Initial Oracle Deep Data Security lab kit

terraform/README.md

@@ -0,0 +1,24 @@
+# Terraform
+
+Este diretório contém a fundação OCI do lab.
+
+## Ambientes
+
+- `envs/demo`: ambiente padrão para demonstrações e workshops.
+
+## Módulos
+
+- `modules/network`: VCN, subnets privadas/públicas opcionais, gateways, route tables e NSGs.
+- `modules/vault`: OCI Vault e chave KMS opcional.
+- `modules/autonomous_database`: Autonomous Database com private endpoint e mTLS.
+- `modules/compute_bastion`: instância opcional para administração dentro da VCN.
+
+## Boas Práticas Aplicadas
+
+- Banco em subnet privada.
+- NSG separado para banco e aplicação.
+- Sem bastion por padrão.
+- Sem senha ou wallet versionada.
+- `.tfvars` real ignorado pelo Git.
+- Variáveis sensíveis marcadas como `sensitive`.
+

terraform/envs/demo/.terraform.lock.hcl

@@ -0,0 +1,25 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/oracle/oci" {
+  version     = "8.13.0"
+  constraints = ">= 6.0.0"
+  hashes = [
+    "h1:c6kNTSmsSeSCOBM8/5Hgt0VpSKyFgFgfY/CdvRyAm5Q=",
+    "zh:055ef341b3370d90b08f1ab56fdede11747c33a8a4f76c01382e80a9eac70c8f",
+    "zh:23713f132f34d0da9dbc11421d4b83d10f7fce677e1a5aafcf07619b12bf1a33",
+    "zh:443afc4c6183d6e9806d7414e4096a2669d0d3435118b37b7fd7bb5bc2596fa9",
+    "zh:579379341440d9be2fb82eeba58f7bb5874868b673c60cff8b8a50bea0747a74",
+    "zh:67a3a5df051e44e180e859bbef8480be10c0a9a7a719fb23abe545811cec3524",
+    "zh:7069d4bc824bf2dd3e6d476f86482bfb96c72ab465e3f770804e62af62935513",
+    "zh:7c6222cfb7f0a6ed330795457f40909e55b2736552767805f9b2bdf784bac1e1",
+    "zh:8346570c97b2f65787b475b2019c8ac7d96d142e9ecd99de85abd7ccf3518058",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:a87d6e48c3f4f97417380518aafe14e3a30d297bee163b2718ded0b8b78da5b5",
+    "zh:ae690079802ffae84c83774b36707765a4d79b17b5971faa1c46fe39f299e0e8",
+    "zh:b78eea21c5ab34d00f243f490e3744925a783c67882a027c53f4ef827349a630",
+    "zh:bc8b719cccfdd20ae8e055abb8ca7d9a27ad629f4904f163850a6e79c8c17482",
+    "zh:c58b39a86a320ab74d340fde48bf0d83fc6de4a790846eb5b91c69b0a6205ca6",
+    "zh:ee4cf6cbafa373bd50de976a0cd5c2429ca8b4c0879dea9831891063820c3a9c",
+  ]
+}

terraform/envs/demo/main.tf

@@ -0,0 +1,86 @@
+resource "oci_identity_compartment" "lab" {
+  count = var.create_compartment ? 1 : 0
+
+  compartment_id = var.compartment_ocid
+  description    = "Compartment for Oracle Deep Data Security lab"
+  name           = var.lab_compartment_name
+  enable_delete  = true
+  freeform_tags  = local.common_tags
+}
+
+locals {
+  lab_compartment_id = var.create_compartment ? oci_identity_compartment.lab[0].id : var.compartment_ocid
+
+  common_tags = merge(
+    {
+      project     = "oracle-deep-data-security-lab"
+      environment = var.environment
+      owner       = var.owner
+    },
+    var.freeform_tags
+  )
+}
+
+module "network" {
+  source = "../../modules/network"
+
+  compartment_id       = local.lab_compartment_id
+  name_prefix          = var.name_prefix
+  vcn_cidr             = var.vcn_cidr
+  private_subnet_cidr  = var.private_subnet_cidr
+  public_subnet_cidr   = var.public_subnet_cidr
+  create_public_subnet = var.enable_compute_bastion
+  adb_port             = var.adb_port
+  freeform_tags        = local.common_tags
+}
+
+module "vault" {
+  count  = var.enable_customer_managed_key ? 1 : 0
+  source = "../../modules/vault"
+
+  compartment_id = local.lab_compartment_id
+  name_prefix    = var.name_prefix
+  freeform_tags  = local.common_tags
+}
+
+module "autonomous_database" {
+  source = "../../modules/autonomous_database"
+
+  compartment_id              = local.lab_compartment_id
+  db_name                     = var.adb_db_name
+  display_name                = var.adb_display_name
+  admin_password              = var.adb_admin_password
+  db_workload                 = var.adb_workload
+  db_version                  = var.adb_db_version
+  compute_model               = var.adb_compute_model
+  compute_count               = var.adb_compute_count
+  data_storage_size_in_tbs    = var.adb_data_storage_size_in_tbs
+  is_auto_scaling_enabled     = var.adb_auto_scaling_enabled
+  license_model               = var.adb_license_model
+  subnet_id                   = module.network.private_subnet_id
+  nsg_ids                     = [module.network.database_nsg_id]
+  private_endpoint_label      = var.adb_private_endpoint_label
+  customer_managed_vault_id   = var.enable_customer_managed_key ? module.vault[0].vault_id : null
+  customer_managed_key_id     = var.enable_customer_managed_key ? module.vault[0].key_id : null
+  whitelisted_ips             = []
+  is_mtls_connection_required = true
+  freeform_tags               = local.common_tags
+}
+
+module "compute_bastion" {
+  count  = var.enable_compute_bastion ? 1 : 0
+  source = "../../modules/compute_bastion"
+
+  compartment_id      = local.lab_compartment_id
+  availability_domain = var.bastion_availability_domain
+  display_name        = "${var.name_prefix}-bastion"
+  shape               = var.bastion_shape
+  ocpus               = var.bastion_ocpus
+  memory_in_gbs       = var.bastion_memory_in_gbs
+  image_ocid          = var.bastion_image_ocid
+  subnet_id           = module.network.public_subnet_id
+  nsg_ids             = [module.network.app_nsg_id]
+  ssh_public_key      = var.bastion_ssh_public_key
+  assign_public_ip    = true
+  freeform_tags       = local.common_tags
+}

terraform/envs/demo/outputs.tf

@@ -0,0 +1,35 @@
+output "compartment_id" {
+  description = "Compartment used by the lab."
+  value       = local.lab_compartment_id
+}
+
+output "vcn_id" {
+  description = "VCN OCID."
+  value       = module.network.vcn_id
+}
+
+output "private_subnet_id" {
+  description = "Private subnet OCID."
+  value       = module.network.private_subnet_id
+}
+
+output "database_nsg_id" {
+  description = "Database NSG OCID."
+  value       = module.network.database_nsg_id
+}
+
+output "autonomous_database_id" {
+  description = "Autonomous Database OCID."
+  value       = module.autonomous_database.autonomous_database_id
+}
+
+output "autonomous_database_private_endpoint" {
+  description = "Autonomous Database private endpoint."
+  value       = module.autonomous_database.private_endpoint
+}
+
+output "bastion_public_ip" {
+  description = "Optional bastion public IP."
+  value       = var.enable_compute_bastion ? module.compute_bastion[0].public_ip : null
+}
+

terraform/envs/demo/provider.tf

@@ -0,0 +1,9 @@
+provider "oci" {
+  tenancy_ocid         = var.tenancy_ocid
+  user_ocid            = var.user_ocid
+  fingerprint          = var.fingerprint
+  private_key_path     = var.private_key_path
+  private_key_password = var.private_key_password
+  region               = var.region
+}
+

terraform/envs/demo/terraform.tfvars.example

@@ -0,0 +1,23 @@
+tenancy_ocid     = "ocid1.tenancy.oc1..example"
+compartment_ocid = "ocid1.compartment.oc1..example"
+user_ocid        = "ocid1.user.oc1..example"
+fingerprint      = "00:00:00:00:00:00:00:00:00:00:00:00:00:00:00:00"
+private_key_path = "C:/Users/you/.oci/oci_api_key.pem"
+region           = "sa-saopaulo-1"
+
+owner       = "database-security-team"
+name_prefix = "dds-lab"
+
+adb_admin_password = "REPLACE_WITH_STRONG_PASSWORD_DO_NOT_COMMIT"
+
+# Set only when the target version is available in your tenancy/region.
+# adb_db_version = "26ai"
+
+enable_customer_managed_key = false
+enable_compute_bastion      = false
+
+# Required only when enable_compute_bastion = true.
+# bastion_availability_domain = "xxxx:SA-SAOPAULO-1-AD-1"
+# bastion_image_ocid          = "ocid1.image.oc1.sa-saopaulo-1.example"
+# bastion_ssh_public_key      = "ssh-rsa AAAA..."
+

terraform/envs/demo/variables.tf

@@ -0,0 +1,211 @@
+variable "tenancy_ocid" {
+  description = "OCI tenancy OCID."
+  type        = string
+}
+
+variable "compartment_ocid" {
+  description = "Parent compartment OCID. If create_compartment is false, resources are created here."
+  type        = string
+}
+
+variable "user_ocid" {
+  description = "OCI API user OCID."
+  type        = string
+}
+
+variable "fingerprint" {
+  description = "OCI API key fingerprint."
+  type        = string
+}
+
+variable "private_key_path" {
+  description = "Path to OCI API private key."
+  type        = string
+}
+
+variable "private_key_password" {
+  description = "Password for encrypted OCI API private key, if used."
+  type        = string
+  default     = null
+  sensitive   = true
+}
+
+variable "region" {
+  description = "OCI region, for example sa-saopaulo-1."
+  type        = string
+}
+
+variable "environment" {
+  description = "Environment label."
+  type        = string
+  default     = "demo"
+}
+
+variable "owner" {
+  description = "Owner tag for lab resources."
+  type        = string
+  default     = "database-security-team"
+}
+
+variable "name_prefix" {
+  description = "Name prefix for lab resources."
+  type        = string
+  default     = "dds-lab"
+}
+
+variable "freeform_tags" {
+  description = "Extra freeform tags."
+  type        = map(string)
+  default     = {}
+}
+
+variable "create_compartment" {
+  description = "Create a child compartment for the lab."
+  type        = bool
+  default     = false
+}
+
+variable "lab_compartment_name" {
+  description = "Name of child compartment when create_compartment is true."
+  type        = string
+  default     = "cmp-deep-data-security-lab"
+}
+
+variable "vcn_cidr" {
+  description = "VCN CIDR."
+  type        = string
+  default     = "10.40.0.0/16"
+}
+
+variable "private_subnet_cidr" {
+  description = "Private subnet CIDR for database and private app workloads."
+  type        = string
+  default     = "10.40.10.0/24"
+}
+
+variable "public_subnet_cidr" {
+  description = "Public subnet CIDR used only when compute bastion is enabled."
+  type        = string
+  default     = "10.40.20.0/24"
+}
+
+variable "adb_port" {
+  description = "Database listener port allowed by NSG. Autonomous Database mTLS commonly uses 1522."
+  type        = number
+  default     = 1522
+}
+
+variable "adb_db_name" {
+  description = "Autonomous Database DB name. Use letters and numbers only."
+  type        = string
+  default     = "DDSLAB"
+}
+
+variable "adb_display_name" {
+  description = "Autonomous Database display name."
+  type        = string
+  default     = "Oracle Deep Data Security Lab"
+}
+
+variable "adb_admin_password" {
+  description = "Autonomous Database ADMIN password."
+  type        = string
+  sensitive   = true
+}
+
+variable "adb_workload" {
+  description = "Autonomous Database workload."
+  type        = string
+  default     = "OLTP"
+}
+
+variable "adb_db_version" {
+  description = "Optional database version. Set to a Deep Data Security compatible version available in your tenancy/region."
+  type        = string
+  default     = null
+}
+
+variable "adb_compute_model" {
+  description = "Autonomous Database compute model."
+  type        = string
+  default     = "ECPU"
+}
+
+variable "adb_compute_count" {
+  description = "Autonomous Database compute count."
+  type        = number
+  default     = 2
+}
+
+variable "adb_data_storage_size_in_tbs" {
+  description = "Autonomous Database storage size in TB."
+  type        = number
+  default     = 1
+}
+
+variable "adb_auto_scaling_enabled" {
+  description = "Enable Autonomous Database autoscaling."
+  type        = bool
+  default     = true
+}
+
+variable "adb_license_model" {
+  description = "Autonomous Database license model."
+  type        = string
+  default     = "LICENSE_INCLUDED"
+}
+
+variable "adb_private_endpoint_label" {
+  description = "Private endpoint DNS label."
+  type        = string
+  default     = "ddslab"
+}
+
+variable "enable_customer_managed_key" {
+  description = "Create OCI Vault and KMS key and attach it to Autonomous Database."
+  type        = bool
+  default     = false
+}
+
+variable "enable_compute_bastion" {
+  description = "Create an optional public compute bastion."
+  type        = bool
+  default     = false
+}
+
+variable "bastion_availability_domain" {
+  description = "Availability domain for optional compute bastion."
+  type        = string
+  default     = null
+}
+
+variable "bastion_shape" {
+  description = "Shape for optional compute bastion."
+  type        = string
+  default     = "VM.Standard.E5.Flex"
+}
+
+variable "bastion_ocpus" {
+  description = "OCPUs for optional flexible compute bastion."
+  type        = number
+  default     = 1
+}
+
+variable "bastion_memory_in_gbs" {
+  description = "Memory in GB for optional flexible compute bastion."
+  type        = number
+  default     = 8
+}
+
+variable "bastion_image_ocid" {
+  description = "Image OCID for optional compute bastion."
+  type        = string
+  default     = null
+}
+
+variable "bastion_ssh_public_key" {
+  description = "SSH public key for optional compute bastion."
+  type        = string
+  default     = null
+  sensitive   = true
+}

terraform/envs/demo/versions.tf

@@ -0,0 +1,11 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    oci = {
+      source  = "oracle/oci"
+      version = ">= 6.0.0"
+    }
+  }
+}
+

terraform/modules/autonomous_database/main.tf

@@ -0,0 +1,21 @@
+resource "oci_database_autonomous_database" "this" {
+  compartment_id              = var.compartment_id
+  db_name                     = var.db_name
+  display_name                = var.display_name
+  admin_password              = var.admin_password
+  db_workload                 = var.db_workload
+  db_version                  = var.db_version
+  compute_model               = var.compute_model
+  compute_count               = var.compute_count
+  data_storage_size_in_tbs    = var.data_storage_size_in_tbs
+  is_auto_scaling_enabled     = var.is_auto_scaling_enabled
+  license_model               = var.license_model
+  subnet_id                   = var.subnet_id
+  nsg_ids                     = var.nsg_ids
+  private_endpoint_label      = var.private_endpoint_label
+  whitelisted_ips             = var.whitelisted_ips
+  is_mtls_connection_required = var.is_mtls_connection_required
+  vault_id                    = var.customer_managed_vault_id
+  kms_key_id                  = var.customer_managed_key_id
+  freeform_tags               = var.freeform_tags
+}

terraform/modules/autonomous_database/outputs.tf

@@ -0,0 +1,16 @@
+output "autonomous_database_id" {
+  description = "Autonomous Database OCID."
+  value       = oci_database_autonomous_database.this.id
+}
+
+output "private_endpoint" {
+  description = "Private endpoint IP/FQDN reported by OCI."
+  value       = try(oci_database_autonomous_database.this.private_endpoint, null)
+}
+
+output "connection_strings" {
+  description = "Connection strings generated by Autonomous Database."
+  value       = try(oci_database_autonomous_database.this.connection_strings, null)
+  sensitive   = true
+}
+

terraform/modules/autonomous_database/variables.tf

@@ -0,0 +1,101 @@
+variable "compartment_id" {
+  description = "Compartment OCID."
+  type        = string
+}
+
+variable "db_name" {
+  description = "Autonomous Database DB name."
+  type        = string
+}
+
+variable "display_name" {
+  description = "Autonomous Database display name."
+  type        = string
+}
+
+variable "admin_password" {
+  description = "ADMIN password."
+  type        = string
+  sensitive   = true
+}
+
+variable "db_workload" {
+  description = "Database workload."
+  type        = string
+}
+
+variable "db_version" {
+  description = "Optional database version."
+  type        = string
+  default     = null
+}
+
+variable "compute_model" {
+  description = "Autonomous Database compute model."
+  type        = string
+}
+
+variable "compute_count" {
+  description = "Autonomous Database compute count."
+  type        = number
+}
+
+variable "data_storage_size_in_tbs" {
+  description = "Storage size in TB."
+  type        = number
+}
+
+variable "is_auto_scaling_enabled" {
+  description = "Enable autoscaling."
+  type        = bool
+}
+
+variable "license_model" {
+  description = "License model."
+  type        = string
+}
+
+variable "subnet_id" {
+  description = "Private endpoint subnet OCID."
+  type        = string
+}
+
+variable "nsg_ids" {
+  description = "NSG OCIDs."
+  type        = list(string)
+}
+
+variable "private_endpoint_label" {
+  description = "Private endpoint DNS label."
+  type        = string
+}
+
+variable "customer_managed_key_id" {
+  description = "Optional KMS key OCID."
+  type        = string
+  default     = null
+}
+
+variable "customer_managed_vault_id" {
+  description = "Optional Vault OCID for customer-managed key."
+  type        = string
+  default     = null
+}
+
+variable "whitelisted_ips" {
+  description = "Whitelisted IPs. Empty for private endpoint use."
+  type        = list(string)
+  default     = []
+}
+
+variable "is_mtls_connection_required" {
+  description = "Require mTLS."
+  type        = bool
+  default     = true
+}
+
+variable "freeform_tags" {
+  description = "Freeform tags."
+  type        = map(string)
+  default     = {}
+}

terraform/modules/autonomous_database/versions.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_providers {
+    oci = {
+      source  = "oracle/oci"
+      version = ">= 6.0.0"
+    }
+  }
+}
+

terraform/modules/compute_bastion/main.tf

@@ -0,0 +1,30 @@
+resource "oci_core_instance" "this" {
+  availability_domain = var.availability_domain
+  compartment_id      = var.compartment_id
+  display_name        = var.display_name
+  shape               = var.shape
+  freeform_tags       = var.freeform_tags
+
+  dynamic "shape_config" {
+    for_each = length(regexall("Flex$", var.shape)) > 0 ? [1] : []
+    content {
+      ocpus         = var.ocpus
+      memory_in_gbs = var.memory_in_gbs
+    }
+  }
+
+  create_vnic_details {
+    subnet_id        = var.subnet_id
+    assign_public_ip = var.assign_public_ip
+    nsg_ids          = var.nsg_ids
+  }
+
+  metadata = {
+    ssh_authorized_keys = var.ssh_public_key
+  }
+
+  source_details {
+    source_type = "image"
+    source_id   = var.image_ocid
+  }
+}

terraform/modules/compute_bastion/outputs.tf

@@ -0,0 +1,10 @@
+output "instance_id" {
+  description = "Bastion instance OCID."
+  value       = oci_core_instance.this.id
+}
+
+output "public_ip" {
+  description = "Bastion public IP."
+  value       = oci_core_instance.this.public_ip
+}
+

terraform/modules/compute_bastion/variables.tf

@@ -0,0 +1,63 @@
+variable "compartment_id" {
+  description = "Compartment OCID."
+  type        = string
+}
+
+variable "availability_domain" {
+  description = "Availability domain."
+  type        = string
+}
+
+variable "display_name" {
+  description = "Instance display name."
+  type        = string
+}
+
+variable "shape" {
+  description = "Compute shape."
+  type        = string
+}
+
+variable "ocpus" {
+  description = "OCPUs for flexible shapes."
+  type        = number
+  default     = 1
+}
+
+variable "memory_in_gbs" {
+  description = "Memory in GB for flexible shapes."
+  type        = number
+  default     = 8
+}
+
+variable "image_ocid" {
+  description = "Image OCID."
+  type        = string
+}
+
+variable "subnet_id" {
+  description = "Subnet OCID."
+  type        = string
+}
+
+variable "nsg_ids" {
+  description = "NSG OCIDs."
+  type        = list(string)
+}
+
+variable "ssh_public_key" {
+  description = "SSH public key."
+  type        = string
+  sensitive   = true
+}
+
+variable "assign_public_ip" {
+  description = "Assign public IP to bastion."
+  type        = bool
+}
+
+variable "freeform_tags" {
+  description = "Freeform tags."
+  type        = map(string)
+  default     = {}
+}

terraform/modules/compute_bastion/versions.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_providers {
+    oci = {
+      source  = "oracle/oci"
+      version = ">= 6.0.0"
+    }
+  }
+}
+

terraform/modules/network/main.tf

@@ -0,0 +1,182 @@
+data "oci_core_services" "oracle_services" {
+  filter {
+    name   = "name"
+    values = ["All .* Services In Oracle Services Network"]
+    regex  = true
+  }
+}
+
+resource "oci_core_vcn" "this" {
+  compartment_id = var.compartment_id
+  cidr_block     = var.vcn_cidr
+  display_name   = "${var.name_prefix}-vcn"
+  dns_label      = replace(var.name_prefix, "-", "")
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_core_nat_gateway" "this" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-nat"
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_core_service_gateway" "this" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-service-gateway"
+  freeform_tags  = var.freeform_tags
+
+  services {
+    service_id = data.oci_core_services.oracle_services.services[0].id
+  }
+}
+
+resource "oci_core_internet_gateway" "this" {
+  count = var.create_public_subnet ? 1 : 0
+
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-igw"
+  enabled        = true
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_core_route_table" "private" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-private-rt"
+  freeform_tags  = var.freeform_tags
+
+  route_rules {
+    destination       = "0.0.0.0/0"
+    destination_type  = "CIDR_BLOCK"
+    network_entity_id = oci_core_nat_gateway.this.id
+  }
+
+  route_rules {
+    destination       = data.oci_core_services.oracle_services.services[0].cidr_block
+    destination_type  = "SERVICE_CIDR_BLOCK"
+    network_entity_id = oci_core_service_gateway.this.id
+  }
+}
+
+resource "oci_core_route_table" "public" {
+  count = var.create_public_subnet ? 1 : 0
+
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-public-rt"
+  freeform_tags  = var.freeform_tags
+
+  route_rules {
+    destination       = "0.0.0.0/0"
+    destination_type  = "CIDR_BLOCK"
+    network_entity_id = oci_core_internet_gateway.this[0].id
+  }
+}
+
+resource "oci_core_security_list" "private" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-private-sl"
+  freeform_tags  = var.freeform_tags
+
+  egress_security_rules {
+    destination = "0.0.0.0/0"
+    protocol    = "6"
+  }
+}
+
+resource "oci_core_security_list" "public" {
+  count = var.create_public_subnet ? 1 : 0
+
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-public-sl"
+  freeform_tags  = var.freeform_tags
+
+  egress_security_rules {
+    destination = "0.0.0.0/0"
+    protocol    = "6"
+  }
+}
+
+resource "oci_core_subnet" "private" {
+  compartment_id             = var.compartment_id
+  vcn_id                     = oci_core_vcn.this.id
+  cidr_block                 = var.private_subnet_cidr
+  display_name               = "${var.name_prefix}-private-subnet"
+  dns_label                  = "private"
+  prohibit_public_ip_on_vnic = true
+  route_table_id             = oci_core_route_table.private.id
+  security_list_ids          = [oci_core_security_list.private.id]
+  freeform_tags              = var.freeform_tags
+}
+
+resource "oci_core_subnet" "public" {
+  count = var.create_public_subnet ? 1 : 0
+
+  compartment_id             = var.compartment_id
+  vcn_id                     = oci_core_vcn.this.id
+  cidr_block                 = var.public_subnet_cidr
+  display_name               = "${var.name_prefix}-public-subnet"
+  dns_label                  = "public"
+  prohibit_public_ip_on_vnic = false
+  route_table_id             = oci_core_route_table.public[0].id
+  security_list_ids          = [oci_core_security_list.public[0].id]
+  freeform_tags              = var.freeform_tags
+}
+
+resource "oci_core_network_security_group" "app" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-app-nsg"
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_core_network_security_group" "database" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-database-nsg"
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_core_network_security_group_security_rule" "app_to_database" {
+  network_security_group_id = oci_core_network_security_group.database.id
+  direction                 = "INGRESS"
+  protocol                  = "6"
+  source                    = oci_core_network_security_group.app.id
+  source_type               = "NETWORK_SECURITY_GROUP"
+
+  tcp_options {
+    destination_port_range {
+      min = var.adb_port
+      max = var.adb_port
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "database_egress_oracle_services" {
+  network_security_group_id = oci_core_network_security_group.database.id
+  direction                 = "EGRESS"
+  protocol                  = "6"
+  destination               = data.oci_core_services.oracle_services.services[0].cidr_block
+  destination_type          = "SERVICE_CIDR_BLOCK"
+}
+
+resource "oci_core_network_security_group_security_rule" "app_egress_https" {
+  network_security_group_id = oci_core_network_security_group.app.id
+  direction                 = "EGRESS"
+  protocol                  = "6"
+  destination               = "0.0.0.0/0"
+  destination_type          = "CIDR_BLOCK"
+
+  tcp_options {
+    destination_port_range {
+      min = 443
+      max = 443
+    }
+  }
+}
+

terraform/modules/network/outputs.tf

@@ -0,0 +1,25 @@
+output "vcn_id" {
+  description = "VCN OCID."
+  value       = oci_core_vcn.this.id
+}
+
+output "private_subnet_id" {
+  description = "Private subnet OCID."
+  value       = oci_core_subnet.private.id
+}
+
+output "public_subnet_id" {
+  description = "Public subnet OCID, when created."
+  value       = try(oci_core_subnet.public[0].id, null)
+}
+
+output "app_nsg_id" {
+  description = "Application NSG OCID."
+  value       = oci_core_network_security_group.app.id
+}
+
+output "database_nsg_id" {
+  description = "Database NSG OCID."
+  value       = oci_core_network_security_group.database.id
+}
+

terraform/modules/network/variables.tf

@@ -0,0 +1,42 @@
+variable "compartment_id" {
+  description = "Compartment OCID."
+  type        = string
+}
+
+variable "name_prefix" {
+  description = "Resource name prefix."
+  type        = string
+}
+
+variable "vcn_cidr" {
+  description = "VCN CIDR."
+  type        = string
+}
+
+variable "private_subnet_cidr" {
+  description = "Private subnet CIDR."
+  type        = string
+}
+
+variable "public_subnet_cidr" {
+  description = "Public subnet CIDR."
+  type        = string
+}
+
+variable "create_public_subnet" {
+  description = "Create public subnet and internet gateway."
+  type        = bool
+  default     = false
+}
+
+variable "adb_port" {
+  description = "Autonomous Database listener port."
+  type        = number
+}
+
+variable "freeform_tags" {
+  description = "Freeform tags."
+  type        = map(string)
+  default     = {}
+}
+

terraform/modules/network/versions.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_providers {
+    oci = {
+      source  = "oracle/oci"
+      version = ">= 6.0.0"
+    }
+  }
+}
+

terraform/modules/vault/main.tf

@@ -0,0 +1,19 @@
+resource "oci_kms_vault" "this" {
+  compartment_id = var.compartment_id
+  display_name   = "${var.name_prefix}-vault"
+  vault_type     = "DEFAULT"
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_kms_key" "adb" {
+  compartment_id      = var.compartment_id
+  display_name        = "${var.name_prefix}-adb-key"
+  management_endpoint = oci_kms_vault.this.management_endpoint
+  freeform_tags       = var.freeform_tags
+
+  key_shape {
+    algorithm = "AES"
+    length    = 32
+  }
+}
+

terraform/modules/vault/outputs.tf

@@ -0,0 +1,10 @@
+output "vault_id" {
+  description = "Vault OCID."
+  value       = oci_kms_vault.this.id
+}
+
+output "key_id" {
+  description = "KMS key OCID."
+  value       = oci_kms_key.adb.id
+}
+

terraform/modules/vault/variables.tf

@@ -0,0 +1,16 @@
+variable "compartment_id" {
+  description = "Compartment OCID."
+  type        = string
+}
+
+variable "name_prefix" {
+  description = "Resource name prefix."
+  type        = string
+}
+
+variable "freeform_tags" {
+  description = "Freeform tags."
+  type        = map(string)
+  default     = {}
+}
+

terraform/modules/vault/versions.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_providers {
+    oci = {
+      source  = "oracle/oci"
+      version = ">= 6.0.0"
+    }
+  }
+}
+