generated from oracle/template-repo
-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathzpr_hub_vcn.tf
46 lines (35 loc) · 3.6 KB
/
zpr_hub_vcn.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
locals {
hub_on_prem_zpr_grants = local.hub_with_vcn && var.deploy_bastion_jump_host && length(var.onprem_cidrs) > 0 ? [
for cidr in var.onprem_cidrs :
"in ${local.zpr_namespace_name}.net:hub-vcn VCN allow '${cidr}' to connect to ${local.zpr_namespace_name}.bastion:${local.zpr_label} endpoints with protocol='tcp/22'"
] : []
hub_bastion_zpr_grants = local.hub_with_vcn && var.deploy_bastion_jump_host && var.deploy_bastion_service == true ? [
"in ${local.zpr_namespace_name}.net:hub-vcn VCN allow '${coalesce(var.hub_vcn_jumphost_subnet_cidr, cidrsubnet(var.hub_vcn_cidrs[0], 3, 4))}' to connect to ${local.zpr_namespace_name}.bastion:${local.zpr_label} endpoints with protocol='tcp/22'",
"in ${local.zpr_namespace_name}.net:hub-vcn VCN allow ${local.zpr_namespace_name}.bastion:${local.zpr_label} endpoints to connect to 'osn-services-ip-addresses' with protocol='tcp/443'"
] : []
hub_to_tt_1_zpr_grants = local.hub_with_vcn && local.add_tt_vcn1 && var.deploy_bastion_jump_host ? [
"in ${local.zpr_namespace_name}.net:hub-vcn VCN allow ${local.zpr_namespace_name}.bastion:${local.zpr_label} endpoints to connect to '${coalesce(var.tt_vcn1_db_subnet_cidr, cidrsubnet(var.tt_vcn1_cidrs[0], 4, 2))}' with protocol='tcp/22'"
] : []
hub_to_tt_2_zpr_grants = local.hub_with_vcn && local.add_tt_vcn2 && var.deploy_bastion_jump_host ? [
"in ${local.zpr_namespace_name}.net:hub-vcn VCN allow ${local.zpr_namespace_name}.bastion:${local.zpr_label} endpoints to connect to '${coalesce(var.tt_vcn2_db_subnet_cidr, cidrsubnet(var.tt_vcn2_cidrs[0], 4, 2))}' with protocol='tcp/22'"
] : []
hub_to_tt_3_zpr_grants = local.hub_with_vcn && local.add_tt_vcn3 && var.deploy_bastion_jump_host ? [
"in ${local.zpr_namespace_name}.net:hub-vcn VCN allow ${local.zpr_namespace_name}.bastion:${local.zpr_label} endpoints to connect to '${coalesce(var.tt_vcn3_db_subnet_cidr, cidrsubnet(var.tt_vcn3_cidrs[0], 4, 2))}' with protocol='tcp/22'"
] : []
hub_to_exa_1_zpr_grants = local.hub_with_vcn && local.add_exa_vcn1 && var.deploy_bastion_jump_host ? [
"in ${local.zpr_namespace_name}.net:hub-vcn VCN allow ${local.zpr_namespace_name}.bastion:${local.zpr_label} endpoints to connect to '${coalesce(var.exa_vcn1_client_subnet_cidr, cidrsubnet(var.exa_vcn1_cidrs[0], 4, 0))}' with protocol='tcp/22'"
] : []
hub_to_exa_2_zpr_grants = local.hub_with_vcn && local.add_exa_vcn2 && var.deploy_bastion_jump_host ? [
"in ${local.zpr_namespace_name}.net:hub-vcn VCN allow ${local.zpr_namespace_name}.bastion:${local.zpr_label} endpoints to connect to '${coalesce(var.exa_vcn2_client_subnet_cidr, cidrsubnet(var.exa_vcn2_cidrs[0], 4, 0))}' with protocol='tcp/22'"
] : []
hub_to_exa_3_zpr_grants = local.hub_with_vcn && local.add_exa_vcn3 && var.deploy_bastion_jump_host ? [
"in ${local.zpr_namespace_name}.net:hub-vcn VCN allow ${local.zpr_namespace_name}.bastion:${local.zpr_label} endpoints to connect to '${coalesce(var.exa_vcn3_client_subnet_cidr, cidrsubnet(var.exa_vcn3_cidrs[0], 4, 0))}' with protocol='tcp/22'"
] : []
hub_zpr_policy = local.hub_with_vcn && var.deploy_bastion_jump_host ? {
ZPR-POLICY-HUB-VCN = {
description = "Core Landing Zone ZPR policy for ${var.service_label}-${coalesce(var.hub_vcn_name, "hub-vcn")}-zpr-policy."
name = "${var.service_label}-${coalesce(var.hub_vcn_name, "hub-vcn")}-zpr-policy"
statements = concat(local.hub_bastion_zpr_grants, local.hub_on_prem_zpr_grants, local.hub_to_tt_1_zpr_grants, local.hub_to_tt_2_zpr_grants, local.hub_to_tt_3_zpr_grants, local.hub_to_exa_1_zpr_grants, local.hub_to_exa_2_zpr_grants, local.hub_to_exa_3_zpr_grants)
}
} : {}
}