# Sentinel政策範例 - 確保所有S3儲存桶都啟用加密
import "tfplan"

# 取得所有計劃的S3儲存桶資源
s3_buckets = filter tfplan.resource_changes as _, rc {
    rc.type is "aws_s3_bucket" and
    (rc.change.actions contains "create" or rc.change.actions contains "update")
}

# 檢查每個儲存桶是否啟用了加密
bucket_encryption_enabled = rule {
    all s3_buckets as _, bucket {
        bucket.change.after.server_side_encryption_configuration is not null
    }
}

# 主規則
main = rule {
    bucket_encryption_enabled
}

# 自動化合規報告生成器
import json
import datetime
import boto3
import csv
import os

def generate_compliance_report():
    # 初始化AWS客戶端
    ec2 = boto3.client('ec2')
    s3 = boto3.client('s3')
    rds = boto3.client('rds')
    
    report_data = {
        "report_date": datetime.datetime.now().isoformat(),
        "compliance_status": "pending",
        "resources_checked": 0,
        "compliance_issues": [],
        "compliant_resources": 0,
        "non_compliant_resources": 0
    }
    
    # 檢查EC2例項合規性
    print("Checking EC2 instances...")
    instances = ec2.describe_instances()
    for reservation in instances['Reservations']:
        for instance in reservation['Instances']:
            report_data["resources_checked"] += 1
            instance_issues = []
            
            # 檢查標籤合規性
            if 'Tags' not in instance or not any(tag['Key'] == 'Environment' for tag in instance.get('Tags', [])):
                instance_issues.append("Missing required 'Environment' tag")
            
            # 檢查安全組合規性
            for sg_id in instance['SecurityGroups']:
                sg = ec2.describe_security_groups(GroupIds=[sg_id['GroupId']])['SecurityGroups'][0]
                for rule in sg['IpPermissions']:
                    if any(ip_range.get('CidrIp') == '0.0.0.0/0' for ip_range in rule.get('IpRanges', [])):
                        if rule.get('FromPort') == 22 or rule.get('ToPort') == 22:
                            instance_issues.append(f"Security group {sg_id['GroupId']} allows SSH from anywhere")
            
            # 記錄合規狀態
            if instance_issues:
                report_data["non_compliant_resources"] += 1
                report_data["compliance_issues"].append({
                    "resource_id": instance['InstanceId'],
                    "resource_type": "EC2 Instance",
                    "issues": instance_issues
                })
            else:
                report_data["compliant_resources"] += 1
    
    # 檢查S3儲存桶合規性
    print("Checking S3 buckets...")
    buckets = s3.list_buckets()
    for bucket in buckets['Buckets']:
        report_data["resources_checked"] += 1
        bucket_issues = []
        
        # 檢查加密
        try:
            encryption = s3.get_bucket_encryption(Bucket=bucket['Name'])
            # 如果上面的呼叫沒有丟擲異常，則儲存桶已加密
        except s3.exceptions.ClientError:
            bucket_issues.append("Server-side encryption not enabled")
        
        # 檢查公共存取設定
        public_access = s3.get_public_access_block(Bucket=bucket['Name'])
        if not all([
            public_access['PublicAccessBlockConfiguration']['BlockPublicAcls'],
            public_access['PublicAccessBlockConfiguration']['IgnorePublicAcls'],
            public_access['PublicAccessBlockConfiguration']['BlockPublicPolicy'],
            public_access['PublicAccessBlockConfiguration']['RestrictPublicBuckets']
        ]):
            bucket_issues.append("Public access not fully blocked")
        
        # 記錄合規狀態
        if bucket_issues:
            report_data["non_compliant_resources"] += 1
            report_data["compliance_issues"].append({
                "resource_id": bucket['Name'],
                "resource_type": "S3 Bucket",
                "issues": bucket_issues
            })
        else:
            report_data["compliant_resources"] += 1
    
    # 設定總體合規狀態
    if report_data["non_compliant_resources"] == 0:
        report_data["compliance_status"] = "compliant"
    else:
        report_data["compliance_status"] = "non_compliant"
    
    # 生成報告檔案
    report_dir = "compliance_reports"
    os.makedirs(report_dir, exist_ok=True)
    
    # JSON報告
    json_report_path = f"{report_dir}/compliance_report_{datetime.datetime.now().strftime('%Y%m%d_%H%M%S')}.json"
    with open(json_report_path, 'w') as f:
        json.dump(report_data, f, indent=2)
    
    # CSV報告（僅包含問題）
    csv_report_path = f"{report_dir}/compliance_issues_{datetime.datetime.now().strftime('%Y%m%d_%H%M%S')}.csv"
    with open(csv_report_path, 'w', newline='') as f:
        writer = csv.writer(f)
        writer.writerow(["Resource ID", "Resource Type", "Issues"])
        for issue in report_data["compliance_issues"]:
            writer.writerow([
                issue["resource_id"],
                issue["resource_type"],
                "; ".join(issue["issues"])
            ])
    
    print(f"Compliance report generated:")
    print(f"- JSON report: {json_report_path}")
    print(f"- CSV issues report: {csv_report_path}")
    print(f"Summary: {report_data['compliant_resources']} compliant, {report_data['non_compliant_resources']} non-compliant resources")
    
    return report_data

if __name__ == "__main__":
    generate_compliance_report()

module "network" {
  source = "./modules/network"
  
  vpc_name = "production-vpc"
  vpc_cidr = "10.0.0.0/16"
  region = "ap-northeast-1"
  availability_zones = ["ap-northeast-1a", "ap-northeast-1c", "ap-northeast-1d"]
  public_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
  private_subnets = ["10.0.11.0/24", "10.0.12.0/24", "10.0.13.0/24"]
  
  enable_nat_gateway = true
  single_nat_gateway = false  # 每個AZ使用一個NAT閘道器以提高用性
  
  tags = {
    Environment = "production"
    Project = "e-commerce"
    ManagedBy = "terraform"
  }
}

# 團隊學習與改進計劃範例
name: Infrastructure Team Learning Plan
quarterly_focus:
  - topic: "Kubernetes Operator模式"
    resources:
      - type: "Workshop"
        title: "構建自定義Kubernetes Operator"
        duration: "1天"
        facilitator: "外部講師"
      - type: "Book"
        title: "Kubernetes Operators實戰"
        chapters: "全部"
      - type: "Project"
        title: "為我們的資料函式庫服務開發自定義Operator"
        duration: "6週"
        team_members: ["Alice", "Bob", "Charlie"]
  
  - topic: "基礎設施測試策略"
    resources:
      - type: "Internal Session"
        title: "基礎設施測試最佳實踐"
        duration: "2小時"
        facilitator: "玄貓"
      - type: "Online Course"
        title: "使用Terratest進行基礎設施測試"
        duration: "8小時"
      - type: "Project"
        title: "為核心基礎設施模組實施自動化測試"
        duration: "4週"
        team_members: ["Dave", "Eve", "Frank"]

retrospectives:
  frequency: "每兩週"
  focus_areas:
    - "工作流程效率"
    - "自動化覆寫率"
    - "事件回顧與學習"
    - "技術債務管理"

knowledge_sharing:
  - type: "Tech Talk"
    frequency: "每週"
    duration: "30分鐘"
    format: "團隊成員輪流分享技術主題"
  
  - type: "Pair Programming"
    frequency: "持續"
    policy: "複雜變更必須有兩人參與"
  
  - type: "Documentation Day"
    frequency: "每月最後一個星期五"
    focus: "更新檔案、增加範例、改進"

external_engagement:
  - type: "Conference"
    frequency: "每人每年至少一次"
    budget: "每人5000元"
  
  - type: "Community Contribution"
    target: "每季度至少一個開放原始碼貢獻或部落格文章"
    support: "工作時間內20%的時間可用於開放原始碼貢獻"

# 安全基準模組範例
module "security_baseline" {
  source = "./modules/security"
  
  environment = var.environment
  encryption_level = var.environment == "prod" ? "high" : "standard"
  logging_retention = var.environment == "prod" ? 90 : 30
}

# 自動化安全測試範例
def test_security_groups_no_public_ssh():
    """確保沒有安全組允許從公網直接SSH連線"""
    security_groups = get_all_security_groups()
    
    for sg in security_groups:
        for rule in sg.ingress_rules:
            if rule.port == 22 and rule.cidr == "0.0.0.0/0":
                assert False, f"安全組 {sg.id} 允許從公網SSH連線"
    
    return True