Secure Microsoft Foundry Agents with a Standalone Gateway

resource "azurerm_subnet" "foundry_agents" {
  name                 = "foundry-agent-subnet"
  resource_group_name  = var.resource_group_name
  virtual_network_name = var.vnet_name
  address_prefixes     = [var.agent_subnet_cidr]

  delegation {
    name = "foundry-agent-delegation"
    service_delegation {
      name    = "Microsoft.App/environments"
      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
    }
  }
}

resource "aviatrix_spoke_gateway" "mcp_containment" {
  cloud_type   = var.cloud_type
  account_name = var.account_name
  gw_name      = "mcp-containment-spoke"
  vpc_id       = var.cluster_vpc_id
  vpc_reg      = var.region
  gw_size      = var.gateway_size
  subnet       = var.subnet_cidr
}

resource "azurerm_route_table" "foundry_agents" {
  name                = "foundry-agent-udr"
  resource_group_name = var.resource_group_name
  location            = var.location
}

resource "azurerm_route" "default_via_aviatrix" {
  name                   = "default-via-aviatrix"
  resource_group_name    = var.resource_group_name
  route_table_name       = azurerm_route_table.foundry_agents.name
  address_prefix         = "0.0.0.0/0"
  next_hop_type          = "None"
}

resource "azurerm_subnet_route_table_association" "foundry_agents" {
  subnet_id      = azurerm_subnet.foundry_agents.id
  route_table_id = azurerm_route_table.foundry_agents.id
}

# Agent workload source — subnet-type matching is more precise than CIDR
# and scopes the SmartGroup to exactly one subnet by account and name.
resource "aviatrix_smart_group" "foundry_agents" {
  name = "foundry-agents"
  selector {
    match_expressions {
      type         = "subnet"
      account_name = var.aviatrix_account_name
      name         = var.agent_subnet_name
    }
  }
}

# All ACA platform control-plane service tags in a single SmartGroup.
# Aviatrix evaluates each match_expressions entry as a logical OR —
# traffic matching any tag in the set is permitted by rule 3.
resource "aviatrix_smart_group" "aca_platform_svctags" {
  name = "aca-platform-svctags"
  selector {
    dynamic "match_expressions" {
      for_each = [
        "AzureActiveDirectory",
        "MicrosoftContainerRegistry",
        "AzureFrontDoorFirstParty",
        "AzureContainerRegistry",
      ]
      content {
        external = "azureips"
        ext_args = {
          service_name = match_expressions.value
        }
      }
    }
  }
}

locals {
  aca_requirement_fqdns = [
    # MCR - all agent types
    "mcr.microsoft.com",
    "*.data.mcr.microsoft.com",
    # AKS infrastructure - all agent types
    "packages.aks.azure.com",
    "acs-mirror.azureedge.net",
    # Managed identity
    "*.identity.azure.net",
    "login.microsoftonline.com",
    "*.login.microsoftonline.com",
    "*.login.microsoft.com",
    # Hosted agent container registry
    "login.microsoft.com",
    # Application Insights telemetry
    "*.in.applicationinsights.azure.com",
    # This is optional and create a large data exfiltration path if enabled
    # "*.blob.core.windows.net"
  ]
}

resource "aviatrix_web_group" "aca_requirements_fqdns" {
  name = "aca-requirements-fqdns"
  selector {
    dynamic "match_expressions" {
      for_each = local.aca_requirement_fqdns
      content {
        snifilter = match_expressions.value
      }
    }
  }
}

resource "aviatrix_web_group" "foundry_tool_calls" {
  name = "foundry-tool-calls"
  selector {
    dynamic "match_expressions" {
      for_each = var.tool_call_fqdns
      content {
        snifilter = match_expressions.value
      }
    }
  }
}

locals {
  # Built-in Aviatrix SmartGroup UUIDs — identical across all controllers.
  sg_public_internet = "def000ad-0000-0000-0000-000000000001"
  sg_threat_intel    = "def05854-4100-0000-0000-000000000000"
}

# DCF attachment point — attaches the ruleset before any UI-managed rules.
data "aviatrix_dcf_attachment_point" "tf_before_ui" {
  name = "TERRAFORM_BEFORE_UI_MANAGED"
}

resource "aviatrix_dcf_ruleset" "foundry" {
  name      = "foundry-agent-egress"
  attach_to = data.aviatrix_dcf_attachment_point.tf_before_ui.id

  # Rule 1 — deny known-malicious destinations before any permit.
  rules {
    name             = "block-threat-intel"
    priority         = 1
    action           = "DENY"
    protocol         = "ANY"
    logging          = true
    src_smart_groups = [aviatrix_smart_group.foundry_agents.uuid]
    dst_smart_groups = [local.sg_threat_intel]
  }

  # Rule 2 — ACA runtime FQDNs: permit without decryption.
  # TLS decryption breaks ACA container startup; these FQDNs must bypass inspection.
  rules {
    name                 = "allow-aca-fqdns"
    priority             = 2
    action               = "PERMIT"
    protocol             = "TCP"
    decrypt_policy       = "DECRYPT_NOT_ALLOWED"
    flow_app_requirement = "TLS_REQUIRED"
    logging              = true
    src_smart_groups     = [aviatrix_smart_group.foundry_agents.uuid]
    dst_smart_groups     = [local.sg_public_internet]
    web_groups           = [aviatrix_web_group.aca_requirements_fqdns.uuid]
    port_ranges { lo = 443 }
  }

  # Rule 3 — ACA platform service tags: permit without decryption.
  # Single SmartGroup covers all four ACA control-plane service tags (logical OR).
  rules {
    name                 = "allow-aca-svctags"
    priority             = 3
    action               = "PERMIT"
    protocol             = "TCP"
    decrypt_policy       = "DECRYPT_NOT_ALLOWED"
    flow_app_requirement = "TLS_REQUIRED"
    logging              = true
    src_smart_groups     = [aviatrix_smart_group.foundry_agents.uuid]
    dst_smart_groups     = [aviatrix_smart_group.aca_platform_svctags.uuid]
    port_ranges { lo = 443 }
  }

  # Rule 4 — approved tool-call FQDNs: permit with TLS decryption for inspection.
  rules {
    name             = "allow-tool-calls"
    priority         = 4
    action           = "PERMIT"
    protocol         = "TCP"
    decrypt_policy   = "DECRYPT_ALLOWED"
    logging          = true
    src_smart_groups = [aviatrix_smart_group.foundry_agents.uuid]
    dst_smart_groups = [local.sg_public_internet]
    web_groups       = [aviatrix_web_group.foundry_tool_calls.uuid]
    port_ranges { lo = 443 }
  }

  # Rule 5 — default deny: block all remaining egress.
  rules {
    name             = "deny-internet"
    priority         = 5
    action           = "DENY"
    protocol         = "ANY"
    logging          = true
    src_smart_groups = [aviatrix_smart_group.foundry_agents.uuid]
    dst_smart_groups = [local.sg_public_internet]
  }
}