# Security Layer Templates — Auto-generated by hmcmkit security-architect
# 8 Security Components for Enterprise deployments

---
# 1. CloudFront Distribution
apiVersion: cloudfront
kind: Distribution
spec:
  origins:
    - domainName: ${alb_domain}
      originProtocolPolicy: https-only
  defaultCacheBehavior:
    viewerProtocolPolicy: redirect-to-https
    allowedMethods: [GET, HEAD, OPTIONS, PUT, POST, PATCH, DELETE]
  webACLId: ${waf_acl_arn}
  comment: "hmcmkit-managed CDN + DDoS protection"

---
# 2. AWS WAF — OWASP Top 10
# Apply via Terraform: aws_wafv2_web_acl
waf_rules:
  - name: AWSManagedRulesCommonRuleSet
    priority: 1
    vendor: AWS
  - name: AWSManagedRulesSQLiRuleSet
    priority: 2
    vendor: AWS
  - name: AWSManagedRulesKnownBadInputsRuleSet
    priority: 3
    vendor: AWS
  - name: rate-limit
    priority: 10
    limit: 2000  # requests per 5 minutes per IP

---
# 3. VPC Design
vpc:
  cidr: "10.0.0.0/16"
  subnets:
    public:
      - "10.0.1.0/24"   # ALB, NAT Gateway
      - "10.0.2.0/24"
    private:
      - "10.0.10.0/24"  # EKS nodes, application
      - "10.0.11.0/24"
    database:
      - "10.0.20.0/24"  # RDS (no internet access)
      - "10.0.21.0/24"
  nat_gateway: single  # staging: single, prod: per-az

---
# 4. IAM — IRSA (IAM Roles for Service Accounts)
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ${project_name}-api
  namespace: ${environment}
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::${aws_account_id}:role/${project_name}-${environment}-api

---
# 5. Network Policy (Calico/Cilium)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: ${project_name}-api-policy
  namespace: ${environment}
spec:
  podSelector:
    matchLabels:
      app: ${project_name}-api
  policyTypes: [Ingress, Egress]
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: ingress-nginx
      ports:
        - port: 3000
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              name: ${environment}
      ports:
        - port: 5432  # PostgreSQL
        - port: 6379  # Redis

---
# 6. ACM + cert-manager
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
      - http01:
          ingress:
            class: nginx

---
# 7. Secrets Rotation Policy
secrets_rotation:
  provider: aws-secrets-manager
  rotation_interval: 30d
  secrets:
    - name: db-credentials
      type: rds
      auto_rotate: true
    - name: api-keys
      type: custom
      auto_rotate: false  # manual rotation

---
# 8. Backup & DR
backup:
  rds:
    retention_period: 7     # days (staging)
    # retention_period: 35  # days (production)
    copy_to_region: ap-northeast-1  # Cross-region backup
    snapshot_schedule: "cron(0 3 * * ? *)"  # Daily 3AM UTC
  s3:
    versioning: true
    lifecycle_rule:
      transition_to_ia: 30   # days
      transition_to_glacier: 90