icdev 0.0.3__py3-none-any.whl

tools/cloudforge/iac/terraform_renderer.py

@@ -0,0 +1,626 @@
+# CUI // SP-CTI
+"""Terraform/OpenTofu HCL renderer for CloudForge landing zones.
+
+Generates provider blocks, VPC/VNet, K8s clusters, IAM, and compliance
+resources for all 8 CSPs. Uses string templates (air-gap safe, no Jinja2 dep).
+"""
+
+import json
+import logging
+import os
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Any, Dict, List, Optional
+
+logger = logging.getLogger(__name__)
+
+BASE_DIR = Path(__file__).resolve().parent.parent.parent.parent
+OUTPUT_DIR = BASE_DIR / ".tmp" / "cloudforge" / "iac"
+
+CUI_HEADER = """# CUI // SP-CTI
+# Generated by ICDEV CloudForge — {timestamp}
+# Classification: CUI // SP-CTI
+# Do not modify directly — regenerate via CloudForge.
+"""
+
+# ---------------------------------------------------------------------------
+# Provider blocks per CSP
+# ---------------------------------------------------------------------------
+_PROVIDER_BLOCKS: Dict[str, str] = {
+    "aws_commercial": '''
+provider "aws" {{
+  region = var.region
+  default_tags {{
+    tags = {{
+      ManagedBy    = "cloudforge"
+      Environment  = var.environment
+      ImpactLevel  = var.impact_level
+      Classification = "CUI"
+    }}
+  }}
+}}
+''',
+    "aws_govcloud": '''
+provider "aws" {{
+  region = var.region
+  default_tags {{
+    tags = {{
+      ManagedBy    = "cloudforge"
+      Environment  = var.environment
+      ImpactLevel  = var.impact_level
+      Classification = "CUI"
+      Partition    = "aws-us-gov"
+    }}
+  }}
+}}
+''',
+    "aws_secret": '''
+provider "aws" {{
+  region = var.region
+  default_tags {{
+    tags = {{
+      ManagedBy    = "cloudforge"
+      Environment  = var.environment
+      ImpactLevel  = var.impact_level
+      Classification = "CUI"
+      Partition    = "aws-iso"
+    }}
+  }}
+}}
+''',
+    "azure_commercial": '''
+provider "azurerm" {{
+  features {{}}
+}}
+''',
+    "azure_gov": '''
+provider "azurerm" {{
+  environment = "usgovernment"
+  features {{}}
+}}
+''',
+    "azure_secret": '''
+provider "azurerm" {{
+  environment = "usgovernment"
+  features {{}}
+}}
+''',
+    "gcp": '''
+provider "google" {{
+  project = var.gcp_project_id
+  region  = var.region
+}}
+''',
+    "oci": '''
+provider "oci" {{
+  region = var.region
+}}
+''',
+}
+
+# ---------------------------------------------------------------------------
+# Backend blocks per CSP
+# ---------------------------------------------------------------------------
+_BACKEND_BLOCKS: Dict[str, str] = {
+    "aws_commercial": '''
+  backend "s3" {{
+    bucket         = "${{var.state_bucket}}"
+    key            = "cloudforge/${{var.zone_id}}/terraform.tfstate"
+    region         = "${{var.region}}"
+    encrypt        = true
+    dynamodb_table = "cloudforge-locks"
+  }}
+''',
+    "aws_govcloud": '''
+  backend "s3" {{
+    bucket         = "${{var.state_bucket}}"
+    key            = "cloudforge/${{var.zone_id}}/terraform.tfstate"
+    region         = "${{var.region}}"
+    encrypt        = true
+    dynamodb_table = "cloudforge-locks"
+  }}
+''',
+    "aws_secret": '''
+  backend "s3" {{
+    bucket  = "${{var.state_bucket}}"
+    key     = "cloudforge/${{var.zone_id}}/terraform.tfstate"
+    region  = "${{var.region}}"
+    encrypt = true
+  }}
+''',
+    "azure_commercial": '''
+  backend "azurerm" {{
+    resource_group_name  = var.state_resource_group
+    storage_account_name = var.state_storage_account
+    container_name       = "cloudforge"
+    key                  = "${{var.zone_id}}.tfstate"
+  }}
+''',
+    "azure_gov": '''
+  backend "azurerm" {{
+    resource_group_name  = var.state_resource_group
+    storage_account_name = var.state_storage_account
+    container_name       = "cloudforge"
+    key                  = "${{var.zone_id}}.tfstate"
+    environment          = "usgovernment"
+  }}
+''',
+    "azure_secret": '''
+  backend "azurerm" {{
+    resource_group_name  = var.state_resource_group
+    storage_account_name = var.state_storage_account
+    container_name       = "cloudforge"
+    key                  = "${{var.zone_id}}.tfstate"
+    environment          = "usgovernment"
+  }}
+''',
+    "gcp": '''
+  backend "gcs" {{
+    bucket = var.state_bucket
+    prefix = "cloudforge/${{var.zone_id}}"
+  }}
+''',
+    "oci": '''
+  backend "http" {{
+    address = "https://objectstorage.${{var.region}}.oraclecloud.com/cloudforge/${{var.zone_id}}"
+  }}
+''',
+}
+
+# ---------------------------------------------------------------------------
+# VPC / VNet / VCN modules per CSP family
+# ---------------------------------------------------------------------------
+_VPC_MODULES: Dict[str, str] = {
+    "aws": '''
+# --- VPC ---
+resource "aws_vpc" "main" {{
+  cidr_block           = var.vpc_cidr
+  enable_dns_support   = true
+  enable_dns_hostnames = true
+
+  tags = {{
+    Name = "${{var.zone_id}}-vpc"
+  }}
+}}
+
+resource "aws_subnet" "private" {{
+  count             = var.az_count
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = cidrsubnet(var.vpc_cidr, 4, count.index)
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+
+  tags = {{
+    Name = "${{var.zone_id}}-private-${{count.index}}"
+    Tier = "private"
+  }}
+}}
+
+resource "aws_subnet" "public" {{
+  count             = var.az_count
+  vpc_id            = aws_vpc.main.id
+  cidr_block        = cidrsubnet(var.vpc_cidr, 4, count.index + var.az_count)
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+
+  tags = {{
+    Name = "${{var.zone_id}}-public-${{count.index}}"
+    Tier = "public"
+  }}
+}}
+
+data "aws_availability_zones" "available" {{
+  state = "available"
+}}
+
+resource "aws_flow_log" "vpc" {{
+  vpc_id          = aws_vpc.main.id
+  traffic_type    = "ALL"
+  iam_role_arn    = aws_iam_role.flow_log.arn
+  log_destination = aws_cloudwatch_log_group.flow_log.arn
+}}
+''',
+    "azure": '''
+# --- Virtual Network ---
+resource "azurerm_resource_group" "main" {{
+  name     = "${{var.zone_id}}-rg"
+  location = var.region
+}}
+
+resource "azurerm_virtual_network" "main" {{
+  name                = "${{var.zone_id}}-vnet"
+  address_space       = [var.vnet_cidr]
+  location            = azurerm_resource_group.main.location
+  resource_group_name = azurerm_resource_group.main.name
+}}
+
+resource "azurerm_subnet" "private" {{
+  name                 = "private"
+  resource_group_name  = azurerm_resource_group.main.name
+  virtual_network_name = azurerm_virtual_network.main.name
+  address_prefixes     = [cidrsubnet(var.vnet_cidr, 4, 0)]
+}}
+
+resource "azurerm_subnet" "public" {{
+  name                 = "public"
+  resource_group_name  = azurerm_resource_group.main.name
+  virtual_network_name = azurerm_virtual_network.main.name
+  address_prefixes     = [cidrsubnet(var.vnet_cidr, 4, 1)]
+}}
+
+resource "azurerm_network_security_group" "main" {{
+  name                = "${{var.zone_id}}-nsg"
+  location            = azurerm_resource_group.main.location
+  resource_group_name = azurerm_resource_group.main.name
+}}
+
+resource "azurerm_network_watcher_flow_log" "main" {{
+  name                      = "${{var.zone_id}}-flowlog"
+  network_watcher_name      = "NetworkWatcher_${{var.region}}"
+  resource_group_name       = "NetworkWatcherRG"
+  network_security_group_id = azurerm_network_security_group.main.id
+  storage_account_id        = azurerm_storage_account.logs.id
+  enabled                   = true
+  retention_policy {{
+    enabled = true
+    days    = 90
+  }}
+}}
+''',
+    "gcp": '''
+# --- VPC Network ---
+resource "google_compute_network" "main" {{
+  name                    = "${{var.zone_id}}-vpc"
+  auto_create_subnetworks = false
+}}
+
+resource "google_compute_subnetwork" "private" {{
+  name          = "${{var.zone_id}}-private"
+  ip_cidr_range = var.subnet_cidr
+  region        = var.region
+  network       = google_compute_network.main.id
+
+  log_config {{
+    aggregation_interval = "INTERVAL_5_SEC"
+    flow_sampling        = 1.0
+    metadata             = "INCLUDE_ALL_METADATA"
+  }}
+}}
+
+resource "google_compute_firewall" "deny_all_ingress" {{
+  name    = "${{var.zone_id}}-deny-all"
+  network = google_compute_network.main.name
+  priority = 65534
+
+  deny {{
+    protocol = "all"
+  }}
+
+  source_ranges = ["0.0.0.0/0"]
+}}
+''',
+    "oci": '''
+# --- Virtual Cloud Network ---
+resource "oci_core_vcn" "main" {{
+  compartment_id = var.compartment_id
+  display_name   = "${{var.zone_id}}-vcn"
+  cidr_blocks    = [var.vcn_cidr]
+  dns_label      = replace(var.zone_id, "-", "")
+}}
+
+resource "oci_core_subnet" "private" {{
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.main.id
+  display_name   = "${{var.zone_id}}-private"
+  cidr_block     = cidrsubnet(var.vcn_cidr, 4, 0)
+  prohibit_public_ip_on_vnic = true
+}}
+
+resource "oci_core_subnet" "public" {{
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.main.id
+  display_name   = "${{var.zone_id}}-public"
+  cidr_block     = cidrsubnet(var.vcn_cidr, 4, 1)
+}}
+
+resource "oci_core_security_list" "default" {{
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.main.id
+  display_name   = "${{var.zone_id}}-default-sl"
+}}
+''',
+}
+
+# ---------------------------------------------------------------------------
+# Variables template
+# ---------------------------------------------------------------------------
+_VARIABLES_TF = '''
+variable "zone_id" {{
+  description = "CloudForge landing zone identifier"
+  type        = string
+}}
+
+variable "region" {{
+  description = "Target cloud region"
+  type        = string
+  default     = "{default_region}"
+}}
+
+variable "environment" {{
+  description = "Deployment environment"
+  type        = string
+  default     = "staging"
+  validation {{
+    condition     = contains(["dev", "staging", "production", "dr"], var.environment)
+    error_message = "Environment must be dev, staging, production, or dr."
+  }}
+}}
+
+variable "impact_level" {{
+  description = "NIST impact level"
+  type        = string
+  default     = "{impact_level}"
+  validation {{
+    condition     = contains(["IL2", "IL4", "IL5", "IL6"], var.impact_level)
+    error_message = "Impact level must be IL2, IL4, IL5, or IL6."
+  }}
+}}
+
+{extra_vars}
+'''
+
+_AWS_EXTRA_VARS = '''
+variable "vpc_cidr" {
+  description = "VPC CIDR block"
+  type        = string
+  default     = "10.0.0.0/16"
+}
+
+variable "az_count" {
+  description = "Number of availability zones"
+  type        = number
+  default     = 2
+}
+
+variable "state_bucket" {
+  description = "S3 bucket for Terraform state"
+  type        = string
+  default     = "cloudforge-state"
+}
+'''
+
+_AZURE_EXTRA_VARS = '''
+variable "vnet_cidr" {
+  description = "Virtual network CIDR"
+  type        = string
+  default     = "10.0.0.0/16"
+}
+
+variable "state_resource_group" {
+  description = "Resource group for state storage"
+  type        = string
+  default     = "cloudforge-state-rg"
+}
+
+variable "state_storage_account" {
+  description = "Storage account for state"
+  type        = string
+  default     = "cloudforgestate"
+}
+'''
+
+_GCP_EXTRA_VARS = '''
+variable "gcp_project_id" {
+  description = "GCP project ID"
+  type        = string
+}
+
+variable "subnet_cidr" {
+  description = "Subnet CIDR range"
+  type        = string
+  default     = "10.0.0.0/20"
+}
+
+variable "state_bucket" {
+  description = "GCS bucket for Terraform state"
+  type        = string
+  default     = "cloudforge-state"
+}
+'''
+
+_OCI_EXTRA_VARS = '''
+variable "compartment_id" {
+  description = "OCI compartment OCID"
+  type        = string
+}
+
+variable "vcn_cidr" {
+  description = "VCN CIDR block"
+  type        = string
+  default     = "10.0.0.0/16"
+}
+'''
+
+# ---------------------------------------------------------------------------
+# Outputs template
+# ---------------------------------------------------------------------------
+_OUTPUTS_TF = '''
+output "zone_id" {{
+  value = var.zone_id
+}}
+
+output "region" {{
+  value = var.region
+}}
+
+output "impact_level" {{
+  value = var.impact_level
+}}
+
+{extra_outputs}
+'''
+
+
+def _cui_header() -> str:
+    return CUI_HEADER.format(timestamp=datetime.now(timezone.utc).isoformat())
+
+
+def _write(path: Path, content: str) -> Path:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(content, encoding="utf-8")
+    return path
+
+
+def _csp_family(cloud_type: str) -> str:
+    """Map cloud_type to CSP family for template selection."""
+    if cloud_type.startswith("aws"):
+        return "aws"
+    if cloud_type.startswith("azure"):
+        return "azure"
+    return cloud_type
+
+
+def _extra_vars(cloud_type: str) -> str:
+    family = _csp_family(cloud_type)
+    return {
+        "aws": _AWS_EXTRA_VARS,
+        "azure": _AZURE_EXTRA_VARS,
+        "gcp": _GCP_EXTRA_VARS,
+        "oci": _OCI_EXTRA_VARS,
+    }.get(family, "")
+
+
+def _default_region(cloud_type: str) -> str:
+    defaults = {
+        "aws_commercial": "us-east-1",
+        "aws_govcloud": "us-gov-west-1",
+        "aws_secret": "us-iso-east-1",
+        "azure_commercial": "eastus",
+        "azure_gov": "usgovvirginia",
+        "azure_secret": "usgovsecret-east",
+        "gcp": "us-central1",
+        "oci": "us-ashburn-1",
+    }
+    return defaults.get(cloud_type, "us-east-1")
+
+
+def render_terraform(
+    cloud_type: str,
+    blueprint_name: str = "default",
+    region: str = "",
+    impact_level: str = "IL4",
+    parameters: Optional[Dict[str, Any]] = None,
+    output_dir: Optional[str] = None,
+    zone_id: str = "",
+) -> str:
+    """Render Terraform HCL for a landing zone blueprint.
+
+    Returns the path to the output directory containing the generated files.
+    """
+    params = parameters or {}
+    region = region or _default_region(cloud_type)
+    zone_id = zone_id or f"lz-{cloud_type}-{region}"
+    out = Path(output_dir) if output_dir else OUTPUT_DIR / zone_id
+    header = _cui_header()
+    family = _csp_family(cloud_type)
+    files_written: List[str] = []
+
+    # --- versions.tf ---
+    required_providers = {
+        "aws": 'aws = { source = "hashicorp/aws", version = "~> 5.0" }',
+        "azure": 'azurerm = { source = "hashicorp/azurerm", version = "~> 3.0" }',
+        "gcp": 'google = { source = "hashicorp/google", version = "~> 5.0" }',
+        "oci": 'oci = { source = "oracle/oci", version = "~> 5.0" }',
+    }
+    backend = _BACKEND_BLOCKS.get(cloud_type, "")
+    versions_content = f"""{header}
+terraform {{
+  required_version = ">= 1.5.0"
+
+  required_providers {{
+    {required_providers.get(family, '')}
+  }}
+
+{backend}
+}}
+"""
+    f = _write(out / "versions.tf", versions_content)
+    files_written.append(str(f))
+
+    # --- provider.tf ---
+    provider_block = _PROVIDER_BLOCKS.get(cloud_type, "")
+    f = _write(out / "provider.tf", f"{header}\n{provider_block}")
+    files_written.append(str(f))
+
+    # --- variables.tf ---
+    vars_content = _VARIABLES_TF.format(
+        default_region=region,
+        impact_level=impact_level,
+        extra_vars=_extra_vars(cloud_type),
+    )
+    f = _write(out / "variables.tf", f"{header}\n{vars_content}")
+    files_written.append(str(f))
+
+    # --- main.tf (VPC/VNet/VCN) ---
+    vpc_module = _VPC_MODULES.get(family, f"# No VPC template for {family}")
+    f = _write(out / "main.tf", f"{header}\n{vpc_module}")
+    files_written.append(str(f))
+
+    # --- outputs.tf ---
+    extra_outputs = ""
+    if family == "aws":
+        extra_outputs = 'output "vpc_id" { value = aws_vpc.main.id }'
+    elif family == "azure":
+        extra_outputs = 'output "vnet_id" { value = azurerm_virtual_network.main.id }'
+    elif family == "gcp":
+        extra_outputs = 'output "network_id" { value = google_compute_network.main.id }'
+    elif family == "oci":
+        extra_outputs = 'output "vcn_id" { value = oci_core_vcn.main.id }'
+    outputs_content = _OUTPUTS_TF.format(extra_outputs=extra_outputs)
+    f = _write(out / "outputs.tf", f"{header}\n{outputs_content}")
+    files_written.append(str(f))
+
+    # --- terraform.tfvars ---
+    tfvars = {
+        "zone_id": zone_id,
+        "region": region,
+        "environment": params.get("environment", "staging"),
+        "impact_level": impact_level,
+    }
+    tfvars.update({k: v for k, v in params.items() if k not in tfvars})
+    tfvars_lines = [f'{k} = {json.dumps(v)}' for k, v in tfvars.items()]
+    f = _write(out / "terraform.tfvars", f"{header}\n" + "\n".join(tfvars_lines) + "\n")
+    files_written.append(str(f))
+
+    logger.info("Rendered %d Terraform files to %s", len(files_written), out)
+    return str(out)
+
+
+# ---------------------------------------------------------------------------
+# CLI
+# ---------------------------------------------------------------------------
+if __name__ == "__main__":
+    import argparse
+
+    parser = argparse.ArgumentParser(description="CloudForge Terraform Renderer")
+    parser.add_argument("--cloud-type", required=True,
+                        choices=list(_PROVIDER_BLOCKS.keys()))
+    parser.add_argument("--region", default="")
+    parser.add_argument("--impact-level", default="IL4")
+    parser.add_argument("--blueprint", default="default")
+    parser.add_argument("--zone-id", default="")
+    parser.add_argument("--output-dir", default="")
+    parser.add_argument("--json", action="store_true")
+    args = parser.parse_args()
+
+    result_path = render_terraform(
+        cloud_type=args.cloud_type,
+        blueprint_name=args.blueprint,
+        region=args.region,
+        impact_level=args.impact_level,
+        zone_id=args.zone_id,
+        output_dir=args.output_dir or None,
+    )
+
+    if args.json:
+        print(json.dumps({"status": "ok", "output_dir": result_path}))
+    else:
+        print(f"Generated Terraform at: {result_path}")

tools/cloudforge/landing_zone/__init__.py

@@ -0,0 +1,2 @@
+# CUI // SP-CTI
+"""CloudForge Landing Zone Engine — blueprint loading, validation, provisioning."""