# Bastion Host Security Group
resource "aws_security_group" "bastion" {
  name_prefix = "bastion-sg"
  vpc_id      = var.vpc_id

  # SSH access from specific IP ranges only
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = var.allowed_cidr_blocks
  }

  # Outbound access to private subnets
  egress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = [var.private_subnet_cidr]
  }

  # HTTPS for package updates
  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "bastion-security-group"
    Purpose = "Bastion Host Access Control"
  }
}

# Bastion Host Instance
resource "aws_instance" "bastion" {
  ami                    = data.aws_ami.amazon_linux.id
  instance_type          = "t3.micro"
  key_name              = var.key_pair_name
  subnet_id             = var.public_subnet_id
  vpc_security_group_ids = [aws_security_group.bastion.id]

  # Enhanced monitoring and detailed monitoring
  monitoring = true

  # EBS optimization for better I/O performance
  ebs_optimized = true

  # IMDSv2 enforcement
  metadata_options {
    http_endpoint = "enabled"
    http_tokens   = "required"
  }

  user_data = base64encode(templatefile("${path.module}/bastion-userdata.sh", {
    log_group_name = aws_cloudwatch_log_group.bastion.name
  }))

  tags = {
    Name = "bastion-host"
    Environment = var.environment
  }
}

#!/bin/bash
# bastion-userdata.sh - Bastion host security hardening

# Update system packages
yum update -y
yum install -y awslogs

# Configure SSH hardening
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup
cat > /etc/ssh/sshd_config << 'EOF'
Port 22
Protocol 2
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding no
PrintMotd no
ClientAliveInterval 300
ClientAliveCountMax 2
MaxAuthTries 3
MaxSessions 2
AllowUsers ec2-user
Banner /etc/ssh/banner
LogLevel VERBOSE
EOF

# Create SSH banner
cat > /etc/ssh/banner << 'EOF'
***************************************************************************
                    AUTHORIZED ACCESS ONLY
***************************************************************************
This system is for the use of authorized users only. Individuals using
this computer system without authority or in excess of their authority
are subject to having all their activities monitored and recorded.
EOF

# Configure fail2ban for SSH protection
yum install -y epel-release
yum install -y fail2ban
cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3

[sshd]
enabled = true
port = 22
logpath = /var/log/secure
EOF

# Configure comprehensive logging
cat > /etc/rsyslog.d/bastion.conf << 'EOF'
# Log all authentication attempts
auth,authpriv.* /var/log/bastion-auth.log
# Log all commands (requires additional setup)
*.* /var/log/bastion-activity.log
EOF

# Set up CloudWatch logging
cat > /etc/awslogs/awslogs.conf << 'EOF'
[general]
state_file = /var/lib/awslogs/agent-state

[/var/log/secure]
file = /var/log/secure
log_group_name = ${log_group_name}
log_stream_name = {instance_id}/ssh-auth
datetime_format = %b %d %H:%M:%S

[/var/log/bastion-auth.log]
file = /var/log/bastion-auth.log
log_group_name = ${log_group_name}
log_stream_name = {instance_id}/auth-attempts
EOF

# Start and enable services
systemctl restart sshd
systemctl enable fail2ban
systemctl start fail2ban
systemctl enable awslogsd
systemctl start awslogsd

# Remove unnecessary packages
yum remove -y gcc make kernel-devel
yum autoremove -y

# Set restrictive permissions
chmod 600 /etc/ssh/sshd_config
chown root:root /etc/ssh/sshd_config

# Install and configure Google Authenticator
yum install -y google-authenticator

# Configure PAM for MFA
echo "auth required pam_google_authenticator.so" >> /etc/pam.d/sshd

# Update SSH config for MFA
echo "AuthenticationMethods publickey,keyboard-interactive" >> /etc/ssh/sshd_config
echo "ChallengeResponseAuthentication yes" >> /etc/ssh/sshd_config

# Install session recording tools
yum install -y tlog

# Configure tlog for session recording
cat > /etc/tlog/tlog-rec-session.conf << 'EOF'
{
    "version": 1,
    "file": {
        "path": "/var/log/tlog/sessions.log"
    },
    "syslog": {
        "facility": "authpriv",
        "priority": "info"
    }
}
EOF

# Set tlog as shell for users requiring session recording
usermod -s /usr/bin/tlog-rec-session ec2-user

resource "aws_cloudwatch_metric_alarm" "bastion_ssh_failures" {
  alarm_name          = "bastion-ssh-failures"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = "2"
  metric_name         = "AuthFailures"
  namespace           = "BastionHost"
  period              = "300"
  statistic           = "Sum"
  threshold           = "5"
  alarm_description   = "Multiple SSH authentication failures on bastion host"

  alarm_actions = [aws_sns_topic.security_alerts.arn]
}

resource "aws_cloudwatch_log_metric_filter" "ssh_failures" {
  name           = "ssh-auth-failures"
  log_group_name = aws_cloudwatch_log_group.bastion.name
  pattern        = "[timestamp, id, msg=\"Failed*\"]"

  metric_transformation {
    name      = "AuthFailures"
    namespace = "BastionHost"
    value     = "1"
  }
}