ce7cb702218693d08ea6d83464d2457c9250027c

terraform/external/short/iam.tf

@@ -0,0 +1,67 @@
+data "vault_generic_secret" "public" {
+  path = "secret/short/public"
+}
+
+resource "oci_identity_user" "short" {
+  provider       = oci.home
+  compartment_id = local.tenancy
+  name           = "short"
+  description    = "Tier S IPsec reconciliation"
+  email          = data.vault_generic_secret.config.data["publisher_email"]
+}
+
+resource "oci_identity_group" "short" {
+  provider       = oci.home
+  compartment_id = local.tenancy
+  name           = "short"
+  description    = "Tier S IPsec reconciliation"
+}
+
+resource "oci_identity_user_group_membership" "short" {
+  provider = oci.home
+  user_id  = oci_identity_user.short.id
+  group_id = oci_identity_group.short.id
+}
+
+resource "oci_identity_api_key" "short" {
+  provider  = oci.home
+  user_id   = oci_identity_user.short.id
+  key_value = data.vault_generic_secret.public.data["public_key"]
+}
+
+resource "oci_identity_user_capabilities_management" "short" {
+  provider                     = oci.home
+  user_id                      = oci_identity_user.short.id
+  can_use_api_keys             = true
+  can_use_auth_tokens          = false
+  can_use_console_password     = false
+  can_use_customer_secret_keys = false
+  can_use_smtp_credentials     = false
+}
+
+resource "oci_identity_policy" "short" {
+  provider       = oci.home
+  compartment_id = local.tenancy
+  name           = "short"
+  description    = "Tier S controller owns CPE and IPsec within its compartment"
+  statements = [
+    "Allow group ${oci_identity_group.short.name} to manage cpes in compartment id ${oci_identity_compartment.ingress.id}",
+    "Allow group ${oci_identity_group.short.name} to manage ipsec-connections in compartment id ${oci_identity_compartment.ingress.id}",
+    "Allow group ${oci_identity_group.short.name} to use drgs in compartment id ${oci_identity_compartment.ingress.id}"
+  ]
+}
+
+resource "vault_kv_secret_v2" "cloud" {
+  mount = "secret"
+  name  = "short/cloud"
+  data_json = jsonencode({ config = jsonencode({
+    tenancy     = local.tenancy
+    user        = oci_identity_user.short.id
+    fingerprint = oci_identity_api_key.short.fingerprint
+    region      = var.region
+    compartment = oci_identity_compartment.ingress.id
+    drg         = oci_core_drg.ingress.id
+    address     = var.tunnel_address
+    network     = var.vcn_cidr
+  }) })
+}