# GCP Cloud KMS Configuration for DPDPA Personal Data Encryption
# Version: 1.0 | Date: 2026-04-02 | Legal Reference: DPDPA Rule 6(1)(a)

terraform {
  required_providers {
    google = {
      source  = "hashicorp/google"
      version = "~> 5.0"
    }
  }
}

variable "project_id" {
  description = "GCP Project ID"
  type        = string
}

variable "region" {
  description = "GCP region: asia-south1 (Mumbai), asia-south2 (Delhi)"
  default     = "asia-south1"
}

variable "environment" {
  default = "production"
}

# KMS Key Ring (container for keys)
resource "google_kms_key_ring" "dpdpa" {
  name     = "dpdpa-personal-data-${var.environment}"
  location = var.region
}

# Cryptographic Key with Automatic Rotation
resource "google_kms_crypto_key" "personal_data" {
  name            = "personal-data-encryption-key"
  key_ring        = google_kms_key_ring.dpdpa.id
  rotation_period = "7776000s"  # 90 days (recommended for personal data)

  lifecycle {
    prevent_destroy = true  # Prevent accidental key deletion
  }

  labels = {
    environment        = var.environment
    compliance         = "dpdpa-rule-6-1-a"
    data_classification = "personal-data"
  }
}

# IAM Policy: Grant encrypt/decrypt to application service accounts
resource "google_kms_crypto_key_iam_binding" "encrypter_decrypter" {
  crypto_key_id = google_kms_crypto_key.personal_data.id
  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"

  members = [
    # Add your service accounts here
    # "serviceAccount:app-api@${var.project_id}.iam.gserviceaccount.com",
    # "serviceAccount:app-worker@${var.project_id}.iam.gserviceaccount.com",
  ]
}

# Cloud Logging for KMS Operations
resource "google_project_iam_audit_config" "kms_audit" {
  project = var.project_id
  service = "cloudkms.googleapis.com"

  audit_log_config {
    log_type = "ADMIN_READ"
  }

  audit_log_config {
    log_type = "DATA_READ"
  }

  audit_log_config {
    log_type = "DATA_WRITE"
  }
}

# Monitoring Alert for Key Access by Unauthorized Principal
resource "google_monitoring_alert_policy" "unauthorized_key_access" {
  display_name = "DPDPA KMS Unauthorized Access"
  combiner     = "OR"

  conditions {
    display_name = "Unauthorized KMS Decrypt Operation"

    condition_matched_log {
      filter = <<-EOT
        resource.type="cloudkms_cryptokey"
        resource.labels.key_name="${google_kms_crypto_key.personal_data.name}"
        protoPayload.methodName="Decrypt"
        protoPayload.authenticationInfo.principalEmail!~"^(app-api|app-worker)@.*"
      EOT
    }
  }

  notification_channels = []  # Add notification channel IDs

  alert_strategy {
    auto_close = "604800s"  # 7 days
  }
}

output "key_ring_id" {
  value = google_kms_key_ring.dpdpa.id
}

output "crypto_key_id" {
  value = google_kms_crypto_key.personal_data.id
}

output "crypto_key_name" {
  value = google_kms_crypto_key.personal_data.name
}

output "rotation_period_days" {
  value = google_kms_crypto_key.personal_data.rotation_period
}