terraform {
  required_version = ">= 1.5"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region                      = "ap-northeast-1"
  access_key                  = "mock_access_key"
  secret_key                  = "mock_secret_key"
  skip_credentials_validation = true
  skip_metadata_api_check     = true
  skip_requesting_account_id  = true
}

# VIOLATION: S3 bucket without public access block
# CIS AWS Foundations: 2.1.5 (S3 Block Public Access)
resource "aws_s3_bucket" "public_data" {
  bucket = "insecure-public-data-bucket-example"
}

# VIOLATION: S3 bucket with public-read ACL
# CIS AWS Foundations: 2.1.5
resource "aws_s3_bucket_acl" "public_data_acl" {
  bucket = aws_s3_bucket.public_data.id
  acl    = "public-read"
}

# VIOLATION: S3 bucket without server-side encryption
# CIS AWS Foundations: 2.1.1 (Ensure S3 buckets encrypted at rest)
resource "aws_s3_bucket" "unencrypted" {
  bucket = "insecure-unencrypted-bucket-example"
}

# VIOLATION: S3 bucket without versioning and access logging
# CIS AWS Foundations: 2.1.3 (versioning), 3.6 (S3 access logging)
resource "aws_s3_bucket" "no_versioning_logging" {
  bucket = "insecure-no-versioning-bucket-example"
}

# VIOLATION: IAM policy with wildcard action and resource (full admin)
# CIS AWS Foundations: 1.16 (Ensure IAM policies that allow full "*:*" privileges are not attached)
resource "aws_iam_policy" "admin_wildcard" {
  name = "insecure-admin-wildcard-policy"
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = "*"
        Resource = "*"
      }
    ]
  })
}

# VIOLATION: IAM role assumable by any AWS account
# CIS AWS Foundations: related to 1.22 (cross-account trust restrictions)
resource "aws_iam_role" "open_assume_role" {
  name = "insecure-open-assume-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          AWS = "*"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })
}

# VIOLATION: IAM user with directly attached policy (should use group)
# CIS AWS Foundations: 1.15 (Ensure IAM Users Receive Permissions Only Through Groups)
resource "aws_iam_user" "direct_attach_user" {
  name = "insecure-direct-attach-user"
}

resource "aws_iam_user_policy_attachment" "direct_attach" {
  user       = aws_iam_user.direct_attach_user.name
  policy_arn = aws_iam_policy.admin_wildcard.arn
}

# VPC without flow logs
# CIS AWS Foundations: 3.9 (Ensure VPC flow logging is enabled in all VPCs)
resource "aws_vpc" "insecure_vpc" {
  cidr_block = "10.0.0.0/16"
  # VIOLATION: no associated aws_flow_log resource
}

# VIOLATION: Security group allows SSH from 0.0.0.0/0
# CIS AWS Foundations: 5.2 (Ensure no SG allows ingress from 0.0.0.0/0 to port 22)
resource "aws_security_group" "ssh_open" {
  name        = "insecure-ssh-open"
  description = "Allow SSH from anywhere"
  vpc_id      = aws_vpc.insecure_vpc.id

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# VIOLATION: Security group allows RDP from 0.0.0.0/0
# CIS AWS Foundations: 5.3 (Ensure no SG allows ingress from 0.0.0.0/0 to port 3389)
resource "aws_security_group" "rdp_open" {
  name        = "insecure-rdp-open"
  description = "Allow RDP from anywhere"
  vpc_id      = aws_vpc.insecure_vpc.id

  ingress {
    from_port   = 3389
    to_port     = 3389
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

# VIOLATION: Security group allows all traffic from 0.0.0.0/0
resource "aws_security_group" "all_open" {
  name        = "insecure-all-open"
  description = "Allow all traffic"
  vpc_id      = aws_vpc.insecure_vpc.id

  ingress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}

resource "aws_s3_bucket" "trail_bucket" {
  bucket = "insecure-trail-bucket-example"
}

# VIOLATION: CloudTrail with logging disabled
# CIS AWS Foundations: 3.1 (Ensure CloudTrail is enabled in all regions)
resource "aws_cloudtrail" "disabled" {
  name           = "insecure-disabled-trail"
  s3_bucket_name = aws_s3_bucket.trail_bucket.id

  enable_logging                = false
  is_multi_region_trail         = false
  enable_log_file_validation    = false
  include_global_service_events = false
}

# VIOLATION: CloudTrail without KMS encryption and log file validation
# CIS AWS Foundations: 3.2 (log file validation), 3.7 (KMS encryption)
resource "aws_cloudtrail" "no_encryption" {
  name           = "insecure-no-encryption-trail"
  s3_bucket_name = aws_s3_bucket.trail_bucket.id

  enable_logging             = true
  enable_log_file_validation = false
  # kms_key_id intentionally not set
}

# VIOLATION: EBS volume without encryption
# CIS AWS Foundations: 2.2.1 (Ensure EBS volume encryption is enabled)
resource "aws_ebs_volume" "unencrypted" {
  availability_zone = "ap-northeast-1a"
  size              = 10
  encrypted         = false
}

# VIOLATION: EBS snapshot from unencrypted volume
resource "aws_ebs_snapshot" "unencrypted_snapshot" {
  volume_id = aws_ebs_volume.unencrypted.id
}

resource "aws_subnet" "public_a" {
  vpc_id            = aws_vpc.insecure_vpc.id
  cidr_block        = "10.0.1.0/24"
  availability_zone = "ap-northeast-1a"
}

resource "aws_subnet" "public_b" {
  vpc_id            = aws_vpc.insecure_vpc.id
  cidr_block        = "10.0.2.0/24"
  availability_zone = "ap-northeast-1b"
}

resource "aws_db_subnet_group" "insecure" {
  name       = "insecure-rds-subnet-group"
  subnet_ids = [aws_subnet.public_a.id, aws_subnet.public_b.id]
}

# VIOLATION: RDS publicly accessible, unencrypted, no backup, hardcoded password
resource "aws_db_instance" "insecure_db" {
  identifier           = "insecure-public-db"
  engine               = "mysql"
  engine_version       = "8.0"
  instance_class       = "db.t3.micro"
  allocated_storage    = 20
  username             = "admin"
  password             = "InsecurePassword123!"
  db_subnet_group_name = aws_db_subnet_group.insecure.name

  publicly_accessible     = true
  storage_encrypted       = false
  backup_retention_period = 0
  deletion_protection     = false
  skip_final_snapshot     = true
}

# VIOLATION: KMS key without rotation enabled
# CIS AWS Foundations: 3.8 (Ensure rotation for customer-created CMKs is enabled)
resource "aws_kms_key" "no_rotation" {
  description             = "insecure-no-rotation-key"
  deletion_window_in_days = 7
  enable_key_rotation     = false
}