Deception Architecture Blueprint

# deception-architecture/main.tf
# Architecture blueprint: deception VPC deployed alongside production
# This scaffold defines the high-level structure for planning purposes

terraform {
  required_providers {
    aws = { source = "hashicorp/aws", version = "~> 5.0" }
  }
}

variable "production_vpc_id" {
  description = "ID of the existing production VPC"
  type        = string
}

variable "production_vpc_cidr" {
  description = "CIDR block of the production VPC"
  type        = string
  default     = "10.0.0.0/16"
}

# --- Deception VPC ---
# Separate VPC for deception assets with controlled peering
resource "aws_vpc" "deception" {
  cidr_block           = "10.200.0.0/16"
  enable_dns_support   = true
  enable_dns_hostnames = true

  tags = {
    Name        = "shadow-cdf-deception-vpc"
    Environment = "deception"
    ManagedBy   = "shadow-cdf-matrix"
  }
}

# Subnets mirror production naming to appear legitimate
resource "aws_subnet" "deception_web_tier" {
  vpc_id            = aws_vpc.deception.id
  cidr_block        = "10.200.10.0/24"
  availability_zone = "us-east-1a"
  tags = { Name = "prod-web-tier-02" }  # Blends with production naming
}

resource "aws_subnet" "deception_db_tier" {
  vpc_id            = aws_vpc.deception.id
  cidr_block        = "10.200.20.0/24"
  availability_zone = "us-east-1a"
  tags = { Name = "prod-db-tier-02" }
}

resource "aws_subnet" "deception_mgmt" {
  vpc_id            = aws_vpc.deception.id
  cidr_block        = "10.200.99.0/24"
  availability_zone = "us-east-1a"
  tags = { Name = "shadow-mgmt" }  # Management subnet - not visible to adversaries
}

# Controlled peering: production can route TO deception, but deception
# cannot initiate connections BACK to production
resource "aws_vpc_peering_connection" "prod_to_deception" {
  vpc_id      = var.production_vpc_id
  peer_vpc_id = aws_vpc.deception.id
  auto_accept = true

  tags = { Name = "prod-deception-peering" }
}

# Security group: allow inbound from production, deny outbound to production
resource "aws_security_group" "deception_isolation" {
  name        = "deception-asset-isolation"
  description = "Allow inbound from prod, block outbound to prod"
  vpc_id      = aws_vpc.deception.id

  # Allow all inbound from production VPC (adversary needs to reach decoys)
  ingress {
    from_port   = 0
    to_port     = 65535
    protocol    = "tcp"
    cidr_blocks = [var.production_vpc_cidr]
  }

  # Allow outbound to management subnet only (for log shipping)
  egress {
    from_port   = 0
    to_port     = 65535
    protocol    = "tcp"
    cidr_blocks = ["10.200.99.0/24"]
    description = "Log shipping to management subnet only"
  }

  tags = { Name = "deception-isolation-sg" }
}

output "deception_vpc_id" { value = aws_vpc.deception.id }
output "deception_web_subnet_id" { value = aws_subnet.deception_web_tier.id }
output "deception_db_subnet_id" { value = aws_subnet.deception_db_tier.id }