# main.tf — NCD compliance fixture
# Produces zero NCD policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# NCD-001 + NCD-002 + NCD-003 — Restricted ingress only
resource "aws_security_group" "good_sg" {
  name   = "good-sg"
  vpc_id = "vpc-12345678"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  ingress {
    from_port   = 3389
    to_port     = 3389
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }

  ingress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }
}

# NCD-004 — Default security group with no rules
resource "aws_default_security_group" "good_default_sg" {
  vpc_id = "vpc-12345678"
}

# NCD-005 — NACL denies admin ports
resource "aws_network_acl_rule" "good_nacl_ssh" {
  network_acl_id = "acl-12345678"
  rule_number    = 100
  egress         = false
  protocol       = "tcp"
  rule_action    = "deny"
  cidr_block     = "0.0.0.0/0"
  from_port      = 22
  to_port        = 22
}

resource "aws_network_acl_rule" "good_nacl_rdp" {
  network_acl_id = "acl-12345678"
  rule_number    = 110
  egress         = false
  protocol       = "tcp"
  rule_action    = "deny"
  cidr_block     = "0.0.0.0/0"
  from_port      = 3389
  to_port        = 3389
}

# NCD-006 — VPC endpoints for all required services
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = "vpc-12345678"
  service_name      = "com.amazonaws.ap-south-1.s3"
  vpc_endpoint_type = "Gateway"
}

resource "aws_vpc_endpoint" "dynamodb" {
  vpc_id            = "vpc-12345678"
  service_name      = "com.amazonaws.ap-south-1.dynamodb"
  vpc_endpoint_type = "Gateway"
}

resource "aws_vpc_endpoint" "kms" {
  vpc_id              = "vpc-12345678"
  service_name        = "com.amazonaws.ap-south-1.kms"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
}

resource "aws_vpc_endpoint" "secretsmanager" {
  vpc_id              = "vpc-12345678"
  service_name        = "com.amazonaws.ap-south-1.secretsmanager"
  vpc_endpoint_type   = "Interface"
  private_dns_enabled = true
}

# NCD-007 — HTTP listener redirects to HTTPS
resource "aws_lb_listener" "good_http" {
  load_balancer_arn = "arn:aws:elasticloadbalancing:ap-south-1:123456789012:loadbalancer/app/good-alb/1234567890"
  port              = 80
  protocol          = "HTTP"

  default_action {
    type = "redirect"
    redirect {
      protocol    = "HTTPS"
      port        = "443"
      status_code = "HTTP_301"
    }
  }
}

# NCD-008 — CloudFront enforces HTTPS with TLSv1.2_2021
resource "aws_cloudfront_distribution" "good_cf" {
  enabled = true

  default_cache_behavior {
    allowed_methods        = ["GET", "HEAD"]
    cached_methods         = ["GET", "HEAD"]
    target_origin_id       = "good-origin"
    viewer_protocol_policy = "redirect-to-https"

    forwarded_values {
      query_string = false
      cookies {
        forward = "none"
      }
    }
  }

  viewer_certificate {
    acm_certificate_arn      = "arn:aws:acm:us-east-1:123456789012:certificate/abc-123"
    ssl_support_method       = "sni-only"
    minimum_protocol_version = "TLSv1.2_2021"
  }

  origin {
    domain_name = "example.com"
    origin_id   = "good-origin"
    custom_origin_config {
      http_port              = 80
      https_port             = 443
      origin_protocol_policy = "https-only"
      origin_ssl_protocols   = ["TLSv1.2"]
    }
  }

  restrictions {
    geo_restriction {
      restriction_type = "none"
    }
  }
}

# NCD-009 — API Gateway with logging enabled
resource "aws_api_gateway_rest_api" "good_api" {
  name = "good-api"
}

resource "aws_api_gateway_stage" "good_stage" {
  rest_api_id   = aws_api_gateway_rest_api.good_api.id
  stage_name    = "prod"
  deployment_id = "d-12345678"
}

resource "aws_api_gateway_method_settings" "good_settings" {
  rest_api_id = aws_api_gateway_rest_api.good_api.id
  stage_name  = aws_api_gateway_stage.good_stage.stage_name
  method_path = "*/*"

  settings {
    logging_level = "ERROR"
  }
}