Identity & Security Baselines

# Note: Conditional Access requires Microsoft Graph provider (azuread)
# These represent the minimum CA policy set for any Azure environment

# Policy 1: Block Legacy Authentication
resource "azuread_conditional_access_policy" "block_legacy" {
  display_name = "CA001 - Block Legacy Authentication"
  state        = "enabled"

  conditions {
    client_app_types = ["exchangeActiveSync", "other"]
    applications { included_applications = ["All"] }
    users { included_users = ["All"] }
  }

  grant_controls {
    built_in_controls = ["block"]
    operator          = "OR"
  }
}

# Policy 2: Require MFA for All Users
resource "azuread_conditional_access_policy" "require_mfa" {
  display_name = "CA002 - Require MFA for All Users"
  state        = "enabled"

  conditions {
    client_app_types = ["browser", "mobileAppsAndDesktopClients"]
    applications { included_applications = ["All"] }
    users {
      included_users  = ["All"]
      excluded_groups = [azuread_group.break_glass.object_id]
    }
  }

  grant_controls {
    built_in_controls = ["mfa"]
    operator          = "OR"
  }
}

# Policy 3: Require Compliant Device for Admin Portals
resource "azuread_conditional_access_policy" "admin_compliant" {
  display_name = "CA003 - Require Compliant Device for Admin Portals"
  state        = "enabled"

  conditions {
    client_app_types = ["browser", "mobileAppsAndDesktopClients"]
    applications {
      included_applications = [
        "797f4846-ba00-4fd7-ba43-dac1f8f63013",  # Azure Portal
        "0000000a-0000-0000-c000-000000000000",  # Intune
      ]
    }
    users { included_roles = ["62e90394-69f5-4237-9190-012177145e10"] }  # Global Admin
  }

  grant_controls {
    built_in_controls = ["compliantDevice", "mfa"]
    operator          = "AND"
  }
}

# Policy 4: Block Access from Untrusted Locations for Privileged Roles
resource "azuread_conditional_access_policy" "block_untrusted_admins" {
  display_name = "CA004 - Block Admins from Untrusted Locations"
  state        = "enabled"

  conditions {
    client_app_types = ["browser", "mobileAppsAndDesktopClients"]
    applications { included_applications = ["All"] }
    users {
      included_roles = [
        "62e90394-69f5-4237-9190-012177145e10",   # Global Admin
        "e8611ab8-c189-46e8-94e1-60213ab1f814",   # Privileged Role Admin
      ]
    }
    locations {
      included_locations = ["All"]
      excluded_locations = [azuread_named_location.trusted.id]
    }
  }

  grant_controls {
    built_in_controls = ["block"]
    operator          = "OR"
  }
}

# Enable Defender for Cloud plans at subscription level
locals {
  defender_plans = [
    "CloudPosture",        # Defender CSPM
    "VirtualMachines",     # Defender for Servers
    "SqlServers",          # Defender for SQL
    "StorageAccounts",     # Defender for Storage
    "Containers",          # Defender for Containers
    "AppServices",         # Defender for App Service
    "KeyVaults",           # Defender for Key Vault
    "CosmosDbs",          # Defender for Cosmos DB
    "Arm",                 # Defender for Resource Manager
    "Dns",                 # Defender for DNS
  ]
}

resource "azurerm_security_center_subscription_pricing" "plans" {
  for_each      = toset(local.defender_plans)
  tier          = "Standard"
  resource_type = each.value

  # Servers Plan 2 with sub-plan
  dynamic "extension" {
    for_each = each.value == "VirtualMachines" ? ["MdeDesignatedSubscription"] : []
    content {
      name = "MdeDesignatedSubscription"
    }
  }
}

# Auto-provisioning: AMA agent for VMs
resource "azurerm_security_center_auto_provisioning" "ama" {
  auto_provision = "On"
}

# Security contact for alerts
resource "azurerm_security_center_contact" "main" {
  email               = "security-team@company.com"
  phone               = "+1-555-0100"
  alert_notifications = true
  alerts_to_admins    = true
}

# Assign MCSB initiative as default policy
resource "azurerm_subscription_policy_assignment" "mcsb" {
  name                 = "mcsb-default"
  subscription_id      = data.azurerm_subscription.current.id
  policy_definition_id = "/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8"
  display_name         = "Microsoft Cloud Security Benchmark"
}

resource "azurerm_log_analytics_workspace" "sentinel" {
  name                = "law-sentinel-prod"
  resource_group_name = azurerm_resource_group.security.name
  location            = azurerm_resource_group.security.location
  sku                 = "PerGB2018"
  retention_in_days   = 90                    # LT-6: Interactive retention

  # Archive tier for long-term compliance
  # Configure via workspace data export or table-level retention
}

resource "azurerm_sentinel_log_analytics_workspace_onboarding" "main" {
  workspace_id                 = azurerm_log_analytics_workspace.sentinel.id
  customer_managed_key_enabled = false
}

# Data connector: Entra ID (critical)
resource "azurerm_sentinel_data_connector_azure_active_directory" "entra" {
  name                       = "entra-id"
  log_analytics_workspace_id = azurerm_sentinel_log_analytics_workspace_onboarding.main.workspace_id
}

# Data connector: Azure Activity
resource "azurerm_sentinel_data_connector_azure_activity" "activity" {
  name                       = "azure-activity"
  log_analytics_workspace_id = azurerm_sentinel_log_analytics_workspace_onboarding.main.workspace_id
}

# Data connector: Defender for Cloud
resource "azurerm_sentinel_data_connector_azure_security_center" "defender" {
  name                       = "defender-for-cloud"
  log_analytics_workspace_id = azurerm_sentinel_log_analytics_workspace_onboarding.main.workspace_id
}

# Analytics rule: Detect break-glass account usage
resource "azurerm_sentinel_alert_rule_scheduled" "break_glass" {
  name                       = "break-glass-usage"
  display_name               = "Break Glass Account Sign-In Detected"
  log_analytics_workspace_id = azurerm_sentinel_log_analytics_workspace_onboarding.main.workspace_id
  severity                   = "High"
  query_frequency            = "PT5M"
  query_period               = "PT5M"
  trigger_operator           = "GreaterThan"
  trigger_threshold          = 0

  query = <<-QUERY
    SigninLogs
    | where UserPrincipalName in ("breakglass1@company.onmicrosoft.com", "breakglass2@company.onmicrosoft.com")
    | project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, ResultType
  QUERY

  entity_mapping {
    entity_type = "Account"
    field_mapping {
      identifier  = "FullName"
      column_name = "UserPrincipalName"
    }
  }

  entity_mapping {
    entity_type = "IP"
    field_mapping {
      identifier  = "Address"
      column_name = "IPAddress"
    }
  }
}