Skip to content

Commit 2f4b436

Browse files
karthicgitkarthicgit
committed
fix for policies,examples update
Signed-off-by: Karthic Ravindran <[email protected]>
1 parent f5780fa commit 2f4b436

File tree

6 files changed

+103
-41
lines changed

6 files changed

+103
-41
lines changed

‎examples/serviceconnector/main.tf

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
module "svc" {
2+
source = "./modules/serviceconnector"
3+
service_connector_def = local.service_connector_def
4+
policy_compartment_id = local.policy_compartment_id
5+
dynamic_group = local.dynamic_group
6+
7+
tenancy_ocid = local.tenancy_ocid
8+
providers = {
9+
oci.home = oci.home
10+
}
11+
12+
}
13+
14+
locals {
15+
tenancy_ocid = "<tenancy_ocid>"
16+
dynamic_group = {
17+
dg1 = { compartment_id = "<service connector compartment id>" }
18+
}
19+
policy_compartment_id = "<policy compartment>" #if not set policy will be created default in root compartment
20+
service_connector_def = { sch2 = {
21+
compartment_id = "<service connector compartment id>"
22+
#If policy needs to be created set the below two values. By default its set to false to not create policy
23+
#Set create_policy to true
24+
#set dynamic group name with respect to service connector compartment
25+
create_policy = true
26+
dynamic_group_name = "<dynamicgroupname>"
27+
28+
sch_source = "streaming"
29+
sch_target = "objectstorage"
30+
display_name = "sch2"
31+
32+
stream_id = "existing stream ocid"
33+
target = {
34+
bucket = "<bucket name>"
35+
}
36+
}
37+
}
38+
}

‎examples/serviceconnector/provider.tf.example

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
provider "oci" {
2+
region = "<region where service connector to be created>"
3+
fingerprint = ""
4+
private_key_path = ""
5+
6+
tenancy_ocid = ""
7+
user_ocid = ""
8+
9+
}
10+
11+
provider "oci" {
12+
alias = "home"
13+
region = "<region>"
14+
fingerprint = ""
15+
private_key_path = ""
16+
17+
tenancy_ocid = ""
18+
user_ocid = ""
19+
20+
}
21+
22+
terraform {
23+
required_providers {
24+
oci = {
25+
source = "oracle/oci"
26+
version = ">= 4.67.3"
27+
}
28+
}
29+
required_version = ">= 1.3.0"
30+
}

‎modules/serviceconnector/README.md

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
| Name | Version |
1212
|------|---------|
1313
| <a name="provider_oci"></a> [oci](#provider\_oci) | >= 4.67.3 |
14+
| <a name="provider_oci.home"></a> [oci.home](#provider\_oci.home) | >= 4.67.3 |
1415

1516
## Modules
1617

@@ -28,11 +29,9 @@ No modules.
2829

2930
| Name | Description | Type | Default | Required |
3031
|------|-------------|------|---------|:--------:|
31-
| <a name="input_compartment_ocid"></a> [compartment\_ocid](#input\_compartment\_ocid) | Compartment OCID | `string` | n/a | yes |
32-
| <a name="input_create_dg"></a> [create\_dg](#input\_create\_dg) | Whether to create dynamic group or not | `bool` | n/a | yes |
33-
| <a name="input_dynamic_group_name"></a> [dynamic\_group\_name](#input\_dynamic\_group\_name) | Dynamic group display name | `string` | n/a | yes |
32+
| <a name="input_dynamic_group"></a> [dynamic\_group](#input\_dynamic\_group) | Dynamic group definition for service connector | `map(any)` | n/a | yes |
3433
| <a name="input_policy_compartment_id"></a> [policy\_compartment\_id](#input\_policy\_compartment\_id) | Compartment where policy will be created | `string` | n/a | yes |
35-
| <a name="input_service_connector_def"></a> [service\_connector\_def](#input\_service\_connector\_def) | n/a | <pre>map(object({<br> defined_tags = optional(map(string))<br> freeform_tags = optional(map(string))<br> display_name = string<br> description = optional(string)<br> state = optional(string, "ACTIVE")<br> sch_source = string<br> sch_target = string<br><br> #For Streaming source<br> stream_id = optional(string)<br> stream_cursor = optional(string)<br> #For logging source<br> log_source = optional(list(object({<br> compartment_id = optional(string)<br> log_group_id = optional(string, "_Audit")<br> log_id = optional(string)<br> })))<br> #For monitoring source<br> monitoring_source = optional(list(object({<br> compartment_id = optional(string)<br> metric_namespace = list(string)<br> })))<br><br> target = object({<br> #For Objectstorage target<br> bucket_name = optional(string)<br> batch_rollover_size_in_mbs = optional(number, 100)<br> batch_rollover_time_in_ms = optional(number, 420000)<br> object_name_prefix = optional(string)<br> #For Streaming target<br> stream_id = optional(string)<br> #For Notification target<br> topic_id = optional(string)<br> #For Function target<br> function_id = optional(string)<br> #For LoggingAnalytics Target<br> log_group_id = optional(string)<br> log_source = optional(string)<br> compartment_id = optional(string)<br> })<br> tasks = optional(object({<br> log_condition = optional(string)<br> function_id = optional(string)<br> batch_size_in_kbs = optional(string, 5120)<br> batch_time_in_sec = optional(string, 600)<br><br> }))<br> }))</pre> | n/a | yes |
34+
| <a name="input_service_connector_def"></a> [service\_connector\_def](#input\_service\_connector\_def) | n/a | <pre>map(object({<br> defined_tags = optional(map(string))<br> freeform_tags = optional(map(string))<br> display_name = string<br> description = optional(string)<br> state = optional(string, "ACTIVE")<br> sch_source = string<br> sch_target = string<br> compartment_id = string<br> create_policy = optional(bool, false)<br> dynamic_group_name = optional(string)<br><br> #For Streaming source<br> stream_id = optional(string)<br> stream_cursor = optional(string)<br> #For logging source<br> log_source = optional(list(object({<br> compartment_id = optional(string)<br> log_group_id = optional(string, "_Audit")<br> log_id = optional(string)<br> })))<br> #For monitoring source<br> monitoring_source = optional(list(object({<br> compartment_id = optional(string)<br> metric_namespace = list(string)<br> })))<br><br> target = object({<br> #For Objectstorage target<br> bucket = optional(string)<br> batch_rollover_size_in_mbs = optional(number, 100)<br> batch_rollover_time_in_ms = optional(number, 420000)<br> object_name_prefix = optional(string)<br> #For Streaming target<br> stream_id = optional(string)<br> #For Notification target<br> topic_id = optional(string)<br> #For Function target<br> function_id = optional(string)<br> #For LoggingAnalytics Target<br> log_group_id = optional(string)<br> log_source = optional(string)<br> compartment_id = optional(string)<br> })<br> tasks = optional(object({<br> log_condition = optional(string)<br> function_id = optional(string)<br> batch_size_in_kbs = optional(string, 5120)<br> batch_time_in_sec = optional(string, 600)<br><br> }))<br> }))</pre> | n/a | yes |
3635
| <a name="input_tenancy_ocid"></a> [tenancy\_ocid](#input\_tenancy\_ocid) | Tenancy OCID | `string` | n/a | yes |
3736

3837
## Outputs

‎modules/serviceconnector/main.tf

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33

44
resource "oci_sch_service_connector" "this" {
55
for_each = var.service_connector_def
6-
compartment_id = var.compartment_ocid
6+
compartment_id = each.value.compartment_id
77
display_name = each.value.display_name
88
source {
99
kind = each.value.sch_source
@@ -18,7 +18,7 @@ resource "oci_sch_service_connector" "this" {
1818
dynamic "log_sources" {
1919
for_each = each.value.sch_source == "logging" ? each.value.log_source : []
2020
content {
21-
compartment_id = coalesce(log_sources.value.compartment_id, var.compartment_ocid)
21+
compartment_id = coalesce(log_sources.value.compartment_id, each.value.compartment_id)
2222
log_group_id = log_sources.value.log_group_id
2323
log_id = log_sources.value.log_id
2424

@@ -28,7 +28,7 @@ resource "oci_sch_service_connector" "this" {
2828
for_each = each.value.sch_source == "monitoring" ? each.value.monitoring_source : []
2929
content {
3030

31-
compartment_id = coalesce(monitoring_sources.value.compartment_id, var.compartment_ocid)
31+
compartment_id = coalesce(monitoring_sources.value.compartment_id, each.value.compartment_id)
3232
namespace_details {
3333
kind = "selected"
3434
dynamic "namespaces" {
@@ -49,7 +49,7 @@ resource "oci_sch_service_connector" "this" {
4949
kind = each.value.sch_target
5050
log_group_id = each.value.sch_target == "loggingAnalytics" ? each.value.target.log_group_id : null
5151
log_source_identifier = (each.value.sch_source == "streaming" && each.value.sch_target == "loggingAnalytics") ? each.value.target.la_log_source : null
52-
compartment_id = coalesce(each.value.target.compartment_id, var.compartment_ocid)
52+
compartment_id = each.value.sch_target == "monitoring" ? coalesce(each.value.target.compartment_id, each.value.compartment_id) : null
5353
stream_id = each.value.sch_target == "streaming" ? each.value.target.stream_id : null
5454
bucket = each.value.sch_target == "objectstorage" ? each.value.target.bucket : null
5555
object_name_prefix = each.value.sch_target == "objectstorage" ? each.value.target.object_name_prefix : null

‎modules/serviceconnector/policies.tf

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,15 @@ locals {
55
policy_compartment_id = var.policy_compartment_id == null ? var.tenancy_ocid : var.policy_compartment_id
66

77
target_policies = {
8-
for k, v in var.service_connector_def : k => (v.create_policy && v.sch_target == "loggingAnalytics") ? "Allow dynamic-group ${var.dynamic_group_name} to use loganalytics-log-group in compartment id ${coalesce(v.target.compartment_id, var.compartment_ocid)} where target.loganalytics-log-group.id='${v.target.log_group_id}'" :
9-
(v.create_policy && v.sch_target == "notifications") ? "Allow dynamic-group ${var.dynamic_group_name} to use ons-topics in compartment id ${coalesce(v.target.compartment_id, var.compartment_ocid)}" :
10-
(v.create_policy && v.sch_target == "functions") ? "Allow dynamic-group ${var.dynamic_group_name} to use fn-invocation in compartment id ${coalesce(v.target.compartment_id, var.compartment_ocid)}" :
11-
(v.create_policy && v.sch_target == "objectstorage") ? "Allow dynamic-group ${var.dynamic_group_name} to manage objects in compartment id ${coalesce(v.target.compartment_id, var.compartment_ocid)} where target.bucket.name='${coalesce(v.target.bucket_name, "dummy")}'" :
12-
(v.create_policy && v.sch_target == "streaming") ? "Allow dynamic-group ${var.dynamic_group_name} to use stream-push in compartment id ${coalesce(v.target.compartment_id, var.compartment_ocid)} where target.stream.id='${v.target.stream_id}'" : ""
8+
for k, v in var.service_connector_def : k => (v.create_policy && v.sch_target == "loggingAnalytics") ? "Allow dynamic-group ${v.dynamic_group_name} to use loganalytics-log-group in compartment id ${coalesce(v.target.compartment_id, v.compartment_id)} where target.loganalytics-log-group.id='${v.target.log_group_id}'" :
9+
(v.create_policy && v.sch_target == "notifications") ? "Allow dynamic-group ${v.dynamic_group_name} to use ons-topics in compartment id ${coalesce(v.target.compartment_id, v.compartment_id)}" :
10+
(v.create_policy && v.sch_target == "functions") ? "Allow dynamic-group ${v.dynamic_group_name} to use fn-invocation in compartment id ${coalesce(v.target.compartment_id, v.compartment_id)}" :
11+
(v.create_policy && v.sch_target == "objectstorage") ? "Allow dynamic-group ${v.dynamic_group_name} to manage objects in compartment id ${coalesce(v.target.compartment_id, v.compartment_id)} where target.bucket.name='${v.target.bucket}'" :
12+
(v.create_policy && v.sch_target == "streaming") ? "Allow dynamic-group ${v.dynamic_group_name} to use stream-push in compartment id ${coalesce(v.target.compartment_id, v.compartment_id)} where target.stream.id='${v.target.stream_id}'" : ""
1313
}
1414
source_policies = {
15-
for k, v in var.service_connector_def : k => (v.create_policy && v.sch_source == "streaming") ? "Allow dynamic-group ${var.dynamic_group_name} to {STREAM_READ, STREAM_CONSUME} in compartment id ${coalesce(v.target.compartment_id, var.compartment_ocid)} where target.stream.id='${v.stream_id}'" :
16-
(v.create_policy && v.sch_source == "monitoring") ? "Allow dynamic-group ${var.dynamic_group_name} to read metrics in compartment id ${coalesce(v.target.compartment_id, var.compartment_ocid)}" : ""
15+
for k, v in var.service_connector_def : k => (v.create_policy && v.sch_source == "streaming") ? "Allow dynamic-group ${v.dynamic_group_name} to {STREAM_READ, STREAM_CONSUME} in compartment id ${coalesce(v.target.compartment_id, v.compartment_id)} where target.stream.id='${v.stream_id}'" :
16+
(v.create_policy && v.sch_source == "monitoring") ? "Allow dynamic-group ${v.dynamic_group_name} to read metrics in compartment id ${coalesce(v.target.compartment_id, v.compartment_id)}" : ""
1717
}
1818

1919
allpolicies = { for key in distinct(concat(keys(local.target_policies), keys(local.source_policies))) :
@@ -30,11 +30,11 @@ locals {
3030
resource "oci_identity_dynamic_group" "serviceconnector_dynamic_group" {
3131
provider = oci.home
3232

33-
count = var.create_dg ? 1 : 0
33+
for_each = var.dynamic_group
3434
compartment_id = var.tenancy_ocid
3535
description = "Dynamic group for service connector"
36-
matching_rule = "All {resource.type = 'serviceconnector', resource.compartment.id = '${var.compartment_ocid}'}"
37-
name = var.dynamic_group_name
36+
matching_rule = "All {resource.type = 'serviceconnector', resource.compartment.id = '${each.value.compartment_id}'}"
37+
name = each.key
3838

3939
}
4040

‎modules/serviceconnector/variables.tf

Lines changed: 18 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,6 @@
11
#Copyright (c) 2023 Oracle Corporation and/or its affiliates.
22
#Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
33

4-
variable "compartment_ocid" {
5-
description = "Compartment OCID"
6-
type = string
7-
}
8-
9-
variable "create_dg" {
10-
type = bool
11-
description = "Whether to create dynamic group or not"
12-
}
134
variable "tenancy_ocid" {
145
description = "Tenancy OCID"
156
type = string
@@ -21,25 +12,29 @@ variable "policy_compartment_id" {
2112

2213
}
2314

24-
variable "dynamic_group_name" {
25-
type = string
26-
description = "Dynamic group display name"
15+
variable "dynamic_group" {
16+
type = map(any)
17+
description = "Dynamic group definition for service connector"
18+
default = {}
2719

2820
}
2921

3022
variable "service_connector_def" {
3123
type = map(object({
32-
defined_tags = optional(map(string))
33-
freeform_tags = optional(map(string))
34-
display_name = string
35-
description = optional(string)
36-
state = optional(string, "ACTIVE")
37-
sch_source = string
38-
sch_target = string
24+
defined_tags = optional(map(string))
25+
freeform_tags = optional(map(string))
26+
display_name = string
27+
description = optional(string)
28+
state = optional(string, "ACTIVE")
29+
sch_source = string
30+
sch_target = string
31+
compartment_id = string
32+
create_policy = optional(bool, false)
33+
dynamic_group_name = optional(string)
3934

4035
#For Streaming source
4136
stream_id = optional(string)
42-
stream_cursor = optional(string)
37+
stream_cursor = optional(string, "LATEST")
4338
#For logging source
4439
log_source = optional(list(object({
4540
compartment_id = optional(string)
@@ -54,7 +49,7 @@ variable "service_connector_def" {
5449

5550
target = object({
5651
#For Objectstorage target
57-
bucket_name = optional(string)
52+
bucket = optional(string)
5853
batch_rollover_size_in_mbs = optional(number, 100)
5954
batch_rollover_time_in_ms = optional(number, 420000)
6055
object_name_prefix = optional(string)
@@ -84,8 +79,8 @@ variable "service_connector_def" {
8479
}
8580
validation {
8681
condition = alltrue([
87-
for i in var.service_connector_def : contains(["loggingAnalytics", "objectstorage", "streaming", "notifications"], i.sch_target)])
88-
error_message = "Allowed value for sch_target is loggingAnalytics,notifications,objectstorage and streaming."
82+
for i in var.service_connector_def : contains(["loggingAnalytics", "objectstorage", "streaming", "notifications", "functions"], i.sch_target)])
83+
error_message = "Allowed value for sch_target is functions,loggingAnalytics,notifications,objectstorage and streaming."
8984
}
9085

9186
}

0 commit comments

Comments
 (0)