IBM Cloud Security Engineer (C1000-178) - Network & Infrastructure Security¶

# vpc-security.tf
resource "ibm_is_vpc" "secure_vpc" {
  name                      = "secure-vpc"
  resource_group            = data.ibm_resource_group.prod.id
  address_prefix_management = "manual"
  tags                      = ["production", "security"]
}

resource "ibm_is_vpc_address_prefix" "zone1_prefix" {
  vpc  = ibm_is_vpc.secure_vpc.id
  zone = "us-south-1"
  cidr = "10.240.0.0/16"
}

# Web tier subnet (public)
resource "ibm_is_subnet" "web_tier" {
  name            = "web-tier-subnet"
  vpc             = ibm_is_vpc.secure_vpc.id
  zone            = "us-south-1"
  ipv4_cidr_block = "10.240.0.0/24"
  public_gateway  = ibm_is_public_gateway.web_gateway.id

  # Disable auto-assign public IP
  resource_group = data.ibm_resource_group.prod.id
}

# Application tier subnet (private)
resource "ibm_is_subnet" "app_tier" {
  name            = "app-tier-subnet"
  vpc             = ibm_is_vpc.secure_vpc.id
  zone            = "us-south-1"
  ipv4_cidr_block = "10.240.1.0/24"
  resource_group  = data.ibm_resource_group.prod.id
}

# Data tier subnet (isolated)
resource "ibm_is_subnet" "data_tier" {
  name            = "data-tier-subnet"
  vpc             = ibm_is_vpc.secure_vpc.id
  zone            = "us-south-1"
  ipv4_cidr_block = "10.240.2.0/24"
  resource_group  = data.ibm_resource_group.prod.id
}

resource "ibm_is_public_gateway" "web_gateway" {
  name           = "web-gateway"
  vpc            = ibm_is_vpc.secure_vpc.id
  zone           = "us-south-1"
  resource_group = data.ibm_resource_group.prod.id
}

# network-acls.tf
resource "ibm_is_network_acl" "web_tier_acl" {
  name = "web-tier-acl"
  vpc  = ibm_is_vpc.secure_vpc.id

  # Inbound rules
  rules {
    name        = "allow-https-inbound"
    action      = "allow"
    direction   = "inbound"
    source      = "0.0.0.0/0"
    destination = "10.240.0.0/24"
    tcp {
      port_min = 443
      port_max = 443
    }
  }

  rules {
    name        = "allow-http-inbound"
    action      = "allow"
    direction   = "inbound"
    source      = "0.0.0.0/0"
    destination = "10.240.0.0/24"
    tcp {
      port_min = 80
      port_max = 80
    }
  }

  rules {
    name        = "allow-ssh-from-office"
    action      = "allow"
    direction   = "inbound"
    source      = "203.0.113.0/24"
    destination = "10.240.0.0/24"
    tcp {
      port_min = 22
      port_max = 22
    }
  }

  # Outbound rules
  rules {
    name        = "allow-all-outbound"
    action      = "allow"
    direction   = "outbound"
    source      = "10.240.0.0/24"
    destination = "0.0.0.0/0"
  }
}

resource "ibm_is_network_acl" "app_tier_acl" {
  name = "app-tier-acl"
  vpc  = ibm_is_vpc.secure_vpc.id

  # Allow inbound from web tier only
  rules {
    name        = "allow-from-web-tier"
    action      = "allow"
    direction   = "inbound"
    source      = "10.240.0.0/24"
    destination = "10.240.1.0/24"
    tcp {
      port_min = 8080
      port_max = 8080
    }
  }

  # Allow outbound to data tier
  rules {
    name        = "allow-to-data-tier"
    action      = "allow"
    direction   = "outbound"
    source      = "10.240.1.0/24"
    destination = "10.240.2.0/24"
    tcp {
      port_min = 5432
      port_max = 5432
    }
  }

  # Allow outbound HTTPS for external APIs
  rules {
    name        = "allow-https-outbound"
    action      = "allow"
    direction   = "outbound"
    source      = "10.240.1.0/24"
    destination = "0.0.0.0/0"
    tcp {
      port_min = 443
      port_max = 443
    }
  }
}

resource "ibm_is_network_acl" "data_tier_acl" {
  name = "data-tier-acl"
  vpc  = ibm_is_vpc.secure_vpc.id

  # Allow inbound from app tier only
  rules {
    name        = "allow-from-app-tier"
    action      = "allow"
    direction   = "inbound"
    source      = "10.240.1.0/24"
    destination = "10.240.2.0/24"
    tcp {
      port_min = 5432
      port_max = 5432
    }
  }

  # Deny all outbound (data tier should not initiate connections)
  rules {
    name        = "deny-all-outbound"
    action      = "deny"
    direction   = "outbound"
    source      = "10.240.2.0/24"
    destination = "0.0.0.0/0"
  }
}

# security-groups.tf
resource "ibm_is_security_group" "bastion_sg" {
  name = "bastion-sg"
  vpc  = ibm_is_vpc.secure_vpc.id
}

resource "ibm_is_security_group_rule" "bastion_ssh_inbound" {
  group     = ibm_is_security_group.bastion_sg.id
  direction = "inbound"
  remote    = "203.0.113.0/24"  # Office IP range

  tcp {
    port_min = 22
    port_max = 22
  }
}

resource "ibm_is_security_group_rule" "bastion_all_outbound" {
  group     = ibm_is_security_group.bastion_sg.id
  direction = "outbound"
  remote    = "0.0.0.0/0"
}

resource "ibm_is_security_group" "web_sg" {
  name = "web-sg"
  vpc  = ibm_is_vpc.secure_vpc.id
}

resource "ibm_is_security_group_rule" "web_https_inbound" {
  group     = ibm_is_security_group.web_sg.id
  direction = "inbound"
  remote    = "0.0.0.0/0"

  tcp {
    port_min = 443
    port_max = 443
  }
}

resource "ibm_is_security_group_rule" "web_http_inbound" {
  group     = ibm_is_security_group.web_sg.id
  direction = "inbound"
  remote    = "0.0.0.0/0"

  tcp {
    port_min = 80
    port_max = 80
  }
}

resource "ibm_is_security_group_rule" "web_ssh_from_bastion" {
  group     = ibm_is_security_group.web_sg.id
  direction = "inbound"
  remote    = ibm_is_security_group.bastion_sg.id

  tcp {
    port_min = 22
    port_max = 22
  }
}

resource "ibm_is_security_group_rule" "web_all_outbound" {
  group     = ibm_is_security_group.web_sg.id
  direction = "outbound"
  remote    = "0.0.0.0/0"
}

resource "ibm_is_security_group" "app_sg" {
  name = "app-sg"
  vpc  = ibm_is_vpc.secure_vpc.id
}

resource "ibm_is_security_group_rule" "app_from_web" {
  group     = ibm_is_security_group.app_sg.id
  direction = "inbound"
  remote    = ibm_is_security_group.web_sg.id

  tcp {
    port_min = 8080
    port_max = 8080
  }
}

resource "ibm_is_security_group_rule" "app_ssh_from_bastion" {
  group     = ibm_is_security_group.app_sg.id
  direction = "inbound"
  remote    = ibm_is_security_group.bastion_sg.id

  tcp {
    port_min = 22
    port_max = 22
  }
}

resource "ibm_is_security_group_rule" "app_all_outbound" {
  group     = ibm_is_security_group.app_sg.id
  direction = "outbound"
  remote    = "0.0.0.0/0"
}

resource "ibm_is_security_group" "db_sg" {
  name = "db-sg"
  vpc  = ibm_is_vpc.secure_vpc.id
}

resource "ibm_is_security_group_rule" "db_from_app" {
  group     = ibm_is_security_group.db_sg.id
  direction = "inbound"
  remote    = ibm_is_security_group.app_sg.id

  tcp {
    port_min = 5432
    port_max = 5432
  }
}

resource "ibm_is_security_group_rule" "db_ssh_from_bastion" {
  group     = ibm_is_security_group.db_sg.id
  direction = "inbound"
  remote    = ibm_is_security_group.bastion_sg.id

  tcp {
    port_min = 22
    port_max = 22
  }
}

# No outbound rule for database (deny by default)

# vpn.tf
resource "ibm_is_vpn_gateway" "vpn" {
  name   = "my-vpn-gateway"
  subnet = ibm_is_subnet.web_tier.id
  mode   = "policy"
}

resource "ibm_is_ike_policy" "ike_policy" {
  name                     = "my-ike-policy"
  authentication_algorithm = "sha256"
  encryption_algorithm     = "aes256"
  dh_group                 = 14
  ike_version              = 2
  key_lifetime             = 28800
}

resource "ibm_is_ipsec_policy" "ipsec_policy" {
  name                     = "my-ipsec-policy"
  authentication_algorithm = "sha256"
  encryption_algorithm     = "aes256"
  pfs                      = "group_14"
  key_lifetime             = 3600
}

resource "ibm_is_vpn_gateway_connection" "vpn_connection" {
  name           = "onprem-connection"
  vpn_gateway    = ibm_is_vpn_gateway.vpn.id
  peer_address   = "203.0.113.50"
  preshared_key  = var.vpn_preshared_key
  local_cidrs    = ["10.240.0.0/16"]
  peer_cidrs     = ["192.168.0.0/16"]
  ike_policy     = ibm_is_ike_policy.ike_policy.id
  ipsec_policy   = ibm_is_ipsec_policy.ipsec_policy.id
  admin_state_up = true
}

# transit-gateway.tf
resource "ibm_tg_gateway" "transit_gateway" {
  name     = "my-transit-gateway"
  location = "us-south"
  global   = true
}

resource "ibm_tg_connection" "vpc1_connection" {
  gateway      = ibm_tg_gateway.transit_gateway.id
  network_type = "vpc"
  name         = "vpc1-connection"
  network_id   = ibm_is_vpc.vpc1.crn
}

resource "ibm_tg_connection" "vpc2_connection" {
  gateway      = ibm_tg_gateway.transit_gateway.id
  network_type = "vpc"
  name         = "vpc2-connection"
  network_id   = ibm_is_vpc.vpc2.crn
}

resource "ibm_tg_connection" "classic_connection" {
  gateway      = ibm_tg_gateway.transit_gateway.id
  network_type = "classic"
  name         = "classic-connection"
}

# load-balancer.tf
resource "ibm_is_lb" "alb" {
  name    = "application-lb"
  subnets = [ibm_is_subnet.web_tier.id]
  type    = "public"
  profile = "network-fixed"

  logging {
    datapath = true
  }
}

resource "ibm_is_lb_pool" "web_pool" {
  lb                 = ibm_is_lb.alb.id
  name               = "web-pool"
  protocol           = "https"
  algorithm          = "round_robin"
  health_delay       = 5
  health_retries     = 2
  health_timeout     = 2
  health_type        = "https"
  health_monitor_url = "/health"

  session_persistence_type = "app_cookie"
  session_persistence_cookie_name = "LB_SESSION"
}

resource "ibm_is_lb_pool_member" "web_members" {
  count          = 3
  lb             = ibm_is_lb.alb.id
  pool           = ibm_is_lb_pool.web_pool.id
  port           = 443
  target_address = ibm_is_instance.web[count.index].primary_network_interface[0].primary_ipv4_address
}

resource "ibm_is_lb_listener" "https_listener" {
  lb                   = ibm_is_lb.alb.id
  port                 = 443
  protocol             = "https"
  certificate_instance = ibm_sm_imported_certificate.ssl_cert.crn
  default_pool         = ibm_is_lb_pool.web_pool.id
  connection_limit     = 2000

  https_redirect {
    http_status_code = 301
    listener         = ibm_is_lb_listener.http_listener.id
    uri              = "/"
  }
}

resource "ibm_is_lb_listener" "http_listener" {
  lb               = ibm_is_lb.alb.id
  port             = 80
  protocol         = "http"
  default_pool     = ibm_is_lb_pool.web_pool.id
  connection_limit = 2000
}

# Listener policy for path-based routing
resource "ibm_is_lb_listener_policy" "api_policy" {
  lb       = ibm_is_lb.alb.id
  listener = ibm_is_lb_listener.https_listener.id
  action   = "forward"
  priority = 1
  name     = "api-routing"
  target   = ibm_is_lb_pool.api_pool.id

  rules {
    condition = "contains"
    type      = "path"
    value     = "/api"
  }
}

# cis-security.tf
resource "ibm_cis" "cis_instance" {
  name     = "my-cis"
  plan     = "enterprise-usage"
  location = "global"
}

resource "ibm_cis_domain" "domain" {
  cis_id = ibm_cis.cis_instance.id
  domain = "example.com"
}

# DDoS settings
resource "ibm_cis_firewall" "firewall" {
  cis_id    = ibm_cis.cis_instance.id
  domain_id = ibm_cis_domain.domain.id
  mode      = "high"
}

# Rate limiting
resource "ibm_cis_rate_limit" "login_rate_limit" {
  cis_id    = ibm_cis.cis_instance.id
  domain_id = ibm_cis_domain.domain.id

  threshold = 10
  period    = 60
  action {
    mode    = "challenge"
    timeout = 86400
  }

  match {
    request {
      url     = "*.example.com/login"
      schemes = ["HTTPS"]
      methods = ["POST"]
    }
  }

  description = "Rate limit login attempts"
}

# IP firewall rules
resource "ibm_cis_firewall_rules" "firewall_rules" {
  cis_id    = ibm_cis.cis_instance.id
  domain_id = ibm_cis_domain.domain.id

  firewall_rules {
    priority    = 1
    action      = "block"
    description = "Block malicious IPs"
    filter {
      expression = "(ip.src in {1.2.3.4 5.6.7.8})"
    }
  }

  firewall_rules {
    priority    = 2
    action      = "challenge"
    description = "Challenge suspicious requests"
    filter {
      expression = "(cf.threat_score > 50)"
    }
  }
}

# waf.tf
resource "ibm_cis_waf_rule" "custom_rule" {
  cis_id    = ibm_cis.cis_instance.id
  domain_id = ibm_cis_domain.domain.id

  mode = "on"

  filter {
    expression = "(http.request.uri.path contains \"/admin\")"
  }

  action = "block"
}

resource "ibm_cis_waf_package" "owasp" {
  cis_id    = ibm_cis.cis_instance.id
  domain_id = ibm_cis_domain.domain.id
  package_id = "a25a9a7e9c00afc1fb2e0245519d725b"

  sensitivity = "high"
  action_mode = "block"
}