Private object ingestion with expiration (TTL)

# Ingesta privada de objetos con expiración (TTL) — Azure
#
# Storage Account sin claves (solo Entra ID), sin acceso público de red,
# alcanzable por Private Endpoint, con un contenedor de ingesta cuyo
# contenido se borra a los N días.

resource "azurerm_resource_group" "this" {
  name     = "rg-${var.name}"
  location = var.location
  tags     = var.tags
}

# --- Red ----------------------------------------------------------------------

resource "azurerm_virtual_network" "this" {
  name                = "vnet-${var.name}"
  resource_group_name = azurerm_resource_group.this.name
  location            = azurerm_resource_group.this.location
  address_space       = [var.vnet_address_space]
  tags                = var.tags
}

resource "azurerm_subnet" "endpoints" {
  name                 = "snet-private-endpoints"
  resource_group_name  = azurerm_resource_group.this.name
  virtual_network_name = azurerm_virtual_network.this.name
  address_prefixes     = [var.endpoints_subnet_prefix]
}

# Sin reglas propias: las default permiten tráfico intra-VNet y bloquean internet.
# Para que el NSG filtre tráfico hacia Private Endpoints hay que habilitar
# network policies en la subnet (private_endpoint_network_policies).
resource "azurerm_network_security_group" "endpoints" {
  name                = "nsg-${var.name}-endpoints"
  resource_group_name = azurerm_resource_group.this.name
  location            = azurerm_resource_group.this.location
  tags                = var.tags
}

resource "azurerm_subnet_network_security_group_association" "endpoints" {
  subnet_id                 = azurerm_subnet.endpoints.id
  network_security_group_id = azurerm_network_security_group.endpoints.id
}

# --- Storage ------------------------------------------------------------------

resource "azurerm_storage_account" "this" {
  #checkov:skip=CKV2_AZURE_1:CMK fuera de alcance del patrón; cifrado con claves de Microsoft + infraestructura.
  #checkov:skip=CKV_AZURE_206:ZRS es suficiente para datos efímeros con TTL; GRS duplica costo sin beneficio.
  #checkov:skip=CKV_AZURE_33:No se usa Queue Storage en este patrón.
  #checkov:skip=CKV_AZURE_59:checkov evalúa public_network_access_enabled (deprecado en azurerm 5); acá se usa public_network_access = "Disabled".
  #checkov:skip=CKV_AZURE_36:Sin bypass de servicios de confianza a propósito: el único camino es el Private Endpoint.
  name                     = var.storage_account_name
  resource_group_name      = azurerm_resource_group.this.name
  location                 = azurerm_resource_group.this.location
  account_kind             = "StorageV2"
  account_tier             = "Standard"
  account_replication_type = "ZRS"

  # Identidad: solo Entra ID. Sin Shared Key, sin SAS de cuenta, sin usuarios locales.
  shared_access_key_enabled       = false
  default_to_oauth_authentication = true
  local_user_enabled              = false

  # Red: sin endpoint público. El único camino es el Private Endpoint.
  public_network_access = "Disabled"

  allow_nested_items_to_be_public   = false
  cross_tenant_replication_enabled  = false
  https_traffic_only_enabled        = true
  min_tls_version                   = "TLS1_2"
  infrastructure_encryption_enabled = true

  network_rules {
    default_action = "Deny"
    bypass         = ["None"]
  }

  blob_properties {
    # Sin versioning: con versiones previas, lifecycle no borra la versión actual
    # hasta borrar las anteriores, y el TTL deja de ser predecible.
    versioning_enabled = false

    delete_retention_policy {
      days = var.soft_delete_retention_days
    }

    container_delete_retention_policy {
      days = 7
    }
  }

  tags = var.tags
}

resource "azurerm_storage_container" "ingest" {
  #checkov:skip=CKV2_AZURE_21:Logging de lectura vía diagnostic settings, fuera de alcance del patrón.
  # storage_account_id → se gestiona por Resource Manager (control plane),
  # así que funciona con public_network_access = "Disabled".
  name                  = "ingest"
  storage_account_id    = azurerm_storage_account.this.id
  container_access_type = "private"
}

# --- Expiración (TTL) ---------------------------------------------------------

resource "azurerm_storage_management_policy" "ttl" {
  storage_account_id = azurerm_storage_account.this.id

  rule {
    name    = "expire-ingest"
    enabled = true

    filters {
      blob_types = ["blockBlob"]
      # El prefijo DEBE empezar con el nombre del contenedor
      # (gotcha: prefix-includes-container).
      prefix_match = ["${azurerm_storage_container.ingest.name}/${var.object_prefix}"]
    }

    actions {
      base_blob {
        delete_after_days_since_creation_greater_than = var.ttl_days
      }
    }
  }
}

# --- Identidad del productor --------------------------------------------------

resource "azurerm_user_assigned_identity" "producer" {
  name                = "id-${var.name}-producer"
  resource_group_name = azurerm_resource_group.this.name
  location            = azurerm_resource_group.this.location
  tags                = var.tags
}

resource "azurerm_role_assignment" "producer_blob_writer" {
  # Scope mínimo posible sin ABAC: el contenedor (gotcha: rbac-scope-is-container).
  scope                = azurerm_storage_container.ingest.id
  role_definition_name = "Storage Blob Data Contributor"
  principal_id         = azurerm_user_assigned_identity.producer.principal_id
  principal_type       = "ServicePrincipal"
}

# --- Private Endpoint + DNS ---------------------------------------------------

resource "azurerm_private_dns_zone" "blob" {
  name                = "privatelink.blob.core.windows.net"
  resource_group_name = azurerm_resource_group.this.name
  tags                = var.tags
}

resource "azurerm_private_dns_zone_virtual_network_link" "blob" {
  name                 = "link-${var.name}"
  private_dns_zone_id  = azurerm_private_dns_zone.blob.id
  virtual_network_id   = azurerm_virtual_network.this.id
  registration_enabled = false
  tags                 = var.tags
}

resource "azurerm_private_endpoint" "blob" {
  name                = "pe-${var.name}-blob"
  resource_group_name = azurerm_resource_group.this.name
  location            = azurerm_resource_group.this.location
  subnet_id           = azurerm_subnet.endpoints.id

  private_service_connection {
    name                           = "psc-${var.name}-blob"
    private_connection_resource_id = azurerm_storage_account.this.id
    subresource_names              = ["blob"]
    is_manual_connection           = false
  }

  # Sin esto el FQDN resuelve a la IP pública y la request falla con 403
  # (gotcha: private-endpoint-needs-dns).
  private_dns_zone_group {
    name                 = "default"
    private_dns_zone_ids = [azurerm_private_dns_zone.blob.id]
  }

  tags = var.tags
}

variable "name" {
  description = "Prefijo para nombrar los recursos (ej. \"ingest-demo\")."
  type        = string

  validation {
    condition     = can(regex("^[a-z0-9-]{3,20}$", var.name))
    error_message = "name: 3-20 caracteres, minúsculas, números o guiones."
  }
}

variable "storage_account_name" {
  description = "Nombre global único de la Storage Account (3-24, solo minúsculas y números)."
  type        = string

  validation {
    condition     = can(regex("^[a-z0-9]{3,24}$", var.storage_account_name))
    error_message = "storage_account_name: 3-24 caracteres, solo minúsculas y números."
  }
}

variable "location" {
  description = "Región de Azure."
  type        = string
  default     = "eastus2"
}

variable "ttl_days" {
  description = "Días desde la creación tras los cuales se borra el blob."
  type        = number
  default     = 7

  validation {
    condition     = var.ttl_days >= 1 && floor(var.ttl_days) == var.ttl_days
    error_message = "ttl_days debe ser un entero >= 1."
  }
}

variable "object_prefix" {
  description = "Ruta dentro del contenedor a la que aplica el TTL (sin el nombre del contenedor)."
  type        = string
  default     = "incoming/"
}

variable "soft_delete_retention_days" {
  description = "Retención de soft delete. El costo efectivo del TTL es ttl_days + este valor (gotcha: soft-delete-keeps-capacity)."
  type        = number
  default     = 7

  validation {
    condition     = var.soft_delete_retention_days >= 1 && var.soft_delete_retention_days <= 365
    error_message = "soft_delete_retention_days debe estar entre 1 y 365."
  }
}

variable "vnet_address_space" {
  description = "Espacio de direcciones de la VNet del workload."
  type        = string
  default     = "10.10.0.0/16"
}

variable "endpoints_subnet_prefix" {
  description = "Prefijo de la subnet para Private Endpoints."
  type        = string
  default     = "10.10.1.0/24"
}

variable "tags" {
  description = "Tags aplicados a todos los recursos."
  type        = map(string)
  default     = {}
}

output "storage_account_id" {
  description = "ID de la Storage Account."
  value       = azurerm_storage_account.this.id
}

output "ingest_container_url" {
  description = "URL del contenedor de ingesta (resuelve a IP privada desde la VNet)."
  value       = "${azurerm_storage_account.this.primary_blob_endpoint}${azurerm_storage_container.ingest.name}"
}

output "producer_identity_client_id" {
  description = "Client ID de la Managed Identity que tiene que usar el workload productor."
  value       = azurerm_user_assigned_identity.producer.client_id
}

terraform {
  required_version = ">= 1.7.0"

  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 5.8"
    }
  }
}

provider "azurerm" {
  features {}

  # Con shared_access_key_enabled = false el provider tiene que usar Entra ID
  # para las llamadas de data plane (gotcha: shared-key-needs-azuread-provider).
  storage_use_azuread = true

  # subscription_id se toma de ARM_SUBSCRIPTION_ID.
}

# Ingesta privada de objetos con expiración (TTL) — AWS
#
# Bucket S3 privado, cifrado con SSE-KMS, accesible por Gateway Endpoint,
# con escritura acotada a un prefijo y expiración a los N días.

# --- Red ----------------------------------------------------------------------

resource "aws_vpc" "this" {
  #checkov:skip=CKV2_AWS_11:Flow logs fuera de alcance del patrón (se cubren en el patrón de networking base).
  cidr_block           = var.vpc_cidr
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = { Name = "vpc-${var.name}" }
}

# Sin reglas: nada usa el SG default (CIS 5.4).
resource "aws_default_security_group" "this" {
  vpc_id = aws_vpc.this.id
}

resource "aws_route_table" "private" {
  vpc_id = aws_vpc.this.id

  tags = { Name = "rt-${var.name}-private" }
}

# Gateway endpoint: entrada en la route table, sin costo por hora ni por GB
# (gotcha: gateway-endpoint-scope).
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.this.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]

  tags = { Name = "vpce-${var.name}-s3" }
}

# --- Bucket -------------------------------------------------------------------

resource "aws_s3_bucket" "ingest" {
  #checkov:skip=CKV_AWS_21:Sin versioning a propósito: con versioning, Expiration solo agrega un delete marker (gotcha: versioning-delete-marker).
  #checkov:skip=CKV_AWS_144:Replicación cross-region no aplica a datos efímeros con TTL.
  #checkov:skip=CKV_AWS_18:Access logging fuera de alcance; usar CloudTrail data events si se requiere auditoría.
  #checkov:skip=CKV2_AWS_62:Notificaciones de eventos fuera de alcance del patrón.
  bucket        = var.bucket_name
  force_destroy = false
}

# Default desde abril 2023 en buckets nuevos; se declara para evitar drift
# (gotcha: secure-defaults-since-2023).
resource "aws_s3_bucket_public_access_block" "ingest" {
  bucket                  = aws_s3_bucket.ingest.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_ownership_controls" "ingest" {
  bucket = aws_s3_bucket.ingest.id

  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "ingest" {
  #checkov:skip=CKV2_AWS_67:Clave administrada por AWS (aws/s3): sin rotación manual que gestionar ni costo mensual.
  bucket = aws_s3_bucket.ingest.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms"
    }
    # Bucket Keys: menos llamadas a KMS (que se cobran por request).
    bucket_key_enabled = true
  }
}

# --- Expiración (TTL) ---------------------------------------------------------

resource "aws_s3_bucket_lifecycle_configuration" "ingest" {
  bucket = aws_s3_bucket.ingest.id

  rule {
    id     = "expire-incoming"
    status = "Enabled"

    filter {
      prefix = var.object_prefix
    }

    expiration {
      days = var.ttl_days
    }
  }

  # Las partes huérfanas se cobran y no se listan (gotcha: abort-incomplete-multipart).
  rule {
    id     = "abort-incomplete-multipart"
    status = "Enabled"

    filter {}

    abort_incomplete_multipart_upload {
      days_after_initiation = 1
    }
  }
}

# --- Perímetro: solo TLS y solo desde el VPC endpoint -------------------------

locals {
  object_arns = "${aws_s3_bucket.ingest.arn}/*"

  # Excluye principals de break-glass del Deny por endpoint. Si la lista está vacía
  # no se agrega la condición (un ArnNotLike vacío no excluye a nadie).
  vpce_deny_condition = merge(
    { StringNotEquals = { "aws:SourceVpce" = aws_vpc_endpoint.s3.id } },
    length(var.break_glass_principal_arns) > 0 ? { ArnNotLike = { "aws:PrincipalArn" = var.break_glass_principal_arns } } : {},
  )
}

resource "aws_s3_bucket_policy" "ingest" {
  bucket = aws_s3_bucket.ingest.id

  # La public access block tiene que existir antes que la policy.
  depends_on = [aws_s3_bucket_public_access_block.ingest]

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "DenyInsecureTransport"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:*"
        Resource  = [aws_s3_bucket.ingest.arn, local.object_arns]
        Condition = { Bool = { "aws:SecureTransport" = "false" } }
      },
      {
        # Solo operaciones de objetos: la configuración del bucket sigue siendo
        # gestionable desde fuera de la VPC (gotcha: sourcevpce-lockout).
        Sid       = "DenyObjectAccessOutsideVpce"
        Effect    = "Deny"
        Principal = "*"
        Action    = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
        Resource  = local.object_arns
        Condition = local.vpce_deny_condition
      },
    ]
  })
}

# --- Identidad del productor --------------------------------------------------

resource "aws_iam_role" "producer" {
  name = "${var.name}-producer"

  # Ejemplo con ECS: cambiá el principal según dónde corra el workload
  # (ec2.amazonaws.com, lambda.amazonaws.com, o un OIDC provider para EKS).
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ecs-tasks.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy" "producer_put" {
  name = "put-incoming-objects"
  role = aws_iam_role.producer.id

  # Acotado al prefijo: el equivalente de Azure necesita ABAC (gotcha: rbac-scope-is-container).
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:PutObject"]
      Resource = "${aws_s3_bucket.ingest.arn}/${var.object_prefix}*"
    }]
  })
}

variable "name" {
  description = "Prefijo para nombrar los recursos (ej. \"ingest-demo\")."
  type        = string

  validation {
    condition     = can(regex("^[a-z0-9-]{3,20}$", var.name))
    error_message = "name: 3-20 caracteres, minúsculas, números o guiones."
  }
}

variable "bucket_name" {
  description = "Nombre global único del bucket S3."
  type        = string

  validation {
    condition     = can(regex("^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$", var.bucket_name))
    error_message = "bucket_name: 3-63 caracteres, minúsculas, números, puntos o guiones."
  }
}

variable "region" {
  description = "Región de AWS."
  type        = string
  default     = "us-east-1"
}

variable "ttl_days" {
  description = "Días desde la creación tras los cuales expira el objeto."
  type        = number
  default     = 7

  validation {
    condition     = var.ttl_days >= 1 && floor(var.ttl_days) == var.ttl_days
    error_message = "ttl_days debe ser un entero >= 1."
  }
}

variable "object_prefix" {
  description = "Prefijo de las keys a las que aplica el TTL (en S3 el prefijo NO incluye el bucket)."
  type        = string
  default     = "incoming/"
}

variable "vpc_cidr" {
  description = "CIDR de la VPC del workload."
  type        = string
  default     = "10.20.0.0/16"
}

variable "break_glass_principal_arns" {
  description = "ARNs (admite comodines) excluidos del Deny por VPC endpoint: consola, CI. Gotcha: sourcevpce-lockout."
  type        = list(string)
  default     = []
}

variable "tags" {
  description = "Tags aplicados a todos los recursos."
  type        = map(string)
  default     = {}
}

output "bucket_arn" {
  description = "ARN del bucket."
  value       = aws_s3_bucket.ingest.arn
}

output "vpc_endpoint_id" {
  description = "ID del Gateway Endpoint (usado en la condición aws:SourceVpce)."
  value       = aws_vpc_endpoint.s3.id
}

output "producer_role_arn" {
  description = "ARN del rol que tiene que asumir el workload productor."
  value       = aws_iam_role.producer.arn
}

terraform {
  required_version = ">= 1.7.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.67"
    }
  }
}

provider "aws" {
  region = var.region

  default_tags {
    tags = var.tags
  }
}