data "aws_iam_policy_document" "github_actions_trust" {
  statement {
    effect  = "Allow"
    actions = ["sts:AssumeRoleWithWebIdentity"]
    
    principals {
      type        = "Federated"
      identifiers = [aws_iam_openid_connect_provider.github.arn]
    }
    
    condition {
      test     = "StringLike"
      variable = "token.actions.githubusercontent.com:sub"
      values   = ["repo:myorg/data-platform:ref:refs/heads/main"]
    }
    
    condition {
      test     = "StringEquals"
      variable = "token.actions.githubusercontent.com:aud"
      values   = ["sts.amazonaws.com"]
    }
  }
}

resource "aws_iam_role" "pipeline_execution" {
  name               = "data-pipeline-cicd"
  assume_role_policy = data.aws_iam_policy_document.github_actions_trust.json
  max_session_duration = 3600  # 1 Stunde max
}

# Databricks Unity Catalog mit SCIM-Provisioning
resource "databricks_user" "data_engineer" {
  for_each     = var.data_engineer_emails
  user_name    = each.value
  display_name = each.key
  # SCIM handhabt Provisioning/Deprovisioning vom IdP
  # Kein lokales Passwort — nur SSO
  force_delete_repos = true
  force_delete_home_dir = true
}

resource "databricks_group_member" "de_team" {
  for_each  = var.data_engineer_emails
  group_id  = databricks_group.data_engineers.id
  member_id = databricks_user.data_engineer[each.key].id
}

# Table-Access an Gruppe geben, nicht Individuen
resource "databricks_grants" "silver_layer" {
  table = "main.silver.customer_events"

  grant {
    principal  = "data-engineers"
    privileges = ["SELECT", "MODIFY"]
  }

  grant {
    principal  = "analysts"
    privileges = ["SELECT"]
  }
}

# Jedes Daten-Asset bei Erstellung taggen
resource "aws_glue_catalog_table" "customer_pii" {
  name          = "customer_profiles"
  database_name = aws_glue_catalog_database.silver.name
  
  parameters = {
    "data_classification" = "PII"
    "data_domain"         = "customer"
    "sensitivity"         = "high"
    "gdpr_relevant"       = "true"
    "retention_days"      = "730"
    "owner_team"          = "customer-platform"
  }
  
  # ... Schema
}

# Zugriff basierend auf Classification-Tags
resource "aws_lakeformation_tag" "classification" {
  key    = "data_classification"
  values = ["public", "internal", "confidential", "PII", "restricted"]
}

# Data-Engineers: internal und confidential, nicht PII
resource "aws_lakeformation_tag_association" "engineer_access" {
  principal {
    iam_arn = "arn:aws:iam::123456789:role/data-engineers"
  }
  
  lf_tag_policy {
    resource_type = "TABLE"
    expression {
      key    = "data_classification"
      values = ["public", "internal", "confidential"]
    }
  }
  
  permissions = ["SELECT", "DESCRIBE"]
}

# PII-Access braucht explizite DPO-Genehmigung
resource "aws_lakeformation_tag_association" "pii_approved_access" {
  principal {
    iam_arn = "arn:aws:iam::123456789:role/pii-approved-analysts"
  }
  
  lf_tag_policy {
    resource_type = "TABLE"
    expression {
      key    = "data_classification"
      values = ["PII"]
    }
  }
  
  permissions = ["SELECT"]
  permissions_with_grant_option = []
}

-- Policy-Tag-Taxonomy erstellen (via Data Catalog API oder Terraform)

-- Policy-Tag auf sensitive Spalte
CREATE OR REPLACE TABLE analytics.customer_orders (
  order_id        STRING,
  customer_id     STRING,
  email           STRING OPTIONS (
    description='PII — geschützt durch Policy-Tag',
    policy_tags='"projects/my-project/locations/us/taxonomies/12345/policyTags/67890"'
  ),
  amount_usd      NUMERIC,
  created_at      TIMESTAMP
);

-- Analysten ohne "PII Viewer"-Rolle sehen:
-- SELECT * → email-Spalte gibt NULL oder REDACTED
-- Kein Fehler, kein Hinweis dass maskiert wird

-- Masking-Policy erstellen
CREATE OR REPLACE MASKING POLICY pii_email_mask AS (val STRING)
RETURNS STRING ->
  CASE
    WHEN CURRENT_ROLE() IN ('PII_APPROVED_ANALYST', 'DPO_TEAM') THEN val
    WHEN CURRENT_ROLE() = 'ANALYST' THEN 
      REGEXP_REPLACE(val, '(.{2}).*(@.*)', '\1***\2')  -- Partial Mask
    ELSE '***REDACTED***'
  END;

-- Auf Spalte anwenden
ALTER TABLE customer_orders 
  MODIFY COLUMN email 
  SET MASKING POLICY pii_email_mask;

-- Als Analyst-Rolle testen:
USE ROLE ANALYST;
SELECT email FROM customer_orders LIMIT 5;
-- Returns: jo***@example.com, ma***@company.org, ...

# S3 Gateway Endpoint (gratis)
resource "aws_vpc_endpoint" "s3" {
  vpc_id          = aws_vpc.data_platform.id
  service_name    = "com.amazonaws.${var.region}.s3"
  route_table_ids = aws_route_table.private[*].id
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = "*"
      Action    = ["s3:GetObject", "s3:PutObject", "s3:ListBucket"]
      Resource  = [
        aws_s3_bucket.lakehouse.arn,
        "${aws_s3_bucket.lakehouse.arn}/*"
      ]
    }]
  })
}

# S3-Bucket auf VPC-Endpoint einschränken
resource "aws_s3_bucket_policy" "lakehouse_vpc_only" {
  bucket = aws_s3_bucket.lakehouse.id
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Deny"
      Principal = "*"
      Action    = "s3:*"
      Resource  = [
        aws_s3_bucket.lakehouse.arn,
        "${aws_s3_bucket.lakehouse.arn}/*"
      ]
      Condition = {
        StringNotEquals = {
          "aws:sourceVpce" = aws_vpc_endpoint.s3.id
        }
      }
    }]
  })
}

# Separate KMS-Keys pro Data-Classification
resource "aws_kms_key" "pii_data" {
  description             = "PII Data Encryption — Data-Platform"
  deletion_window_in_days = 30
  enable_key_rotation     = true
  
  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Sid    = "Enable DPO team management"
        Effect = "Allow"
        Principal = { AWS = var.dpo_team_role_arn }
        Action = ["kms:*"]
        Resource = "*"
      },
      {
        Sid    = "Allow approved roles to use key"
        Effect = "Allow"
        Principal = { AWS = [
          var.pii_pipeline_role_arn,
          var.pii_analyst_role_arn
        ]}
        Action = ["kms:GenerateDataKey", "kms:Decrypt"]
        Resource = "*"
      },
      {
        Sid    = "Deny all others"
        Effect = "Deny"
        Principal = { AWS = "*" }
        Action = ["kms:GenerateDataKey", "kms:Decrypt"]
        Resource = "*"
        Condition = {
          StringNotLike = {
            "aws:PrincipalArn" = [
              var.dpo_team_role_arn,
              var.pii_pipeline_role_arn,
              var.pii_analyst_role_arn
            ]
          }
        }
      }
    ]
  })
}

# Pseudocode für Query-Audit-Log-Analyse
# Als geplanter Spark-Job auf CloudTrail/Audit-Logs

from pyspark.sql import functions as F

audit_logs = spark.table("security.data_access_audit")

# Unusual Data-Volume-Access erkennen
anomalies = (
    audit_logs
    .where(F.col("event_date") == F.current_date())
    .groupBy("principal_id", "table_name")
    .agg(
        F.sum("bytes_scanned").alias("bytes_today"),
        F.count("*").alias("query_count")
    )
    .join(
        # Vergleich mit 30-Tage-Baseline
        audit_logs
        .where(F.col("event_date") >= F.date_sub(F.current_date(), 30))
        .groupBy("principal_id", "table_name")
        .agg((F.sum("bytes_scanned") / 30).alias("avg_daily_bytes")),
        on=["principal_id", "table_name"],
        how="left"
    )
    .where(F.col("bytes_today") > F.col("avg_daily_bytes") * 10)  # 10x Spike
)

# Alert via PagerDuty / Slack
anomalies.foreach(lambda row: alert_security_team(row))