generated from oracle-quickstart/oci-quickstart-template
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
make app_name and deploy_id autogenerated
- Loading branch information
1 parent
d562640
commit ba76cfe
Showing
8 changed files
with
114 additions
and
88 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,29 +1,29 @@ | ||
# Get compartment name for policy | ||
data "oci_identity_compartment" "oci_compartment" { | ||
id = var.compartment_ocid | ||
id = var.compartment_ocid | ||
} | ||
|
||
# Define the dynamic group | ||
resource "oci_identity_dynamic_group" "dyn_group" { | ||
provider = oci.home_region | ||
name = "${var.app_name}-instance-dg" | ||
provider = oci.home_region | ||
name = "${local.app_name}-instance-dg" | ||
description = "Dynamic group for OKE instances across the tenancy" | ||
compartment_id = var.tenancy_ocid | ||
matching_rule = "ALL {instance.compartment.id = '${var.compartment_ocid}'}" | ||
count = var.policy_creation_enabled ? 1 : 0 | ||
count = var.policy_creation_enabled ? 1 : 0 | ||
} | ||
|
||
# Define the IAM policy | ||
resource "oci_identity_policy" "oke_instances_tenancy_policy" { | ||
provider = oci.home_region | ||
name = "${var.app_name}-dg-inst-policy" | ||
name = "${local.app_name}-dg-inst-policy" | ||
description = "Tenancy-level policy to grant needed permissions to the dynamic group" | ||
compartment_id = var.tenancy_ocid | ||
|
||
statements = [ | ||
"Allow dynamic-group 'Default'/'${oci_identity_dynamic_group.dyn_group[0].name}' to manage all-resources in compartment ${data.oci_identity_compartment.oci_compartment.name}", | ||
"Allow dynamic-group 'Default'/'${oci_identity_dynamic_group.dyn_group[0].name}' to use all-resources in tenancy", | ||
] | ||
count = var.policy_creation_enabled ? 1 : 0 | ||
count = var.policy_creation_enabled ? 1 : 0 | ||
depends_on = [oci_identity_dynamic_group.dyn_group] | ||
} |
Oops, something went wrong.