Shadow Network Provisioning

# modules/shadow-network/main.tf

variable "environment_id" { type = string }
variable "production_vpc_cidr" { type = string }
variable "deception_cidr" { type = string, default = "10.200.0.0/16" }

resource "aws_vpc" "shadow" {
  cidr_block           = var.deception_cidr
  enable_dns_support   = true
  enable_dns_hostnames = true
  tags = { Name = "internal-svcs-${var.environment_id}" }
}

# Mimic production subnet naming conventions
resource "aws_subnet" "decoy_subnets" {
  for_each = {
    web    = { cidr = "10.200.10.0/24", az = "us-east-1a" }
    app    = { cidr = "10.200.20.0/24", az = "us-east-1a" }
    db     = { cidr = "10.200.30.0/24", az = "us-east-1b" }
    admin  = { cidr = "10.200.40.0/24", az = "us-east-1b" }
  }

  vpc_id            = aws_vpc.shadow.id
  cidr_block        = each.value.cidr
  availability_zone = each.value.az
  tags = { Name = "prod-${each.key}-${var.environment_id}" }
}

# Isolation: decoys can receive traffic but cannot reach production
resource "aws_network_acl" "isolation" {
  vpc_id     = aws_vpc.shadow.id
  subnet_ids = [for s in aws_subnet.decoy_subnets : s.id]

  # Allow inbound from production
  ingress {
    protocol   = "tcp"
    rule_no    = 100
    action     = "allow"
    cidr_block = var.production_vpc_cidr
    from_port  = 0
    to_port    = 65535
  }

  # DENY outbound to production (critical isolation control)
  egress {
    protocol   = "tcp"
    rule_no    = 50
    action     = "deny"
    cidr_block = var.production_vpc_cidr
    from_port  = 0
    to_port    = 65535
  }

  # Allow outbound to management/logging subnet
  egress {
    protocol   = "tcp"
    rule_no    = 100
    action     = "allow"
    cidr_block = "10.200.99.0/24"
    from_port  = 0
    to_port    = 65535
  }

  tags = { Name = "shadow-isolation-nacl" }
}

# VPC Flow Logs: capture all traffic for analysis
resource "aws_flow_log" "shadow_flows" {
  vpc_id               = aws_vpc.shadow.id
  traffic_type         = "ALL"
  log_destination_type = "cloud-watch-logs"
  log_destination      = aws_cloudwatch_log_group.shadow.arn
  iam_role_arn         = aws_iam_role.flow_log.arn
}

resource "aws_cloudwatch_log_group" "shadow" {
  name              = "/shadow-cdf/vpc-flow-logs"
  retention_in_days = 90
}

# modules/shadow-network-azure/main.tf

resource "azurerm_virtual_network" "shadow" {
  name                = "vnet-internal-services-02"
  location            = var.location
  resource_group_name = var.resource_group_name
  address_space       = ["10.200.0.0/16"]
  tags = { environment = "deception", managed_by = "shadow-cdf" }
}

resource "azurerm_subnet" "decoy_web" {
  name                 = "snet-web-prod-02"
  resource_group_name  = var.resource_group_name
  virtual_network_name = azurerm_virtual_network.shadow.name
  address_prefixes     = ["10.200.10.0/24"]
}

resource "azurerm_subnet" "decoy_db" {
  name                 = "snet-db-prod-02"
  resource_group_name  = var.resource_group_name
  virtual_network_name = azurerm_virtual_network.shadow.name
  address_prefixes     = ["10.200.20.0/24"]
}

# NSG: allow inbound from production, block outbound to production
resource "azurerm_network_security_group" "isolation" {
  name                = "nsg-shadow-isolation"
  location            = var.location
  resource_group_name = var.resource_group_name

  security_rule {
    name                       = "AllowProductionInbound"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_address_prefix      = var.production_vnet_cidr
    destination_address_prefix = "*"
    source_port_range          = "*"
    destination_port_range     = "*"
  }

  security_rule {
    name                       = "DenyProductionOutbound"
    priority                   = 100
    direction                  = "Outbound"
    access                     = "Deny"
    protocol                   = "*"
    source_address_prefix      = "*"
    destination_address_prefix = var.production_vnet_cidr
    source_port_range          = "*"
    destination_port_range     = "*"
  }
}

# Network Watcher flow logs for traffic capture
resource "azurerm_network_watcher_flow_log" "shadow" {
  name                 = "flowlog-shadow-vpc"
  network_watcher_name = var.network_watcher_name
  resource_group_name  = var.resource_group_name
  network_security_group_id = azurerm_network_security_group.isolation.id
  storage_account_id   = var.log_storage_account_id
  enabled              = true
  retention_policy {
    enabled = true
    days    = 90
  }
}