HITRUST CSF 11.5 - AWS

const instance = new aws.ec2.Instance("protected-instance", {
    instanceType: "t3.medium",
    ami: "ami-0c55b159cbfafe1f0",
    userData: "#!/bin/bash\nyum install -y amazon-ssm-agent\nsystemctl enable amazon-ssm-agent\nsystemctl start amazon-ssm-agent", // Install SSM agent
    subnetId: subnet.id,
});

const logGroup = new aws.cloudwatch.LogGroup("api-logs", {
    retentionInDays: 30,
});

const stage = new aws.apigateway.Stage("my-stage", {
    restApi: api.id,
    stageName: "prod",
    deployment: deployment.id,
    accessLogSettings: { // Enable access logging
        destinationArn: logGroup.arn, // Specify CloudWatch Log Group
        format: "$context.requestId",
    },
});

const method = new aws.apigateway.Method("my-method", {
    restApi: api.id,
    resourceId: resource.id,
    httpMethod: "GET",
    authorization: "AWS_IAM", // Use strong authorization instead of "NONE"
    // For CUSTOM authorization, also specify the authorizer:
    // authorizerId: authorizer.id,
});

const domainName = new apigateway.DomainName("my-domain", {
    domainName: "api.example.com",
    certificateArn: cert.arn,
    securityPolicy: "TLS_1_2", // Use TLS 1.2 for secure encryption
});

const logGroup = new aws.cloudwatch.LogGroup("api-v2-logs", {
    retentionInDays: 30,
});

const stage = new aws.apigatewayv2.Stage("my-stage", {
    apiId: api.id,
    name: "prod",
    accessLogSettings: { // Enable access logging
        destinationArn: logGroup.arn, // Specify CloudWatch Log Group
        format: "$context.requestId",
    },
});

const domainName = new aws.apigatewayv2.DomainName("my-domain", {
    domainName: "api.example.com",
    domainNameConfiguration: {
        certificateArn: certificate.arn,
        endpointType: "REGIONAL",
        securityPolicy: "TLS_1_2", // Use TLS 1.2 for secure encryption
    },
});

const domainName = new apigatewayv2.DomainName("my-domain", {
    domainName: "api.example.com",
    domainNameConfiguration: { // Enable domain name configuration
        certificateArn: certificate.arn,
        endpointType: "REGIONAL",
        securityPolicy: "TLS_1_2",
    },
});

const logGroup = new aws.cloudwatch.LogGroup("api-logs", {
    retentionInDays: 30,
});

const stage = new aws.apigatewayv2.Stage("api-stage", {
    apiId: api.id,
    name: "prod",
    accessLogSettings: { // Configure access logging
        destinationArn: logGroup.arn, // CloudWatch Log Group ARN
        format: JSON.stringify({ // Log format specification
            requestId: "$context.requestId",
            ip: "$context.identity.sourceIp",
            requestTime: "$context.requestTime",
            httpMethod: "$context.httpMethod",
            routeKey: "$context.routeKey",
            status: "$context.status",
        }),
    },
});

const stage = new aws.apigatewayv2.Stage("my-stage", {
    apiId: api.id,
    name: "prod",
    accessLogSettings: { // Enable access logging
        destinationArn: logGroup.arn,
        format: "$context.requestId",
    },
});

// Create a WAF Web ACL association for the API Gateway stage
const wafAssociation = new aws.wafv2.WebAclAssociation("api-waf-association", {
    resourceArn: pulumi.interpolate`arn:aws:apigateway:${region}::/restapis/${restApi.id}/stages/${stage.stageName}`, // Stage ARN
    webAclArn: webAcl.arn, // Reference the WAF Web ACL ARN
});

const connectorProfile = new aws.appflow.ConnectorProfile("my-connector-profile", {
    connectorProfileName: "salesforce-connector",
    connectorType: "Salesforce",
    connectionMode: "Public",
    kmsArn: kmsKey.arn, // Specify customer-managed KMS key ARN
    connectorProfileConfig: {
        connectorProfileCredentials: {
            salesforce: {
                accessToken: salesforceAccessToken,
                refreshToken: salesforceRefreshToken,
                oauthRequest: {
                    authCode: authCode,
                    redirectUri: redirectUri,
                },
            },
        },
    },
});

const flow = new aws.appflow.Flow("my-flow", {
    name: "my-appflow",
    kmsArn: kmsKey.arn, // Configure customer-managed KMS key
    sourceFlowConfig: {
        connectorType: "S3",
        sourceConnectorProperties: {
            s3: {
                bucketName: sourceBucket.bucket,
                bucketPrefix: "data/",
            },
        },
    },
    destinationFlowConfigs: [{
        connectorType: "S3",
        destinationConnectorProperties: {
            s3: {
                bucketName: destBucket.bucket,
            },
        },
    }],
    tasks: [{
        taskType: "Map_all",
        sourceFields: [],
        connectorOperator: {
            s3: "NO_OP",
        },
    }],
    triggerConfig: {
        triggerType: "OnDemand",
    },
});

// Create a WAF Web ACL association for the AppSync GraphQL API
const wafAssociation = new aws.wafv2.WebAclAssociation("appsync-waf-association", {
    resourceArn: graphqlApi.arn, // Reference the GraphQL API ARN
    webAclArn: webAcl.arn, // Reference the WAF Web ACL ARN
});

const athenaDatabase = new aws.athena.Database("my-database", {
    name: "my_database",
    bucket: myBucket.id,
    encryptionConfiguration: {
        encryptionOption: "SSE_KMS", // Use customer-managed KMS key
        kmsKey: myKmsKey.arn, // Specify the KMS key ARN
    },
});

const athenaDatabase = new aws.athena.Database("my-database", {
    name: "my_database",
    bucket: dataBucket.id,
    encryptionConfiguration: { // Enable encryption
        encryptionOption: "SSE_S3", // Use SSE-S3, SSE-KMS, or CSE-KMS
    },
});

const workgroup = new athena.Workgroup("my-workgroup", {
    name: "my-workgroup",
    configuration: {
        resultConfiguration: {
            outputLocation: "s3://my-bucket/query-results/",
            encryptionConfiguration: {
                encryptionOption: "SSE_KMS", // Enable customer-managed key encryption
                kmsKey: kmsKey.arn, // Optional: specify a specific KMS key
            },
        },
    },
});

const workgroup = new athena.Workgroup("my-workgroup", {
    name: "example-workgroup",
    configuration: {
        resultConfiguration: {
            outputLocation: "s3://my-query-results-bucket/",
            encryptionConfiguration: { // Add encryption configuration
                encryptionOption: "SSE_KMS", // or "SSE_S3" or "CSE_KMS"
                kmsKey: kmsKey.arn, // Required when using SSE_KMS or CSE_KMS
            },
        },
    },
});

const workgroup = new athena.Workgroup("my-workgroup", {
    name: "my-workgroup",
    configuration: {
        enforceWorkgroupConfiguration: true, // Enforce workgroup configuration on clients
        resultConfiguration: {
            outputLocation: "s3://my-query-results/",
        },
    },
});

const instance = new aws.ec2.Instance("web-server", {
    ami: "ami-0c55b159cbfafe1f0",
    instanceType: "t3.micro",
    userData: `#!/bin/bash
##### Install and configure CloudWatch Agent for centralized logging
wget https://s3.amazonaws.com/amazoncloudwatch-agent/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm
rpm -U ./amazon-cloudwatch-agent.rpm
##### Configure agent to forward logs
/opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-ctl \
    -a fetch-config -m ec2 -s -c ssm:AmazonCloudWatch-Config
`, // Add logging agent to userData
    iamInstanceProfile: instanceProfile.name,
    subnetId: subnet.id,
});

const distribution = new cloudfront.Distribution("my-distribution", {
    enabled: true,
    loggingConfig: {
        bucket: logBucket.bucketDomainName, // S3 bucket for access logs
        includeCookies: false,
        prefix: "cloudfront-logs/",
    },
    // ... other distribution configuration
});

const distribution = new cloudfront.Distribution("my-distribution", {
    enabled: true,
    origins: [/* ... */],
    defaultCacheBehavior: {/* ... */},
    viewerCertificate: {
        cloudfrontDefaultCertificate: true,
        minimumProtocolVersion: "TLSv1.2_2021", // Use secure TLS 1.2 with modern cipher suites
    },
});

const distribution = new cloudfront.Distribution("my-distribution", {
    enabled: true,
    origins: [{
        domainName: "my-origin.example.com",
        originId: "myCustomOrigin",
        customOriginConfig: {
            httpPort: 80,
            httpsPort: 443,
            originProtocolPolicy: "https-only",
            originSslProtocols: ["TLSv1.2"], // Only allow TLS 1.2
        },
    }],
    defaultCacheBehavior: {
        targetOriginId: "myCustomOrigin",
        viewerProtocolPolicy: "redirect-to-https",
        allowedMethods: ["GET", "HEAD"],
        cachedMethods: ["GET", "HEAD"],
        forwardedValues: {
            queryString: false,
            cookies: { forward: "none" },
        },
    },
});

const distribution = new aws.cloudfront.Distribution("my-distribution", {
    enabled: true,
    webAclId: webAcl.arn, // Associate WAF Web ACL for protection
    origins: [{
        domainName: bucket.bucketRegionalDomainName,
        originId: "myS3Origin",
    }],
    defaultCacheBehavior: {
        targetOriginId: "myS3Origin",
        viewerProtocolPolicy: "redirect-to-https",
        allowedMethods: ["GET", "HEAD"],
        cachedMethods: ["GET", "HEAD"],
        forwardedValues: {
            queryString: false,
            cookies: { forward: "none" },
        },
    },
});

const distribution = new cloudfront.Distribution("my-distribution", {
    enabled: true,
    defaultCacheBehavior: {
        targetOriginId: origin.originId,
        viewerProtocolPolicy: "redirect-to-https", // Enforce HTTPS for all traffic
        allowedMethods: ["GET", "HEAD"],
        cachedMethods: ["GET", "HEAD"],
        forwardedValues: {
            queryString: false,
            cookies: { forward: "none" },
        },
    },
    orderedCacheBehaviors: [{
        pathPattern: "/api/*",
        targetOriginId: origin.originId,
        viewerProtocolPolicy: "https-only", // Enforce HTTPS-only for API paths
        allowedMethods: ["GET", "HEAD", "OPTIONS"],
        cachedMethods: ["GET", "HEAD"],
        forwardedValues: {
            queryString: true,
            cookies: { forward: "none" },
        },
    }],
    origins: [origin],
    viewerCertificate: {
        cloudfrontDefaultCertificate: true,
    },
});

const distribution = new aws.cloudfront.Distribution("my-distribution", {
    enabled: true,
    origins: [{
        domainName: bucket.bucketRegionalDomainName,
        originId: "myS3Origin",
    }],
    defaultCacheBehavior: {
        targetOriginId: "myS3Origin",
        viewerProtocolPolicy: "redirect-to-https",
        allowedMethods: ["GET", "HEAD"],
        cachedMethods: ["GET", "HEAD"],
        forwardedValues: {
            queryString: false,
            cookies: { forward: "none" },
        },
    },
    loggingConfig: {  // Enable access logging
        bucket: logBucket.bucketDomainName,  // S3 bucket for logs
        includeCookies: false,
        prefix: "cloudfront-logs/",
    },
    restrictions: {
        geoRestriction: {
            restrictionType: "none",
        },
    },
    viewerCertificate: {
        cloudfrontDefaultCertificate: true,
    },
});

const distribution = new cloudfront.Distribution("my-distribution", {
    enabled: true,
    origins: [{
        domainName: "my-custom-origin.example.com",
        originId: "my-custom-origin",
        customOriginConfig: {
            httpPort: 80,
            httpsPort: 443,
            originProtocolPolicy: "https-only", // Enforce TLS encryption to origin
            originSslProtocols: ["TLSv1.2"],
        },
    }],
    defaultCacheBehavior: {
        targetOriginId: "my-custom-origin",
        viewerProtocolPolicy: "redirect-to-https",
        allowedMethods: ["GET", "HEAD"],
        cachedMethods: ["GET", "HEAD"],
        forwardedValues: {
            queryString: false,
            cookies: { forward: "none" },
        },
    },
});

const distribution = new aws.cloudfront.Distribution("my-distribution", {
    enabled: true,
    webAclId: webAcl.arn, // Associate the WAF Web ACL with the distribution
    origins: [{
        domainName: bucket.bucketRegionalDomainName,
        originId: "S3Origin",
    }],
    defaultCacheBehavior: {
        targetOriginId: "S3Origin",
        viewerProtocolPolicy: "redirect-to-https",
        allowedMethods: ["GET", "HEAD"],
        cachedMethods: ["GET", "HEAD"],
        forwardedValues: {
            queryString: false,
            cookies: { forward: "none" },
        },
    },
});

// Create a security group with restricted ingress
const dbSecurityGroup = new aws.ec2.SecurityGroup("db-sg", {
    vpcId: vpc.id,
    ingress: [{
        protocol: "tcp",
        fromPort: 3306,
        toPort: 3306,
        cidrBlocks: ["10.0.0.0/16"], // Restrict to internal VPC CIDR only
    }],
});

// Associate security group with RDS instance
const db = new aws.rds.Instance("my-db", {
    engine: "mysql",
    instanceClass: "db.t3.micro",
    allocatedStorage: 20,
    vpcSecurityGroupIds: [dbSecurityGroup.id], // Attach security group
    dbSubnetGroupName: dbSubnetGroup.name,
});

// Ensure subnet group has at least 2 subnets
const dbSubnetGroup = new aws.rds.SubnetGroup("db-subnet-group", {
    subnetIds: [privateSubnet1.id, privateSubnet2.id], // Minimum 2 subnets
});

const clusterInstance = new aws.docdb.ClusterInstance("my-cluster-instance", {
    clusterIdentifier: cluster.id,
    instanceClass: "db.r5.large",
    autoMinorVersionUpgrade: true, // Enable automatic minor version upgrades
});

const table = new aws.dynamodb.Table("my-table", {
    name: "my-table",
    attributes: [
        { name: "id", type: "S" },
    ],
    hashKey: "id",
    streamEnabled: true, // Enable DynamoDB Streams
    billingMode: "PAY_PER_REQUEST",
});

const volume = new aws.ebs.Volume("my-volume", {
    availabilityZone: "us-west-2a",
    size: 100,
    encrypted: true,
    kmsKeyId: customerKey.arn, // Use customer-managed KMS key instead of default AWS-managed key
});

const volume = new aws.ebs.Volume("my-volume", {
    availabilityZone: "us-west-2a",
    size: 100,
    encrypted: true, // Enable encryption for the volume
});

const instance = new ec2.Instance("my-instance", {
    instanceType: "t3.micro",
    ami: "ami-12345678",
    associatePublicIpAddress: false, // Disable public IP assignment
    subnetId: privateSubnet.id,
});

const instance = new aws.ec2.Instance("my-instance", {
    ami: "ami-12345678",
    instanceType: "t3.micro",
    ebsBlockDevices: [{
        deviceName: "/dev/sdf",
        volumeSize: 20,
        encrypted: true, // Enable encryption for the EBS volume
    }],
});

const instance = new aws.ec2.Instance("my-instance", {
    instanceType: "t3.micro",
    ami: "ami-12345678",
    rootBlockDevice: {
        encrypted: true, // Enable encryption for root volume
    },
});

const launchConfig = new aws.ec2.LaunchConfiguration("my-launch-config", {
    imageId: "ami-12345678",
    instanceType: "t3.micro",
    associatePublicIpAddress: false, // Disable public IP assignment
    securityGroups: [securityGroup.id],
});

const launchConfig = new aws.ec2.LaunchConfiguration("my-launch-config", {
    imageId: "ami-12345678",
    instanceType: "t3.medium",
    ebsBlockDevices: [{
        deviceName: "/dev/sdf",
        volumeSize: 100,
        encrypted: true, // Enable encryption for all EBS block devices
    }],
});

const launchConfig = new ec2.LaunchConfiguration("my-launch-config", {
    imageId: "ami-0c55b159cbfafe1f0",
    instanceType: "t2.micro",
    rootBlockDevice: {
        encrypted: true, // Enable encryption for root block device
    },
});

const launchTemplate = new aws.ec2.LaunchTemplate("my-template", {
    blockDeviceMappings: [{
        ebs: {
            encrypted: "true",
            kmsKeyId: customerManagedKey.id, // Specify customer-managed KMS key
            volumeSize: 20,
        },
    }],
});

const launchTemplate = new aws.ec2.LaunchTemplate("my-template", {
    imageId: "ami-12345678",
    instanceType: "t3.micro",
    networkInterfaces: [{
        associatePublicIpAddress: "false", // Disable public IP assignment
        securityGroups: [securityGroup.id],
        subnetId: privateSubnet.id,
    }],
});

const launchTemplate = new aws.ec2.LaunchTemplate("my-template", {
    imageId: "ami-12345678",
    instanceType: "t3.micro",
    blockDeviceMappings: [{
        deviceName: "/dev/sda1",
        ebs: {
            encrypted: "true", // Enable encryption for the EBS volume
            volumeSize: 20,
            volumeType: "gp3",
        },
    }],
});

const securityGroup = new ec2.SecurityGroup("my-sg", {
    vpcId: vpc.id,
    ingress: [
        {
            protocol: "tcp",
            fromPort: 443, // Use HTTPS instead of HTTP (port 80)
            toPort: 443,
            cidrBlocks: ["0.0.0.0/0"],
        },
        // Remove any rules with fromPort: 80 or toPort: 80
    ],
});

const repository = new aws.ecr.Repository("my-repo", {
    name: "my-application",
    imageScanningConfiguration: {
        scanOnPush: true, // Enable automatic vulnerability scanning
    },
});

const kmsKey = new aws.kms.Key("ecr-key", {
    description: "KMS key for ECR repository encryption",
});

const repo = new ecr.Repository("my-repo", {
    encryptionConfigurations: [{
        encryptionType: "KMS", // Use KMS encryption instead of AES256
        kmsKey: kmsKey.arn, // Specify customer-managed KMS key
    }],
});

const repository = new aws.ecr.Repository("my-repo", {
    imageScanningConfiguration: {
        scanOnPush: true, // Enable automatic vulnerability scanning on image push
    },
});

const repository = new ecr.Repository("my-repository", {
    imageTagMutability: "IMMUTABLE", // Prevent image tags from being overwritten
});

const repo = new ecr.Repository("my-repo", {
    name: "my-application-repo",
    encryptionConfigurations: [{ // Enable encryption
        encryptionType: "AES256", // Use AWS managed encryption (or "KMS" for customer-managed keys)
    }],
});

const repository = new aws.ecr.Repository("my-repository", {
    imageScanningConfiguration: {
        scanOnPush: true, // Enable automatic vulnerability scanning
    },
});

const taskDefinition = new aws.ecs.TaskDefinition("my-task", {
    family: "my-app",
    containerDefinitions: JSON.stringify([{
        name: "app",
        image: "123456789012.dkr.ecr.us-east-1.amazonaws.com/my-repo:latest", // Use ECR image with scanning
        memory: 512,
        cpu: 256,
    }]),
    requiresCompatibilities: ["FARGATE"],
    networkMode: "awsvpc",
    cpu: "256",
    memory: "512",
});

const fileSystem = new aws.efs.FileSystem("my-efs", {
    encrypted: true,
    kmsKeyId: kmsKey.arn, // Use customer-managed KMS key instead of AWS-managed key
    lifecyclePolicy: {
        transitionToIa: "AFTER_30_DAYS",
    },
});

const fileSystem = new aws.efs.FileSystem("my-efs", {
    encrypted: true, // Enable encryption at rest
    kmsKeyId: kmsKey.arn, // Optional: specify a custom KMS key
});

const cluster = new eks.Cluster("my-cluster", {
    vpcConfig: {
        subnetIds: privateSubnetIds,
        endpointPublicAccess: false, // Disable public access to API endpoint
        endpointPrivateAccess: true, // Enable private access for internal communication
    },
    // ... other configuration
});

const cluster = new aws.eks.Cluster("my-cluster", {
    roleArn: clusterRole.arn,
    vpcConfig: {
        subnetIds: subnetIds,
    },
    encryptionConfig: { // Enable encryption for Kubernetes secrets
        provider: {
            keyArn: kmsKey.arn, // KMS key for encrypting secrets
        },
        resources: ["secrets"], // Encrypt Kubernetes secrets at rest
    },
});

const lb = new aws.elb.LoadBalancer("my-lb", {
    availabilityZones: ["us-west-2a", "us-west-2b"],
    listeners: [{
        instancePort: 80,
        instanceProtocol: "http",
        lbPort: 80,
        lbProtocol: "http",
    }],
    accessLogs: {
        enabled: true, // Enable access logging
        bucket: "my-logs-bucket", // S3 bucket for logs
    },
});

const lb = new aws.elb.LoadBalancer("my-lb", {
    availabilityZones: ["us-east-1a", "us-east-1b"], // Configure multiple AZs for resilience
    listeners: [{
        instancePort: 8000,
        instanceProtocol: "http",
        lbPort: 80,
        lbProtocol: "http",
    }],
});

const lb = new aws.elb.LoadBalancer("my-lb", {
    availabilityZones: ["us-west-2a", "us-west-2b"],
    listeners: [{
        instancePort: 443,
        instanceProtocol: "https",
        lbPort: 443,
        lbProtocol: "https", // Use HTTPS instead of HTTP
        sslCertificateId: "arn:aws:iam::123456789012:server-certificate/my-cert",
    }],
});

const lb = new aws.elb.LoadBalancer("my-load-balancer", {
    availabilityZones: ["us-west-2a", "us-west-2b"],
    listeners: [{
        instancePort: 80,
        instanceProtocol: "HTTP",
        lbPort: 80,
        lbProtocol: "HTTP",
    }],
    healthCheck: { // Enable health check configuration
        target: "HTTP:80/",
        interval: 30,
        timeout: 5,
        healthyThreshold: 2,
        unhealthyThreshold: 2,
    },
});

const instance = new aws.ec2.Instance("web-server", {
    instanceType: "t3.micro",
    ami: "ami-12345678",
    tags: {
        "Environment": "production", // Add environment tag for proper separation
        "Name": "web-server",
    },
});

const groupPolicy = new aws.iam.GroupPolicy("my-group-policy", {
    group: myGroup.name,
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "cloudwatch:PutMetricData",  // Specify exact actions needed
            ],
            Resource: "*",  // Some AWS services require "*" for resource
            Condition: {
                StringEquals: {
                    "cloudwatch:namespace": "MyApp",  // Use conditions to scope access
                },
            },
        }],
    }),
});

const passwordPolicy = new aws.iam.AccountPasswordPolicy("account-password-policy", {
    minimumPasswordLength: 14, // Set minimum length to at least 14 characters
});

const accountPasswordPolicy = new aws.iam.AccountPasswordPolicy("password-policy", {
    minimumPasswordLength: 14,
    requireNumbers: true,
    requireSymbols: true,
    requireUppercaseCharacters: true,
    requireLowercaseCharacters: true,
    passwordReusePrevention: 24, // Prevent reuse of previous 24 passwords
});

const policy = new aws.iam.Policy("my-policy", {
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "s3:GetObject",        // Specify exact actions needed
                "s3:PutObject",
            ],
            Resource: [
                "arn:aws:s3:::my-bucket/*",  // Scope to specific resources
            ],
        }],
    }),
});

const adminRole = new aws.iam.Role("admin-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: {
                AWS: "arn:aws:iam::123456789012:root" // Root account (human)
            },
            Action: "sts:AssumeRole",
            Condition: {
                Bool: {
                    "aws:MultiFactorAuthPresent": "true" // Require MFA
                }
            }
        }],
    }),
});

const userAssumeRole = new aws.iam.Role("user-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: {
                AWS: "arn:aws:iam::123456789012:user/john.doe" // IAM user (human)
            },
            Action: "sts:AssumeRole",
            Condition: {
                Bool: {
                    "aws:MultiFactorAuthPresent": "true" // Require MFA
                }
            }
        }],
    }),
});

// Service roles are automatically exempt (no MFA condition needed)
const ecsTaskRole = new aws.iam.Role("ecs-task-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: {
                Service: "ecs-tasks.amazonaws.com" // Service principal - no MFA needed
            },
            Action: "sts:AssumeRole"
        }],
    }),
});

// Role principals are never flagged (could be cross-account service roles)
const crossAccountRole = new aws.iam.Role("cross-account-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: {
                AWS: "arn:aws:iam::111111111111:role/service-role" // Role principal - not checked
            },
            Action: "sts:AssumeRole"
        }],
    }),
});

const role = new aws.iam.Role("my-role", {
    assumeRolePolicy: assumePolicyDoc,
    inlinePolicies: [{
        name: "my-inline-policy",
        policy: JSON.stringify({
            Version: "2012-10-17",
            Statement: [{
                Effect: "Allow",
                Action: [
                    "dynamodb:GetItem",    // Specify exact actions needed
                    "dynamodb:PutItem",
                ],
                Resource: [
                    "arn:aws:dynamodb:us-east-1:123456789012:table/MyTable",  // Scope to specific resources
                ],
            }],
        }),
    }],
});

const rolePolicy = new aws.iam.RolePolicy("my-role-policy", {
    role: myRole.id,
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "ec2:DescribeInstances",   // Specify exact actions needed
                "ec2:StartInstances",
                "ec2:StopInstances",
            ],
            Resource: [
                "arn:aws:ec2:us-east-1:123456789012:instance/*",  // Scope to specific resources
            ],
        }],
    }),
});

const appRole = new aws.iam.Role("app-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: { Service: "ec2.amazonaws.com" },
            Action: "sts:AssumeRole",
        }],
    }),
    maxSessionDuration: 3600, // 1 hour for general roles (default)
});

const adminRole = new aws.iam.Role("admin-role", {
    name: "AdminRole",
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: { AWS: "arn:aws:iam::123456789012:root" },
            Action: "sts:AssumeRole",
        }],
    }),
    maxSessionDuration: 7200, // 2 hours for administrative roles
});

const user = new aws.iam.User("example-user", {
    name: "example-user",
});

const loginProfile = new aws.iam.UserLoginProfile("example-login", {
    user: user.name,
});

// Create Virtual MFA Device for the user
const mfaDevice = new aws.iam.VirtualMfaDevice("example-user-mfa", {
    virtualMfaDeviceName: "example-user-mfa", // Name must match pattern: <username>-mfa or <username>-mfa-device
    userName: user.name, // Associate MFA device with the user
});

const userPolicy = new aws.iam.UserPolicy("my-user-policy", {
    user: myUser.name,
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "s3:ListBucket",         // Specify exact actions needed
            ],
            Resource: [
                "arn:aws:s3:::my-bucket",  // Scope to specific resources
            ],
        }],
    }),
});

const eventSourceMapping = new aws.lambda.EventSourceMapping("kinesis-mapping", {
    eventSourceArn: kinesisStream.arn,
    functionName: lambdaFunction.arn,
    startingPosition: "LATEST",
    destinationConfig: { // Add destination configuration for error handling
        onFailure: {
            destination: dlqArn, // ARN of SQS queue or SNS topic for failed records
        },
    },
});

const stream = new aws.kinesis.Stream("my-stream", {
    shardCount: 1,
    retentionPeriod: 24, // Set retention period in hours (24 hours minimum)
    encryptionType: "KMS",
    kmsKeyId: kmsKey.id,
});

const grant = new aws.kms.Grant("my-kms-grant", {
    keyId: kmsKey.id,
    granteePrincipal: roleArn, // Specify a specific grantee principal
    operations: ["Encrypt", "Decrypt"], // Define specific operations
    constraints: {
        encryptionContextSubset: {
            "Department": "Finance", // Add constraints for sensitive operations
        },
    },
});

const key = new aws.kms.Key("my-key", {
    description: "Key for encrypting application data", // Add clear description
    customerMasterKeySpec: "SYMMETRIC_DEFAULT", // Use approved key spec
    keyUsage: "ENCRYPT_DECRYPT", // Specify key usage
    deletionWindowInDays: 30, // Set deletion window between 7-30 days
    enableKeyRotation: true,
});

const kmsKey = new aws.kms.Key("my-key", {
    description: "Encryption key for application data",
    deletionWindowInDays: 30, // Set deletion window between 7-30 days
    tags: {
        Environment: "production",
        Owner: "security-team",
        Purpose: "data-encryption",
    },
});

const key = new kms.Key("my-key", {
    description: "KMS key with automatic rotation",
    enableKeyRotation: true, // Enable automatic annual key rotation
});

const keyPolicy = {
    Version: "2012-10-17",
    Statement: [
        {
            Sid: "Enable IAM User Permissions",
            Effect: "Allow",
            Principal: {
                AWS: `arn:aws:iam::${accountId}:root`, // Specific account root
            },
            Action: "kms:*",
            Resource: "*",
        },
        {
            Sid: "Allow Key Administrators",
            Effect: "Allow",
            Principal: {
                AWS: `arn:aws:iam::${accountId}:role/KeyAdminRole`, // Specific role ARN
            },
            Action: [
                "kms:Create*",
                "kms:Describe*",
                "kms:Enable*",
                "kms:List*",
                "kms:Put*",
                "kms:Update*",
                "kms:Revoke*",
                "kms:Disable*",
                "kms:Get*",
                "kms:Delete*",
                "kms:ScheduleKeyDeletion",
                "kms:CancelKeyDeletion", // Specific administrative actions only
            ],
            Resource: "*",
        },
        {
            Sid: "Allow Key Usage",
            Effect: "Allow",
            Principal: {
                AWS: `arn:aws:iam::${accountId}:role/KeyUserRole`, // Specific user role ARN
            },
            Action: [
                "kms:Decrypt",
                "kms:EncryptionContext*",
                "kms:GenerateDataKey", // Specific usage actions only
            ],
            Resource: "*",
        },
    ],
};

const key = new aws.kms.Key("my-key", {
    description: "My KMS key with least privilege policy",
    policy: JSON.stringify(keyPolicy), // Apply the policy with specific principals and actions
});

const kmsKey = new aws.kms.Key("lambda-env-key", {
    description: "KMS key for Lambda environment variable encryption",
});

const lambdaFunction = new aws.lambda.Function("my-function", {
    runtime: "nodejs18.x",
    handler: "index.handler",
    role: role.arn,
    code: new pulumi.asset.AssetArchive({
        ".": new pulumi.asset.FileArchive("./function"),
    }),
    environment: {
        variables: {
            DATABASE_URL: "postgres://example.com/db",
        },
    },
    kmsKeyArn: kmsKey.arn, // Encrypt environment variables with KMS
});

const myFunction = new aws.lambda.Function("my-function", {
    code: new pulumi.asset.FileArchive("./function"),
    role: lambdaRole.arn,
    handler: "index.handler",
    runtime: "nodejs20.x",
    description: "Processes user authentication requests and validates credentials", // Add descriptive documentation
});

const myFunction = new aws.lambda.Function("my-function", {
    runtime: "nodejs18.x",
    handler: "index.handler",
    role: lambdaRole.arn,
    code: new pulumi.asset.AssetArchive({
        ".": new pulumi.asset.FileArchive("./app"),
    }),
    loggingConfig: {
        logFormat: "JSON",
        applicationLogLevel: "INFO", // Set log level to INFO or DEBUG for adequate logging
    },
});

const lambdaPermission = new aws.lambda.Permission("my-permission", {
    action: "lambda:InvokeFunction",
    function: myFunction.name,
    principal: "apigateway.amazonaws.com",
    sourceArn: apiGateway.executionArn, // Specify the source ARN to restrict invocation
});

const myFunction = new aws.lambda.Function("my-function", {
    runtime: "nodejs20.x", // Use an approved runtime version
    handler: "index.handler",
    role: role.arn,
    code: new pulumi.asset.AssetArchive({
        ".": new pulumi.asset.FileArchive("./function"),
    }),
});

const myFunction = new aws.lambda.Function("my-function", {
    runtime: "nodejs20.x",
    handler: "index.handler",
    role: lambdaRole.arn,
    code: new pulumi.asset.AssetArchive({
        ".": new pulumi.asset.FileArchive("./app"),
    }),
    timeout: 300, // Set timeout to prevent extended access (max 300 seconds by default)
});

// Create a WAF Web ACL association for the Load Balancer
const wafAssociation = new aws.wafv2.WebAclAssociation("lb-waf-association", {
    resourceArn: loadBalancer.arn, // Reference the Load Balancer ARN
    webAclArn: webAcl.arn, // Reference the WAF Web ACL ARN
});

const neptuneInstance = new aws.neptune.ClusterInstance("my-neptune-instance", {
    clusterIdentifier: neptuneCluster.id,
    instanceClass: "db.r5.large",
    engine: "neptune",
    autoMinorVersionUpgrade: true, // Enable automatic minor version upgrades
});

const neptuneInstance = new aws.neptune.ClusterInstance("neptune-instance", {
    clusterIdentifier: neptuneCluster.id,
    instanceClass: "db.r5.large",
    engine: "neptune",
    publiclyAccessible: false,  // Disable public access
});

// Remove this - do not create IAM access keys
// const accessKey = new aws.iam.AccessKey("user-key", {
//     user: user.name,
// });

// Instead, use IAM roles for workloads
const role = new aws.iam.Role("app-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Principal: { Service: "ec2.amazonaws.com" }, // Use appropriate service
            Action: "sts:AssumeRole",
        }],
    }),
});

// Attach necessary policies to the role
new aws.iam.RolePolicyAttachment("app-policy", {
    role: role.name,
    policyArn: "arn:aws:iam::aws:policy/ReadOnlyAccess", // Use least-privilege policy
});

// For human users, use AWS SSO or federated identity instead of access keys

const instance = new aws.ec2.Instance("web-server", {
    instanceType: "t3.micro",
    ami: "ami-12345678",
    userData: `#!/bin/bash
export DATABASE_PASSWORD="mySecretPassword123"
export API_KEY="sk_live_abc123def456789"
mysql -u admin -p"hardcodedPassword" -h db.example.com
`,
});

const queuePolicy = new aws.iam.Policy("queue-policy", {
    policy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Effect: "Allow",
            Action: [
                "sqs:SendMessage",      // Use specific actions instead of sqs:*
                "sqs:ReceiveMessage",
                "sqs:DeleteMessage",
            ],
            Resource: "arn:aws:sqs:us-east-1:123456789012:my-queue", // Use specific ARN instead of *
        }],
    }),
});

// For MySQL/MariaDB
const db = new aws.rds.Instance("my-db", {
    engine: "mysql",
    instanceClass: "db.t3.micro",
    allocatedStorage: 20,
    enabledCloudwatchLogsExports: ["audit", "error", "general", "slowquery"], // Enable audit logs
    // ... other configuration
});

// For PostgreSQL
const pgDb = new aws.rds.Instance("my-pg-db", {
    engine: "postgres",
    instanceClass: "db.t3.micro",
    allocatedStorage: 20,
    enabledCloudwatchLogsExports: ["postgresql"], // Enable PostgreSQL logs
    // ... other configuration
});

// For Aurora clusters
const cluster = new aws.rds.Cluster("my-cluster", {
    engine: "aurora-mysql",
    enabledCloudwatchLogsExports: ["audit", "error", "general", "slowquery"], // Enable audit logs
    // ... other configuration
});