Secure Mattermost on AWS

# KMS Key 생성
MattermostKMSKey:
  Type: AWS::KMS::Key
  Properties:
    Description: KMS Key for Mattermost encryption
    EnableKeyRotation: true  # 자동 키 로테이션 활성화
    KeyPolicy:
      Version: '2012-10-17'
      Statement:
        - Sid: Enable IAM User Permissions
          Effect: Allow
          Principal:
            AWS: !Sub 'arn:aws:iam::${AWS::AccountId}:root'
          Action: 'kms:*'
          Resource: '*'

# Secrets Manager로 DB 비밀번호 관리
DBSecret:
  Type: AWS::SecretsManager::Secret
  Properties:
    Name: !Sub '${AWS::StackName}-db-secret'
    GenerateSecretString:
      SecretStringTemplate: '{"username": "mmuser"}'
      GenerateStringKey: "password"
      PasswordLength: 32
      ExcludePunctuation: true  # 특수문자 제외
    KmsKeyId: !Ref MattermostKMSKey  # KMS로 암호화

# ALB Security Group - 인터넷에서 접근 허용
ALBSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: ALB Security Group
    VpcId: !Ref VpcId
    SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 80
        ToPort: 80
        CidrIp: 0.0.0.0/0  # 모든 IP에서 HTTP 허용
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        CidrIp: 0.0.0.0/0  # 모든 IP에서 HTTPS 허용

# ECS Security Group - ALB에서만 접근 허용
ECSSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: ECS Security Group
    VpcId: !Ref VpcId
    SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 8065
        ToPort: 8065
        SourceSecurityGroupId: !Ref ALBSecurityGroup  # ALB SG만 허용

# RDS Security Group - ECS에서만 접근 허용
RDSSecurityGroup:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: RDS Security Group
    VpcId: !Ref VpcId
    SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 5432
        ToPort: 5432
        SourceSecurityGroupId: !Ref ECSSecurityGroup  # ECS SG만 허용

# Aurora PostgreSQL Cluster
MattermostDBCluster:
  Type: AWS::RDS::DBCluster
  Properties:
    DBClusterIdentifier: !Sub '${AWS::StackName}-cluster'
    Engine: aurora-postgresql
    EngineVersion: '16.4'
    # Secrets Manager에서 자격 증명 가져오기
    MasterUsername: !Sub '{{resolve:secretsmanager:${DBSecret}:SecretString:username}}'
    MasterUserPassword: !Sub '{{resolve:secretsmanager:${DBSecret}:SecretString:password}}'
    DatabaseName: mattermost
    StorageEncrypted: true
    KmsKeyId: !Ref MattermostKMSKey
    DBSubnetGroupName: !Ref DBSubnetGroup
    VpcSecurityGroupIds:
      - !Ref RDSSecurityGroup
    BackupRetentionPeriod: 7  # 7일간 백업 보관
    # Serverless v2 설정
    ServerlessV2ScalingConfiguration:
      MinCapacity: 0.5
      MaxCapacity: 2

# Aurora Instance
MattermostDBInstance:
  Type: AWS::RDS::DBInstance
  Properties:
    DBInstanceClass: db.serverless  # Serverless v2
    Engine: aurora-postgresql
    DBClusterIdentifier: !Ref MattermostDBCluster
    PubliclyAccessible: false  # Private 서브넷에만 배치

# Application Load Balancer
ApplicationLoadBalancer:
  Type: AWS::ElasticLoadBalancingV2::LoadBalancer
  Properties:
    Name: !Sub '${AWS::StackName}-alb'
    Scheme: internet-facing  # 인터넷에서 접근 가능
    Type: application
    SecurityGroups:
      - !Ref ALBSecurityGroup
    Subnets: !Ref PublicSubnetIds  # Public 서브넷에 배치

# Target Group
MattermostTargetGroup:
  Type: AWS::ElasticLoadBalancingV2::TargetGroup
  Properties:
    Port: 8065
    Protocol: HTTP
    VpcId: !Ref VpcId
    TargetType: ip  # Fargate용
    HealthCheckPath: /api/v4/system/ping
    HealthCheckIntervalSeconds: 30

# HTTPS Listener (SSL 인증서가 있을 때)
HTTPSListener:
  Type: AWS::ElasticLoadBalancingV2::Listener
  Condition: HasSSLCertificate
  Properties:
    DefaultActions:
      - Type: forward
        TargetGroupArn: !Ref MattermostTargetGroup
    LoadBalancerArn: !Ref ApplicationLoadBalancer
    Port: 443
    Protocol: HTTPS
    Certificates:
      - CertificateArn: !Ref SSLCertificateArn

# ECS Cluster
MattermostCluster:
  Type: AWS::ECS::Cluster
  Properties:
    ClusterName: !Sub '${AWS::StackName}-cluster'
    ClusterSettings:
      - Name: containerInsights
        Value: enabled  # 모니터링 활성화

# Task Definition
MattermostTaskDefinition:
  Type: AWS::ECS::TaskDefinition
  Properties:
    Family: !Sub '${AWS::StackName}-task'
    NetworkMode: awsvpc  # Fargate 필수
    RequiresCompatibilities:
      - FARGATE
    Cpu: '1024'   # 1 vCPU
    Memory: '2048' # 2GB
    ExecutionRoleArn: !GetAtt ECSTaskExecutionRole.Arn
    ContainerDefinitions:
      - Name: mattermost
        Image: mattermost/mattermost-team-edition:latest
        PortMappings:
          - ContainerPort: 8065
        Environment:
          - Name: MM_SQLSETTINGS_DRIVERNAME
            Value: postgres
          - Name: MM_SQLSETTINGS_DATASOURCE
            Value: !Sub
              - 'postgres://${Username}:${Password}@${Host}:5432/mattermost'
              - Username: '{{resolve:secretsmanager:${DBSecret}:SecretString:username}}'
                Password: '{{resolve:secretsmanager:${DBSecret}:SecretString:password}}'
                Host: !GetAtt MattermostDBCluster.Endpoint.Address
        LogConfiguration:
          LogDriver: awslogs
          Options:
            awslogs-group: !Ref MattermostLogGroup
            awslogs-region: !Ref AWS::Region
            awslogs-stream-prefix: mattermost

# WAF Web ACL
MattermostWebACL:
  Type: AWS::WAFv2::WebACL
  Properties:
    Name: !Sub '${AWS::StackName}-waf'
    Scope: REGIONAL  # ALB용
    DefaultAction:
      Allow: {}  # 기본적으로 허용
    Rules:
      # 일반적인 웹 취약점 차단
      - Name: AWSManagedRulesCommonRuleSet
        Priority: 1
        OverrideAction:
          None: {}
        Statement:
          ManagedRuleGroupStatement:
            VendorName: AWS
            Name: AWSManagedRulesCommonRuleSet
        VisibilityConfig:
          SampledRequestsEnabled: true
          CloudWatchMetricsEnabled: true
          MetricName: CommonRules
      # SQL Injection 차단
      - Name: AWSManagedRulesSQLiRuleSet
        Priority: 3
        OverrideAction:
          None: {}
        Statement:
          ManagedRuleGroupStatement:
            VendorName: AWS
            Name: AWSManagedRulesSQLiRuleSet
        VisibilityConfig:
          CloudWatchMetricsEnabled: true
          MetricName: SQLi

# WAF를 ALB에 연결
WebACLAssociation:
  Type: AWS::WAFv2::WebACLAssociation
  Properties:
    ResourceArn: !Ref ApplicationLoadBalancer
    WebACLArn: !GetAtt MattermostWebACL.Arn