40 lines
1.5 KiB
HCL
40 lines
1.5 KiB
HCL
resource "oci_identity_user" "wan_controller" {
|
|
compartment_id = local.tenancy_ocid
|
|
name = "oci-l4-relay-wan-controller"
|
|
description = "In-cluster controller for the relay WireGuard NSG source"
|
|
email = local.publisher_email
|
|
}
|
|
|
|
resource "oci_identity_group" "wan_controllers" {
|
|
compartment_id = local.tenancy_ocid
|
|
name = "oci-l4-relay-wan-controllers"
|
|
description = "Principals allowed to update relay NSG security rules"
|
|
}
|
|
|
|
resource "oci_identity_user_group_membership" "wan_controller" {
|
|
group_id = oci_identity_group.wan_controllers.id
|
|
user_id = oci_identity_user.wan_controller.id
|
|
}
|
|
|
|
resource "oci_identity_api_key" "wan_controller" {
|
|
user_id = oci_identity_user.wan_controller.id
|
|
key_value = local.wan_controller_public_key
|
|
}
|
|
|
|
resource "oci_identity_user_capabilities_management" "wan_controller" {
|
|
user_id = oci_identity_user.wan_controller.id
|
|
can_use_api_keys = true
|
|
can_use_auth_tokens = false
|
|
can_use_console_password = false
|
|
can_use_customer_secret_keys = false
|
|
can_use_smtp_credentials = false
|
|
}
|
|
|
|
resource "oci_identity_policy" "wan_controller" {
|
|
compartment_id = local.tenancy_ocid
|
|
name = "oci-l4-relay-wan-controller"
|
|
description = "Allow the WAN controller to update NSG rules in the relay compartment"
|
|
statements = [
|
|
"Allow group ${oci_identity_group.wan_controllers.name} to manage network-security-groups in compartment id ${local.compartment_id} where request.operation = 'UpdateNetworkSecurityGroupSecurityRules'"
|
|
]
|
|
}
|