クラウドネイティブ金融AP基盤（EKS / CNCF / GitOps）

module "eks" {
  source  = "terraform-aws-modules/eks/aws"
  version = "~> 20.0"

  cluster_name    = "cloudnative-fin"
  cluster_version = "1.31"
  vpc_id          = var.vpc_id
  subnet_ids      = var.private_subnet_ids

  # コントロールプレーンの監査ログを全種別有効化
  cluster_enabled_log_types = ["api", "audit", "authenticator", "controllerManager", "scheduler"]

  # KMS でシークレットを暗号化（封筒暗号化）
  create_kms_key            = true
  cluster_encryption_config = { resources = ["secrets"] }

  cluster_endpoint_public_access  = false
  cluster_endpoint_private_access = true

  eks_managed_node_groups = {
    app = {
      instance_types = ["m6i.large"]
      min_size       = 2
      max_size       = 6
      desired_size   = 3
      subnet_ids     = var.private_subnet_ids
    }
  }
}

# ECR Enhanced Scanning（Amazon Inspector）
resource "aws_ecr_repository" "app" {
  name                 = "cloudnative-fin-app"
  image_tag_mutability = "IMMUTABLE"
  image_scanning_configuration { scan_on_push = true }
  encryption_configuration { encryption_type = "KMS" }
}

resource "aws_inspector2_enabler" "this" {
  account_ids    = [data.aws_caller_identity.current.account_id]
  resource_types = ["ECR", "LAMBDA", "EC2"]
}

# GuardDuty EKS Runtime Monitoring
resource "aws_guardduty_detector_feature" "eks_runtime" {
  detector_id = var.guardduty_detector_id
  name        = "EKS_RUNTIME_MONITORING"
  status      = "ENABLED"

  additional_configuration {
    name   = "EKS_ADDON_MANAGEMENT"
    status = "ENABLED"
  }
}

data "aws_caller_identity" "current" {}