Environment & Secret #

# ANTI-PATTERN: Generate password di Terraform
resource "random_password" "db" {
  length  = 32
  special = true
}

resource "aws_db_instance" "main" {
  password = random_password.db.result  # Password masuk ke state
}

# BENAR: Password dibuat di luar Terraform (manual atau via secrets manager)
# Terraform hanya membaca ARN-nya, bukan nilainya

# Buat secret di AWS Secrets Manager (sekali, di luar Terraform)
# aws secretsmanager create-secret --name prod/db/password --secret-string "..."

# Terraform hanya referensikan ARN secret, bukan nilainya
data "aws_secretsmanager_secret" "db_password" {
  name = "prod/db/password"
}

resource "aws_db_instance" "main" {
  # Gunakan referensi ARN ke Secrets Manager, bukan nilai password
  manage_master_user_password = true
  # Atau: gunakan master_user_secret yang di-manage AWS
}

# Baca secret dari Secrets Manager
data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "prod/db/master-password"
}

# Gunakan nilai secret
resource "aws_db_instance" "main" {
  identifier     = "production-db"
  engine         = "postgres"
  instance_class = "db.t3.medium"

  # Nilai ini masuk ke state — ini trade-off yang perlu disadari
  # Pastikan state di-enkripsi dan akses ke state sangat terbatas
  username = "admin"
  password = data.aws_secretsmanager_secret_version.db_password.secret_string

  # Lebih baik: gunakan manage_master_user_password yang di-manage AWS
  # sehingga password tidak pernah muncul di state sama sekali
}

# Cara terbaik untuk RDS: biarkan AWS mengelola password
resource "aws_db_instance" "main_v2" {
  identifier     = "production-db"
  engine         = "postgres"
  instance_class = "db.t3.medium"
  username       = "admin"

  manage_master_user_password = true
  # AWS buat password, simpan di Secrets Manager
  # Password TIDAK masuk ke Terraform state
  # Rotasi bisa dikonfigurasi via master_user_secret_rotation
}

# Simpan konfigurasi di SSM Parameter Store
resource "aws_ssm_parameter" "db_endpoint" {
  name  = "/prod/database/endpoint"
  type  = "String"          # Bukan secret — cukup String
  value = aws_db_instance.main.endpoint
}

resource "aws_ssm_parameter" "api_key" {
  name  = "/prod/external/api-key"
  type  = "SecureString"    # Secret — dienkripsi dengan KMS
  value = var.external_api_key
  # Nilai masih masuk ke state — tapi dienkripsi di SSM
}

# Baca parameter dari SSM (di konfigurasi lain atau di aplikasi)
data "aws_ssm_parameter" "db_endpoint" {
  name = "/prod/database/endpoint"
}

output "db_endpoint" {
  value = data.aws_ssm_parameter.db_endpoint.value
}

# ANTI-PATTERN: Hardcode secret di resource
resource "aws_ecs_task_definition" "app" {
  container_definitions = jsonencode([{
    name  = "app"
    image = "myapp:latest"
    environment = [
      {
        name  = "DB_PASSWORD"
        value = "MyP4ssword"  # ✗ Masuk ke state sebagai plaintext
      }
    ]
  }])
}

# BENAR: Referensikan secret dari Secrets Manager, bukan nilai
resource "aws_ecs_task_definition" "app" {
  container_definitions = jsonencode([{
    name  = "app"
    image = "myapp:latest"
    # Jangan gunakan 'environment' untuk secret
    # Gunakan 'secrets' yang membaca dari Secrets Manager saat runtime
    secrets = [
      {
        name      = "DB_PASSWORD"
        valueFrom = "arn:aws:secretsmanager:ap-southeast-1:123456789:secret:prod/db/password"
        # ECS agent membaca nilai ini saat container start
        # Nilai tidak pernah masuk ke Terraform state
      }
    ]
  }])
}

# Backend S3 dengan enkripsi dan akses ketat
terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "production/terraform.tfstate"
    region         = "ap-southeast-1"

    # Enkripsi wajib
    encrypt        = true
    kms_key_id     = "arn:aws:kms:ap-southeast-1:123456789:key/abc-123"

    # Akses via DynamoDB lock
    dynamodb_table = "terraform-state-lock"
  }
}

# IAM Policy untuk S3 state bucket:
# - Hanya TerraformApplyRole yang bisa read/write state
# - Tim engineering hanya bisa list bucket, tidak bisa baca state
# - Audit log semua akses via CloudTrail

# S3 backend dengan KMS encryption
terraform {
  backend "s3" {
    bucket         = "my-terraform-state"
    key            = "production/terraform.tfstate"
    region         = "ap-southeast-1"
    encrypt        = true
    kms_key_id     = aws_kms_key.terraform_state.arn
    dynamodb_table = "terraform-state-lock"
  }
}

resource "aws_kms_key" "terraform_state" {
  description             = "KMS key for Terraform state"
  deletion_window_in_days = 30
  enable_key_rotation     = true
}

# Verifikasi enkripsi aktif
aws s3api get-bucket-encryption --bucket my-terraform-state
# Harus mengembalikan SSEAlgorithm: aws:kms

# Verifikasi KMS key rotation aktif
aws kms get-key-rotation-status --key-id $KEY_ID
# Harus mengembalikan true

# Strategi rotasi:

# 1. Rotasi otomatis menggunakan AWS Secrets Manager
resource "aws_secretsmanager_secret_rotation" "db" {
  secret_id           = aws_secretsmanager_secret.db.id
  rotation_lambda_arn = aws_lambda_function.rotate.arn

  rotation_rules {
    automatically_after_days = 30
  }
}

# 2. Rotasi manual (untuk secret yang tidak bisa auto-rotate)
# a. Generate secret baru
# b. Update di secret manager
# c. Deploy aplikasi dengan secret baru
# d. Verifikasi aplikasi berfungsi
# e. Disable secret lama
# f. Hapus secret lama setelah grace period

# AWS Secrets Manager dengan Terraform
resource "aws_secretsmanager_secret" "app" {
  name        = "${local.name_prefix}/app-config"
  description = "Application configuration secrets"
  
  # Enable rotation
  rotation_lambda_arn = aws_lambda_function.rotate.arn
  rotation_rules {
    automatically_after_days = 30
  }
}

resource "aws_secretsmanager_secret_version" "app" {
  secret_id = aws_secretsmanager_secret.app.id
  secret_string = jsonencode({
    database_url = "postgres://${var.db_user}:${random_password.db.result}@${aws_db_instance.main.address}:5432/app"
    redis_url    = "redis://${aws_elasticache_cluster.main.cache_nodes[0].address}:6379"
    jwt_secret   = random_password.jwt.result
  })
}