298 lines
6.5 KiB
HCL
298 lines
6.5 KiB
HCL
/*Copyright © 2018, Oracle and/or its affiliates. All rights reserved.
|
||
|
||
The Universal Permissive License (UPL), Version 1.0*/
|
||
|
||
|
||
locals {
|
||
tcp_protocol = "6"
|
||
udp_protocol = "17"
|
||
all_protocols = "all"
|
||
anywhere = "0.0.0.0/0"
|
||
db_port = "1521"
|
||
ssh_port = "22"
|
||
rdp_port = "3389"
|
||
winrm_port = "5986"
|
||
fss_ports = ["2048", "2050", "111"]
|
||
}
|
||
|
||
# Bastion Security List
|
||
resource "oci_core_security_list" "BastionSecList" {
|
||
compartment_id = var.compartment_ocid
|
||
display_name = "BastionSecList"
|
||
vcn_id = module.create_vcn.vcnid
|
||
|
||
egress_security_rules = [
|
||
{
|
||
protocol = "${local.tcp_protocol}"
|
||
destination = "${local.anywhere}"
|
||
},
|
||
]
|
||
|
||
ingress_security_rules = [
|
||
{
|
||
tcp_options = {
|
||
"min" = "${local.ssh_port}"
|
||
"max" = "${local.ssh_port}"
|
||
}
|
||
|
||
protocol = "${local.tcp_protocol}"
|
||
source = "${local.anywhere}"
|
||
},
|
||
]
|
||
}
|
||
|
||
|
||
# Database System Security List
|
||
resource "oci_core_security_list" "DBSecList" {
|
||
compartment_id = var.compartment_ocid
|
||
display_name = "DBSecList"
|
||
vcn_id = module.create_vcn.vcnid
|
||
|
||
egress_security_rules = [
|
||
{
|
||
protocol = "${local.tcp_protocol}"
|
||
destination = "${local.anywhere}"
|
||
},
|
||
]
|
||
|
||
ingress_security_rules = [
|
||
{
|
||
tcp_options = {
|
||
"min" = "${local.ssh_port}"
|
||
"max" = "${local.ssh_port}"
|
||
}
|
||
|
||
protocol = "${local.tcp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
{
|
||
tcp_options = {
|
||
"min" = "${local.db_port}"
|
||
"max" = "${local.db_port}"
|
||
}
|
||
|
||
protocol = "${local.tcp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
]
|
||
}
|
||
|
||
# Application Server Security List
|
||
resource "oci_core_security_list" "AppSecList" {
|
||
compartment_id = var.compartment_ocid
|
||
display_name = "AppSecList"
|
||
vcn_id = module.create_vcn.vcnid
|
||
|
||
egress_security_rules = [
|
||
{
|
||
protocol = "${local.tcp_protocol}"
|
||
destination = "${local.anywhere}"
|
||
},
|
||
]
|
||
|
||
ingress_security_rules = [
|
||
{
|
||
tcp_options = {
|
||
"min" = "${local.ssh_port}"
|
||
"max" = "${local.ssh_port}"
|
||
}
|
||
|
||
protocol = "${local.tcp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
{
|
||
tcp_options = {
|
||
"min" = "${var.psft_app_instance_listen_port_range[0]}"
|
||
"max" = "${var.psft_app_instance_listen_port_range[1]}"
|
||
}
|
||
|
||
protocol = "${local.tcp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
]
|
||
}
|
||
|
||
# Web Server Security List
|
||
resource "oci_core_security_list" "WebSecList" {
|
||
compartment_id = var.compartment_ocid
|
||
display_name = "WebSecList"
|
||
vcn_id = module.create_vcn.vcnid
|
||
|
||
egress_security_rules = [
|
||
{
|
||
protocol = "${local.tcp_protocol}"
|
||
destination = "${local.anywhere}"
|
||
},
|
||
]
|
||
|
||
ingress_security_rules = [
|
||
{
|
||
tcp_options = {
|
||
"min" = "${local.ssh_port}"
|
||
"max" = "${local.ssh_port}"
|
||
}
|
||
|
||
protocol = "${local.tcp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
{
|
||
tcp_options = {
|
||
"min" = "${var.psft_web_instance_listen_port}"
|
||
"max" = "${var.psft_web_instance_listen_port}"
|
||
}
|
||
|
||
protocol = "${local.tcp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
]
|
||
}
|
||
|
||
# Load Balancer Security List
|
||
resource "oci_core_security_list" "LBSecList" {
|
||
compartment_id = var.compartment_ocid
|
||
display_name = "LBSecList"
|
||
vcn_id = module.create_vcn.vcnid
|
||
|
||
egress_security_rules = [
|
||
{
|
||
protocol = "${local.tcp_protocol}"
|
||
destination = "${local.anywhere}"
|
||
},
|
||
]
|
||
|
||
ingress_security_rules = [
|
||
{
|
||
tcp_options = {
|
||
"min" = "${var.load_balancer_listen_port}"
|
||
"max" = "${var.load_balancer_listen_port}"
|
||
}
|
||
|
||
protocol = "${local.tcp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
]
|
||
}
|
||
|
||
# Elastic Search Server Security List
|
||
resource "oci_core_security_list" "ESSecList" {
|
||
compartment_id = var.compartment_ocid
|
||
display_name = "ESSecList"
|
||
vcn_id = module.create_vcn.vcnid
|
||
|
||
egress_security_rules = [
|
||
{
|
||
protocol = "${local.tcp_protocol}"
|
||
destination = "${local.anywhere}"
|
||
},
|
||
]
|
||
|
||
ingress_security_rules = [
|
||
{
|
||
tcp_options = {
|
||
"min" = "${local.ssh_port}"
|
||
"max" = "${local.ssh_port}"
|
||
}
|
||
|
||
protocol = "${local.tcp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
{
|
||
tcp_options = {
|
||
"min" = "${var.psft_es_instance_listen_port}"
|
||
"max" = "${var.psft_es_instance_listen_port}"
|
||
}
|
||
|
||
protocol = "${local.tcp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
]
|
||
}
|
||
|
||
# Peoplesoft Tools Security List
|
||
resource "oci_core_security_list" "PToolsSecList" {
|
||
compartment_id = var.compartment_ocid
|
||
display_name = "PToolsSecList"
|
||
vcn_id = module.create_vcn.vcnid
|
||
|
||
egress_security_rules = [
|
||
{
|
||
protocol = "${local.tcp_protocol}"
|
||
destination = "${local.anywhere}"
|
||
},
|
||
]
|
||
|
||
ingress_security_rules = [
|
||
{
|
||
tcp_options = {
|
||
"min" = "${local.rdp_port}"
|
||
"max" = "${local.rdp_port}"
|
||
}
|
||
|
||
<20>Žotocol = "${local.tcp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
{
|
||
tcp_options = {
|
||
"min" = "${local.winrm_port}"
|
||
"max" = "${local.winrm_port}"
|
||
}
|
||
|
||
protocol = "${local.tcp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
]
|
||
}
|
||
|
||
# File Storage Service Security List
|
||
resource "oci_core_security_list" "FSSSecList" {
|
||
compartment_id = var.compartment_ocid
|
||
display_name = "FSSSecList"
|
||
vcn_id = module.create_vcn.vcnid
|
||
|
||
egress_security_rules = [
|
||
{
|
||
protocol = "${local.tcp_protocol}"
|
||
destination = "${local.anywhere}"
|
||
},
|
||
]
|
||
|
||
ingress_security_rules = [
|
||
{
|
||
tcp_options = {
|
||
"min" = "${local.fss_ports[0]}"
|
||
"max" = "${local.fss_ports[1]}"
|
||
}
|
||
|
||
protocol = "${local.tcp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
{
|
||
tcp_options = {
|
||
"min" = "${local.fss_ports[2]}"
|
||
"max" = "${local.fss_ports[2]}"
|
||
}
|
||
|
||
protocol = "${local.tcp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
{
|
||
udp_options = {
|
||
"min" = "${local.fss_ports[0]}"
|
||
"max" = "${local.fss_ports[0]}"
|
||
}
|
||
|
||
protocol = "${local.udp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
{
|
||
udp_options = {
|
||
"min" = "${local.fss_ports[2]}"
|
||
"max" = "${local.fss_ports[2]}"
|
||
}
|
||
|
||
protocol = "${local.udp_protocol}"
|
||
source = "${var.vcn_cidr}"
|
||
},
|
||
]
|
||
}
|