Compute Security Baselines

resource "azurerm_service_plan" "main" {
  name                = "asp-prod-001"
  resource_group_name = azurerm_resource_group.app.name
  location            = azurerm_resource_group.app.location
  os_type             = "Linux"
  sku_name            = "P1v3"               # Premium v3 for VNet integration
  zone_balancing_enabled = true              # Zone redundancy
}

resource "azurerm_linux_web_app" "main" {
  name                = "app-web-prod"
  resource_group_name = azurerm_resource_group.app.name
  location            = azurerm_resource_group.app.location
  service_plan_id     = azurerm_service_plan.main.id

  # IM-3: Managed Identity
  identity {
    type = "SystemAssigned"
  }

  site_config {
    minimum_tls_version       = "1.2"        # NS-8: Disable insecure protocols
    ftps_state                = "Disabled"   # IM: Disable basic auth channel
    http2_enabled             = true
    always_on                 = true
    vnet_route_all_enabled    = true         # NS-1: Route all traffic through VNet
    remote_debugging_enabled  = false        # PV: Reduce attack surface
  }

  # DP-3: HTTPS only
  https_only = true

  # IM: Disable basic auth for SCM and FTP
  # (Set via azapi_update_resource or site_config in newer provider versions)

  app_settings = {
    "WEBSITE_RUN_FROM_PACKAGE" = "1"         # DS: Immutable deployment
  }
}

# NS-2: Private Endpoint (disable public access)
resource "azurerm_private_endpoint" "app" {
  name                = "pe-app-web-prod"
  location            = azurerm_resource_group.app.location
  resource_group_name = azurerm_resource_group.app.name
  subnet_id           = azurerm_subnet.private_endpoints.id

  private_service_connection {
    name                           = "psc-app-web"
    private_connection_resource_id = azurerm_linux_web_app.main.id
    subresource_names              = ["sites"]
    is_manual_connection           = false
  }

  private_dns_zone_group {
    name                 = "pdz-app-web"
    private_dns_zone_ids = [azurerm_private_dns_zone.app_service.id]
  }
}

# NS-1: VNet Integration (outbound)
resource "azurerm_app_service_virtual_network_swift_connection" "main" {
  app_service_id = azurerm_linux_web_app.main.id
  subnet_id      = azurerm_subnet.app_integration.id
}

# LT-3: Diagnostic Settings
resource "azurerm_monitor_diagnostic_setting" "app" {
  name                       = "diag-app-web-prod"
  target_resource_id         = azurerm_linux_web_app.main.id
  log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id

  enabled_log { category = "AppServiceHTTPLogs" }
  enabled_log { category = "AppServiceConsoleLogs" }
  enabled_log { category = "AppServiceAuditLogs" }
  enabled_log { category = "AppServicePlatformLogs" }

  metric { category = "AllMetrics" }
}

resource "azurerm_linux_virtual_machine" "main" {
  name                = "vm-app-prod-001"
  resource_group_name = azurerm_resource_group.compute.name
  location            = azurerm_resource_group.compute.location
  size                = "Standard_D4s_v5"
  admin_username      = "azureadmin"
  zone                = "1"

  # IM-3: Managed Identity
  identity {
    type = "SystemAssigned"
  }

  # IM-1: Entra ID SSH login (no password auth)
  admin_ssh_key {
    username   = "azureadmin"
    public_key = file("~/.ssh/id_rsa.pub")
  }
  disable_password_authentication = true

  # NS: No Public IP — use Azure Bastion for access
  network_interface_ids = [azurerm_network_interface.vm_nic.id]

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Premium_LRS"
    # DP: Disk encryption set with CMK
    disk_encryption_set_id = azurerm_disk_encryption_set.main.id
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-jammy"
    sku       = "22_04-lts-gen2"
    version   = "latest"
  }

  # PV: Trusted Launch
  secure_boot_enabled = true
  vtpm_enabled        = true

  # DP: Encryption at host (all temp disks and caches encrypted)
  encryption_at_host_enabled = true
}

# NS-1: NIC in private subnet, no public IP
resource "azurerm_network_interface" "vm_nic" {
  name                = "nic-vm-app-prod-001"
  location            = azurerm_resource_group.compute.location
  resource_group_name = azurerm_resource_group.compute.name

  ip_configuration {
    name                          = "internal"
    subnet_id                     = azurerm_subnet.compute.id
    private_ip_address_allocation = "Dynamic"
    # No public_ip_address_id — access via Bastion only
  }
}

# ES-1: MDE via Defender for Servers auto-provisioning
# (Deployed automatically when Defender for Servers Plan 2 is enabled)

# BR-1: Azure Backup
resource "azurerm_backup_protected_vm" "main" {
  resource_group_name = azurerm_resource_group.compute.name
  recovery_vault_name = azurerm_recovery_services_vault.main.name
  source_vm_id        = azurerm_linux_virtual_machine.main.id
  backup_policy_id    = azurerm_backup_policy_vm.daily.id
}

resource "azurerm_service_plan" "func" {
  name                = "asp-func-prod"
  resource_group_name = azurerm_resource_group.app.name
  location            = azurerm_resource_group.app.location
  os_type             = "Linux"
  sku_name            = "EP1"                # Premium Elastic for VNet
}

resource "azurerm_linux_function_app" "main" {
  name                = "func-process-prod"
  resource_group_name = azurerm_resource_group.app.name
  location            = azurerm_resource_group.app.location
  service_plan_id     = azurerm_service_plan.func.id

  storage_account_name       = azurerm_storage_account.func.name
  storage_account_access_key = azurerm_storage_account.func.primary_access_key

  # IM-3: Managed Identity
  identity {
    type = "SystemAssigned"
  }

  site_config {
    minimum_tls_version       = "1.2"
    ftps_state                = "Disabled"
    vnet_route_all_enabled    = true
    remote_debugging_enabled  = false

    application_stack {
      dotnet_version              = "8.0"
      use_dotnet_isolated_runtime = true
    }
  }

  # DP-3: HTTPS only
  https_only = true

  app_settings = {
    "FUNCTIONS_WORKER_RUNTIME"       = "dotnet-isolated"
    "WEBSITE_RUN_FROM_PACKAGE"       = "1"
    # DP: Use Key Vault references instead of connection strings
    "ServiceBusConnection__fullyQualifiedNamespace" = "sb-prod.servicebus.windows.net"
  }
}

# NS-2: VNet Integration
resource "azurerm_app_service_virtual_network_swift_connection" "func" {
  app_service_id = azurerm_linux_function_app.main.id
  subnet_id      = azurerm_subnet.func_integration.id
}

resource "azurerm_container_app_environment" "main" {
  name                       = "cae-prod"
  resource_group_name        = azurerm_resource_group.app.name
  location                   = azurerm_resource_group.app.location
  log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id

  # NS-1: Internal VNet deployment
  infrastructure_subnet_id   = azurerm_subnet.container_apps.id
  internal_load_balancer_enabled = true         # Internal-only access
}

resource "azurerm_container_app" "api" {
  name                         = "api-prod"
  container_app_environment_id = azurerm_container_app_environment.main.id
  resource_group_name          = azurerm_resource_group.app.name
  revision_mode                = "Single"

  # IM-3: Managed Identity
  identity {
    type = "SystemAssigned"
  }

  template {
    container {
      name   = "api"
      image  = "myacr.azurecr.io/api:latest"
      cpu    = 0.5
      memory = "1Gi"
    }
  }

  # DP-3: HTTPS-only ingress
  ingress {
    external_enabled = false                    # Internal only
    target_port      = 8080
    transport        = "http"

    traffic_weight {
      percentage      = 100
      latest_revision = true
    }
  }

  secret {
    name                = "db-connection"
    key_vault_secret_id = azurerm_key_vault_secret.db_conn.versionless_id
    identity            = "System"              # DP: Key Vault reference
  }
}

resource "azurerm_virtual_desktop_host_pool" "main" {
  name                = "hp-prod"
  resource_group_name = azurerm_resource_group.avd.name
  location            = azurerm_resource_group.avd.location
  type                = "Pooled"
  load_balancer_type  = "BreadthFirst"

  # DP-7: RDP Properties Hardening
  custom_rdp_properties = join(";", [
    "targetisaadjoined:i:1",                    # IM-1: Entra ID Join
    "enablecredsspsupport:i:1",                 # NLA enabled
    "redirectclipboard:i:0",                    # Disable clipboard
    "redirectprinters:i:0",                     # Disable printers
    "drivestoredirect:s:",                       # Disable drive redirection
    "audiocapturemode:i:0",                     # Disable mic
    "camerastoredirect:s:",                      # Disable camera
    "devicestoredirect:s:",                      # Disable USB devices
  ])

  scheduled_agent_updates {
    enabled  = true
    timezone = "UTC"
    schedule {
      day_of_week = "Saturday"
      hour_of_day = 2
    }
  }
}

resource "azurerm_virtual_desktop_workspace" "main" {
  name                = "ws-prod"
  resource_group_name = azurerm_resource_group.avd.name
  location            = azurerm_resource_group.avd.location
}

# LT-3: Diagnostic settings for connection monitoring
resource "azurerm_monitor_diagnostic_setting" "hp" {
  name                       = "diag-hp-prod"
  target_resource_id         = azurerm_virtual_desktop_host_pool.main.id
  log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id

  enabled_log { category = "Checkpoint" }
  enabled_log { category = "Connection" }
  enabled_log { category = "Error" }
  enabled_log { category = "HostRegistration" }
  enabled_log { category = "AgentHealthStatus" }
}