ce7cb702218693d08ea6d83464d2457c9250027c

terraform/external/oci-relay/wan-controller.tf

@@ -0,0 +1,40 @@
+resource "oci_identity_user" "wan_controller" {
+  compartment_id = local.tenancy_ocid
+  name           = "oci-l4-relay-wan-controller"
+  description    = "In-cluster controller for the relay WireGuard NSG source"
+  email          = local.publisher_email
+}
+
+resource "oci_identity_group" "wan_controllers" {
+  compartment_id = local.tenancy_ocid
+  name           = "oci-l4-relay-wan-controllers"
+  description    = "Principals allowed to update relay NSG security rules"
+}
+
+resource "oci_identity_user_group_membership" "wan_controller" {
+  group_id = oci_identity_group.wan_controllers.id
+  user_id  = oci_identity_user.wan_controller.id
+}
+
+resource "oci_identity_api_key" "wan_controller" {
+  user_id   = oci_identity_user.wan_controller.id
+  key_value = local.wan_controller_public_key
+}
+
+resource "oci_identity_user_capabilities_management" "wan_controller" {
+  user_id                      = oci_identity_user.wan_controller.id
+  can_use_api_keys             = true
+  can_use_auth_tokens          = false
+  can_use_console_password     = false
+  can_use_customer_secret_keys = false
+  can_use_smtp_credentials     = false
+}
+
+resource "oci_identity_policy" "wan_controller" {
+  compartment_id = local.tenancy_ocid
+  name           = "oci-l4-relay-wan-controller"
+  description    = "Allow the WAN controller to update NSG rules in the relay compartment"
+  statements = [
+    "Allow group ${oci_identity_group.wan_controllers.name} to manage network-security-groups in compartment id ${local.compartment_id} where request.operation = 'UpdateNetworkSecurityGroupSecurityRules'"
+  ]
+}