# main.tf — NCD violations fixture
# Triggers all 9 NCD policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# NCD-001 + NCD-002 + NCD-003 — Unrestricted SSH, RDP, high-risk ports
resource "aws_security_group" "bad_sg" {
  name   = "bad-sg"
  vpc_id = "vpc-12345678"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 3389
    to_port     = 3389
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# NCD-004 — Default security group has rules
resource "aws_default_security_group" "bad_default_sg" {
  vpc_id = "vpc-12345678"

  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# NCD-005 — NACL allows SSH from 0.0.0.0/0
resource "aws_network_acl_rule" "bad_nacl_ssh" {
  network_acl_id = "acl-12345678"
  rule_number    = 100
  egress         = false
  protocol       = "tcp"
  rule_action    = "allow"
  cidr_block     = "0.0.0.0/0"
  from_port      = 22
  to_port        = 22
}

# NCD-005 — NACL allows RDP from 0.0.0.0/0
resource "aws_network_acl_rule" "bad_nacl_rdp" {
  network_acl_id = "acl-12345678"
  rule_number    = 110
  egress         = false
  protocol       = "tcp"
  rule_action    = "allow"
  cidr_block     = "0.0.0.0/0"
  from_port      = 3389
  to_port        = 3389
}

# NCD-006 — No VPC endpoints declared (absence check, no resource needed)

# NCD-007 — HTTP listener with no HTTPS redirect
resource "aws_lb_listener" "bad_http" {
  load_balancer_arn = "arn:aws:elasticloadbalancing:ap-south-1:123456789012:loadbalancer/app/bad-alb/1234567890"
  port              = 80
  protocol          = "HTTP"

  default_action {
    type = "fixed-response"
    fixed_response {
      content_type = "text/plain"
      message_body = "OK"
      status_code  = "200"
    }
  }
}

# NCD-008 — CloudFront with HTTP allowed
resource "aws_cloudfront_distribution" "bad_cf" {
  enabled = true

  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "bad-origin"
    viewer_protocol_policy = "allow-all"

    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }
  }

  viewer_certificate {
    cloudfront_default_certificate = true
    minimum_protocol_version       = "TLSv1"
  }

  origin {
    domain_name = "example.com"
    origin_id   = "bad-origin"
    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "http-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }
}

# NCD-009 — API Gateway with logging disabled
resource "aws_api_gateway_rest_api" "bad_api" {
  name = "bad-api"
}

resource "aws_api_gateway_stage" "bad_stage" {
  rest_api_id   = aws_api_gateway_rest_api.bad_api.id
  stage_name    = "prod"
  deployment_id = "d-12345678"
}

resource "aws_api_gateway_method_settings" "bad_settings" {
  rest_api_id = aws_api_gateway_rest_api.bad_api.id
  stage_name  = aws_api_gateway_stage.bad_stage.stage_name
  method_path = "*/*"

  settings {
    logging_level = "OFF"
  }
}