CDE Network Security

# Terraform - AWS VPC for CDE

module "vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "~> 5.0"

  name = "cde-vpc"
  cidr = "10.0.0.0/16"

  azs             = ["us-east-1a", "us-east-1b", "us-east-1c"]
  private_subnets = ["10.0.10.0/24", "10.0.11.0/24", "10.0.12.0/24"]
  public_subnets  = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]

  # Workspace subnets - larger CIDR for many workspaces
  intra_subnets   = ["10.0.20.0/22", "10.0.24.0/22", "10.0.28.0/22"]

  enable_nat_gateway     = true
  single_nat_gateway     = false  # HA: one per AZ
  enable_vpn_gateway     = false
  enable_dns_hostnames   = true
  enable_dns_support     = true

  # VPC Flow Logs for security monitoring
  enable_flow_log                      = true
  create_flow_log_cloudwatch_log_group = true
  create_flow_log_cloudwatch_iam_role  = true
  flow_log_max_aggregation_interval    = 60

  tags = {
    Environment = "production"
    Project     = "cde"
  }
}

# Private endpoints for AWS services (no internet required)
resource "aws_vpc_endpoint" "s3" {
  vpc_id       = module.vpc.vpc_id
  service_name = "com.amazonaws.us-east-1.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = module.vpc.private_route_table_ids
}

resource "aws_vpc_endpoint" "ecr_api" {
  vpc_id              = module.vpc.vpc_id
  service_name        = "com.amazonaws.us-east-1.ecr.api"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = module.vpc.private_subnets
  security_group_ids  = [aws_security_group.vpc_endpoints.id]
  private_dns_enabled = true
}

resource "aws_vpc_endpoint" "ecr_dkr" {
  vpc_id              = module.vpc.vpc_id
  service_name        = "com.amazonaws.us-east-1.ecr.dkr"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = module.vpc.private_subnets
  security_group_ids  = [aws_security_group.vpc_endpoints.id]
  private_dns_enabled = true
}

# Terraform - Azure VNet for CDE

resource "azurerm_virtual_network" "cde" {
  name                = "cde-vnet"
  location            = azurerm_resource_group.cde.location
  resource_group_name = azurerm_resource_group.cde.name
  address_space       = ["10.0.0.0/16"]
}

resource "azurerm_subnet" "control_plane" {
  name                 = "control-plane-subnet"
  resource_group_name  = azurerm_resource_group.cde.name
  virtual_network_name = azurerm_virtual_network.cde.name
  address_prefixes     = ["10.0.10.0/24"]

  # Enable private endpoint support
  private_endpoint_network_policies_enabled = true
}

resource "azurerm_subnet" "workspaces" {
  name                 = "workspaces-subnet"
  resource_group_name  = azurerm_resource_group.cde.name
  virtual_network_name = azurerm_virtual_network.cde.name
  address_prefixes     = ["10.0.20.0/22"]

  # AKS node pool subnet
  service_endpoints = ["Microsoft.Storage", "Microsoft.ContainerRegistry"]
}

resource "azurerm_subnet" "aks" {
  name                 = "aks-subnet"
  resource_group_name  = azurerm_resource_group.cde.name
  virtual_network_name = azurerm_virtual_network.cde.name
  address_prefixes     = ["10.0.32.0/20"]
}

# Network Security Group for workspaces
resource "azurerm_network_security_group" "workspaces" {
  name                = "workspaces-nsg"
  location            = azurerm_resource_group.cde.location
  resource_group_name = azurerm_resource_group.cde.name

  security_rule {
    name                       = "DenyInternetOutbound"
    priority                   = 100
    direction                  = "Outbound"
    access                     = "Deny"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "Internet"
  }

  security_rule {
    name                       = "AllowAzureServicesOutbound"
    priority                   = 90
    direction                  = "Outbound"
    access                     = "Allow"
    protocol                   = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
    source_address_prefix      = "*"
    destination_address_prefix = "AzureCloud"
  }
}