A-Team Security — Infrastructure & Security Agent Engineer v1.1

terraform/network.tf

@@ -0,0 +1,189 @@
+# -----------------------------------------------------------------------------
+# VCN
+# -----------------------------------------------------------------------------
+resource "oci_core_vcn" "main" {
+  compartment_id = var.compartment_ocid
+  cidr_blocks    = [var.vcn_cidr]
+  display_name   = "cisagent-vcn"
+  dns_label      = "cisagent"
+  freeform_tags  = var.freeform_tags
+}
+
+# -----------------------------------------------------------------------------
+# Gateways
+# -----------------------------------------------------------------------------
+resource "oci_core_internet_gateway" "main" {
+  compartment_id = var.compartment_ocid
+  vcn_id         = oci_core_vcn.main.id
+  display_name   = "cisagent-igw"
+  enabled        = true
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_core_nat_gateway" "main" {
+  compartment_id = var.compartment_ocid
+  vcn_id         = oci_core_vcn.main.id
+  display_name   = "cisagent-natgw"
+  freeform_tags  = var.freeform_tags
+}
+
+data "oci_core_services" "all" {
+  filter {
+    name   = "name"
+    values = ["All .* Services In Oracle Services Network"]
+    regex  = true
+  }
+}
+
+resource "oci_core_service_gateway" "main" {
+  compartment_id = var.compartment_ocid
+  vcn_id         = oci_core_vcn.main.id
+  display_name   = "cisagent-svcgw"
+
+  services {
+    service_id = data.oci_core_services.all.services[0].id
+  }
+
+  freeform_tags = var.freeform_tags
+}
+
+# -----------------------------------------------------------------------------
+# Route Tables
+# -----------------------------------------------------------------------------
+resource "oci_core_route_table" "public" {
+  compartment_id = var.compartment_ocid
+  vcn_id         = oci_core_vcn.main.id
+  display_name   = "cisagent-public-rt"
+  freeform_tags  = var.freeform_tags
+
+  route_rules {
+    network_entity_id = oci_core_internet_gateway.main.id
+    destination       = "0.0.0.0/0"
+    destination_type  = "CIDR_BLOCK"
+  }
+}
+
+resource "oci_core_route_table" "private" {
+  compartment_id = var.compartment_ocid
+  vcn_id         = oci_core_vcn.main.id
+  display_name   = "cisagent-private-rt"
+  freeform_tags  = var.freeform_tags
+
+  route_rules {
+    network_entity_id = oci_core_nat_gateway.main.id
+    destination       = "0.0.0.0/0"
+    destination_type  = "CIDR_BLOCK"
+  }
+
+  route_rules {
+    network_entity_id = oci_core_service_gateway.main.id
+    destination       = data.oci_core_services.all.services[0].cidr_block
+    destination_type  = "SERVICE_CIDR_BLOCK"
+  }
+}
+
+# -----------------------------------------------------------------------------
+# Security Lists
+# -----------------------------------------------------------------------------
+resource "oci_core_security_list" "public" {
+  compartment_id = var.compartment_ocid
+  vcn_id         = oci_core_vcn.main.id
+  display_name   = "cisagent-public-sl"
+  freeform_tags  = var.freeform_tags
+
+  # Ingress: HTTP
+  ingress_security_rules {
+    protocol  = "6" # TCP
+    source    = "0.0.0.0/0"
+    stateless = false
+
+    tcp_options {
+      min = 80
+      max = 80
+    }
+  }
+
+  # Ingress: HTTPS
+  ingress_security_rules {
+    protocol  = "6"
+    source    = "0.0.0.0/0"
+    stateless = false
+
+    tcp_options {
+      min = 443
+      max = 443
+    }
+  }
+
+  # Egress: All
+  egress_security_rules {
+    protocol    = "all"
+    destination = "0.0.0.0/0"
+    stateless   = false
+  }
+}
+
+resource "oci_core_security_list" "private" {
+  compartment_id = var.compartment_ocid
+  vcn_id         = oci_core_vcn.main.id
+  display_name   = "cisagent-private-sl"
+  freeform_tags  = var.freeform_tags
+
+  # Ingress: LB health checks and traffic from public subnet
+  ingress_security_rules {
+    protocol  = "6"
+    source    = var.public_subnet_cidr
+    stateless = false
+
+    tcp_options {
+      min = 8080
+      max = 8080
+    }
+  }
+
+  # Ingress: SSH from within VCN
+  ingress_security_rules {
+    protocol  = "6"
+    source    = var.vcn_cidr
+    stateless = false
+
+    tcp_options {
+      min = 22
+      max = 22
+    }
+  }
+
+  # Egress: All
+  egress_security_rules {
+    protocol    = "all"
+    destination = "0.0.0.0/0"
+    stateless   = false
+  }
+}
+
+# -----------------------------------------------------------------------------
+# Subnets
+# -----------------------------------------------------------------------------
+resource "oci_core_subnet" "public" {
+  compartment_id             = var.compartment_ocid
+  vcn_id                     = oci_core_vcn.main.id
+  cidr_block                 = var.public_subnet_cidr
+  display_name               = "cisagent-public-subnet"
+  dns_label                  = "pub"
+  route_table_id             = oci_core_route_table.public.id
+  security_list_ids          = [oci_core_security_list.public.id]
+  prohibit_public_ip_on_vnic = false
+  freeform_tags              = var.freeform_tags
+}
+
+resource "oci_core_subnet" "private" {
+  compartment_id             = var.compartment_ocid
+  vcn_id                     = oci_core_vcn.main.id
+  cidr_block                 = var.private_subnet_cidr
+  display_name               = "cisagent-private-subnet"
+  dns_label                  = "priv"
+  route_table_id             = oci_core_route_table.private.id
+  security_list_ids          = [oci_core_security_list.private.id]
+  prohibit_public_ip_on_vnic = true
+  freeform_tags              = var.freeform_tags
+}