-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathfunctions-policies.tf
80 lines (69 loc) · 3.37 KB
/
functions-policies.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
## Copyright (c) 2021, Oracle and/or its affiliates.
## All rights reserved. The Universal Permissive License (UPL), Version 1.0 as shown at http://oss.oracle.com/licenses/upl
# Functions Policies
resource "oci_identity_policy" "faas_read_repos_tenancy_policy" {
provider = oci.home_region
name = "${var.app_name}-faas-read-repos-tenancy-policy-${random_id.tag.hex}"
description = "${var.app_name}-faas-read-repos-tenancy-policy-${random_id.tag.hex}"
compartment_id = var.tenancy_ocid
statements = ["Allow service FaaS to read repos in tenancy"]
provisioner "local-exec" {
command = "sleep 5"
}
}
resource "oci_identity_policy" "admin_manage_function_family_policy" {
provider = oci.home_region
depends_on = [oci_identity_policy.faas_read_repos_tenancy_policy]
name = "${var.app_name}-admin-manage-function-family-policy-${random_id.tag.hex}"
description = "${var.app_name}-admin-manage-function-family-policy-${random_id.tag.hex}"
compartment_id = var.compartment_ocid
statements = ["Allow group Administrators to manage functions-family in compartment id ${var.compartment_ocid}",
"Allow group Administrators to read metrics in compartment id ${var.compartment_ocid}"]
provisioner "local-exec" {
command = "sleep 5"
}
}
resource "oci_identity_policy" "admin_use_vcn_family_policy" {
provider = oci.home_region
depends_on = [oci_identity_policy.admin_manage_function_family_policy]
name = "${var.app_name}-admin-use-vcn-family-policy-${random_id.tag.hex}"
description = "${var.app_name}-admin-use-vcn-family-policy-${random_id.tag.hex}"
compartment_id = var.compartment_ocid
statements = ["Allow group Administrators to use virtual-network-family in compartment id ${var.compartment_ocid}"]
provisioner "local-exec" {
command = "sleep 5"
}
}
resource "oci_identity_policy" "faas_use_vcn_family_policy" {
provider = oci.home_region
depends_on = [oci_identity_policy.admin_use_vcn_family_policy]
name = "${var.app_name}-faas-use-vcn-family-policy-${random_id.tag.hex}"
description = "${var.app_name}-faas-use-vcn-family-policy-${random_id.tag.hex}"
compartment_id = var.tenancy_ocid
statements = ["Allow service FaaS to use virtual-network-family in compartment id ${var.compartment_ocid}"]
provisioner "local-exec" {
command = "sleep 5"
}
}
resource "oci_identity_dynamic_group" "faas_dg" {
provider = oci.home_region
depends_on = [oci_identity_policy.faas_use_vcn_family_policy]
name = "${var.app_name}-faas-dg-${random_id.tag.hex}"
description = "${var.app_name}-faas-dg-${random_id.tag.hex}"
compartment_id = var.tenancy_ocid
matching_rule = "ALL {resource.type = 'fnfunc', resource.compartment.id = '${var.compartment_ocid}'}"
provisioner "local-exec" {
command = "sleep 5"
}
}
resource "oci_identity_policy" "faas_dg_policy" {
provider = oci.home_region
depends_on = [oci_identity_dynamic_group.faas_dg]
name = "${var.app_name}-faas-dg-policy-${random_id.tag.hex}"
description = "${var.app_name}-faas-dg-policy-${random_id.tag.hex}"
compartment_id = var.compartment_ocid
statements = ["allow dynamic-group ${oci_identity_dynamic_group.faas_dg.name} to manage all-resources in compartment id ${var.compartment_ocid}"]
provisioner "local-exec" {
command = "sleep 5"
}
}