Skip to content

Commit 597db9f

Browse files
AlexanderHodickeAlexanderHodicke
authored
Merge pull request #264 from oracle-devrel/LZ_17072023
LZ initial version
2 parents 458603a + 449340d commit 597db9f

22 files changed

+598
-39
lines changed

‎landing-zones/README.md

Lines changed: 36 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,44 @@
1-
# Landing Zones
1+
# LANDING ZONE FRAMEWORK
2+
3+
 
4+
5+
6+
Welcome to the **Landing Zone Framework (LZF)**.
7+
8+
The LZF is a set of assets that aim to **simplify the OCI onboarding experience** and **reduce OCI day-one and day-two efforts**. It provides **best practices**, and approaches covering the complete spectrum of OCI landing zones, from the **Standards** ones with the CIS LZ and OELZ to the **Tailored** approaches with IaC configurations.
9+
 
10+
11+
12+
| APPROACH | DESCRIPTION | ASSET |
13+
|---|---|:---:|
14+
| <a href="/landing-zones/standard_landing_zones/standard_landing_zones.md" ><img src="images/slz.png" alt= “” width="600" height=""></a> | A standard landing zone is a **prescribed** approach to landing zones with a **guided setup** by the user, using an **existing IaC solution**. This is the recommended approach for initial landing zone deployments covering the most-common workload scenarios. | **[VIEW](/landing-zones/standard_landing_zones/standard_landing_zones.md)** |
15+
| <a href="tailored_landing_zones/tailored_landing_zones.md" ><img src="images/tlz.png" alt= “” width="600" height=""> </a> | A tailored landing zone is a solution to **fit specific requirements** when the standard approach is not enough. It's an **IaC configuration-driven** approach, simple to set up, and is normally used to bridge with existing operating models, with fine-grained segregations of duties, strong network isolation, and heterogeneous workloads, among others. | **[VIEW](/landing-zones/tailored_landing_zones/tailored_landing_zones.md)** | |
16+
&nbsp;
17+
18+
If you're starting with landing zones, we recommend the following **decision process**:
19+
1. Start with the **standard** approach as they're full of best practices.
20+
2. If it needs adjustments or **extensions** on top of the prescribed design, customize it by code or manually.
21+
3. If the design requires **structural changes** to the standard landing zone and a **scalable operating model**, use the **tailored** approach with IaC configuration (json/hcl).
22+
23+
&nbsp;
24+
25+
The following support assets are also available for a better OCI experience:
26+
- [Resource Namining Conventions](/commons/resource_naming_conventions.md)
27+
- [User Identity Management](/commons/user_identity_management.md)
28+
- [Budgets and Tagging](/commons/budgets_and_tagging.md)
29+
30+
31+
&nbsp;
32+
33+
&nbsp;
34+
35+
236

3-
With Landing Zones, we simplify the OCI onboarding experience and reduce OCI day-one and day-two efforts. We provide Landing Zone assets, best practices, and approaches covering the complete spectrum of OCI landing zones, from the standards ones with the CIS LZ and OELZ to the most strategically tailored design with IaC.
437

538
# License
639

740
Copyright (c) 2023 Oracle and/or its affiliates.
841

942
Licensed under the Universal Permissive License (UPL), Version 1.0.
1043

11-
See [LICENSE](https://github.com/oracle-devrel/technology-engineering/blob/folder-structure/LICENSE) for more details.
44+
See [LICENSE](https://github.com/oracle-devrel/technology-engineering/blob/main/LICENSE) for more details.

‎landing-zones/commons/budgets_and_tagging.md

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# BUDGETS AND TAGGING
2+
3+
## 1. Tagging
4+
5+
OCI Tagging allows you to assign **key:value** pairs to resources and use these assigned tags for the purpose of organizing and listing resources, based on requirements. Tagging can be used for organizing/listing resources, cost-tracking, and access control purposes. There are two ways for you to add tags to resources. Each approach offers a different type of tag for you to work with:
6+
7+
- **Defined tags**: tag administrators manage resource metadata.
8+
- **Free-form tags**: unmanaged metadata applied to resources by users (these are out of scope)
9+
10+
**Cost tracking** is a feature available with defined tags. This feature is currently only relevant for use with **Budgets**.
11+
12+
Tags are grouped into **Tag Namespaces** which are a container for tag keys. They consist of a name and zero or more tag key definitions. Tag namespaces are not case-sensitive and must be unique across the tenancy. The namespace is also a natural grouping to which administrators can apply policy. One policy on the tag namespace applies to all the tag definitions contained within that namespace.
13+
14+
Below are some service limitations with respect to using tags:
15+
16+
- Tags per tenancy: unlimited
17+
- Tags per resource: 10 free-form tags and 64 defined tags
18+
- Tags enabled for cost-tracking: 10 per tenancy (includes both active and retired tags)
19+
- Total tag data size: 5 K (JSON). The total tag data size includes all tag data for a single resource (all applied tags and tag values). Sizing is per UTF-8.
20+
- Number of pre-defined values for a tag key: 100 per list
21+
&nbsp;
22+
### 1.2 Design and Usage of Defined Tags
23+
24+
The design and usage of defined tags are customers, business, and even OE-specific. It must be designed and used that matches the customer's nomenclature and values.
25+
26+
Defined tags can be assigned to resources and used in policy statements or Cloud Guard recipes.
27+
28+
Defined tags can be applied to Terraform configurations at any time. They are considered updates to existing resources and will not trigger any recreation of these.
29+
30+
&nbsp;
31+
## 2. Budgets
32+
33+
Budgets can be used to set limits on OCI spending (i.e., Quotas). You can set alerts on your budget to inform you when you are close to exceeding your budget. The budgets and spending are available directly from the OCI console.
34+
35+
Budgets are set on a cost-tracking tags or compartment basis and allow the tracking of all spending in that cost-tracking tag or for the compartment and its child compartments. A monthly threshold is defined for OCI spending and email alerts can be defined to get sent out for the respective budget. Alerts are evaluated every hour in most regions and can be triggered when the actual or forecasted spending hits either a percentage of the budget or a specified set amount.
36+
37+
In addition, automation can be created for Budgets with the use of Events Service.
38+
39+
&nbsp;
40+
### 2.1 Budget Control and Billing
41+
42+
For budget control and billing two approaches are recommended:
43+
44+
- Tenancy-global to identify unauthenticated usage
45+
- Landing Zone structure specific
46+
47+
48+
While the tenancy-global budget control applies to the overall average consumption, the landing zone compartment structure enables the creation of budgets to set soft limits on OCI tenancy spending, by shared elements, operating entities, departments, projects, etc. With budget control, the available budget can be controlled using quotas and also trigger alarms when unusual costs occur.
49+
50+
Budget control and billing is a global task for every tenancy, and since it's a generic OCI topic not specific to any landing zone, it is not described in this asset.
51+
52+
&nbsp;
53+
&nbsp;
54+
# License
55+
56+
Copyright (c) 2023 Oracle and/or its affiliates.
57+
58+
Licensed under the Universal Permissive License (UPL), Version 1.0.
59+
60+
See [LICENSE](https://github.com/oracle-devrel/technology-engineering/blob/main/LICENSE) for more details.

‎landing-zones/commons/resource_naming_conventions.md

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
# RESOURCE NAMING CONVENTIONS
2+
3+
&nbsp;
4+
5+
## 1. Introduction
6+
7+
A resource naming convention helps to identify resources, their type, and location by the name, quickly. If you don't have any naming convention in place, we recommend the following Resource Naming Convention:
8+
9+
- Segments of the name are separated by "-".
10+
- Within a name segment avoid using &lt;space&gt; and ".".
11+
- Where possible intuitive/standard abbreviations should be considered (e.g., use "shared" instead of "shared.cloud.team").
12+
- When referring to the compartment fully qualified compartment path, use ":" as a separator, e.g. cmp-shared:cmp-security
13+
14+
Examples of names are:
15+
- cmp-shared
16+
- cmp-&lt;workload&gt;
17+
- cmp-networking
18+
19+
The patterns used for the names are:
20+
- &lt;resource-type&gt;-&lt;environment&gt;-&lt;location&gt;-&lt;purpose&gt;
21+
&lt;resource-type&gt;-&lt;environment&gt;-&lt;source-location&gt;-&lt;destination-location&gt;-&lt;purpose&gt;
22+
- &lt;resource-type&gt;-&lt;entity/sub-entity&gt;-&lt;environment&gt;-&lt;function/department&gt;-&lt;project&gt;-&lt;custom&gt;
23+
24+
&nbsp;
25+
26+
## 2. List of Resource Types
27+
28+
29+
| RESOURCE TYPE | ABREVIATION |
30+
|---|---|
31+
| Agent | agt |
32+
| Alarm | al |
33+
| API Gateway |apigw |
34+
| Autonomous Container Database (Dedicated) | adbc
35+
| Autonomous Database (Transaction Processing) | atp
36+
| Autonomous Data Warehouse | adw
37+
| Autonomous Exadata Infrastructure | aei
38+
| Autonomous JSON Database | ajd
39+
| Autonomous Database with APEX | apx
40+
| Bastion Service | bst |
41+
| Bucket | bkt |
42+
| Block Volume | blk |
43+
| Cloud Guard Recipe (cloned) | cg-act, cg-cfg|
44+
| Cloud Guard Responder (cloned) | cg-rsp |
45+
| Cloud Guard Target | cg-tgt |
46+
| Compartment | cmp |
47+
| Container Repository | cir |
48+
| Customer Premise Equipment | cpe |
49+
| Database on VM | db |
50+
| Database Backup | dbb |
51+
| Database Backup Destination | dbbd |
52+
| Database Connection | dbc |
53+
| Database Home | dbh |
54+
| Database Key Store | dks |
55+
| Database Node | dbn |
56+
| Database Pluggable Database | pdb |
57+
| Database Server | dbs |
58+
| Database Software Image | dbi |
59+
| Database System | dbsys |
60+
| DNS Endpoint Forwarder | dnsepf |
61+
| DNS Endpoint Listener | dnsepl |
62+
| Dynamic Group | dgp |
63+
| Dynamic Routing Gateway | drg |
64+
| Dynamic Routing Gateway Attachment | drgatt |
65+
| Event Rule | rul |
66+
| ExaCS Infrastructure | ecsi |
67+
| ExaCS VMCluster Cloud | ecsvmc |
68+
| Exadata Cloud@Customer Infrastructure | ecci |
69+
| Exadata Cloud@Customer VMCluster | eccvmcls |
70+
| Exadata Cloud@Customer Operator Control | eccop |
71+
| Exadata Cloud@Customer Operator Control Assignment | eccopasgn |
72+
| Exadata Cloud@Customer Operator Control Access Request | eccopreq |
73+
| External Database | edb |
74+
| External Container Database | edbc |
75+
| External Pluggable Container Database | epdb |
76+
| External Non-Container Database | edbn |
77+
| External Database Connector | edbc |
78+
| Fast Connect | fc# &lt;# := 1...n&gt; |
79+
| File Storage | fss |
80+
| Function | fun |
81+
| Group | grp |
82+
| Internet Gateway | igw |
83+
| Load Balancer | lb |
84+
| Location (Three-letter region code)| ams, fra, etc. |
85+
| Log | log |
86+
| Log Groups | lgrp |
87+
| NAT Gateway | nat |
88+
| Network Security Group | nsg |
89+
| Notification Topic | nott |
90+
| Managed key | key |
91+
| OCI Function Application | fn |
92+
| Object Storage Bucket | bkt |
93+
| Policy | pcy |
94+
| Routing Table | rt |
95+
| Secret | sec |
96+
| Security List | sl |
97+
| Security Zone Recipe | sz-rcp |
98+
| Security Zone Target | sz-tgt |
99+
| Service Gateway | sgw |
100+
| Service Connector Hub | sch |
101+
| Stream | str |
102+
| Subnet | sub |
103+
| Tenancy | tcy |
104+
| Vault | vlt |
105+
| Virtual Cloud Network | vcn |
106+
| Virtual Machine | vm |
107+
| Vulnerability Scanning Recipe - Container | vss-recc |
108+
| Vulnerability Scanning Recipe - Host | vss-rech |
109+
| Vulnerability Scanning Target | vss-tgt |
110+
111+
&nbsp;
112+
# License
113+
114+
Copyright (c) 2023 Oracle and/or its affiliates.
115+
116+
Licensed under the Universal Permissive License (UPL), Version 1.0.
117+
118+
See [LICENSE](https://github.com/oracle-devrel/technology-engineering/blob/main/LICENSE) for more details.

‎landing-zones/commons/select_your_solution.pdf

163 KB
Binary file not shown.

‎landing-zones/commons/user_identity_management.md

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# USER IDENTITY MANAGEMENT
2+
3+
## 1. Introduction
4+
5+
Like in every environment, OCI has users who work with the platform or the services provisioned on it. For life cycle management these are often managed by dedicated user identity management platforms already in place at the customer's enterprise environment.
6+
7+
Depending on the role, each user (or persona) plays, different processes are used to maintain their status and permissions.
8+
9+
This pattern explains the personas and related processes.
10+
11+
Before you start, take into account these considerations:
12+
- Never share accounts between users.
13+
- Never share passwords between users.
14+
- Never create shared accounts for tenancy global administration.
15+
- Never trust your password.
16+
17+
&nbsp;
18+
## 2. User Personas
19+
20+
### 2.1 OCI Platform Administrator
21+
&nbsp;
22+
| TYPE | DESCRIPTION | USER TYPE | RESPONSIBILITIES | CAPABILITIES | LIFE CYCLE | OCI GROUP MEMBERSHIP | FEDERATED | DOMAIN |
23+
|---|---|---|---|---|---|---|---|---|
24+
| Emergency User | A dedicated group of users that are able to maintain the tenancy when nothing else works. | Human users only | - Not for daily business. <br> - Bootstrapping of Emergency Users, Federation, and Provisioning of Groups and Users. Initial Group and Policy Setup. <br>- Resolve operational issues which cannot be handled by other personas. <br>- Allowed user capabilities (sage of any user capability (apart from the local password) is prohibited! | Local password | Manual, documented process (see implementation example) | Administrators | No | Default
25+
Administrators | Dedicated groups of users to manage the OCI platform resources on a daily business. Groups for specific resource types should be used to implement proper segregation of duties. | Human users | - For daily business. <br> - Resource-specific groups to maintain OCI resources. | API Keys, Auth Keys, SMTP Credentials, Customer Secret Keys, OAuth 2.0 Client Credentials | Through user provisioning where the customer identity management system is the source of truth. | | Yes | Default |
26+
| CI/CD process | Dedicated group for automation of OCI resource management. | Non-human user | For daily business. Several CI/CD users are for distinct tasks, i.e., one for the common tenancy configuration, and one per OE, are possible. | API Keys | Through user provisioning where the customer identity management system is the source of truth. | DevOps group(s) | Yes | Default |
27+
| Auditors | A single dedicated group with read-only access to all OCI resources. | Human users<br> Non-human user | For daily business. | API Keys | Through user provisioning where the customer identity management system is the source of truth. | Auditors group | Yes | Default |
28+
&nbsp;
29+
&nbsp;
30+
31+
### 2.2 Workload User
32+
33+
| TYPE | DESCRIPTION | USER TYPE | LIFE CYCLE | OCI GROUP MEMBERSHIP | FEDERATED | DOMAIN |
34+
|---|---|---|---|---|---|---|
35+
| OS User | A user working in the VM as an OS user. Permissions are granted at the OS level. <br> *Not related to any OCI groups and policies.* | Root users <br>Human users | If possible, through user provisioning where customer identity management system is the source of truth. | N/A | Optional | Not required<br> Dedicated |
36+
| Database User | A user working in a database using a database schema user. Permissions are granted within the database. <br>*Not related to any OCI groups and policies.* | DBAs, Admin users<br>Schema users | If possible, through user provisioning where customer identity management system is the source of truth. | N/A | Optional | Not required<br> Dedicated |
37+
| Application User | A user working in an application. <br>*Not related to any OCI groups and policies.* | Application Administrators<br>Application Users<br>Backplane processes | If possible, through user provisioning where the customer identity management system is the source of truth. | N/A | Optional | Not required<br> Dedicated |
38+
| PaaS User | A user working in PaaS services. <br>*Not related to any OCI groups and policies.* | PaaS-related user types | If possible, through user provisioning where the customer identity management system is the source of truth. | N/A | Optional | Dedicated |
39+
40+
&nbsp;
41+
42+
## 3. Identity Federation
43+
44+
Identity Federation will be handled by the respective Identity Domain. Implementation steps depend on the product used by the customer and are listed in the OCI platform user guide:
45+
46+
- [SSO Between OCI Microsoft Azure](https://docs.oracle.com/en-us/iaas/Content/Identity/tutorials/azure_ad/sso_azure/azure_sso.htm)
47+
- [SSO With OCI and Okta](https://docs.oracle.com/en-us/iaas/Content/Identity/tutorials/okta/sso_okta/sso_okta.htm)
48+
- [Federating with Identity Providers](https://docs.oracle.com/en-us/iaas/Content/Identity/federating/federating_section.htm)
49+
50+
&nbsp;
51+
## 4. Identity Provisioning
52+
53+
Identity Provisioning is the sibling part of the Identity Federation setup. Identity Federation requires user identities that are provisioned by Identity Provisioning. This includes the whole life cycle of the process (joiners/movers/leavers). When a user access has been revoked (leavers/movers) the related user capabilities will be removed automatically.
54+
55+
Implementation Steps depend on the product used by the customer. It is highly recommended to use SCIM-based automation.
56+
57+
The OCI platform user guide provides detailed steps for these products:
58+
59+
- [Identity Lifecycle Management Between OCI IAM and Azure AD](https://docs.oracle.com/en-us/iaas/Content/Identity/tutorials/azure_ad/lifecycle_azure/azure_lifecycle.htm)
60+
- [Identity Lifecycle Management Between OCI and Okta](https://docs.oracle.com/en-us/iaas/Content/Identity/tutorials/okta/lifecycle_okta/okta-lifecycle.htm)
61+
62+
&nbsp;
63+
64+
## 5. Emergency or Break Glass Process
65+
66+
Emergency or Break Glass users are not intended for daily business but for rare emergency use cases when nothing else works anymore, i.e., no federation, no connectivity to third-party environments, etc. They are tenancy local users authenticated with multi-factor authentication (MFA) and adaptive security control.
67+
68+
This section will be updated soon.
69+
70+
&nbsp;
71+
&nbsp;
72+
73+
# License
74+
75+
Copyright (c) 2023 Oracle and/or its affiliates.
76+
77+
Licensed under the Universal Permissive License (UPL), Version 1.0.
78+
79+
See [LICENSE](https://github.com/oracle-devrel/technology-engineering/blob/main/LICENSE) for more details.

‎landing-zones/images/landing_zone_300.png

20.8 KB
Loading

‎landing-zones/images/lzf_standard.png

23 KB
Loading

‎landing-zones/images/lzf_tailored.png

24.1 KB
Loading

‎landing-zones/images/slz.png

8.13 KB
Loading

‎landing-zones/images/tlz.png

8.23 KB
Loading

0 commit comments

Comments
 (0)