Networking Security Baselines

resource "azurerm_cdn_frontdoor_profile" "main" {
  name                = "fd-prod"
  resource_group_name = azurerm_resource_group.network.name
  sku_name            = "Premium_AzureFrontDoor"    # Private Link + managed rulesets
}

# NS-6: WAF Policy in Prevention Mode
resource "azurerm_cdn_frontdoor_firewall_policy" "main" {
  name                = "wafprod"
  resource_group_name = azurerm_resource_group.network.name
  sku_name            = azurerm_cdn_frontdoor_profile.main.sku_name
  mode                = "Prevention"

  managed_rule {
    type    = "Microsoft_DefaultRuleSet"
    version = "2.1"                           # Latest OWASP ruleset
    action  = "Block"
  }

  managed_rule {
    type    = "Microsoft_BotManagerRuleSet"
    version = "1.0"
    action  = "Block"
  }

  # Rate limiting rule
  custom_rule {
    name     = "RateLimitRule"
    type     = "RateLimitRule"
    action   = "Block"
    priority = 100
    rate_limit_duration_in_minutes = 1
    rate_limit_threshold           = 100

    match_condition {
      match_variable = "RemoteAddr"
      operator       = "IPMatch"
      match_values   = ["0.0.0.0/0"]
      negation_condition = true
    }
  }
}

resource "azurerm_cdn_frontdoor_endpoint" "main" {
  name                     = "ep-prod"
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.main.id
}

# NS-2: Private Link origin (no public exposure on backend)
resource "azurerm_cdn_frontdoor_origin_group" "app" {
  name                     = "og-app-prod"
  cdn_frontdoor_profile_id = azurerm_cdn_frontdoor_profile.main.id

  health_probe {
    interval_in_seconds = 30
    path                = "/health"
    protocol            = "Https"
  }

  load_balancing {
    sample_size                 = 4
    successful_samples_required = 3
  }
}

resource "azurerm_cdn_frontdoor_origin" "app" {
  name                          = "origin-app-prod"
  cdn_frontdoor_origin_group_id = azurerm_cdn_frontdoor_origin_group.app.id
  host_name                     = azurerm_linux_web_app.main.default_hostname
  origin_host_header            = azurerm_linux_web_app.main.default_hostname
  certificate_name_check_enabled = true
  enabled                        = true

  private_link {
    location               = azurerm_resource_group.app.location
    private_link_target_id = azurerm_linux_web_app.main.id
    target_type            = "sites"
    request_message        = "Front Door Private Link"
  }
}

# LT-3: Diagnostic Settings
resource "azurerm_monitor_diagnostic_setting" "fd" {
  name                       = "diag-fd-prod"
  target_resource_id         = azurerm_cdn_frontdoor_profile.main.id
  log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id

  enabled_log { category = "FrontDoorAccessLog" }
  enabled_log { category = "FrontDoorWebApplicationFirewallLog" }
  enabled_log { category = "FrontDoorHealthProbeLog" }

  metric { category = "AllMetrics" }
}

resource "azurerm_firewall_policy" "main" {
  name                = "fwpol-hub-prod"
  resource_group_name = azurerm_resource_group.hub.name
  location            = azurerm_resource_group.hub.location
  sku                 = "Premium"

  threat_intelligence_mode = "Deny"

  intrusion_detection {
    mode = "Deny"                             # Alert+Deny for IDPS

    traffic_bypass {
      name                  = "AllowHealthProbes"
      protocol              = "TCP"
      source_addresses      = ["168.63.129.16/32"]
      destination_addresses = ["*"]
      destination_ports     = ["*"]
    }
  }

  dns {
    proxy_enabled = true                      # DNS proxy for private DNS resolution
  }
}

# Application rule collection — FQDN filtering
resource "azurerm_firewall_policy_rule_collection_group" "app_rules" {
  name               = "rcg-app-prod"
  firewall_policy_id = azurerm_firewall_policy.main.id
  priority           = 200

  application_rule_collection {
    name     = "AllowAzurePaaS"
    priority = 210
    action   = "Allow"

    rule {
      name = "AllowAzureMonitor"
      source_addresses = ["10.0.0.0/8"]
      protocols { type = "Https"; port = 443 }
      destination_fqdn_tags = ["AzureMonitor"]
    }
  }

  network_rule_collection {
    name     = "DenyAll"
    priority = 300
    action   = "Deny"

    rule {
      name                  = "DenyInternetOutbound"
      source_addresses      = ["10.0.0.0/8"]
      destination_addresses = ["*"]
      destination_ports     = ["*"]
      protocols             = ["Any"]
    }
  }
}

resource "azurerm_virtual_network_gateway" "vpn" {
  name                = "vpng-hub-prod"
  location            = azurerm_resource_group.hub.location
  resource_group_name = azurerm_resource_group.hub.name
  type                = "Vpn"
  vpn_type            = "RouteBased"
  sku                 = "VpnGw2AZ"           # Zone-redundant
  active_active       = true                  # BR: High availability
  enable_bgp          = true

  ip_configuration {
    name                 = "vpn-ipconfig-1"
    public_ip_address_id = azurerm_public_ip.vpn_1.id
    subnet_id            = azurerm_subnet.gateway.id
  }

  ip_configuration {
    name                 = "vpn-ipconfig-2"
    public_ip_address_id = azurerm_public_ip.vpn_2.id
    subnet_id            = azurerm_subnet.gateway.id
  }
}

# NS-9: Custom IPsec policy (strong crypto only)
resource "azurerm_virtual_network_gateway_connection" "onprem" {
  name                = "conn-onprem-prod"
  location            = azurerm_resource_group.hub.location
  resource_group_name = azurerm_resource_group.hub.name
  type                = "IPsec"

  virtual_network_gateway_id = azurerm_virtual_network_gateway.vpn.id
  local_network_gateway_id   = azurerm_local_network_gateway.onprem.id
  shared_key                 = data.azurerm_key_vault_secret.vpn_psk.value

  ipsec_policy {
    sa_lifetime       = 3600                  # 1 hour
    sa_datasize       = 102400000             # 100 GB
    ipsec_encryption  = "GCMAES256"           # AES-256-GCM
    ipsec_integrity   = "GCMAES256"
    ike_encryption    = "AES256"
    ike_integrity     = "SHA256"
    dh_group          = "DHGroup14"           # 2048-bit
    pfs_group         = "PFS2048"
  }
}

resource "azurerm_application_gateway" "main" {
  name                = "appgw-prod"
  resource_group_name = azurerm_resource_group.network.name
  location            = azurerm_resource_group.network.location

  sku {
    name     = "WAF_v2"
    tier     = "WAF_v2"
  }

  autoscale_configuration {
    min_capacity = 2
    max_capacity = 10
  }

  # NS-1: VNet deployment
  gateway_ip_configuration {
    name      = "appgw-ipconfig"
    subnet_id = azurerm_subnet.appgw.id
  }

  # DP-3: HTTPS listener with TLS 1.2+
  ssl_policy {
    policy_type = "Predefined"
    policy_name = "AppGwSslPolicy20220101S"   # TLS 1.2+ only
  }

  # IM-3: Key Vault certificate via managed identity
  identity {
    type         = "UserAssigned"
    identity_ids = [azurerm_user_assigned_identity.appgw.id]
  }

  ssl_certificate {
    name                = "frontend-cert"
    key_vault_secret_id = azurerm_key_vault_certificate.frontend.versionless_secret_id
  }

  # NS-6: WAF configuration
  waf_configuration {
    enabled          = true
    firewall_mode    = "Prevention"
    rule_set_type    = "OWASP"
    rule_set_version = "3.2"
  }
}

resource "azurerm_subnet" "bastion" {
  name                 = "AzureBastionSubnet"   # Must be this exact name
  resource_group_name  = azurerm_resource_group.hub.name
  virtual_network_name = azurerm_virtual_network.hub.name
  address_prefixes     = ["10.0.1.0/26"]        # /26 minimum
}

resource "azurerm_bastion_host" "main" {
  name                = "bastion-hub-prod"
  location            = azurerm_resource_group.hub.location
  resource_group_name = azurerm_resource_group.hub.name
  sku                 = "Standard"              # Session recording + native client

  ip_configuration {
    name                 = "bastion-ipconfig"
    subnet_id            = azurerm_subnet.bastion.id
    public_ip_address_id = azurerm_public_ip.bastion.id
  }
}

# LT-3: Session audit logs
resource "azurerm_monitor_diagnostic_setting" "bastion" {
  name                       = "diag-bastion-prod"
  target_resource_id         = azurerm_bastion_host.main.id
  log_analytics_workspace_id = azurerm_log_analytics_workspace.main.id

  enabled_log { category = "BastionAuditLogs" }
  metric { category = "AllMetrics" }
}

resource "azurerm_express_route_circuit" "main" {
  name                  = "erc-prod"
  resource_group_name   = azurerm_resource_group.hub.name
  location              = azurerm_resource_group.hub.location
  service_provider_name = "Equinix"
  peering_location      = "Silicon Valley"
  bandwidth_in_mbps     = 1000

  sku {
    tier   = "Premium"               # Cross-region + Global Reach
    family = "UnlimitedData"
  }
}

resource "azurerm_virtual_network_gateway" "er" {
  name                = "ergw-hub-prod"
  location            = azurerm_resource_group.hub.location
  resource_group_name = azurerm_resource_group.hub.name
  type                = "ExpressRoute"
  sku                 = "ErGw2AZ"    # Zone-redundant

  ip_configuration {
    name                 = "ergw-ipconfig"
    public_ip_address_id = azurerm_public_ip.ergw.id
    subnet_id            = azurerm_subnet.gateway.id
  }
}

resource "azurerm_virtual_network_gateway_connection" "er" {
  name                            = "conn-er-prod"
  location                        = azurerm_resource_group.hub.location
  resource_group_name             = azurerm_resource_group.hub.name
  type                            = "ExpressRoute"
  virtual_network_gateway_id      = azurerm_virtual_network_gateway.er.id
  express_route_circuit_id        = azurerm_express_route_circuit.main.id
}