[AWS] 취약한 EC2 및 ALB 네트워크 구축

# ==================================================================
# =====================Victim EC2를 위한 Network 설계==================
# ==================================================================

# =======================================================
# Public Subnet 생성 for ALB(서로 다른 AZ에 배치)
# =======================================================
resource "aws_subnet" "alb_public_subnets" {
  for_each = var.alb_public_subnets

  vpc_id            = local.main_vpc_id
  cidr_block        = each.value.cidr_block
  availability_zone = each.value.availability_zone

  map_public_ip_on_launch = false

  tags = {
    Name      = "${var.project_name}-alb-public-subnet-${each.key}"
    Role      = "ALB"
    ManagedBy = "Terraform"
  }
}

# =======================================================
# Public Subnet 생성 for Victim EC2
# =======================================================
resource "aws_subnet" "victim_public_subnet" {
  vpc_id            = local.main_vpc_id
  cidr_block        = var.victim_public_subnet_cidr
  availability_zone = "ap-northeast-2a"

  map_public_ip_on_launch = false

  tags = {
    Name      = "${var.project_name}-victim-public-subnet"
    Role      = "Victim"
    ManagedBy = "Terraform"
  }
}

# =======================================================
# Victim Subnet and ALB Subnets 용 라우트 테이블 생성 및 라우팅
# =======================================================
resource "aws_route_table" "victim_route_table" {
  vpc_id = local.main_vpc_id

  route {
    cidr_block = "0.0.0.0/0"
    gateway_id = local.main_igw_id
  }

  tags = {
    Name      = "${var.project_name}-victim-public-route-table"
    Role      = "Victim"
    ManagedBy = "Terraform"
  }
}

resource "aws_route_table_association" "victim_public" {
  subnet_id      = aws_subnet.victim_public_subnet.id
  route_table_id = aws_route_table.victim_route_table.id
}

resource "aws_route_table_association" "alb_public_subnets" {
  for_each       = aws_subnet.alb_public_subnets
  subnet_id      = each.value.id
  route_table_id = aws_route_table.victim_route_table.id
}


# ==================================================================
# ====================Victim EC2 생성================================
# ==================================================================

# =======================================================
# Victim EC2 생성
# =======================================================
data "aws_ssm_parameter" "amazon_linux_2023" {
  name = "/aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64"
}

resource "aws_instance" "victim_ec2" {
  ami           = data.aws_ssm_parameter.amazon_linux_2023.value
  instance_type = "t3.micro"
  subnet_id     = aws_subnet.victim_public_subnet.id
  vpc_security_group_ids = [
    aws_security_group.victim_sg.id,
    aws_security_group.victim_sg_agent.id
  ]
  iam_instance_profile        = aws_iam_instance_profile.victim_ec2_profile.name
  associate_public_ip_address = true

  user_data = templatefile("${path.module}/files/victim-install.sh", {
    victim_app_port = var.victim_app_port
  })
  user_data_replace_on_change = false

  root_block_device {
    volume_type           = "gp3"
    iops                  = 3000
    throughput            = 125
    encrypted             = true
    delete_on_termination = true
  }

  metadata_options {
    http_endpoint               = "enabled"
    http_tokens                 = "optional" # IMDSv1과 IMDSv2 모두 허용
    http_put_response_hop_limit = 2          # docker 환경에서도 IMDS 사용
    instance_metadata_tags      = "disabled" # 태그정보는 노출되지 않도록하여 공격 표면 최소화"
  }

  lifecycle {
    ignore_changes = [
      ami,
      associate_public_ip_address
    ]
  }

  tags = {
    Name      = "${var.project_name}-victim-ec2"
    ManagedBy = "Terraform"
  }
}

# ==================================================================
# =================== 공격 대상 S3 Bucket 생성 ========================
# ==================================================================

# ======================================================
# 공격용 S3 Bucket 생성
# ======================================================
resource "random_string" "suffix" {
  length  = 6
  special = false
  upper   = false
}

resource "aws_s3_bucket" "victim" {
  bucket        = "${var.victim_bucket_name}-${random_string.suffix.result}"
  force_destroy = true

  tags = {
    Name      = "${var.project_name}-victim-bucket"
    ManagedBy = "Terraform"
  }
}

# ======================================================
# 공격용 S3 Bucket BPA
# ======================================================
resource "aws_s3_bucket_public_access_block" "victim" {
  bucket = aws_s3_bucket.victim.id

  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# ======================================================
# 공격용 S3 Bucket SSE
# ======================================================
resource "aws_s3_bucket_server_side_encryption_configuration" "victim" {
  bucket = aws_s3_bucket.victim.id

  rule {
    apply_server_side_encryption_by_default {
      # S3 관리형 키이기 때문에,
      # s3:GetObject에 대한 권한만 있으면 S3가 객체를 자동으로 복호화하여 반환
      sse_algorithm = "AES256"
    }
  }
}

# ======================================================
# 공격용 S3 Bucket에 가짜 Secrets 업로드
# ======================================================
/*locals {
  upload_dir   = "${path.module}/files/secrets-file"
  upload_files = fileset(local.upload_dir, "**") # 하위 폴더 포함 모든 파일 찾기
}

resource "aws_s3_object" "secrets_upload" {
  for_each = local.upload_files

  bucket = aws_s3_bucket.victim.id
  key    = each.value
  source = "${local.upload_dir}/${each.value}"

  # 암호화 방식이나 S3 ETag 형식에 영향받지 않고 파일변경 감지 - 파일 내용 변경 시 객체 다시 업로드
  source_hash = filemd5("${local.upload_dir}/${each.value}")
}*/

# ======================================================
# 기존 실습 파일을 S3에 보존하고 Terraform 관리만 해제
# ======================================================
removed {
  from = aws_s3_object.secrets_upload

  lifecycle {
    destroy = false
  }
}

#!/bin/bash

set -Eeuo pipefail

umask 022

BOOTSTRAP_STATE_DIR="/var/lib/victim-bootstrap"
BOOTSTRAP_LOG="/var/log/victim-bootstrap.log"

install -d -m 755 "$${BOOTSTRAP_STATE_DIR}"

if [[ -f "$${BOOTSTRAP_STATE_DIR}/complete" ]]; then
    exit 0
fi

exec > >(tee -a "$${BOOTSTRAP_LOG}") 2>&1

trap 'echo "[ERROR] Victim bootstrap failed at line $${LINENO}"' ERR
echo "[INFO] Victim bootstrap started at $(date --iso-8601=seconds)"

# amazon linux 패키지 업데이트 및 최신 버전 설치
dnf upgrade --refresh -y

# =======================================================
# Nginx 웹 서버 설치 및 설정
# =======================================================

dnf install -y nginx

# Terraform이 포트를 채운 뒤, 아래 내용을 Nginx 설정 파일로 저장
cat > /etc/nginx/nginx.conf << 'NGINX'
user nginx;
worker_processes auto;

# 오류 로그와 실행 중인 PID 저장
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;

events {
    worker_connections 1024;
}

http {
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    server {
        # Terraform에서 전달 받은 포트로 IPv4 IPv6 요청을 받아 헬스체크 처리
        listen ${victim_app_port} default_server;
        listen [::]:${victim_app_port} default_server;
        server_name _;

        # 기존 스크립트가 생성하는 index.html과 health 파일의 위치
        root /usr/share/nginx/html;
        index index.html;

        location / {
            # 요청 경로에 해당하는 파일을 제공하고 없으면 404 반환
            try_files $uri $uri/ =404;
        }
    }
}
NGINX

# Nginx가 웹 파일을 제공할 기본 디렉터리를 확인 및 생성
install -d -m 755 /usr/share/nginx/html

# 기본 페이지 생성
cat > /usr/share/nginx/html/index.html <<'EOF'
<!DOCTYPE html>
<html lang="ko">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Kintoun Project</title>
</head>
<body>
    <h1>Kintoun Project</h1>
</body>
</html>
EOF

# root만 수정할 수 있도록 권한 설정(read는 all)
chmod 644 /usr/share/nginx/html/index.html

# =======================================================
# ALB Health Check 경로 생성
# =======================================================

# ALB가 Get /health 요청을 보냈을 때 HTTP 200 응답을 받을 수 있도록 정적 파일 생성
printf '%s\n' 'healthy' > /usr/share/nginx/html/health

chmod 644 /usr/share/nginx/html/health

# Nginx 설정 문법 오류 확인
nginx -t

systemctl enable --now nginx
systemctl is-active --quiet nginx

# 로컬에서 /health 요청을 보내 HTTP 오류가 있는지 확인
curl \
    --fail \
    --silent \
    --show-error \
    --max-time 10 \
    http://127.0.0.1:${victim_app_port}/health

# SSM Agent 실행
systemctl enable --now amazon-ssm-agent
systemctl is-active --quiet amazon-ssm-agent

# 모든 설치와 서비스 검증이 끝났음을 기록
touch "$${BOOTSTRAP_STATE_DIR}/complete"

echo "[INFO] Victim bootstrap completed at $(date --iso-8601=seconds)"