配置漂移与安全基线：IaC漂移检测、CIS合规、供应链安全与密钥轮换

terraform plan -detailed-exitcode
# exit 0: 无差异；exit 2: 有变更（漂移）

# 定期漂移巡检（GitHub Actions 定时任务）
name: drift-detection
on:
  schedule: [{ cron: '0 2 * * *' }]   # 每天凌晨
  workflow_dispatch: {}

jobs:
  drift-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: hashicorp/setup-terraform@v3
        with: { terraform_version: '1.9.0' }
      - name: Terraform Init
        run: terraform init
      - name: Plan (drift detect)
        id: plan
        run: terraform plan -detailed-exitcode -no-color
        continue-on-error: true
      - name: Notify on drift
        if: steps.plan.outputs.exitcode == 2
        run: |
          curl -X POST https://hooks.slack.com/services/xxx \
            -d '{"text":":warning: 生产环境检测到配置漂移，请检查 plan 输出"}'

driftctl scan --from tfstate+tf://terraform.tfstate

Drift detected:
- aws_security_group (sg-123456)  → 声明中不存在，但现实中存在（未纳管资源）
- aws_db_instance (db-prod)       → 参数 vpc_security_group_ids 与声明不一致

{
  "resource": "aws_s3_bucket.finance_data",
  "attribute": "acl",
  "declared": "private",
  "actual": "public-read",
  "drift_type": "security_regression",
  "detected_at": "2026-09-27T02:00:00Z",
  "responsible_service": "finance-ingestion"
}

# 按 CIS AWS Foundations 基线扫描
prowler aws --compliance cis_aws_foundations_2.0.0 \
  -o /reports -M csv html

# 结果摘要
prowler aws --list-compliance

kube-bench run --targets master,node,etcd,controlplane,policies \
  --version 1.29 --check 1.1,1.2,4.1

[FAIL] 4.1.1  Ensure that the etcd pod specification file permissions are set to 644 or more restrictive
[PASS] 1.2.6  Ensure that the --authorization-mode argument is set to AlwaysAllow only if needed

# 满足 CIS 要求的 S3 配置作为模块默认值
resource "aws_s3_bucket" "default" {
  bucket = var.bucket_name
}

resource "aws_s3_bucket_public_access_block" "block" {
  bucket = aws_s3_bucket.default.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

# policy/deny_public_s3.rego
package terraform

deny[msg] {
  resource := input.resource_changes[_]
  resource.type == "aws_s3_bucket_public_access_block"
  resource.change.after.block_public_acls == false
  msg := sprintf("S3 bucket %v must block public ACLs (CIS 2.1.x)", [resource.address])
}

deny[msg] {
  resource := input.resource_changes[_]
  resource.type == "aws_db_instance"
  resource.change.after.publicly_accessible == true
  msg := sprintf("RDS instance %v must not be publicly accessible", [resource.address])
}

terraform plan -out plan.tfplan
terraform show -json plan.tfplan > plan.json
opa eval -i plan.json -d policy --fail-defined data.terraform.deny

checkov -d terraform/ --framework terraform
# 输出：PASS / FAIL，含 CKV_AWS_* 规则号

syft scan image:app-server:v1.4.0 -o cyclonedx-json > sbom.json

# 持续跟踪漏洞（Trivy）
trivy fs --sbom sbom.json --scanners vuln

# 构建时签名
cosign sign --key cosign.key ghcr.io/example/app-server:v1.4.0

# 准入时验证（K8s 用 policy-controller / cosigned）
cosign verify \
  --key cosign.pub \
  ghcr.io/example/app-server:v1.4.0

# Kubernetes 准入策略（policy-controller）
apiVersion: policy.sigstore.dev/v1beta1
kind: ClusterImagePolicy
metadata:
  name: require-signature
spec:
  images:
    - glob: "ghcr.io/example/**"
  authorities:
    - key:
        kms: gcpkms://projects/xxx/locations/global/keyRings/cosign/cryptoKeys/cosign-key

# Trivy 在 CI 中设置 FAIL 阈值
- name: Scan image
  run: trivy image --severity HIGH,CRITICAL --exit-code 1 app-server:v1.4.0

# 数据库动态凭据：每次请求分配短期凭据
vault write database/creds/order-app-role ttl=1h

# 自动轮换根凭据
vault write database/rotate-root/order-db

# 用 External Secrets 把 Vault 密钥同步为 K8s Secret（不硬编码）
resource "kubernetes_secret" "app_secret" {
  metadata { name = "app-secret" }
  data = {
    DB_PASSWORD = vault_generic_secret.app_secret.data.DB_PASSWORD
  }
}

# 强制开启 CloudTrail（CIS 2.1 要求）
resource "aws_cloudtrail" "trail" {
  name                          = "all-region-trail"
  s3_bucket_name                = aws_s3_bucket.trail_bucket.id
  is_multi_region_trail         = true
  enable_log_file_validation    = true
  include_global_service_events = true
}

resource "aws_s3_bucket_policy" "trail_bucket_policy" {
  bucket = aws_s3_bucket.trail_bucket.id
  policy = data.aws_iam_policy_document.trail.json  # 仅允许 CloudTrail 写入
}

# drift whitelist
allowed_drifts:
  - resource: "aws_cloudwatch_alarm.temp_scale"
    reason: "自动伸缩临时创建，声明未覆盖"
  - attribute: "aws_autoscaling_group.desired"
    reason: "期望实例数由 HPA 动态调整，属预期波动"