Skip to content

Commit 3acfaac

Browse files
gargnipungarggargnipungarg
authored
Merge pull request #659 from VipulMascarenhas/update_ai_policies_2
Update AI Hub Policies
2 parents 711c63a + d6b0679 commit 3acfaac

File tree

9 files changed

+58
-32
lines changed

9 files changed

+58
-32
lines changed

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
4.0
1+
4.1

‎ai-hub/ai-document-converter/policies/terraform/model_deployment.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,9 @@ resource "oci_datascience_model_deployment" "ai_deployment" {
6868
freeform_tags = {
6969
"ai-hub-solution-name" = "PDF to markdown conversion"
7070
"ai_solution_playground_url" = "https://${oci_apigateway_gateway.ai_application_oci_apigateway_gateway.hostname}/"
71-
"ai_solution_mcp_endpoint" = "https://${oci_apigateway_gateway.ai_application_oci_apigateway_gateway.hostname}/mcp"
72-
"ai_solution_api_endpoint_list_apis" = "https://${oci_apigateway_gateway.ai_application_oci_apigateway_gateway.hostname}/api/convert"
71+
"ai_solution_mcp_endpoint" = "/predictWithResponseStream/mcp/"
72+
"ai_solution_api_endpoint" = "/predict/api/convert"
73+
"ai_solution_readme" = "https://github.com/oracle-samples/oci-data-science-ai-samples/blob/main/ai-hub/ai-document-converter/README.md"
7374
}
7475

7576
depends_on = [oci_identity_policy.ai_solution_policies]

‎ai-hub/ai-document-converter/policies/terraform/policies.tf‎

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,25 @@
11
resource "oci_identity_dynamic_group" "ai_solution_group" {
2+
count = use_existing_dynamic_group_and_policies ? 0 : 1
23
compartment_id = var.tenancy_ocid
34
description = "Dynamic Group for AI Solution"
45
name = "ai_solution_group-${random_string.randomstring.result}"
56
matching_rule = "any { all {resource.type='datasciencemodeldeployment',resource.compartment.id='${var.data_science_project_compartment_id}'}, all {resource.type='apigateway',resource.compartment.id='${var.compartment_id}'},all {resource.type='computecontainerinstance',resource.compartment.id='${var.vcn_compartment_id}'},all {resource.type='datasciencejobrun', resource.compartment.id='${var.data_science_project_compartment_id}'}}"
67
}
78

8-
locals {
9-
policies = [
10-
"allow service datascience to use virtual-network-family in compartment id ${var.vcn_compartment_id}",
11-
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group.name} to manage secret-family in compartment id ${var.vault_compartment_id}",
12-
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group.name} to use virtual-network-family in compartment id ${var.vcn_compartment_id}",
13-
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group.name} to use logging-family in compartment id ${var.log_compartment_id}",
14-
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group.name} to manage data-science-family in compartment id ${var.data_science_project_compartment_id}",
15-
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group.name} to manage generative-ai-family in tenancy",
16-
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group.name} to read repos in tenancy"
17-
]
18-
}
19-
209
resource "oci_identity_policy" "ai_solution_policies" {
10+
count = use_existing_dynamic_group_and_policies ? 0 : 1
2111
compartment_id = "${var.tenancy_ocid}"
2212
description = "Dynamic group policies for AI Solution"
2313
name = "ai_solution_policies-${random_string.randomstring.result}"
24-
statements = local.policies
14+
statements = [
15+
"allow service datascience to use virtual-network-family in compartment id ${var.vcn_compartment_id}",
16+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to manage secret-family in compartment id ${var.vault_compartment_id}",
17+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to use virtual-network-family in compartment id ${var.vcn_compartment_id}",
18+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to use logging-family in compartment id ${var.log_compartment_id}",
19+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to manage data-science-family in compartment id ${var.data_science_project_compartment_id}",
20+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to manage generative-ai-family in tenancy",
21+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to read repos in tenancy",
22+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to use objects in compartment id ${var.compartment_id}"
23+
]
2524
depends_on = [oci_identity_dynamic_group.ai_solution_group]
2625
}

‎ai-hub/ai-document-converter/policies/terraform/schema.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ variableGroups:
3131
variables:
3232
- compartment_id
3333
- availability_domain
34+
- use_existing_dynamic_group_and_policies
3435
- title: "Network"
3536
variables:
3637
- vcn_compartment_id
@@ -83,6 +84,12 @@ variables:
8384
description: The availability domain in which to create Compute resources.
8485
dependsOn:
8586
compartmentId: ${compartment_id}
87+
use_existing_dynamic_group_and_policies:
88+
type: boolean
89+
title: Use existing Dynamic Group and Policies
90+
required: true
91+
default: false
92+
description: If checked, the stack will not create additional Dynamic Group and Policies and expect required Dynamic Group and Policies to be present
8693
#Network Configuration
8794
vcn_compartment_id:
8895
type: oci:identity:compartment:id

‎ai-hub/ai-document-converter/policies/terraform/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,12 @@ variable "key_id" {
8686
default = "none"
8787
}
8888

89+
variable "use_existing_dynamic_group_and_policies" {
90+
type = bool
91+
description = "Use existing Dynamic Group and Policies"
92+
default = true
93+
}
94+
8995
# ------------------------- Environment variables required for Document Extraction Application ----------------------------- #
9096

9197
# The following variables will be used by deployment.

‎ai-hub/ai-translation/policies/terraform/model_deployment.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,9 @@ resource "oci_datascience_model_deployment" "ai_deployment" {
7272
freeform_tags = {
7373
"ai-hub-solution-name" = "LLM based translation"
7474
"ai_solution_playground_url" = "https://${oci_apigateway_gateway.ai_application_oci_apigateway_gateway.hostname}/"
75-
"ai_solution_mcp_endpoint" = "https://${oci_apigateway_gateway.ai_application_oci_apigateway_gateway.hostname}/mcp"
76-
"ai_solution_api_endpoint_list_apis" = "https://${oci_apigateway_gateway.ai_application_oci_apigateway_gateway.hostname}/api/translate"
75+
"ai_solution_mcp_endpoint" = "/predictWithResponseStream/mcp/"
76+
"ai_solution_api_endpoint" = "/predictWithResponseStream/api/translate"
77+
"ai_solution_readme" = "https://github.com/oracle-samples/oci-data-science-ai-samples/blob/main/ai-hub/ai-translation/README.md"
7778
}
7879

7980
}

‎ai-hub/ai-translation/policies/terraform/policies.tf‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,26 @@
11
resource "oci_identity_dynamic_group" "ai_solution_group" {
2+
count = use_existing_dynamic_group_and_policies ? 0 : 1
23
compartment_id = var.tenancy_ocid
34
description = "Dynamic Group for AI Solution"
45
name = "ai_solution_group-${random_string.randomstring.result}"
56
matching_rule = "any { all {resource.type='datasciencemodeldeployment',resource.compartment.id='${var.data_science_project_compartment_id}'}, all {resource.type='apigateway',resource.compartment.id='${var.compartment_ocid}'},all {resource.type='computecontainerinstance',resource.compartment.id='${var.vcn_compartment_id}'},all {resource.type='datasciencejobrun', resource.compartment.id='${var.data_science_project_compartment_id}'}}"
67
}
78

8-
locals {
9-
policies = [
10-
"allow service datascience to use virtual-network-family in compartment id ${var.vcn_compartment_id}",
11-
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group.name} to manage secret-family in compartment id ${var.vault_compartment_id}",
12-
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group.name} to use virtual-network-family in compartment id ${var.vcn_compartment_id}",
13-
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group.name} to use logging-family in compartment id ${var.log_compartment_id}",
14-
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group.name} to manage data-science-family in compartment id ${var.data_science_project_compartment_id}",
15-
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group.name} to manage generative-ai-family in tenancy",
16-
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group.name} to manage generative-ai-family in compartment id ${var.data_science_project_compartment_id}",
17-
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group.name} to read repos in tenancy"
18-
]
19-
}
20-
219
resource "oci_identity_policy" "ai_solution_policies" {
10+
count = use_existing_dynamic_group_and_policies ? 0 : 1
2211
compartment_id = "${var.tenancy_ocid}"
2312
description = "Dynamic group policies for AI Solution"
2413
name = "ai_solution_policies-${random_string.randomstring.result}"
25-
statements = local.policies
14+
statements = [
15+
"allow service datascience to use virtual-network-family in compartment id ${var.vcn_compartment_id}",
16+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to manage secret-family in compartment id ${var.vault_compartment_id}",
17+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to use virtual-network-family in compartment id ${var.vcn_compartment_id}",
18+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to use logging-family in compartment id ${var.log_compartment_id}",
19+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to manage data-science-family in compartment id ${var.data_science_project_compartment_id}",
20+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to manage generative-ai-family in tenancy",
21+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to manage generative-ai-family in compartment id ${var.data_science_project_compartment_id}",
22+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to read repos in tenancy",
23+
"allow dynamic-group ${oci_identity_dynamic_group.ai_solution_group[0].name} to use objects in compartment id ${var.compartment_ocid}"
24+
]
2625
depends_on = [oci_identity_dynamic_group.ai_solution_group]
2726
}

‎ai-hub/ai-translation/policies/terraform/schema.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ variableGroups:
2222
variables:
2323
- compartment_ocid
2424
- availability_domain
25+
- use_existing_dynamic_group_and_policies
2526
- data_science_project_compartment_id
2627
- project_ocid
2728
- log_compartment_id
@@ -116,6 +117,12 @@ variables:
116117
required: false
117118
title: Log OCID
118119
description: Log OCID.
120+
use_existing_dynamic_group_and_policies:
121+
type: boolean
122+
title: Use existing Dynamic Group and Policies
123+
required: true
124+
default: false
125+
description: If checked, the stack will not create additional Dynamic Group and Policies and expect required Dynamic Group and Policies to be present
119126
# Application
120127
data_science_project_compartment_id:
121128
type: oci:identity:compartment:id

‎ai-hub/ai-translation/policies/terraform/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,12 @@ variable "key_id" {
7777
default = "none"
7878
}
7979

80+
variable "use_existing_dynamic_group_and_policies" {
81+
type = bool
82+
description = "Use existing Dynamic Group and Policies"
83+
default = true
84+
}
85+
8086
variable "data_science_project_compartment_id" {
8187
description = "Compartment in which Data Science Project is present"
8288
type = string

0 commit comments

Comments
 (0)