Design a PCI-DSS Compliant VPC for a Multi-Tier Application

# Create route table for CDE subnets (no internet route)
aws ec2 create-route-table \
  --vpc-id vpc-0abc123 \
  --tag-specifications 'ResourceType=route-table,Tags=[{Key=Name,Value=rtb-pci-cde}]'

# Add ONLY local VPC route (10.0.0.0/16 → local)
# Do NOT add: 0.0.0.0/0 → igw or 0.0.0.0/0 → nat

# Associate with CDE subnets
aws ec2 associate-route-table \
  --subnet-id subnet-pci-az1 \
  --route-table-id rtb-pci-cde

aws ec2 associate-route-table \
  --subnet-id subnet-pci-az2 \
  --route-table-id rtb-pci-cde

resource "aws_network_acl" "pci_cde" {
  vpc_id     = aws_vpc.main.id
  subnet_ids = [aws_subnet.pci_az1.id, aws_subnet.pci_az2.id]

  tags = { Name = "nacl-pci-cde" }
}

# Allow inbound from App tier on port 8443 only
resource "aws_network_acl_rule" "pci_allow_inbound_app" {
  network_acl_id = aws_network_acl.pci_cde.id
  rule_number    = 100
  egress         = false
  protocol       = "tcp"
  rule_action    = "allow"
  cidr_block     = "10.0.10.0/22"   # App subnet CIDR only
  from_port      = 8443
  to_port        = 8443
}

# Allow return traffic (ephemeral ports)
resource "aws_network_acl_rule" "pci_allow_return_traffic" {
  network_acl_id = aws_network_acl.pci_cde.id
  rule_number    = 110
  egress         = true
  protocol       = "tcp"
  rule_action    = "allow"
  cidr_block     = "10.0.10.0/22"
  from_port      = 1024
  to_port        = 65535
}

# Deny everything else (explicit — belt AND suspenders)
resource "aws_network_acl_rule" "pci_deny_all_inbound" {
  network_acl_id = aws_network_acl.pci_cde.id
  rule_number    = 32766
  egress         = false
  protocol       = "-1"
  rule_action    = "deny"
  cidr_block     = "0.0.0.0/0"
}

resource "aws_network_acl_rule" "pci_deny_all_outbound" {
  network_acl_id = aws_network_acl.pci_cde.id
  rule_number    = 32766
  egress         = true
  protocol       = "-1"
  rule_action    = "deny"
  cidr_block     = "0.0.0.0/0"
}

# CDE payment service security group
resource "aws_security_group" "pci_payment_service" {
  name   = "sg-pci-payment-service"
  vpc_id = aws_vpc.main.id

  ingress {
    from_port       = 8443
    to_port         = 8443
    protocol        = "tcp"
    security_groups = [aws_security_group.app_tier.id]  # Only from app tier SG
    description     = "Payment API from app tier only"
  }

  # Egress: only to tokenization service and secrets manager VPC endpoint
  egress {
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    security_groups = [aws_security_group.pci_tokenization.id]
    description     = "Tokenization service"
  }

  egress {
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    prefix_list_ids = [data.aws_ec2_managed_prefix_list.secretsmanager.id]
    description     = "Secrets Manager VPC endpoint"
  }

  tags = { Name = "sg-pci-payment-service", PCIScope = "in-scope" }
}

# Interface VPC endpoint for Secrets Manager
resource "aws_vpc_endpoint" "secretsmanager" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.us-east-1.secretsmanager"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = [aws_subnet.pci_az1.id, aws_subnet.pci_az2.id]
  security_group_ids  = [aws_security_group.vpc_endpoint_sg.id]
  private_dns_enabled = true

  tags = { Name = "vpce-secretsmanager-pci" }
}

# KMS endpoint — for decrypting card data
resource "aws_vpc_endpoint" "kms" {
  vpc_id              = aws_vpc.main.id
  service_name        = "com.amazonaws.us-east-1.kms"
  vpc_endpoint_type   = "Interface"
  subnet_ids          = [aws_subnet.pci_az1.id, aws_subnet.pci_az2.id]
  security_group_ids  = [aws_security_group.vpc_endpoint_sg.id]
  private_dns_enabled = true
}

resource "aws_wafv2_web_acl" "public_alb" {
  name  = "public-alb-waf"
  scope = "REGIONAL"

  default_action { allow {} }

  # AWS Managed Rules — OWASP Top 10
  rule {
    name     = "AWSManagedRulesCommonRuleSet"
    priority = 1
    override_action { none {} }
    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesCommonRuleSet"
        vendor_name = "AWS"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "CommonRuleSet"
      sampled_requests_enabled   = true
    }
  }

  # AWS Managed Rules — Known Bad Inputs (SQL injection, XSS, etc.)
  rule {
    name     = "AWSManagedRulesKnownBadInputsRuleSet"
    priority = 2
    override_action { none {} }
    statement {
      managed_rule_group_statement {
        name        = "AWSManagedRulesKnownBadInputsRuleSet"
        vendor_name = "AWS"
      }
    }
    visibility_config {
      cloudwatch_metrics_enabled = true
      metric_name                = "KnownBadInputs"
      sampled_requests_enabled   = true
    }
  }

  visibility_config {
    cloudwatch_metrics_enabled = true
    metric_name                = "PublicALBWebACL"
    sampled_requests_enabled   = true
  }
}

resource "aws_wafv2_web_acl_association" "alb" {
  resource_arn = aws_lb.public.arn
  web_acl_arn  = aws_wafv2_web_acl.public_alb.arn
}

resource "aws_flow_log" "pci_cde" {
  iam_role_arn    = aws_iam_role.flow_log.arn
  log_destination = aws_cloudwatch_log_group.pci_flow_logs.arn
  traffic_type    = "ALL"
  subnet_id       = aws_subnet.pci_az1.id   # Log per-subnet for CDE
}

# Retention: PCI-DSS requires 12 months minimum
resource "aws_cloudwatch_log_group" "pci_flow_logs" {
  name              = "/aws/vpc/flowlogs/pci-cde"
  retention_in_days = 365
  kms_key_id        = aws_kms_key.log_encryption.arn
}