Messaging & Events Security Baselines

resource "azurerm_servicebus_namespace" "main" {
  name                = "sb-messaging-prod"
  resource_group_name = azurerm_resource_group.messaging.name
  location            = azurerm_resource_group.messaging.location
  sku                 = "Premium"              # Required for VNet, CMK, zone redundancy
  capacity            = 1                      # Messaging units
  premium_messaging_partitions = 1
  zone_redundant      = true                   # BR: Zone redundancy

  # NS-2: Disable public network access
  public_network_access_enabled = false

  # NS-8: TLS 1.2 minimum
  minimum_tls_version = "1.2"

  # IM-1: Disable SAS/key-based auth — Entra only
  local_auth_enabled = false

  # DP-5: CMK encryption
  customer_managed_key {
    key_vault_key_id                  = azurerm_key_vault_key.sb_cmk.id
    identity_id                       = azurerm_user_assigned_identity.sb.id
    infrastructure_encryption_enabled = true    # Double encryption
  }

  identity {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.sb.id]
  }
}

# Queue with dead letter monitoring
resource "azurerm_servicebus_queue" "orders" {
  name         = "orders"
  namespace_id = azurerm_servicebus_namespace.main.id

  max_delivery_count         = 10
  dead_lettering_on_message_expiration = true
  requires_duplicate_detection = true
  duplicate_detection_history_time_window = "PT10M"

  # Messages auto-expire after 14 days (data retention limit)
  default_message_ttl = "P14D"
}

# Topic with subscription filtering
resource "azurerm_servicebus_topic" "events" {
  name         = "business-events"
  namespace_id = azurerm_servicebus_namespace.main.id

  max_size_in_megabytes        = 5120
  requires_duplicate_detection = true
  default_message_ttl          = "P7D"
}

# NS-2: Private Endpoint
resource "azurerm_private_endpoint" "sb" {
  name                = "pe-sb-prod"
  location            = azurerm_resource_group.messaging.location
  resource_group_name = azurerm_resource_group.messaging.name
  subnet_id           = azurerm_subnet.messaging.id

  private_service_connection {
    name                           = "psc-sb-prod"
    private_connection_resource_id = azurerm_servicebus_namespace.main.id
    subresource_names              = ["namespace"]
    is_manual_connection           = false
  }

  private_dns_zone_group {
    name                 = "pdz-sb"
    private_dns_zone_ids = [azurerm_private_dns_zone.servicebus.id]
  }
}

# IM: RBAC role assignment for sending application
resource "azurerm_role_assignment" "app_sb_sender" {
  scope                = azurerm_servicebus_queue.orders.id
  role_definition_name = "Azure Service Bus Data Sender"
  principal_id         = azurerm_linux_web_app.api.identity[0].principal_id
}

resource "azurerm_role_assignment" "func_sb_receiver" {
  scope                = azurerm_servicebus_queue.orders.id
  role_definition_name = "Azure Service Bus Data Receiver"
  principal_id         = azurerm_linux_function_app.processor.identity[0].principal_id
}

# LT-3: Diagnostic Settings
resource "azurerm_monitor_diagnostic_setting" "sb" {
  name                       = "diag-sb-prod"
  target_resource_id         = azurerm_servicebus_namespace.main.id
  log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id

  enabled_log { category = "OperationalLogs" }
  enabled_log { category = "VNetAndIPFilteringLogs" }
  enabled_log { category = "RuntimeAuditLogs" }

  metric { category = "AllMetrics" }
}

resource "azurerm_eventhub_namespace" "main" {
  name                = "evhns-telemetry-prod"
  resource_group_name = azurerm_resource_group.messaging.name
  location            = azurerm_resource_group.messaging.location
  sku                 = "Premium"
  capacity            = 1
  zone_redundant      = true

  # NS-2: Disable public access
  public_network_access_enabled = false

  # NS-8: TLS 1.2 minimum
  minimum_tls_version = "1.2"

  # IM-1: Disable SAS/key auth
  local_authentication_enabled = false

  identity {
    type = "SystemAssigned"
  }
}

resource "azurerm_eventhub" "telemetry" {
  name             = "telemetry-events"
  namespace_id     = azurerm_eventhub_namespace.main.id
  partition_count  = 8
  message_retention = 7                       # Retention days

  # BR: Capture events to immutable storage
  capture_description {
    enabled             = true
    encoding            = "Avro"
    interval_in_seconds = 300
    size_limit_in_bytes = 314572800

    destination {
      name                = "EventHubArchive"
      archive_name_format = "{Namespace}/{EventHub}/{PartitionId}/{Year}/{Month}/{Day}/{Hour}/{Minute}/{Second}"
      blob_container_name = azurerm_storage_container.capture.name
      storage_account_id  = azurerm_storage_account.archive.id
    }
  }
}

# NS-2: Private Endpoint
resource "azurerm_private_endpoint" "eh" {
  name                = "pe-evhns-prod"
  location            = azurerm_resource_group.messaging.location
  resource_group_name = azurerm_resource_group.messaging.name
  subnet_id           = azurerm_subnet.messaging.id

  private_service_connection {
    name                           = "psc-evhns-prod"
    private_connection_resource_id = azurerm_eventhub_namespace.main.id
    subresource_names              = ["namespace"]
    is_manual_connection           = false
  }
}

# IM: Least privilege RBAC
resource "azurerm_role_assignment" "producer_eh" {
  scope                = azurerm_eventhub.telemetry.id
  role_definition_name = "Azure Event Hubs Data Sender"
  principal_id         = azurerm_linux_web_app.telemetry_api.identity[0].principal_id
}

resource "azurerm_role_assignment" "consumer_eh" {
  scope                = azurerm_eventhub.telemetry.id
  role_definition_name = "Azure Event Hubs Data Receiver"
  principal_id         = azurerm_linux_function_app.telemetry_processor.identity[0].principal_id
}