pontual Fix

fss_server.tf

@@ -2,7 +2,8 @@ resource "oci_file_storage_file_system" "sei-fss" {
   availability_domain = data.oci_identity_availability_domain.ad.name
   compartment_id = var.ocid_compartment_app
   display_name = "${var.sei_nfs_name}-${var.environment}"
-  filesystem_snapshot_policy_id = var.fss_backup ? oci_file_storage_filesystem_snapshot_policy.sei_filesystem_snapshot_policy[0].id : null
+  #filesystem_snapshot_policy_id = var.fss_backup ? oci_file_storage_filesystem_snapshot_policy.sei_filesystem_snapshot_policy[0].id : null
+  filesystem_snapshot_policy_id = var.fss_backup ? ( oci_file_storage_filesystem_snapshot_policy.sei_filesystem_snapshot_policy[0].id) : null
 }
 
 resource "oci_file_storage_mount_target" "mount-target-sei" {
@@ -32,14 +33,15 @@ resource "oci_file_storage_export" "export-dados" {
     }
 }
 resource "oci_file_storage_filesystem_snapshot_policy" "sei_filesystem_snapshot_policy" {
-    count = var.fss_backup == "true" ? 1 : 0
+    count = var.fss_backup ? 1 : 0
     availability_domain = data.oci_identity_availability_domain.ad.name
     compartment_id = var.ocid_compartment_app
-    display_name = "sei-fss-snapshot-policy-${var.environment}"
+    display_name = "sei-${var.environment}-snapshot-policy"
     policy_prefix = "fss-sei-${var.environment}"
     schedules {
         period = "DAILY"
         time_zone = "REGIONAL_DATA_CENTER_TIME"
         hour_of_day = "23"
+        retention_duration_in_seconds = var.fss_snapshot_retention_in_days * 86400
     } 
 }

logging_group.tf

@@ -1,4 +1,19 @@
-resource "oci_logging_log_group" "sei_log_group" {
+resource "oci_logging_log_group" "sei_log_group_app" {
     compartment_id = var.ocid_compartment_app
-    display_name = "sei-log-group-${var.environment}"
+    display_name = "aplications-log-group-${var.environment}"
+}
+
+resource "oci_logging_log_group" "sei_log_group_network" {
+    compartment_id = var.ocid_compartment_networking
+    display_name = "network-log-group-${var.environment}"
+}
+
+resource "oci_logging_log_group" "sei_log_group_security" {
+    compartment_id = var.ocid_compartment_security
+    display_name = "security-log-group-${var.environment}"
+}
+
+resource "oci_logging_log_group" "sei_log_group_database" {
+    compartment_id = var.ocid_compartment_database
+    display_name = "database-log-group-${var.environment}"
 }

mysql-sei.tf

@@ -8,48 +8,38 @@ resource "oci_mysql_mysql_configuration" "sei_mysql_configuration" {
     name = "lower_case_table_names"
     value = "CASE_SENSITIVE"
   }
-
   options {
     name  = "character_set_server"
     value = "LATIN1"
   }
-
   options {
     name  = "collation_server"
     value = "LATIN1_SWEDISH_CI"
   }
-
   options {
     name  = "character_set_client"
     value = "LATIN1"
   }
-
   options {
     name  = "character_set_connection" 
     value = "LATIN1"
   }
-
   options {
     name  = "character_set_results"
     value = "LATIN1"
   }
-
   options {
     name  = "collation_connection"
     value = "LATIN1_SWEDISH_CI"
   }
-
   options {
     name  = "init_connect"
     value = "SET NAMES latin1"
   }
-
   options {
     name  = "sql_require_primary_key"
     value = "OFF"
   }
-
-  
 }
 
 resource "oci_mysql_mysql_db_system" "sei_mysql_dbsystem" {
@@ -77,35 +67,33 @@ resource "oci_mysql_mysql_db_system" "sei_mysql_dbsystem" {
   shape_name              = var.mysql_shape
   state                   = "ACTIVE"
   subnet_id               = var.ocid_subnet_database
-
   data_storage {
     is_auto_expand_storage_enabled = false
   }
-
   deletion_policy {
     automatic_backup_retention = "RETAIN"
     final_backup               = "REQUIRE_FINAL_BACKUP"
     is_delete_protected        = true
   }
-
   encrypt_data {
     key_generation_type = "SYSTEM"
   }
-
   maintenance {
-    window_start_time = "SUNDAY 00:00"
+    window_start_time = "SATURDAY 00:00"
   }
-
   read_endpoint {
     exclude_ips                  = []
     is_enabled                   = false
   }
-
   secure_connections {
     certificate_generation_type = "SYSTEM"
   }
-
   source {
     source_type    = "NONE"
   }
+  backup_policy {
+        is_enabled = var.mysql_automatic_backup_enabled
+        retention_in_days = var.mysql_backup_retention_in_days
+        window_start_time = "01:00-00:00"
+    }
 }

sei_public_load_balancer.tf

@@ -290,7 +290,7 @@ resource "oci_load_balancer_hostname" "solr_hostname" {
 #------------------------------------------------------------------------------------------------------------------------------------------------
 resource "oci_logging_log" "lb_access_log" {
   display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-access-log"
-  log_group_id = oci_logging_log_group.sei_log_group.id
+  log_group_id = oci_logging_log_group.sei_log_group_network.id
   log_type     = "SERVICE"
 
   configuration {
@@ -307,7 +307,7 @@ resource "oci_logging_log" "lb_access_log" {
 
 resource "oci_logging_log" "lb_error_log" {
   display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-error-log"
-  log_group_id = oci_logging_log_group.sei_log_group.id
+  log_group_id = oci_logging_log_group.sei_log_group_network.id
   log_type     = "SERVICE"
 
   configuration {

sei_waf.tf

@@ -1,6 +1,6 @@
 resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
-  count = var.enable_waf == "true" ? 1 : 0
+  count = var.enable_waf ? 1 : 0
-  compartment_id = var.ocid_compartment_networking
+  compartment_id = var.ocid_compartment_security
   display_name  = "sei-waf-policy-${var.environment}-v01"
   actions {
     code = 0
@@ -32,12 +32,29 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
 
   actions {
     code = 403
-    name = "Deny Country"
+    name = "403 - Response Code Action for protection rules"
     type = "RETURN_HTTP_RESPONSE"
     body {
       text = jsonencode({
         code    = "403"
-        message = "This is country is Forbidden request"
+        message = "Your request was blocked by OCI WAF security policy. Please contact the system administrator for assistance."
+      })
+      type = "STATIC_TEXT"
+    }
+    headers {
+      name  = "Content-Type"
+      value = "application/json"
+    }
+  }
+
+  actions {
+    code = 403
+    name = "403 - Response Code Action for country"
+    type = "RETURN_HTTP_RESPONSE"
+    body {
+      text = jsonencode({
+        code    = "403"
+        message = "Your country request was blocked by OCI WAF security policy. Please contact the system administrator for assistance."
       })
       type = "STATIC_TEXT"
     }
@@ -49,7 +66,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
   request_access_control {
     default_action_name = "Pre-configured Allow Action"
     rules {
-      action_name        = "Deny Country"
+      action_name        = "403 - Response Code Action for country"
       condition          = "!i_contains(['BR'], connection.source.geo.countryCode)"
       condition_language = "JMESPATH"
       name               = "Allow Countries"
@@ -57,9 +74,9 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
     }
   }
   request_protection {
-    body_inspection_size_limit_in_bytes             = 8192
+    body_inspection_size_limit_in_bytes = 8192
     rules {
-      action_name                = "Pre-configured Check Action"
+      action_name                = "403 - Response Code Action for protection rules"
       condition_language         = "JMESPATH"
       is_body_inspection_enabled = true
       name                       = "recommended-protection-rules"
@@ -166,7 +183,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
       }
     }
     rules {
-      action_name                = "Pre-configured Check Action"
+      action_name                = "403 - Response Code Action for protection rules"
       condition_language         = "JMESPATH"
       is_body_inspection_enabled = true
       name                       = "mysql-protection-rules"
@@ -213,7 +230,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
       }
     }
     rules {
-      action_name                = "Pre-configured Check Action"
+      action_name                = "403 - Response Code Action for protection rules"
       condition_language         = "JMESPATH"
       is_body_inspection_enabled = true
       name                       = "php-protection-rules"
@@ -435,7 +452,7 @@ resource "oci_waf_web_app_firewall_policy" "sei-waf-policy" {
       }
     }
     rules {
-      action_name                = "Pre-configured Check Action"
+      action_name                = "403 - Response Code Action for protection rules"
       condition_language         = "JMESPATH"
       is_body_inspection_enabled = true
       name                       = "apache-protection-rules"
@@ -585,7 +602,7 @@ resource "oci_waf_web_app_firewall" "sei_public_load_balancer_waf" {
 resource "oci_logging_log" "waf_log_lb_public" {
     count = var.enable_waf ? 1 : 0 
     display_name = "${oci_load_balancer_load_balancer.sei_load_balancer_public.display_name}-waf-log"
-    log_group_id = oci_logging_log_group.sei_log_group.id
+    log_group_id = oci_logging_log_group.sei_log_group_security.id
     log_type = "SERVICE"
     configuration {
         source {
@@ -594,7 +611,7 @@ resource "oci_logging_log" "waf_log_lb_public" {
             service = "waf"
             source_type = "OCISERVICE"
         }
-        compartment_id = var.ocid_compartment_security
+      compartment_id = var.ocid_compartment_security
     }
     is_enabled = "true"
     retention_duration = "30"

variables.tf

@@ -69,6 +69,7 @@ variable "load_balancer_certificate_bundle_ocid" {}
 
 # FSS
 variable "fss_backup" {} 
+variable "fss_snapshot_retention_in_days" {}
 variable "sei_nfs_name" {}
 
 # WAF
@@ -89,6 +90,7 @@ variable "mysql_database_version" {}
 variable "mysql_database_user_name" {}
 variable "mysql_database_storage_size" {}
 variable "mysql_shape" {}
+variable "mysql_automatic_backup_enabled" {}
 variable "mysql_backup_retention_in_days" {}
 variable "mysql_highly_available" {}
 variable "mysql_contacts_email" {}