Skip to content

Commit 1a0cfb2

Browse files
cosmindevcosmindev
authored
Merge pull request #458 from oracle-devrel/LZF.2023.09.3
Lzf.2023.09.3
2 parents a151395 + bf30db1 commit 1a0cfb2

File tree

5 files changed

+12547
-22
lines changed

5 files changed

+12547
-22
lines changed

‎landing-zones/commons/lz_solution_definition.md

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
# OCI LANDING ZONE SOLUTION DEFINITION
2+
3+
## **Table of Contents**
4+
5+
[1. Introduction](#1-introduction) </br>
6+
[2. Design Considerations](#1-design-considerations--decisions)</br>
7+
[3. Landing Zone Approach](#3-landing-zone-zone-approach) </br>
8+
[4. Standard Landing Zones](#4-standard-landing-zones) </br>
9+
[5. Tailored Landing Zones](#5-tailored-landing-zones)
10+
11+
&nbsp;
12+
13+
## **1. Introduction**
14+
15+
Welcome to the [Landing Zone Framework (LZF)](/landing-zones/README.md) Solution Definition.
16+
17+
This asset provides guidance on the **landing zone design considerations**, and helps select the best **approach** and **solution** to setup and run your OCI Landing Zone.
18+
19+
An OCI Landing Zone sets the foundations for a **secure tenancy**, providing design **best practices** and **operational control** over OCI resources. A Landing Zone also simplifies the **onboarding** of **workloads** and **teams**, with clear patterns for **network isolation** and **segregation of duties** in the organization, which sets the cloud operating model for **day two operations**.
20+
21+
&nbsp;
22+
23+
## **2. Design Considerations**
24+
25+
Before choosing the approach and solution, it's important to understand a set of security, network, and operational considerations to successfully run OCI - or any cloud provider. It is recommended to iterate over these elements as they will guide the design process, simplify the understanding of OCI core resources, and clarify the day-two operations. For tangibles examples, find [**here**](https://github.com/oracle-quickstart/terraform-oci-open-lz/blob/master/design/OCI_Open_LZ.pdf) an OCI landing zone design document matching these topics.
26+
27+
&nbsp;
28+
29+
## 2.1 Security
30+
31+
The following table presents the recommended security topics to review in the landing zone design.
32+
33+
| ID | TOPIC | DESCRIPTION | OCI RESOURCES
34+
|---|---|---|---|
35+
| **SD.01** | **Tenancy Structure** | Compartment structure to support resource grouping, separation of duties, budget control and billing, and workloads. | Compartments |
36+
| **SD.02**| **Identity and Access Management** | The groups, dynamic groups, and policies for the related duties and compartments. | Identity Domains, Groups, and Policies |
37+
| **SD.03**| **Security Posture** | Additional configurations for OCI native security tooling. | Cloud Guard, Security Zones, Vulnerability Scanning, etc. |
38+
39+
&nbsp;
40+
41+
## 2.2 Network
42+
43+
The following table presents the recommended network topics to review in the landing zone design. The first two topics are highly recommended while the last two can be optional depending on requirements.
44+
45+
46+
| ID | TOPIC | DESCRIPTION | OCI RESOURCES
47+
|---|---|---|---|
48+
| **ND.01** | **Network Structure** | Network elements to support the workloads and network segregation. | VCNs, Subnets, DRG, Gateways |
49+
| **ND.02**| **Network Security** | Network areas and their security posture. | NSGs, Security Lists, Gateways, Firewalls |
50+
| **ND.03**| **Network Connectivity** | Connection to on-premises or other cloud providers with network traffic scenarios. | FastConnec, Site-to-site VPN. </br> ND.01, ND.02 Resources. |
51+
| **ND.04**| **DNS** | Naming resolution and how DNS zones and records are solved to handle domain DNS queries. | VCNs, Subnets, Resolvers, and Endpoints. |
52+
53+
&nbsp;
54+
55+
## 2.3 Operations
56+
57+
The following table presents the recommended operational topics to review in the landing zone design.
58+
59+
| ID | TOPIC | DESCRIPTION | OCI RESOURCES
60+
|---|---|---|---|
61+
| **OD.01** | **Teams** | Cloud operations teams responsible for running (provisioning and changing) OCI landing zone and OCI workloads. | Relates to SD01 and SD.02 |
62+
| **OD.02** | **Tooling** | Tools to run OCI, used for provisioning and changing of resources. | OCI Console, ORM, CLI, Terraform, SDK, Pipelines, Git, etc. |
63+
| **OD.03**| **Operating Model** | The modus operandi to provision and change resources with the tooling by the cloud operations teams. | Relates to OD.01, OD.02 |
64+
| **OD.04**| **Operatinal Integrations** | Integrate OCI Landing Zone with external systems, such as SIEM or Monitoring. | Relates to SD.01, SD.02, SD.03, ND.01, ND.03 |
65+
66+
&nbsp;
67+
68+
69+
## **3. Landing Zone Zone Approach**
70+
71+
There are two types of landing zone approaches to consider:
72+
73+
74+
| APPROACH | DESCRIPTION |
75+
|---|---|
76+
| [**Standard Landing Zones**](/landing-zones/standard_landing_zones/standard_landing_zones.md) | **Prescribed** and **ready to use** solutions with a **guided setup** and **IaC**. This is the recommended approach for initial landing zone deployments covering the most common workload scenarios. |
77+
| [**Tailored Landing Zones**](/tailored_landing_zones/tailored_landing_zones.md) | An approach to solve **specific requirements** when the standard is not enough. These LZs run with **configuration-as-code** and are used to scale/bridge with existing **operating models**, complying with fine-grained **segregations of duties**, strong **network isolation**, and heterogeneous **workloads**. |
78+
79+
&nbsp;
80+
81+
The **guidance** we recommend to follow is very simple:
82+
83+
- If you're **starting** with OCI landing zones use a **standard landing zone** as they're full of best practices. If it needs adjustments or **extensions** on top of the prescribed design, customize it by code or manually. This approach is described in [next section](#4-standard-landing-zones).
84+
- If your [**requirements** are very **specific/detailed**](/landing-zones/tailored_landing_zones/tailored_landing_zones.md#1-what-are-tailored-landing-zones), or they imply structural changes to a standard landing zone, and/or you need a highly scalable operating model, **use the tailored approach** described in [section 5](#5-tailored-landing-zones).
85+
86+
&nbsp;
87+
88+
89+
## **4. Standard Landing Zones**
90+
91+
92+
| TOPIC | DESCRIPTION |
93+
|---|---|
94+
| **APPROACH** | [Standard Landing Zones](/landing-zones/standard_landing_zones/standard_landing_zones.md) |
95+
| **SOLUTION** | [CIS Landing Zone](/landing-zones/standard_landing_zones/cis_lz_v2/cis_landing_zone_v2.md). CIS 1.2 [certified](https://www.cisecurity.org/partner/oracle) since september 2023. |
96+
| **SECURITY SCOPE** | Covers all topics in [section 2.1](#21-security).
97+
| **NETWORK SCOPE** | Covers all topics in [section 2.2](#22-network) exept ND.04 DNS.
98+
| **OPERATIONS SCOPE** | Covers OD.02 Tooling in [section 2.3](#23-operations). Note that standards landing zones normally have very simple and centralized operating models, and might not require the remaining elements.
99+
| **RUNTIME** | Use the solution link for complete guidance on the **configuration** and **deployment** of this solution.
100+
| **EXTENSIONS** | **- Design**: For guidande on **extending** this **solution design** with OCI resources on top of the standard model review the [section 4](/landing-zones/standard_landing_zones/cis_lz_v2/cis_landing_zone_v2.md#4-extend-the-solution) of the CIS LZ solution. </br>**- Deployment/Run with IaC**: An alternative to add-ons on the solution v2 code base is using of the [CIS Landing Zone Enhanced Modules](https://www.ateam-oracle.com/post/cis-landing-zone-enhanced-modules), to **configure** the resources templates with *json/hcl* terraform native interfaces. |
101+
102+
&nbsp;
103+
104+
## **5. Tailored Landing Zones**
105+
106+
107+
| TOPIC | DESCRIPTION |
108+
|---|---|
109+
| **APPROACH** | [Tailored Landing Zones](/landing-zones/tailored_landing_zones/tailored_landing_zones.md) |
110+
| **SOLUTION** | Use the [OCI Open LZ Blueprint](https://github.com/oracle-quickstart/terraform-oci-open-lz) to tailor your landing zone. There are also complementar [models](https://github.com/oracle-quickstart/terraform-oci-open-lz/blob/master/design/models/readme.md) for initial discussions. This solution uses CIS 1.2 compliant Terraform modules.|
111+
| **SECURITY SCOPE** | Covers all topics in [section 2.1](#21-security).
112+
| **NETWORK SCOPE** | Covers all topics in [section 2.2](#22-network).
113+
| **OPERATIONS SCOPE** | Covers all topics in [section 2.3](#23-operations) except OD.04 Integrations.
114+
| **RUNTIME** | - In terms of **deployment** and **running** your landing zone design, we recommend the use of the **[CIS Landing Zone Enhanced Modules](https://www.ateam-oracle.com/post/cis-landing-zone-enhanced-modules)**, to **configure** the resources with *json/hcl* terraform native interfaces. </br> - Note the [**OCI Open LZ Blueprint**](https://github.com/oracle-quickstart/terraform-oci-open-lz) also presents the **Runtime View** of the design, with IaC configurations for each operation scenario, using these same [modules](https://www.ateam-oracle.com/post/cis-landing-zone-enhanced-modules).
115+
| **EXTENSIONS** | Any extension is a new operation scenario and follows the same process and cloud operating model of all other scenarios. Refer to the **OCI Open LZ** [**Runtime View**](https://github.com/oracle-quickstart/terraform-oci-open-lz/blob/master/examples/oci-open-lz/readme.md) for examples and the [**Operations View**](https://github.com/oracle-quickstart/terraform-oci-open-lz/blob/master/design/OCI_Open_LZ.pdf) for more details on the cloud operating model.|
116+
117+
118+
&nbsp;
119+
120+
&nbsp;
121+
122+
123+
# License
124+
125+
Copyright (c) 2023 Oracle and/or its affiliates.
126+
127+
Licensed under the Universal Permissive License (UPL), Version 1.0.
128+
129+
See [LICENSE](https://github.com/oracle-devrel/technology-engineering/blob/main/LICENSE) for more details.

‎landing-zones/commons/user_identity_management.md

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ Depending on the role, each user (or persona) plays, different processes are use
88

99
This pattern explains the personas and related processes.
1010

11-
Before you start, take into account these considerations:
11+
Before you start, take these considerations into account:
1212
- Never share accounts between users.
1313
- Never share passwords between users.
1414
- Never create shared accounts for tenancy global administration.
@@ -18,6 +18,8 @@ Before you start, take into account these considerations:
1818
## 2. User Personas
1919

2020
### 2.1 OCI Platform Administrator
21+
22+
OCI Platform Administrator Personas use the Default domain only. **No other user persona should be in this domain.** [See Design Guidance for IAM Identity Domains](https://docs.oracle.com/en-us/iaas/Content/cloud-adoption-framework/iam-security-structure.htm#IAM-identity-domains)
2123
&nbsp;
2224
| TYPE | DESCRIPTION | USER TYPE | RESPONSIBILITIES | CAPABILITIES | LIFE CYCLE | OCI GROUP MEMBERSHIP | FEDERATED | DOMAIN |
2325
|---|---|---|---|---|---|---|---|---|
@@ -30,12 +32,14 @@ Administrators | Dedicated groups of users to manage the OCI platform resources
3032

3133
### 2.2 Workload User
3234

35+
Workload User Personas are workload dependent and may life in the related resources (like OS users or Database schema users). Workload personas should **never** be part of the *Default* domain. [See Design Guidance for IAM Identity Domains](https://docs.oracle.com/en-us/iaas/Content/cloud-adoption-framework/iam-security-structure.htm#IAM-identity-domains)
36+
3337
| TYPE | DESCRIPTION | USER TYPE | LIFE CYCLE | OCI GROUP MEMBERSHIP | FEDERATED | DOMAIN |
3438
|---|---|---|---|---|---|---|
35-
| OS User | A user working in the VM as an OS user. Permissions are granted at the OS level. <br> *Not related to any OCI groups and policies.* | Root users <br>Human users | If possible, through user provisioning where customer identity management system is the source of truth. | N/A | Optional | Not required<br> Dedicated |
36-
| Database User | A user working in a database using a database schema user. Permissions are granted within the database. <br>*Not related to any OCI groups and policies.* | DBAs, Admin users<br>Schema users | If possible, through user provisioning where customer identity management system is the source of truth. | N/A | Optional | Not required<br> Dedicated |
37-
| Application User | A user working in an application. <br>*Not related to any OCI groups and policies.* | Application Administrators<br>Application Users<br>Backplane processes | If possible, through user provisioning where the customer identity management system is the source of truth. | N/A | Optional | Not required<br> Dedicated |
38-
| PaaS User | A user working in PaaS services. <br>*Not related to any OCI groups and policies.* | PaaS-related user types | If possible, through user provisioning where the customer identity management system is the source of truth. | N/A | Optional | Dedicated |
39+
| OS User | A user working in the VM as an OS user. Permissions are granted at the OS level. <br> *Not related to any OCI groups and policies.* | Root users <br>Human users | If possible, through user provisioning where customer identity management system is the source of truth. | N/A | Optional | Not required<br> Dedicated domain|
40+
| Database User | A user working in a database using a database schema user. Permissions are granted within the database. <br>*Not related to any OCI groups and policies.* | DBAs, Admin users<br>Schema users | If possible, through user provisioning where customer identity management system is the source of truth. | N/A | Optional | Not required<br> Dedicated domain|
41+
| Application User | A user working in an application. <br>*Not related to any OCI groups and policies.* | Application Administrators<br>Application Users<br>Backplane processes | If possible, through user provisioning where the customer identity management system is the source of truth. | N/A | Optional | Not required<br> Dedicated domain|
42+
| PaaS User | A user working in PaaS services. <br>*Not related to any OCI groups and policies.* | PaaS-related user types | If possible, through user provisioning where the customer identity management system is the source of truth. | N/A | Optional | Dedicated domain |
3943

4044
&nbsp;
4145

0 commit comments

Comments
 (0)