B システム設計/インフラ — コンテナサプライチェーンセキュリティ（Workload Identity Federation 静的キー廃止 × 最小権限IAM × イミュータブルダイジェスト固定 × 脆弱性スキャンゲート × Cloud KMS署名アテステーション(Binary Authorization) × cosign keyless署名 × break-glass監査ログ）（MOps campaign-api GitHub Actions → GKE Autopilot Bad→Good）

📋 コピー# ── Workload Identity Federation for GitHub Actions ──────────
resource "google_iam_workload_identity_pool" "github" {
  project                   = var.project_id
  workload_identity_pool_id = "github-actions-pool"
}

resource "google_iam_workload_identity_pool_provider" "github" {
  project                             = var.project_id
  workload_identity_pool_id           = google_iam_workload_identity_pool.github.workload_identity_pool_id
  workload_identity_pool_provider_id  = "github-provider"

  attribute_mapping = {
    "google.subject"       = "assertion.sub"
    "attribute.repository" = "assertion.repository"
  }
  attribute_condition = "assertion.repository == 'org/campaign-api'"   # 修正①

  oidc {
    issuer_uri = "https://token.actions.githubusercontent.com"
  }
}

resource "google_service_account" "cicd" {
  project      = var.project_id
  account_id   = "campaign-api-cicd"
  display_name = "campaign-api CI/CD (WIF)"
}

# 修正②: roles/editor ではなく最小権限のみ付与
resource "google_project_iam_member" "cicd_artifact_writer" {
  project = var.project_id
  role    = "roles/artifactregistry.writer"
  member  = "serviceAccount:${google_service_account.cicd.email}"
}
resource "google_project_iam_member" "cicd_kms_signer" {
  project = var.project_id
  role    = "roles/cloudkms.signerVerifier"
  member  = "serviceAccount:${google_service_account.cicd.email}"
}
resource "google_service_account_iam_member" "wif_binding" {
  service_account_id = google_service_account.cicd.name
  role                = "roles/iam.workloadIdentityUser"
  member              = "principalSet://iam.googleapis.com/${google_iam_workload_identity_pool.github.name}/attribute.repository/org/campaign-api"
}

# ── Cloud KMS（Binary Authorization アテステーション署名鍵）──────
resource "google_kms_key_ring" "binauthz" {
  project  = var.project_id
  name     = "binauthz-keyring"
  location = "asia-northeast1"
}
resource "google_kms_crypto_key" "attestor_key" {
  name     = "campaign-api-attestor-key"
  key_ring = google_kms_key_ring.binauthz.id
  purpose  = "ASYMMETRIC_SIGN"
  version_template { algorithm = "EC_SIGN_P256_SHA256" }
}
data "google_kms_crypto_key_version" "attestor_key_version" {
  crypto_key = google_kms_crypto_key.attestor_key.id
}

# ── Binary Authorization Attestor ──────────────────────────────
resource "google_container_analysis_note" "attestor_note" {
  project = var.project_id
  name    = "campaign-api-attestor-note"
  attestation_authority {
    hint { human_readable_name = "campaign-api build attestor" }
  }
}
resource "google_binary_authorization_attestor" "build_attestor" {
  project = var.project_id
  name    = "campaign-api-build-attestor"
  attestation_authority_note {
    note_reference = google_container_analysis_note.attestor_note.name
    public_keys {
      id = data.google_kms_crypto_key_version.attestor_key_version.id
      pkix_public_key {
        public_key_pem      = data.google_kms_crypto_key_version.attestor_key_version.public_key[0].pem
        signature_algorithm = "ECDSA_P256_SHA256"
      }
    }
  }
}

# ── Binary Authorization Policy（修正⑥）───────────────────────
resource "google_binary_authorization_policy" "policy" {
  project                        = var.project_id
  global_policy_evaluation_mode  = "ENABLE"

  default_admission_rule {
    evaluation_mode         = "ALWAYS_DENY"
    enforcement_mode        = "ENFORCED_BLOCK_AND_AUDIT_LOG"
    require_attestations_by = []
  }

  cluster_admission_rules {
    cluster                 = "asia-northeast1.mops-campaign-cluster"
    evaluation_mode         = "REQUIRE_ATTESTATION"
    enforcement_mode        = "ENFORCED_BLOCK_AND_AUDIT_LOG"   # 修正⑦
    require_attestations_by = [google_binary_authorization_attestor.build_attestor.name]
  }
}

# ── GKE Autopilot（クラスタ側でも強制）──────────────────────────
resource "google_container_cluster" "campaign" {
  project          = var.project_id
  name             = "mops-campaign-cluster"
  location         = "asia-northeast1"
  enable_autopilot = true

  binary_authorization {
    evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"   # 修正⑥
  }
}

# 修正⑦: break-glass（拒否イベント）検知
resource "google_logging_metric" "binauthz_denials" {
  project = var.project_id
  name    = "binauthz-denial-events"
  filter  = "resource.type=\"k8s_cluster\" AND protoPayload.response.message:\"binary authorization\""
  metric_descriptor {
    metric_kind = "DELTA"
    value_type  = "INT64"
  }
}

resource "google_monitoring_alert_policy" "binauthz_denial_alert" {
  project      = var.project_id
  display_name = "Binary Authorization 拒否イベント検知"
  combiner     = "OR"
  conditions {
    display_name = "拒否イベント発生"
    condition_threshold {
      filter          = "metric.type=\"logging.googleapis.com/user/${google_logging_metric.binauthz_denials.name}\""
      comparison      = "COMPARISON_GT"
      threshold_value = 0
      duration        = "0s"
    }
  }
  notification_channels = [var.slack_notification_channel_id]
}