Initial Oracle Deep Data Security lab kit

terraform/modules/network/main.tf

@@ -0,0 +1,182 @@
+data "oci_core_services" "oracle_services" {
+  filter {
+    name   = "name"
+    values = ["All .* Services In Oracle Services Network"]
+    regex  = true
+  }
+}
+
+resource "oci_core_vcn" "this" {
+  compartment_id = var.compartment_id
+  cidr_block     = var.vcn_cidr
+  display_name   = "${var.name_prefix}-vcn"
+  dns_label      = replace(var.name_prefix, "-", "")
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_core_nat_gateway" "this" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-nat"
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_core_service_gateway" "this" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-service-gateway"
+  freeform_tags  = var.freeform_tags
+
+  services {
+    service_id = data.oci_core_services.oracle_services.services[0].id
+  }
+}
+
+resource "oci_core_internet_gateway" "this" {
+  count = var.create_public_subnet ? 1 : 0
+
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-igw"
+  enabled        = true
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_core_route_table" "private" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-private-rt"
+  freeform_tags  = var.freeform_tags
+
+  route_rules {
+    destination       = "0.0.0.0/0"
+    destination_type  = "CIDR_BLOCK"
+    network_entity_id = oci_core_nat_gateway.this.id
+  }
+
+  route_rules {
+    destination       = data.oci_core_services.oracle_services.services[0].cidr_block
+    destination_type  = "SERVICE_CIDR_BLOCK"
+    network_entity_id = oci_core_service_gateway.this.id
+  }
+}
+
+resource "oci_core_route_table" "public" {
+  count = var.create_public_subnet ? 1 : 0
+
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-public-rt"
+  freeform_tags  = var.freeform_tags
+
+  route_rules {
+    destination       = "0.0.0.0/0"
+    destination_type  = "CIDR_BLOCK"
+    network_entity_id = oci_core_internet_gateway.this[0].id
+  }
+}
+
+resource "oci_core_security_list" "private" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-private-sl"
+  freeform_tags  = var.freeform_tags
+
+  egress_security_rules {
+    destination = "0.0.0.0/0"
+    protocol    = "6"
+  }
+}
+
+resource "oci_core_security_list" "public" {
+  count = var.create_public_subnet ? 1 : 0
+
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-public-sl"
+  freeform_tags  = var.freeform_tags
+
+  egress_security_rules {
+    destination = "0.0.0.0/0"
+    protocol    = "6"
+  }
+}
+
+resource "oci_core_subnet" "private" {
+  compartment_id             = var.compartment_id
+  vcn_id                     = oci_core_vcn.this.id
+  cidr_block                 = var.private_subnet_cidr
+  display_name               = "${var.name_prefix}-private-subnet"
+  dns_label                  = "private"
+  prohibit_public_ip_on_vnic = true
+  route_table_id             = oci_core_route_table.private.id
+  security_list_ids          = [oci_core_security_list.private.id]
+  freeform_tags              = var.freeform_tags
+}
+
+resource "oci_core_subnet" "public" {
+  count = var.create_public_subnet ? 1 : 0
+
+  compartment_id             = var.compartment_id
+  vcn_id                     = oci_core_vcn.this.id
+  cidr_block                 = var.public_subnet_cidr
+  display_name               = "${var.name_prefix}-public-subnet"
+  dns_label                  = "public"
+  prohibit_public_ip_on_vnic = false
+  route_table_id             = oci_core_route_table.public[0].id
+  security_list_ids          = [oci_core_security_list.public[0].id]
+  freeform_tags              = var.freeform_tags
+}
+
+resource "oci_core_network_security_group" "app" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-app-nsg"
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_core_network_security_group" "database" {
+  compartment_id = var.compartment_id
+  vcn_id         = oci_core_vcn.this.id
+  display_name   = "${var.name_prefix}-database-nsg"
+  freeform_tags  = var.freeform_tags
+}
+
+resource "oci_core_network_security_group_security_rule" "app_to_database" {
+  network_security_group_id = oci_core_network_security_group.database.id
+  direction                 = "INGRESS"
+  protocol                  = "6"
+  source                    = oci_core_network_security_group.app.id
+  source_type               = "NETWORK_SECURITY_GROUP"
+
+  tcp_options {
+    destination_port_range {
+      min = var.adb_port
+      max = var.adb_port
+    }
+  }
+}
+
+resource "oci_core_network_security_group_security_rule" "database_egress_oracle_services" {
+  network_security_group_id = oci_core_network_security_group.database.id
+  direction                 = "EGRESS"
+  protocol                  = "6"
+  destination               = data.oci_core_services.oracle_services.services[0].cidr_block
+  destination_type          = "SERVICE_CIDR_BLOCK"
+}
+
+resource "oci_core_network_security_group_security_rule" "app_egress_https" {
+  network_security_group_id = oci_core_network_security_group.app.id
+  direction                 = "EGRESS"
+  protocol                  = "6"
+  destination               = "0.0.0.0/0"
+  destination_type          = "CIDR_BLOCK"
+
+  tcp_options {
+    destination_port_range {
+      min = 443
+      max = 443
+    }
+  }
+}
+

terraform/modules/network/outputs.tf

@@ -0,0 +1,25 @@
+output "vcn_id" {
+  description = "VCN OCID."
+  value       = oci_core_vcn.this.id
+}
+
+output "private_subnet_id" {
+  description = "Private subnet OCID."
+  value       = oci_core_subnet.private.id
+}
+
+output "public_subnet_id" {
+  description = "Public subnet OCID, when created."
+  value       = try(oci_core_subnet.public[0].id, null)
+}
+
+output "app_nsg_id" {
+  description = "Application NSG OCID."
+  value       = oci_core_network_security_group.app.id
+}
+
+output "database_nsg_id" {
+  description = "Database NSG OCID."
+  value       = oci_core_network_security_group.database.id
+}
+

terraform/modules/network/variables.tf

@@ -0,0 +1,42 @@
+variable "compartment_id" {
+  description = "Compartment OCID."
+  type        = string
+}
+
+variable "name_prefix" {
+  description = "Resource name prefix."
+  type        = string
+}
+
+variable "vcn_cidr" {
+  description = "VCN CIDR."
+  type        = string
+}
+
+variable "private_subnet_cidr" {
+  description = "Private subnet CIDR."
+  type        = string
+}
+
+variable "public_subnet_cidr" {
+  description = "Public subnet CIDR."
+  type        = string
+}
+
+variable "create_public_subnet" {
+  description = "Create public subnet and internet gateway."
+  type        = bool
+  default     = false
+}
+
+variable "adb_port" {
+  description = "Autonomous Database listener port."
+  type        = number
+}
+
+variable "freeform_tags" {
+  description = "Freeform tags."
+  type        = map(string)
+  default     = {}
+}
+

terraform/modules/network/versions.tf

@@ -0,0 +1,9 @@
+terraform {
+  required_providers {
+    oci = {
+      source  = "oracle/oci"
+      version = ">= 6.0.0"
+    }
+  }
+}
+