Skip to content

Commit 87d0644

Browse files
parkerjohnsparkerjohns
authored
Add files via upload
1 parent 1976a94 commit 87d0644

File tree

7 files changed

+257
-0
lines changed

7 files changed

+257
-0
lines changed

‎datasources.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
data "oci_identity_tenancy" "tenancy" {
2+
tenancy_id = var.tenancy_ocid
3+
}
4+
5+
data "oci_identity_regions" "regions" {
6+
}
7+
8+
data "oci_objectstorage_namespace" "objectstorage_namespace" {
9+
}
10+
11+
data "oci_identity_region_subscriptions" "region_subscriptions" {
12+
tenancy_id = var.tenancy_ocid
13+
filter {
14+
name = "region_name"
15+
values = [var.region]
16+
}
17+
}

‎identity.tf‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
## Copyright © 2021, Oracle and/or its affiliates.
2+
## All rights reserved. The Universal Permissive License (UPL), Version 1.0 as shown at http://oss.oracle.com/licenses/upl
3+
4+
resource "oci_identity_compartment" "Migration" {
5+
provider = oci.homeregion
6+
name = "Migration"
7+
description = "Compartment for OCM resources."
8+
compartment_id = var.tenancy_ocid
9+
enable_delete = false
10+
}
11+
resource "oci_identity_compartment" "MigrationSecrets" {
12+
provider = oci.homeregion
13+
name = "MigrationSecrets"
14+
description = "Compartment for OCM secrets."
15+
compartment_id = var.tenancy_ocid
16+
enable_delete = false
17+
}
18+
19+
resource "oci_identity_dynamic_group" "MigrationDynamicGroup" {
20+
provider = oci.homeregion
21+
name = "MigrationDynamicGroup"
22+
description = "All ocmmigration resource types in the ${oci_identity_compartment.Migration.name} compartment."
23+
compartment_id = var.tenancy_ocid
24+
matching_rule = "All { resource.type = 'ocmmigration', resource.compartment.id = '${oci_identity_compartment.Migration.id}' }"
25+
}
26+
27+
resource "oci_identity_dynamic_group" "RemoteAgentDynamicGroup" {
28+
provider = oci.homeregion
29+
name = "RemoteAgentDynamicGroup"
30+
description = "All ocbagent resource types."
31+
compartment_id = var.tenancy_ocid
32+
matching_rule = "Any { resource.type = 'ocbagent' }"
33+
}
34+
35+
resource "oci_identity_dynamic_group" "DiscoveryPluginDynamicGroup" {
36+
provider = oci.homeregion
37+
name = "DiscoveryPluginDynamicGroup"
38+
description = "All ocbagent resource types."
39+
compartment_id = var.tenancy_ocid
40+
matching_rule = "Any { resource.type = 'ocbagent' }"
41+
}
42+
43+
resource "oci_identity_dynamic_group" "ReplicationPluginDynamicGroup" {
44+
provider = oci.homeregion
45+
name = "ReplicationPluginDynamicGroup"
46+
description = "All ocbagent resource types."
47+
compartment_id = var.tenancy_ocid
48+
matching_rule = "Any { resource.type = 'ocbagent' }"
49+
}
50+
51+
resource "oci_identity_dynamic_group" "HydrationAgentDynamicGroup" {
52+
provider = oci.homeregion
53+
name = "HydrationAgentDynamicGroup"
54+
description = "All all instances in the ${oci_identity_compartment.Migration.name} compartment."
55+
compartment_id = var.tenancy_ocid
56+
matching_rule = "ALL { instance.compartment.id = '${oci_identity_compartment.Migration.id}'}"
57+
}
58+
59+
resource "oci_identity_policy" "MigrationServicePolicy" {
60+
provider = oci.homeregion
61+
name = "MigrationServicePolicy"
62+
description = "MigrationServicePolicy"
63+
compartment_id = var.tenancy_ocid
64+
statements = [
65+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} to manage instance-family in compartment ${oci_identity_compartment.Migration.name}",
66+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} to manage compute-image-capability-schema in compartment ${oci_identity_compartment.Migration.name}",
67+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} to manage virtual-network-family in compartment ${oci_identity_compartment.Migration.name}",
68+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} to manage volume-family in compartment ${oci_identity_compartment.Migration.name}",
69+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} to manage object-family in compartment ${oci_identity_compartment.Migration.name}",
70+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} to read ocb-inventory in tenancy",
71+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} to read ocb-inventory-asset in compartment ${oci_identity_compartment.Migration.name}",
72+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} { OCB_CONNECTOR_READ, OCB_CONNECTOR_DATA_READ, OCB_ASSET_SOURCE_READ, OCB_ASSET_SOURCE_CONNECTOR_DATA_UPDATE } in compartment ${oci_identity_compartment.Migration.name}",
73+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} { INSTANCE_IMAGE_INSPECT, INSTANCE_IMAGE_READ } in tenancy",
74+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} { INSTANCE_INSPECT } in tenancy where any { request.operation='ListShapes' }",
75+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} { DEDICATED_VM_HOST_READ } in tenancy where any { request.operation='GetDedicatedVmHost' }",
76+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} { CAPACITY_RESERVATION_READ } in tenancy where any { request.operation='GetComputeCapacityReservation' }",
77+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} { ORGANIZATIONS_SUBSCRIPTION_INSPECT } in tenancy where any { request.operation='ListSubscriptions' }",
78+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} to read rate-cards in tenancy",
79+
"Allow dynamic-group ${oci_identity_dynamic_group.MigrationDynamicGroup.name} to use metrics in tenancy where target.metrics.namespace='ocb_asset'"
80+
81+
]
82+
}
83+
84+
resource "oci_identity_policy" "RemoteAgentPolicy" {
85+
provider = oci.homeregion
86+
name = "RemoteAgentPolicy"
87+
description = "RemoteAgentPolicy"
88+
compartment_id = var.tenancy_ocid
89+
statements = [
90+
"Allow dynamic-group ${oci_identity_dynamic_group.RemoteAgentDynamicGroup.name} to manage buckets in compartment ${oci_identity_compartment.Migration.name}",
91+
"Allow dynamic-group ${oci_identity_dynamic_group.RemoteAgentDynamicGroup.name} to manage object-family in compartment ${oci_identity_compartment.Migration.name}",
92+
"Allow dynamic-group ${oci_identity_dynamic_group.RemoteAgentDynamicGroup.name} { OCM_REPLICATION_TASK_READ, OCM_REPLICATION_TASK_UPDATE } in compartment ${oci_identity_compartment.Migration.name}",
93+
"Allow dynamic-group ${oci_identity_dynamic_group.RemoteAgentDynamicGroup.name} to use ocb-asset-source-connectors in compartment ${oci_identity_compartment.Migration.name}",
94+
"Allow dynamic-group ${oci_identity_dynamic_group.RemoteAgentDynamicGroup.name} to use ocb-connectors in compartment ${oci_identity_compartment.Migration.name}",
95+
"Allow dynamic-group ${oci_identity_dynamic_group.RemoteAgentDynamicGroup.name} to manage ocb-inventory in tenancy",
96+
"Allow dynamic-group ${oci_identity_dynamic_group.RemoteAgentDynamicGroup.name} to manage ocb-inventory-asset in compartment ${oci_identity_compartment.Migration.name}",
97+
"Allow dynamic-group ${oci_identity_dynamic_group.RemoteAgentDynamicGroup.name} to read secret-family in compartment ${oci_identity_compartment.MigrationSecrets.name}",
98+
"Allow dynamic-group ${oci_identity_dynamic_group.RemoteAgentDynamicGroup.name} to use metrics in compartment ${oci_identity_compartment.Migration.name} where target.metrics.namespace='ocb_asset'",
99+
"Allow dynamic-group ${oci_identity_dynamic_group.RemoteAgentDynamicGroup.name} to {OCM_CONNECTOR_INSPECT, OCM_ASSET_SOURCE_READ, OCM_ASSET_SOURCE_CONNECTION_PUSH} in compartment ${oci_identity_compartment.Migration.name}",
100+
"Allow dynamic-group ${oci_identity_dynamic_group.RemoteAgentDynamicGroup.name} to {OCB_AGENT_INSPECT, OCB_AGENT_SYNC, OCB_AGENT_READ, OCB_AGENT_DEPENDENCY_INSPECT, OCB_AGENT_DEPENDENCY_READ, OCB_AGENT_KEY_UPDATE, OCB_AGENT_TASK_READ, OCB_AGENT_ASSET_SOURCES_INSPECT, OCB_AGENT_TASK_UPDATE} in compartment ${oci_identity_compartment.Migration.name}",
101+
"Allow dynamic-group ${oci_identity_dynamic_group.RemoteAgentDynamicGroup.name} to {OCB_ASSET_SOURCE_INSPECT, OCB_ASSET_SOURCE_READ, OCB_ASSET_SOURCE_ASSET_HANDLES_PUSH, OCB_ASSET_SOURCE_CONNECTION_PUSH} in compartment ${oci_identity_compartment.Migration.name}"
102+
103+
]
104+
}
105+
106+
resource "oci_identity_policy" "DiscoveryPluginPolicy" {
107+
provider = oci.homeregion
108+
name = "DiscoveryPluginPolicy"
109+
description = "DiscoveryPluginPolicy"
110+
compartment_id = var.tenancy_ocid
111+
statements = [
112+
"Allow dynamic-group ${oci_identity_dynamic_group.DiscoveryPluginDynamicGroup.name} to use ocb-connectors in compartment ${oci_identity_compartment.Migration.name}",
113+
"Allow dynamic-group ${oci_identity_dynamic_group.DiscoveryPluginDynamicGroup.name} to use ocb-asset-source-connectors in compartment ${oci_identity_compartment.Migration.name}",
114+
"Allow dynamic-group ${oci_identity_dynamic_group.DiscoveryPluginDynamicGroup.name} to read ocb-inventory in tenancy",
115+
"Allow dynamic-group ${oci_identity_dynamic_group.DiscoveryPluginDynamicGroup.name} to manage ocb-inventory-asset in compartment ${oci_identity_compartment.Migration.name}",
116+
"Allow dynamic-group ${oci_identity_dynamic_group.DiscoveryPluginDynamicGroup.name} to read secret-family in compartment ${oci_identity_compartment.MigrationSecrets.name}",
117+
"Allow dynamic-group ${oci_identity_dynamic_group.DiscoveryPluginDynamicGroup.name} to use metrics in compartment ${oci_identity_compartment.Migration.name} where target.metrics.namespace='ocb_asset'"
118+
]
119+
}
120+
121+
resource "oci_identity_policy" "ReplicationPluginPolicy" {
122+
provider = oci.homeregion
123+
name = "ReplicationPluginPolicy"
124+
description = "ReplicationPluginPolicy"
125+
compartment_id = var.tenancy_ocid
126+
statements = [
127+
"Allow dynamic-group ${oci_identity_dynamic_group.ReplicationPluginDynamicGroup.name} to { OCB_AGENT_INSPECT, OCB_AGENT_SYNC, OCB_AGENT_READ, OCB_AGENT_DEPENDENCY_INSPECT, OCB_AGENT_DEPENDENCY_READ, OCB_AGENT_KEY_UPDATE, OCB_AGENT_TASK_READ, OCB_AGENT_ASSET_SOURCES_INSPECT, OCB_AGENT_TASK_UPDATE } in tenancy",
128+
"Allow dynamic-group ${oci_identity_dynamic_group.ReplicationPluginDynamicGroup.name} to { OCM_REPLICATION_TASK_INSPECT, OCM_REPLICATION_TASK_READ, OCM_REPLICATION_TASK_UPDATE, OCM_CONNECTOR_INSPECT, OCM_ASSET_SOURCE_READ, OCM_ASSET_SOURCE_CONNECTION_PUSH } in compartment ${oci_identity_compartment.Migration.name}",
129+
"Allow dynamic-group ${oci_identity_dynamic_group.ReplicationPluginDynamicGroup.name} to { BUCKET_INSPECT, BUCKET_READ, OBJECTSTORAGE_NAMESPACE_READ, OBJECT_CREATE, OBJECT_DELETE, OBJECT_INSPECT, OBJECT_OVERWRITE, OBJECT_READ } in compartment ${oci_identity_compartment.Migration.name} where all { target.bucket.name='${oci_objectstorage_bucket.ReplicationBucket.name}' }",
130+
"Allow dynamic-group ${oci_identity_dynamic_group.ReplicationPluginDynamicGroup.name} to use ocb-connectors in compartment ${oci_identity_compartment.Migration.name}",
131+
"Allow dynamic-group ${oci_identity_dynamic_group.ReplicationPluginDynamicGroup.name} to use ocb-asset-source-connectors in compartment ${oci_identity_compartment.Migration.name}",
132+
"Allow dynamic-group ${oci_identity_dynamic_group.ReplicationPluginDynamicGroup.name} to manage ocb-inventory in tenancy",
133+
"Allow dynamic-group ${oci_identity_dynamic_group.ReplicationPluginDynamicGroup.name} to manage ocb-inventory-asset in compartment ${oci_identity_compartment.Migration.name}",
134+
"Allow dynamic-group ${oci_identity_dynamic_group.ReplicationPluginDynamicGroup.name} to read secret-family in compartment ${oci_identity_compartment.MigrationSecrets.name}",
135+
"Allow dynamic-group ${oci_identity_dynamic_group.ReplicationPluginDynamicGroup.name} to use metrics in compartment ${oci_identity_compartment.Migration.name} where target.metrics.namespace='ocb_asset'"
136+
137+
]
138+
}
139+
140+
resource "oci_identity_policy" "DiscoveryServicePolicy" {
141+
provider = oci.homeregion
142+
name = "DiscoveryServicePolicy"
143+
description = "DiscoveryServicePolicy"
144+
compartment_id = var.tenancy_ocid
145+
statements = [
146+
"Allow service ocb-discovery to read ocb-environment in compartment ${oci_identity_compartment.Migration.name}",
147+
"Allow service ocb-discovery to read ocb-agents in compartment ${oci_identity_compartment.Migration.name}",
148+
"Allow service ocb-discovery to read ocb-inventory in tenancy",
149+
"Allow service ocb-discovery to manage ocb-inventory-asset in compartment ${oci_identity_compartment.Migration.name}",
150+
"Allow service ocb-discovery to { TENANCY_INSPECT } in tenancy"
151+
]
152+
}
153+
154+
resource "oci_identity_policy" "HydrationAgentPolicy" {
155+
provider = oci.homeregion
156+
name = "HydrationAgentPolicy"
157+
description = "HydrationAgentPolicy"
158+
compartment_id = var.tenancy_ocid
159+
statements = [
160+
"Allow dynamic-group ${oci_identity_dynamic_group.HydrationAgentDynamicGroup.name} to { OCM_HYDRATION_AGENT_TASK_INSPECT, OCM_HYDRATION_AGENT_TASK_UPDATE, OCM_HYDRATION_AGENT_REPORT_STATUS } in compartment ${oci_identity_compartment.Migration.name}",
161+
"Allow dynamic-group ${oci_identity_dynamic_group.HydrationAgentDynamicGroup.name} to read objects in compartment ${oci_identity_compartment.Migration.name}"
162+
]
163+
}
164+

‎object_storage.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
resource "oci_objectstorage_bucket" "ReplicationBucket" {
2+
compartment_id = oci_identity_compartment.Migration.id
3+
name = var.replication_bucket
4+
namespace = data.oci_objectstorage_namespace.objectstorage_namespace.namespace
5+
}

‎provider.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
provider "oci" {
2+
tenancy_ocid = var.tenancy_ocid
3+
user_ocid = var.user_ocid
4+
fingerprint = var.fingerprint
5+
private_key_path = var.private_key_path
6+
region = var.region
7+
}
8+
9+
# ## Required for IAM resource creation. IAM resource must be created in the tenancy home region.
10+
provider "oci" {
11+
alias = "homeregion"
12+
tenancy_ocid = var.tenancy_ocid
13+
user_ocid = var.user_ocid
14+
fingerprint = var.fingerprint
15+
private_key_path = var.private_key_path
16+
region = local.home_region
17+
}
18+
19+
locals {
20+
region_map = {
21+
for r in data.oci_identity_regions.regions.regions :
22+
r.key => r.name
23+
}
24+
25+
home_region = lookup(local.region_map, data.oci_identity_tenancy.tenancy.home_region_key)
26+
}

‎service_logging_oc1.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
resource "oci_identity_policy" "HydrationAgentLoggingPolicy" {
2+
provider = oci.homeregion
3+
name = "HydrationAgentLoggingPolicy"
4+
description = "HydrationAgentLoggingPolicy"
5+
compartment_id = var.tenancy_ocid
6+
statements = [
7+
"Define tenancy OCM-SERVICE AS ocid1.tenancy.oc1..aaaaaaaartv6j5muce2s4djz7rvfn2vwceq3cnue33d72isntnlfmi7huv7q",
8+
"Endorse dynamic-group ${oci_identity_dynamic_group.HydrationAgentDynamicGroup.name} to { OBJECT_CREATE } in tenancy OCM-SERVICE where all { target.bucket.name = '${var.tenancy_ocid}' }"
9+
]
10+
}
11+
12+
resource "oci_identity_policy" "RemoteAgentLoggingPolicy" {
13+
provider = oci.homeregion
14+
name = "RemoteAgentLoggingPolicy"
15+
description = "RemoteAgentLoggingPolicy"
16+
compartment_id = var.tenancy_ocid
17+
statements = [
18+
"Define tenancy OCB-SERVICE as ocid1.tenancy.oc1..aaaaaaaahr2xcduf4knzkzhkzt442t66bpqt3aazss6cy2ll6x4xj3ci7tiq",
19+
"Endorse dynamic-group ${oci_identity_dynamic_group.RemoteAgentDynamicGroup.name} to { OBJECT_CREATE } in tenancy OCB-SERVICE"
20+
]
21+
}

‎variables.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
variable "tenancy_ocid" {}
2+
variable "user_ocid" {}
3+
variable "fingerprint" {}
4+
variable "private_key_path" {}
5+
variable "region" {}
6+
7+
variable "replication_bucket" {
8+
default = "ocm_replication"
9+
}

‎vault.tf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
resource "oci_kms_vault" "OCMSecrets" {
2+
display_name = "OCMSecrets"
3+
compartment_id = oci_identity_compartment.MigrationSecrets.id
4+
vault_type = "DEFAULT"
5+
}
6+
7+
resource "oci_kms_key" "MainKey" {
8+
compartment_id = oci_identity_compartment.MigrationSecrets.id
9+
display_name = "MainKey"
10+
key_shape {
11+
algorithm = "AES"
12+
length = "32"
13+
}
14+
management_endpoint = oci_kms_vault.OCMSecrets.management_endpoint
15+
}

0 commit comments

Comments
 (0)