Private object ingestion with expiration (TTL)

# Ingesta privada de objetos con expiración (TTL) — GCP
#
# Bucket con UBLA + public access prevention, soft delete explícito,
# acceso desde una subnet con Private Google Access, escritura acotada
# a un prefijo con IAM Conditions y borrado a los N días.

# --- Red ----------------------------------------------------------------------

resource "google_compute_network" "this" {
  name                    = "vpc-${var.name}"
  auto_create_subnetworks = false
}

# Denegar todo ingress explícitamente (las VPCs custom no traen reglas,
# pero declararlo deja la intención en el código).
resource "google_compute_firewall" "deny_all_ingress" {
  name      = "fw-${var.name}-deny-all-ingress"
  network   = google_compute_network.this.id
  direction = "INGRESS"
  priority  = 65534

  deny {
    protocol = "all"
  }

  source_ranges = ["0.0.0.0/0"]
}

resource "google_compute_subnetwork" "workloads" {
  name          = "snet-${var.name}-workloads"
  region        = var.region
  network       = google_compute_network.this.id
  ip_cidr_range = var.subnet_cidr

  # VMs/servicios sin IP pública llegan a storage.googleapis.com sin NAT.
  # No restringe quién accede al bucket (gotcha: pga-is-not-a-perimeter).
  private_ip_google_access = true

  log_config {
    aggregation_interval = "INTERVAL_10_MIN"
    flow_sampling        = 0.5
    metadata             = "INCLUDE_ALL_METADATA"
  }
}

# --- Bucket -------------------------------------------------------------------

resource "google_storage_bucket" "ingest" {
  #checkov:skip=CKV_GCP_62:Access logs fuera de alcance; usar Cloud Audit Logs (Data Access) si se requiere auditoría.
  #checkov:skip=CKV_GCP_78:Sin versioning a propósito: el TTL es el comportamiento buscado.
  name          = var.bucket_name
  location      = upper(var.region)
  storage_class = "STANDARD"
  force_destroy = false
  labels        = var.labels

  # Equivalente a BucketOwnerEnforced + Block Public Access (gotcha: ubla-and-pap).
  uniform_bucket_level_access = true
  public_access_prevention    = "enforced"

  versioning {
    enabled = false
  }

  # Default de GCS: 7 días. Acá es una decisión explícita (gotcha: soft-delete-default-7-days).
  soft_delete_policy {
    retention_duration_seconds = var.soft_delete_retention_seconds
  }

  lifecycle_rule {
    condition {
      age            = var.ttl_days
      matches_prefix = [var.object_prefix]
    }
    action {
      type = "Delete"
    }
  }

  lifecycle_rule {
    condition {
      age = 1
    }
    action {
      type = "AbortIncompleteMultipartUpload"
    }
  }

  dynamic "ip_filter" {
    for_each = var.restrict_to_vpc ? [1] : []
    content {
      mode = "Enabled"
      vpc_network_sources {
        network                = google_compute_network.this.id
        allowed_ip_cidr_ranges = [var.subnet_cidr]
      }
    }
  }
}

# --- Identidad del productor --------------------------------------------------

resource "google_service_account" "producer" {
  account_id   = "${var.name}-producer"
  display_name = "Productor de ingesta (${var.name})"
}

resource "google_storage_bucket_iam_member" "producer_create" {
  bucket = google_storage_bucket.ingest.name
  # objectCreator no puede sobrescribir (gotcha: objectcreator-cannot-overwrite).
  role   = "roles/storage.objectCreator"
  member = google_service_account.producer.member

  # Acotado al prefijo, como en S3. Requiere UBLA.
  condition {
    title       = "only-${trimsuffix(var.object_prefix, "/")}"
    description = "Solo objetos bajo ${var.object_prefix}"
    expression  = "resource.name.startsWith(\"projects/_/buckets/${var.bucket_name}/objects/${var.object_prefix}\")"
  }
}

variable "project_id" {
  description = "ID del proyecto de GCP."
  type        = string
}

variable "name" {
  description = "Prefijo para nombrar los recursos (ej. \"ingest-demo\")."
  type        = string

  validation {
    condition     = can(regex("^[a-z][a-z0-9-]{2,19}$", var.name))
    error_message = "name: 3-20 caracteres, empieza con letra, minúsculas, números o guiones."
  }
}

variable "bucket_name" {
  description = "Nombre global único del bucket."
  type        = string

  validation {
    condition     = can(regex("^[a-z0-9][a-z0-9_.-]{1,61}[a-z0-9]$", var.bucket_name))
    error_message = "bucket_name: 3-63 caracteres, minúsculas, números, puntos, guiones o guiones bajos."
  }
}

variable "region" {
  description = "Región de GCP (el bucket se crea regional en la misma región)."
  type        = string
  default     = "us-central1"
}

variable "ttl_days" {
  description = "Edad en días tras la cual se borra el objeto."
  type        = number
  default     = 7

  validation {
    condition     = var.ttl_days >= 1 && floor(var.ttl_days) == var.ttl_days
    error_message = "ttl_days debe ser un entero >= 1."
  }
}

variable "object_prefix" {
  description = "Prefijo de los objetos a los que aplica el TTL (en GCS el prefijo NO incluye el bucket)."
  type        = string
  default     = "incoming/"
}

variable "soft_delete_retention_seconds" {
  description = "Retención de soft delete. 0 lo deshabilita; el default de GCS es 7 días (gotcha: soft-delete-default-7-days)."
  type        = number
  default     = 0

  validation {
    condition     = var.soft_delete_retention_seconds == 0 || (var.soft_delete_retention_seconds >= 604800 && var.soft_delete_retention_seconds <= 7776000)
    error_message = "soft_delete_retention_seconds: 0 (deshabilitado) o entre 7 y 90 días (604800-7776000)."
  }
}

variable "subnet_cidr" {
  description = "CIDR de la subnet del workload."
  type        = string
  default     = "10.30.0.0/24"
}

variable "restrict_to_vpc" {
  description = "Activa bucket IP filtering para aceptar requests solo desde la VPC. Puede dejar afuera al pipeline si corre fuera de la VPC."
  type        = bool
  default     = false
}

variable "labels" {
  description = "Labels aplicados a los recursos que los soportan."
  type        = map(string)
  default     = {}
}

output "bucket_url" {
  description = "URL gs:// del bucket."
  value       = google_storage_bucket.ingest.url
}

output "producer_service_account_email" {
  description = "Service Account que tiene que usar el workload productor."
  value       = google_service_account.producer.email
}

terraform {
  required_version = ">= 1.7.0"

  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 8.6"
    }
  }
}

provider "google" {
  project = var.project_id
  region  = var.region
}

# Ingesta privada de objetos con expiración (TTL) — AWS
#
# Bucket S3 privado, cifrado con SSE-KMS, accesible por Gateway Endpoint,
# con escritura acotada a un prefijo y expiración a los N días.

# --- Red ----------------------------------------------------------------------

resource "aws_vpc" "this" {
  #checkov:skip=CKV2_AWS_11:Flow logs fuera de alcance del patrón (se cubren en el patrón de networking base).
  cidr_block           = var.vpc_cidr
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = { Name = "vpc-${var.name}" }
}

# Sin reglas: nada usa el SG default (CIS 5.4).
resource "aws_default_security_group" "this" {
  vpc_id = aws_vpc.this.id
}

resource "aws_route_table" "private" {
  vpc_id = aws_vpc.this.id

  tags = { Name = "rt-${var.name}-private" }
}

# Gateway endpoint: entrada en la route table, sin costo por hora ni por GB
# (gotcha: gateway-endpoint-scope).
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.this.id
  service_name      = "com.amazonaws.${var.region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]

  tags = { Name = "vpce-${var.name}-s3" }
}

# --- Bucket -------------------------------------------------------------------

resource "aws_s3_bucket" "ingest" {
  #checkov:skip=CKV_AWS_21:Sin versioning a propósito: con versioning, Expiration solo agrega un delete marker (gotcha: versioning-delete-marker).
  #checkov:skip=CKV_AWS_144:Replicación cross-region no aplica a datos efímeros con TTL.
  #checkov:skip=CKV_AWS_18:Access logging fuera de alcance; usar CloudTrail data events si se requiere auditoría.
  #checkov:skip=CKV2_AWS_62:Notificaciones de eventos fuera de alcance del patrón.
  bucket        = var.bucket_name
  force_destroy = false
}

# Default desde abril 2023 en buckets nuevos; se declara para evitar drift
# (gotcha: secure-defaults-since-2023).
resource "aws_s3_bucket_public_access_block" "ingest" {
  bucket                  = aws_s3_bucket.ingest.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

resource "aws_s3_bucket_ownership_controls" "ingest" {
  bucket = aws_s3_bucket.ingest.id

  rule {
    object_ownership = "BucketOwnerEnforced"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "ingest" {
  #checkov:skip=CKV2_AWS_67:Clave administrada por AWS (aws/s3): sin rotación manual que gestionar ni costo mensual.
  bucket = aws_s3_bucket.ingest.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "aws:kms"
    }
    # Bucket Keys: menos llamadas a KMS (que se cobran por request).
    bucket_key_enabled = true
  }
}

# --- Expiración (TTL) ---------------------------------------------------------

resource "aws_s3_bucket_lifecycle_configuration" "ingest" {
  bucket = aws_s3_bucket.ingest.id

  rule {
    id     = "expire-incoming"
    status = "Enabled"

    filter {
      prefix = var.object_prefix
    }

    expiration {
      days = var.ttl_days
    }
  }

  # Las partes huérfanas se cobran y no se listan (gotcha: abort-incomplete-multipart).
  rule {
    id     = "abort-incomplete-multipart"
    status = "Enabled"

    filter {}

    abort_incomplete_multipart_upload {
      days_after_initiation = 1
    }
  }
}

# --- Perímetro: solo TLS y solo desde el VPC endpoint -------------------------

locals {
  object_arns = "${aws_s3_bucket.ingest.arn}/*"

  # Excluye principals de break-glass del Deny por endpoint. Si la lista está vacía
  # no se agrega la condición (un ArnNotLike vacío no excluye a nadie).
  vpce_deny_condition = merge(
    { StringNotEquals = { "aws:SourceVpce" = aws_vpc_endpoint.s3.id } },
    length(var.break_glass_principal_arns) > 0 ? { ArnNotLike = { "aws:PrincipalArn" = var.break_glass_principal_arns } } : {},
  )
}

resource "aws_s3_bucket_policy" "ingest" {
  bucket = aws_s3_bucket.ingest.id

  # La public access block tiene que existir antes que la policy.
  depends_on = [aws_s3_bucket_public_access_block.ingest]

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid       = "DenyInsecureTransport"
        Effect    = "Deny"
        Principal = "*"
        Action    = "s3:*"
        Resource  = [aws_s3_bucket.ingest.arn, local.object_arns]
        Condition = { Bool = { "aws:SecureTransport" = "false" } }
      },
      {
        # Solo operaciones de objetos: la configuración del bucket sigue siendo
        # gestionable desde fuera de la VPC (gotcha: sourcevpce-lockout).
        Sid       = "DenyObjectAccessOutsideVpce"
        Effect    = "Deny"
        Principal = "*"
        Action    = ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"]
        Resource  = local.object_arns
        Condition = local.vpce_deny_condition
      },
    ]
  })
}

# --- Identidad del productor --------------------------------------------------

resource "aws_iam_role" "producer" {
  name = "${var.name}-producer"

  # Ejemplo con ECS: cambiá el principal según dónde corra el workload
  # (ec2.amazonaws.com, lambda.amazonaws.com, o un OIDC provider para EKS).
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ecs-tasks.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_role_policy" "producer_put" {
  name = "put-incoming-objects"
  role = aws_iam_role.producer.id

  # Acotado al prefijo: el equivalente de Azure necesita ABAC (gotcha: rbac-scope-is-container).
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["s3:PutObject"]
      Resource = "${aws_s3_bucket.ingest.arn}/${var.object_prefix}*"
    }]
  })
}

variable "name" {
  description = "Prefijo para nombrar los recursos (ej. \"ingest-demo\")."
  type        = string

  validation {
    condition     = can(regex("^[a-z0-9-]{3,20}$", var.name))
    error_message = "name: 3-20 caracteres, minúsculas, números o guiones."
  }
}

variable "bucket_name" {
  description = "Nombre global único del bucket S3."
  type        = string

  validation {
    condition     = can(regex("^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$", var.bucket_name))
    error_message = "bucket_name: 3-63 caracteres, minúsculas, números, puntos o guiones."
  }
}

variable "region" {
  description = "Región de AWS."
  type        = string
  default     = "us-east-1"
}

variable "ttl_days" {
  description = "Días desde la creación tras los cuales expira el objeto."
  type        = number
  default     = 7

  validation {
    condition     = var.ttl_days >= 1 && floor(var.ttl_days) == var.ttl_days
    error_message = "ttl_days debe ser un entero >= 1."
  }
}

variable "object_prefix" {
  description = "Prefijo de las keys a las que aplica el TTL (en S3 el prefijo NO incluye el bucket)."
  type        = string
  default     = "incoming/"
}

variable "vpc_cidr" {
  description = "CIDR de la VPC del workload."
  type        = string
  default     = "10.20.0.0/16"
}

variable "break_glass_principal_arns" {
  description = "ARNs (admite comodines) excluidos del Deny por VPC endpoint: consola, CI. Gotcha: sourcevpce-lockout."
  type        = list(string)
  default     = []
}

variable "tags" {
  description = "Tags aplicados a todos los recursos."
  type        = map(string)
  default     = {}
}

output "bucket_arn" {
  description = "ARN del bucket."
  value       = aws_s3_bucket.ingest.arn
}

output "vpc_endpoint_id" {
  description = "ID del Gateway Endpoint (usado en la condición aws:SourceVpce)."
  value       = aws_vpc_endpoint.s3.id
}

output "producer_role_arn" {
  description = "ARN del rol que tiene que asumir el workload productor."
  value       = aws_iam_role.producer.arn
}

terraform {
  required_version = ">= 1.7.0"

  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.67"
    }
  }
}

provider "aws" {
  region = var.region

  default_tags {
    tags = var.tags
  }
}