "none" }
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
    minimum_protocol_version       = "TLSv1"
  }

  origin {
    domain_name = "example.com"
    origin_id   = "bad-origin"
    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  restrictions {
    geo_restriction { restriction_type = "none" }
  }
}

# GAC-023 — EKS with public endpoint open to all
resource "aws_eks_cluster" "bad_eks" {
  name     = "bad-eks"
  role_arn = "arn:aws:iam::123456789012:role/eks-role"

  vpc_config {
    subnet_ids              = ["subnet-12345678"]
    endpoint_public_access  = true
    endpoint_private_access = false
    public_access_cidrs     = ["0.0.0.0/0"]
  }
}