204 lines
9.5 KiB
Terraform
204 lines
9.5 KiB
Terraform
|
data "oci_objectstorage_namespace" "relay" {
|
||
|
|
compartment_id = local.tenancy_ocid
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_objectstorage_bucket" "address_lists" {
|
||
|
|
compartment_id = local.compartment_id
|
||
|
|
namespace = data.oci_objectstorage_namespace.relay.namespace
|
||
|
|
name = "oci-l4-relay-address-lists"
|
||
|
|
access_type = "NoPublicAccess"
|
||
|
|
storage_tier = "Standard"
|
||
|
|
versioning = "Enabled"
|
||
|
|
freeform_tags = var.freeform_tags
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_objectstorage_object_lifecycle_policy" "address_lists" {
|
||
|
|
namespace = data.oci_objectstorage_namespace.relay.namespace
|
||
|
|
bucket = oci_objectstorage_bucket.address_lists.name
|
||
|
|
|
||
|
|
depends_on = [oci_identity_policy.address_list_lifecycle_service]
|
||
|
|
|
||
|
|
rules {
|
||
|
|
action = "DELETE"
|
||
|
|
is_enabled = true
|
||
|
|
name = "delete-web-allow-versions-after-30-days"
|
||
|
|
target = "objects"
|
||
|
|
time_amount = 30
|
||
|
|
time_unit = "DAYS"
|
||
|
|
|
||
|
|
object_name_filter {
|
||
|
|
inclusion_patterns = ["admission/v1/versions/*", "web-allow/v1/versions/*"]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
rules {
|
||
|
|
action = "DELETE"
|
||
|
|
is_enabled = true
|
||
|
|
name = "delete-smtp-deny-versions-after-30-days"
|
||
|
|
target = "objects"
|
||
|
|
time_amount = 30
|
||
|
|
time_unit = "DAYS"
|
||
|
|
|
||
|
|
object_name_filter {
|
||
|
|
inclusion_patterns = ["smtp-deny/v1/versions/*"]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
rules {
|
||
|
|
action = "DELETE"
|
||
|
|
is_enabled = true
|
||
|
|
name = "delete-previous-smtp-deny-current-versions-after-30-days"
|
||
|
|
target = "previous-object-versions"
|
||
|
|
time_amount = 30
|
||
|
|
time_unit = "DAYS"
|
||
|
|
|
||
|
|
object_name_filter {
|
||
|
|
inclusion_patterns = ["smtp-deny/v1/current.json.gz"]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
rules {
|
||
|
|
action = "DELETE"
|
||
|
|
is_enabled = true
|
||
|
|
name = "delete-previous-web-allow-current-versions-after-30-days"
|
||
|
|
target = "previous-object-versions"
|
||
|
|
time_amount = 30
|
||
|
|
time_unit = "DAYS"
|
||
|
|
|
||
|
|
object_name_filter {
|
||
|
|
inclusion_patterns = ["admission/v1/current.json.gz", "web-allow/v1/current.json.gz"]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
rules {
|
||
|
|
action = "ABORT"
|
||
|
|
is_enabled = true
|
||
|
|
name = "abort-incomplete-admission-uploads"
|
||
|
|
target = "multipart-uploads"
|
||
|
|
time_amount = 1
|
||
|
|
time_unit = "DAYS"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_policy" "address_list_lifecycle_service" {
|
||
|
|
compartment_id = local.tenancy_ocid
|
||
|
|
name = "oci-l4-relay-address-list-lifecycle"
|
||
|
|
description = "Allow the regional Object Storage service to enforce address-list retention"
|
||
|
|
statements = [
|
||
|
|
"Allow service objectstorage-${local.region} to manage object-family in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', any {request.permission = 'BUCKET_INSPECT', request.permission = 'BUCKET_READ', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_DELETE', request.permission = 'OBJECT_VERSION_DELETE'}}"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_dynamic_group" "address_list_readers" {
|
||
|
|
compartment_id = local.tenancy_ocid
|
||
|
|
name = "oci-l4-relay-address-list-readers"
|
||
|
|
description = "OCI L4 relay instances authorized to read validated address lists"
|
||
|
|
matching_rule = "ALL {instance.compartment.id = '${local.compartment_id}', tag.${oci_identity_tag_namespace.relay.name}.${oci_identity_tag.address_list_reader.name}.value = 'enabled'}"
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_policy" "address_list_readers" {
|
||
|
|
compartment_id = local.tenancy_ocid
|
||
|
|
name = "oci-l4-relay-address-list-readers"
|
||
|
|
description = "Allow relay instances to read validated address-list objects"
|
||
|
|
statements = [
|
||
|
|
"Allow dynamic-group ${oci_identity_dynamic_group.address_list_readers.name} to read objects in compartment id ${local.compartment_id} where target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}'"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_user" "admission_publisher" {
|
||
|
|
count = local.publisher_enabled ? 1 : 0
|
||
|
|
compartment_id = local.tenancy_ocid
|
||
|
|
name = "oci-l4-relay-admission-publisher"
|
||
|
|
description = "In-cluster Tier R web allow publisher"
|
||
|
|
email = local.publisher_email
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_group" "admission_publishers" {
|
||
|
|
count = local.publisher_enabled ? 1 : 0
|
||
|
|
compartment_id = local.tenancy_ocid
|
||
|
|
name = "oci-l4-relay-admission-publishers"
|
||
|
|
description = "Principals allowed to publish Tier R web allow bundles"
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_user_group_membership" "admission_publisher" {
|
||
|
|
count = local.publisher_enabled ? 1 : 0
|
||
|
|
group_id = oci_identity_group.admission_publishers[0].id
|
||
|
|
user_id = oci_identity_user.admission_publisher[0].id
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_api_key" "admission_publisher" {
|
||
|
|
count = local.publisher_enabled ? 1 : 0
|
||
|
|
user_id = oci_identity_user.admission_publisher[0].id
|
||
|
|
key_value = local.publisher_api_public_key
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_user_capabilities_management" "admission_publisher" {
|
||
|
|
count = local.publisher_enabled ? 1 : 0
|
||
|
|
user_id = oci_identity_user.admission_publisher[0].id
|
||
|
|
can_use_api_keys = true
|
||
|
|
can_use_auth_tokens = false
|
||
|
|
can_use_console_password = false
|
||
|
|
can_use_customer_secret_keys = false
|
||
|
|
can_use_smtp_credentials = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_policy" "admission_publisher" {
|
||
|
|
count = local.publisher_enabled ? 1 : 0
|
||
|
|
compartment_id = local.tenancy_ocid
|
||
|
|
name = "oci-l4-relay-admission-publisher"
|
||
|
|
description = "Allow dual publication during the web allow prefix migration"
|
||
|
|
statements = [
|
||
|
|
"Allow group ${oci_identity_group.admission_publishers[0].name} to manage objects in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', target.object.name = 'admission/v1/versions/*', any {request.permission = 'OBJECT_CREATE', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_READ'}}",
|
||
|
|
"Allow group ${oci_identity_group.admission_publishers[0].name} to manage objects in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', target.object.name = 'admission/v1/current.json.gz', any {request.permission = 'OBJECT_CREATE', request.permission = 'OBJECT_OVERWRITE', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_READ'}}",
|
||
|
|
"Allow group ${oci_identity_group.admission_publishers[0].name} to manage objects in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', target.object.name = 'web-allow/v1/versions/*', any {request.permission = 'OBJECT_CREATE', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_READ'}}",
|
||
|
|
"Allow group ${oci_identity_group.admission_publishers[0].name} to manage objects in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', target.object.name = 'web-allow/v1/current.json.gz', any {request.permission = 'OBJECT_CREATE', request.permission = 'OBJECT_OVERWRITE', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_READ'}}"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_user" "smtp_deny_publisher" {
|
||
|
|
count = local.smtp_deny_publisher_enabled ? 1 : 0
|
||
|
|
compartment_id = local.tenancy_ocid
|
||
|
|
name = "oci-l4-relay-smtp-deny-publisher"
|
||
|
|
description = "In-cluster transport-evidence SMTP deny publisher"
|
||
|
|
email = local.smtp_deny_publisher_email
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_group" "smtp_deny_publishers" {
|
||
|
|
count = local.smtp_deny_publisher_enabled ? 1 : 0
|
||
|
|
compartment_id = local.tenancy_ocid
|
||
|
|
name = "oci-l4-relay-smtp-deny-publishers"
|
||
|
|
description = "Principals allowed to publish SMTP deny bundles"
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_user_group_membership" "smtp_deny_publisher" {
|
||
|
|
count = local.smtp_deny_publisher_enabled ? 1 : 0
|
||
|
|
group_id = oci_identity_group.smtp_deny_publishers[0].id
|
||
|
|
user_id = oci_identity_user.smtp_deny_publisher[0].id
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_api_key" "smtp_deny_publisher" {
|
||
|
|
count = local.smtp_deny_publisher_enabled ? 1 : 0
|
||
|
|
user_id = oci_identity_user.smtp_deny_publisher[0].id
|
||
|
|
key_value = local.smtp_deny_publisher_api_public_key
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_user_capabilities_management" "smtp_deny_publisher" {
|
||
|
|
count = local.smtp_deny_publisher_enabled ? 1 : 0
|
||
|
|
user_id = oci_identity_user.smtp_deny_publisher[0].id
|
||
|
|
can_use_api_keys = true
|
||
|
|
can_use_auth_tokens = false
|
||
|
|
can_use_console_password = false
|
||
|
|
can_use_customer_secret_keys = false
|
||
|
|
can_use_smtp_credentials = false
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "oci_identity_policy" "smtp_deny_publisher" {
|
||
|
|
count = local.smtp_deny_publisher_enabled ? 1 : 0
|
||
|
|
compartment_id = local.tenancy_ocid
|
||
|
|
name = "oci-l4-relay-smtp-deny-publisher"
|
||
|
|
description = "Allow immutable SMTP deny versions and current-bundle promotion"
|
||
|
|
statements = [
|
||
|
|
"Allow group ${oci_identity_group.smtp_deny_publishers[0].name} to manage objects in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', target.object.name = 'smtp-deny/v1/versions/*', any {request.permission = 'OBJECT_CREATE', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_READ'}}",
|
||
|
|
"Allow group ${oci_identity_group.smtp_deny_publishers[0].name} to manage objects in compartment id ${local.compartment_id} where all {target.bucket.name = '${oci_objectstorage_bucket.address_lists.name}', target.object.name = '${var.smtp_deny_bundle_object}', any {request.permission = 'OBJECT_CREATE', request.permission = 'OBJECT_OVERWRITE', request.permission = 'OBJECT_INSPECT', request.permission = 'OBJECT_READ'}}"
|
||
|
|
]
|
||
|
|
}
|