From c9ec31ca921b783662a18298df95689711382735 Mon Sep 17 00:00:00 2001 From: Guilherme Silva Date: Wed, 2 Sep 2026 08:38:27 -0300 Subject: [PATCH] pontual Fix --- fss_server.tf | 8 +++++--- logging_group.tf | 19 +++++++++++++++-- mysql-sei.tf | 24 ++++++---------------- sei_public_load_balancer.tf | 4 ++-- sei_waf.tf | 41 ++++++++++++++++++++++++++----------- variables.tf | 2 ++ 6 files changed, 61 insertions(+), 37 deletions(-) diff --git a/fss_server.tf b/fss_server.tf index 0f167aa..9a81bd2 100644 --- a/fss_server.tf +++ b/fss_server.tf @@ -2,7 +2,8 @@ resource "oci_file_storage_file_system" "sei-fss" { availability_domain = data.oci_identity_availability_domain.ad.name compartment_id = var.ocid_compartment_app display_name = "${var.sei_nfs_name}-${var.environment}" - filesystem_snapshot_policy_id = var.fss_backup ? oci_file_storage_filesystem_snapshot_policy.sei_filesystem_snapshot_policy[0].id : null + #filesystem_snapshot_policy_id = var.fss_backup ? oci_file_storage_filesystem_snapshot_policy.sei_filesystem_snapshot_policy[0].id : null + filesystem_snapshot_policy_id = var.fss_backup ? ( oci_file_storage_filesystem_snapshot_policy.sei_filesystem_snapshot_policy[0].id) : null } resource "oci_file_storage_mount_target" "mount-target-sei" { @@ -32,14 +33,15 @@ resource "oci_file_storage_export" "export-dados" { } } resource "oci_file_storage_filesystem_snapshot_policy" "sei_filesystem_snapshot_policy" { - count = var.fss_backup == "true" ? 1 : 0 + count = var.fss_backup ? 1 : 0 availability_domain = data.oci_identity_availability_domain.ad.name compartment_id = var.ocid_compartment_app - display_name = "sei-fss-snapshot-policy-${var.environment}" + display_name = "sei-${var.environment}-snapshot-policy" policy_prefix = "fss-sei-${var.environment}" schedules { period = "DAILY" time_zone = "REGIONAL_DATA_CENTER_TIME" hour_of_day = "23" + retention_duration_in_seconds = var.fss_snapshot_retention_in_days * 86400 } } \ No newline at end of file diff --git a/logging_group.tf b/logging_group.tf index 0560fab..bfb944e 100644 --- a/logging_group.tf +++ b/logging_group.tf @@ -1,4 +1,19 @@ -resource "oci_logging_log_group" "sei_log_group" { +resource "oci_logging_log_group" "sei_log_group_app" { compartment_id = var.ocid_compartment_app - display_name = "sei-log-group-${var.environment}" + display_name = "aplications-log-group-${var.environment}" +} + +resource "oci_logging_log_group" "sei_log_group_network" { + compartment_id = var.ocid_compartment_networking + display_name = "network-log-group-${var.environment}" +} + +resource "oci_logging_log_group" "sei_log_group_security" { + compartment_id = var.ocid_compartment_security + display_name = "security-log-group-${var.environment}" +} + +resource "oci_logging_log_group" "sei_log_group_database" { + compartment_id = var.ocid_compartment_database + display_name = "database-log-group-${var.environment}" } \ No newline at end of file diff --git a/mysql-sei.tf b/mysql-sei.tf index 8071187..ef0104e 100755 --- a/mysql-sei.tf +++ b/mysql-sei.tf @@ -8,48 +8,38 @@ resource "oci_mysql_mysql_configuration" "sei_mysql_configuration" { name = "lower_case_table_names" value = "CASE_SENSITIVE" } - options { name = "character_set_server" value = "LATIN1" } - options { name = "collation_server" value = "LATIN1_SWEDISH_CI" } - options { name = "character_set_client" value = "LATIN1" } - options { name = "character_set_connection" value = "LATIN1" } - options { name = "character_set_results" value = "LATIN1" } - options { name = "collation_connection" value = "LATIN1_SWEDISH_CI" } - options { name = "init_connect" value = "SET NAMES latin1" } - options { name = "sql_require_primary_key" value = "OFF" } - - } resource "oci_mysql_mysql_db_system" "sei_mysql_dbsystem" { @@ -77,35 +67,33 @@ resource "oci_mysql_mysql_db_system" "sei_mysql_dbsystem" { shape_name = var.mysql_shape state = "ACTIVE" subnet_id = var.ocid_subnet_database - data_storage { is_auto_expand_storage_enabled = false } - deletion_policy { automatic_backup_retention = "RETAIN" final_backup = "REQUIRE_FINAL_BACKUP" is_delete_protected = true } - encrypt_data { key_generation_type = "SYSTEM" } - maintenance { - window_start_time = "SUNDAY 00:00" + window_start_time = "SATURDAY 00:00" } - read_endpoint { exclude_ips = [] is_enabled = false } - secure_connections { certificate_generation_type = "SYSTEM" } - source { source_type = "NONE" } + backup_policy { + is_enabled = var.mysql_automatic_backup_enabled + retention_in_days = var.mysql_backup_retention_in_days + window_start_time = "01:00-00:00" + } } \ No newline at end of file diff --git a/sei_public_load_balancer.tf b/sei_public_load_balancer.tf index b93d7d2..a5b505b 100755 --- a/sei_public_load_balancer.tf +++ b/sei_public_load_balancer.tf @@ -290,7 +290,7 @@ resource "oci_load_balancer_hostname" "solr_hostname" { #------------------------------------------------------------------------------------------------------------------------------------------------ resource "oci_logging_log" "lb_access_log" { display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-access-log" - log_group_id = oci_logging_log_group.sei_log_group.id + log_group_id = oci_logging_log_group.sei_log_group_network.id log_type = "SERVICE" configuration { @@ -307,7 +307,7 @@ resource "oci_logging_log" "lb_access_log" { resource "oci_logging_log" "lb_error_log" { display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-error-log" - log_group_id = oci_logging_log_group.sei_log_group.id + log_group_id = oci_logging_log_group.sei_log_group_network.id log_type = "SERVICE" configuration { diff --git a/sei_waf.tf b/sei_waf.tf index fb2e76d..136ba70 100755 --- a/sei_waf.tf +++ b/sei_waf.tf @@ -1,6 +1,6 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" { - count = var.enable_waf == "true" ? 1 : 0 - compartment_id = var.ocid_compartment_networking + count = var.enable_waf ? 1 : 0 + compartment_id = var.ocid_compartment_security display_name = "sei-waf-policy-${var.environment}-v01" actions { code = 0 @@ -32,12 +32,29 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" { actions { code = 403 - name = "Deny Country" + name = "403 - Response Code Action for protection rules" type = "RETURN_HTTP_RESPONSE" body { text = jsonencode({ code = "403" - message = "This is country is Forbidden request" + message = "Your request was blocked by OCI WAF security policy. Please contact the system administrator for assistance." + }) + type = "STATIC_TEXT" + } + headers { + name = "Content-Type" + value = "application/json" + } + } + + actions { + code = 403 + name = "403 - Response Code Action for country" + type = "RETURN_HTTP_RESPONSE" + body { + text = jsonencode({ + code = "403" + message = "Your country request was blocked by OCI WAF security policy. Please contact the system administrator for assistance." }) type = "STATIC_TEXT" } @@ -49,7 +66,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" { request_access_control { default_action_name = "Pre-configured Allow Action" rules { - action_name = "Deny Country" + action_name = "403 - Response Code Action for country" condition = "!i_contains(['BR'], connection.source.geo.countryCode)" condition_language = "JMESPATH" name = "Allow Countries" @@ -57,9 +74,9 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" { } } request_protection { - body_inspection_size_limit_in_bytes = 8192 + body_inspection_size_limit_in_bytes = 8192 rules { - action_name = "Pre-configured Check Action" + action_name = "403 - Response Code Action for protection rules" condition_language = "JMESPATH" is_body_inspection_enabled = true name = "recommended-protection-rules" @@ -166,7 +183,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" { } } rules { - action_name = "Pre-configured Check Action" + action_name = "403 - Response Code Action for protection rules" condition_language = "JMESPATH" is_body_inspection_enabled = true name = "mysql-protection-rules" @@ -213,7 +230,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" { } } rules { - action_name = "Pre-configured Check Action" + action_name = "403 - Response Code Action for protection rules" condition_language = "JMESPATH" is_body_inspection_enabled = true name = "php-protection-rules" @@ -435,7 +452,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" { } } rules { - action_name = "Pre-configured Check Action" + action_name = "403 - Response Code Action for protection rules" condition_language = "JMESPATH" is_body_inspection_enabled = true name = "apache-protection-rules" @@ -585,7 +602,7 @@ resource "oci_waf_web_app_firewall" "sei_public_load_balancer_waf" { resource "oci_logging_log" "waf_log_lb_public" { count = var.enable_waf ? 1 : 0 display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-waf-log" - log_group_id = oci_logging_log_group.sei_log_group.id + log_group_id = oci_logging_log_group.sei_log_group_security.id log_type = "SERVICE" configuration { source { @@ -594,7 +611,7 @@ resource "oci_logging_log" "waf_log_lb_public" { service = "waf" source_type = "OCISERVICE" } - compartment_id = var.ocid_compartment_security + compartment_id = var.ocid_compartment_security } is_enabled = "true" retention_duration = "30" diff --git a/variables.tf b/variables.tf index 41e3849..f306ab5 100644 --- a/variables.tf +++ b/variables.tf @@ -69,6 +69,7 @@ variable "load_balancer_certificate_bundle_ocid" {} # FSS variable "fss_backup" {} +variable "fss_snapshot_retention_in_days" {} variable "sei_nfs_name" {} # WAF @@ -89,6 +90,7 @@ variable "mysql_database_version" {} variable "mysql_database_user_name" {} variable "mysql_database_storage_size" {} variable "mysql_shape" {} +variable "mysql_automatic_backup_enabled" {} variable "mysql_backup_retention_in_days" {} variable "mysql_highly_available" {} variable "mysql_contacts_email" {}