Zero Trust в облаке 2026: SPIFFE/SPIRE, AWS Verified Access и GCP BeyondCorp

terraform {
  required_providers {
    aws = { source = "hashicorp/aws" }
    kubernetes = { source = "hashicorp/kubernetes" }
  }
}

provider "aws" {
  region = "us-east-1"
}

# EKS cluster
resource "aws_eks_cluster" "spiffe" {
  name     = "spiffe-cluster"
  role_arn = aws_iam_role.eks.arn
  # ... остальные параметры
}

# IRSA для SPIRE Server
resource "aws_iam_role" "spire_server" {
  name = "spire-server-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRoleWithWebIdentity"
      Effect = "Allow"
      Principal = {
        Federated = aws_iam_openid_connect_provider.eks.arn
      }
      Condition = {
        StringEquals = {
          "${replace(aws_eks_cluster.spiffe.identity[0].oidc[0].issuer, "https://", "")}:sub" = "system:serviceaccount:spire:spire-server"
        }
      }
    }]
  })
}

# Развертывание SPIRE Server через Helm
resource "helm_release" "spire" {
  name       = "spire"
  repository = "https://spiffe.github.io/spire-helm/"
  chart      = "spire"
  namespace  = "spire"
  values = [<<-EOT
    server:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: topology.kubernetes.io/zone
                    operator: In
                    values:
                      - us-east-1a
      podDisruptionBudget:
        enabled: true
      serviceAccount:
        annotations:
          eks.amazonaws.com/role-arn: ${aws_iam_role.spire_server.arn}
    agent:
      enabled: true
      joinToken: "spire-server"
  EOT
  ]
}

- name: Install SPIFFE CSI Driver
  hosts: k8s_cluster
  tasks:
    - name: Add SPIFFE Helm repo
      kubernetes.core.helm_repository:
        name: spiffe
        repo_url: https://spiffe.github.io/spire-helm/

    - name: Install SPIFFE CSI Driver
      kubernetes.core.helm:
        name: spiffe-csi
        chart: spiffe/spire-csi
        namespace: kube-system
        values:
          driver:
            enabled: true
            logLevel: "info"
          spire:
            serverAddress: "spire-server.spire.svc.cluster.local:8081"
            trustDomain: "example.org"
          node:
            enabled: true
          pod:
            enabled: true

# Создание Verified Access Instance
aws ec2 create-verified-access-instance \
  --fips-enabled \
  --tag-specifications 'ResourceType=verified-access-instance,Tags=[{Key=Name,Value=ZeroTrustVA}]'

# Создание группы (application)
aws ec2 create-verified-access-group \
  --verified-access-instance-id vai-0123456789abcdef0 \
  --description "Production apps" \
  --tag-specifications 'ResourceType=verified-access-group,Tags=[{Key=Env,Value=Prod}]'

# Политика доступа (только управляемые устройства)
aws ec2 create-verified-access-policy \
  --verified-access-instance-id vai-0123456789abcdef0 \
  --document '{
    "Version": "2023-06-01",
    "Statement": [{
      "Effect": "Allow",
      "Principal": "*",
      "Action": "verifiedaccess:Authenticate",
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "verifiedaccess:device_management_enabled": "true"
        }
      }
    }]
  }'