1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81

# main.tf — DAT compliance fixture
# Produces zero DAT policy violations

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

# DAT-001 + DAT-002 + DAT-003 + DAT-004 + DAT-005
resource "aws_db_instance" "good_rds" {
  identifier                 = "good-rds"
  engine                     = "mysql"
  engine_version             = "8.0"
  instance_class             = "db.t3.micro"
  allocated_storage          = 20
  username                   = "admin"
  password                   = "Goodpassword123"
  publicly_accessible        = false
  storage_encrypted          = true
  kms_key_id                 = "arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd"
  deletion_protection        = true
  auto_minor_version_upgrade = true
  skip_final_snapshot        = false
  final_snapshot_identifier  = "good-rds-final"

  enabled_cloudwatch_logs_exports = ["audit", "error", "general", "slowquery"]
}

# DAT-006 — DynamoDB with PITR enabled
resource "aws_dynamodb_table" "good_table" {
  name         = "good-table"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "id"

  attribute {
    name = "id"
    type = "S"
  }

  point_in_time_recovery {
    enabled = true
  }
}

# DAT-007 + DAT-008 — Redshift private, with logging
resource "aws_redshift_cluster" "good_redshift" {
  cluster_identifier  = "good-redshift"
  database_name       = "gooddb"
  master_username     = "admin"
  master_password     = "Goodpassword123"
  node_type           = "dc2.large"
  cluster_type        = "single-node"
  publicly_accessible = false
  skip_final_snapshot = true
}

resource "aws_redshift_logging" "good_redshift_logging" {
  cluster_identifier   = aws_redshift_cluster.good_redshift.cluster_identifier
  log_destination_type = "s3"
  bucket_name          = "good-redshift-logs"
  s3_key_prefix        = "redshift/"
}

# DAT-009 — ElastiCache with encryption
resource "aws_elasticache_replication_group" "good_redis" {
  replication_group_id       = "good-redis"
  description                = "good redis"
  node_type                  = "cache.t3.micro"
  num_cache_clusters         = 1
  transit_encryption_enabled = true
  at_rest_encryption_enabled = true
  kms_key_id                 = "arn:aws:kms:ap-south-1:123456789012:key/mrk-1234abcd"
}