67 lines
2.2 KiB
HCL
67 lines
2.2 KiB
HCL
data "vault_generic_secret" "public" {
|
|
path = "secret/short/public"
|
|
}
|
|
|
|
resource "oci_identity_user" "short" {
|
|
provider = oci.home
|
|
compartment_id = local.tenancy
|
|
name = "short"
|
|
description = "Tier S IPsec reconciliation"
|
|
email = data.vault_generic_secret.config.data["publisher_email"]
|
|
}
|
|
|
|
resource "oci_identity_group" "short" {
|
|
provider = oci.home
|
|
compartment_id = local.tenancy
|
|
name = "short"
|
|
description = "Tier S IPsec reconciliation"
|
|
}
|
|
|
|
resource "oci_identity_user_group_membership" "short" {
|
|
provider = oci.home
|
|
user_id = oci_identity_user.short.id
|
|
group_id = oci_identity_group.short.id
|
|
}
|
|
|
|
resource "oci_identity_api_key" "short" {
|
|
provider = oci.home
|
|
user_id = oci_identity_user.short.id
|
|
key_value = data.vault_generic_secret.public.data["public_key"]
|
|
}
|
|
|
|
resource "oci_identity_user_capabilities_management" "short" {
|
|
provider = oci.home
|
|
user_id = oci_identity_user.short.id
|
|
can_use_api_keys = true
|
|
can_use_auth_tokens = false
|
|
can_use_console_password = false
|
|
can_use_customer_secret_keys = false
|
|
can_use_smtp_credentials = false
|
|
}
|
|
|
|
resource "oci_identity_policy" "short" {
|
|
provider = oci.home
|
|
compartment_id = local.tenancy
|
|
name = "short"
|
|
description = "Tier S controller owns CPE and IPsec within its compartment"
|
|
statements = [
|
|
"Allow group ${oci_identity_group.short.name} to manage cpes in compartment id ${oci_identity_compartment.ingress.id}",
|
|
"Allow group ${oci_identity_group.short.name} to manage ipsec-connections in compartment id ${oci_identity_compartment.ingress.id}",
|
|
"Allow group ${oci_identity_group.short.name} to use drgs in compartment id ${oci_identity_compartment.ingress.id}"
|
|
]
|
|
}
|
|
|
|
resource "vault_kv_secret_v2" "cloud" {
|
|
mount = "secret"
|
|
name = "short/cloud"
|
|
data_json = jsonencode({ config = jsonencode({
|
|
tenancy = local.tenancy
|
|
user = oci_identity_user.short.id
|
|
fingerprint = oci_identity_api_key.short.fingerprint
|
|
region = var.region
|
|
compartment = oci_identity_compartment.ingress.id
|
|
drg = oci_core_drg.ingress.id
|
|
address = var.tunnel_address
|
|
network = var.vcn_cidr
|
|
}) })
|
|
}
|