Oracle Enterprise Landing Zone v2 Configuration

The following information supplies the required provider variables for OELZ v2.

The following information provides required arguments and parameters for the identity domain.

For control over users and user groups, create a federate-able identity domain in the L4-Security compartment for each environment. If you're deploying OELZ v2, set up federation after the OELZ v2 has been deployed.

OELZ v2 creates six different user groups for managing individually deployed environments (two by default for production and non-production).

• Network Admin: OCI OELZ v2 Network Administrators Group that manages all network resources
• SecOps Admin: OCI OELZ v2 Security Administrators Group
• IAM Admin: OCI OELZ v2 IAM Group
• Ops Admin: OCI OELZ v2 Ops Admin Group
• Platform Admin: OCI OELZ v2 Platform Admin Group

When you create these user groups, the inputs are optional since there are default values for the group name; however, if you want to set up federation, you need to update the user groups with the names that exist in the federated domain.

The following information provides required arguments and parameters for the groups.

Production Environment

Non-Production Environment

OELZ v2 deploys policies that grant administrative privileges to members of each group over resources in their respective compartments.

The Budget module is responsible for deploying the budget component in a single environment. OELZ v2 creates the following components:

• 1 budget per environment
  • Budget scope: Environment (Production and Non-Production)

The following information provides the arguments and parameters for the Budget module.

Production Environment

Non-Production Environment

The Tagging module is responsible for deploying tags in the L2 Environment compartment.

OELZ v2 creates the following components:

• Tag namespace per environment containing the following defined tags and tag defaults:
  • Cost Center
  • Geo Location
  • Environment Prefix

The following information provides the arguments and parameters for the Tagging module.

Production Environment

Non-Production Environment

The Monitoring module configures at least 100 Alarms. Make sure the tenancy meets the required service limit.

Production Environment

Non-Production Environment

• The following CIDR ranges can't be used during OELZ v2 deployment:
  • 169.254.10.0-169.254.19.255
  • 169.254.100.0-169.254.109.255
  • 169.254.192.0-169.254.201.255
  • 100.64.0.0–100.127.255.255 (Used by Exadata X8M/X9M for the interconnect)

Production Environment

Hub-Related Variables

Spoke-Related Variables

VPN-Related Variables

OCI FastConnect-Related Variables (By design, FastConnect-related variables are deployed only in the production environment.)

FastConnect Provider List

FastConnect Routing Policy

Non-Production Environment Variables

Hub-Related Variables

Spoke-Related Variables

VPN-Related Variables

CPE Vendor List

Naming Convention

Route Rule

Public Route Table information:

1. If Internet Gateway is enabled, it will act as default gateway.
2. All Spoke Subnet destination will be forwarded to DRG.

Private Route Table information:

1. If NAT Gateway is enabled, it will act as default gateway.
2. If Service Gateway is enabled, all OCI services can access Hub resources.
3. All Spoke Subnet destinations are forwarded to DRG.

Security Rule

1. Ingress Rule: Allow All ICMP Traffic.
2. Egress Rule: Allow All Protocol Traffic.

Naming Convention

Route Rule

Public Route Table Information:

1. If NAT Gateway is enabled, it acts as default gateway.
2. If Service Gateway is enabled, all OCI services can access Spoke resources.
3. All Hub Subnet destinations are forwarded to DRG.
4. All Spoke Subnet destination are forwarded to DRG.

Security Rule

1. Ingress Rule: Allow All ICMP Traffic.
2. Egress Rule: Allow All Protocol Traffic.

OELZ v2 deploys configurations for multiple security services. Vulnerability Scanning scans compute instances deployed in OELZ v2 (for example, as part of the workloads) for open ports and known security vulnerabilities. OS Management Service works with operating systems on deployed compute instances, such as Oracle Autonomous Linux, to manage patches and updates, helping to ensure a secure environment.

Cloud Guard can monitor multiple security conditions. OELZ v2 configures Cloud Guard with several Oracle-managed security recipes for up-to-date best practice security monitoring.

By default, Cloud Guard is configured to monitor only the resources deployed in the OELZ v2 home compartment and sub compartments. An option is for Cloud Guard to monitor the entire tenancy. It's controlled by the cloud_guard_target_tenancy variable.

This is a Boolean variable that defaults to false. If it's set to true Cloud Guard is configured to monitor the entire tenancy, instead of the OELZ v2 home compartment.

Cloud Guard Target is deployed in the base compartment of both L2-Prod and L2-Non-Prod environments with related IAM policies. All Oracle managed responder recipes reside in the L4 Security compartment of each environment.

The following target_detector_recipes are Oracle managed:

• OCI Config Detector Recipes
• OCI Threat Detector Recipes
• OCI Activity Detector Recipe

For more information about Cloud Guard, see Cloud Guard.

Required Arguments and Parameters in the Cloud Guard Module

The OCI Bastion service is created in the L4 Security compartment within the L2-Prod compartment, with a second one created in the L4 Security compartment within the L2-Non-Prod compartment. It allows secure access to compute resources in the respective environments. The CIDR Block provided gives the address range of all the resources the Bastion service can host sessions for.

The following information provides the required arguments and parameters in the Bastion module.

Production Environment

Non-Production Environment

Vulnerability Scanning is part of many security services deployed in OELZ v2. It scans compute instances deployed in OELZ v2 (for example, as part of workloads) for open ports and other known security vulnerabilities.

Key Features:

• Vulnerability Scanning recipes are created in the L4-Security compartment in both the production and non-production environments to manage instances and read components and VNICs.
• Network and agent based scanning in enabled by default.
• Scans are configured with a "Daily" schedule.
• Qualys integration lets you to run reports on the Qualys Dashboard instead of Cloud Guard. This feature is not currently available from Terraform Code Support, but might be available for later versions.

There are no input parameters required for the Vulnerability Scanning module.

The OS Management service works with operating systems on deployed compute instances, such as Oracle Autonomous Linux, to manage patches and updates, helping you ensure a secure environment.

Key Features:

• IAM policy is created at the tenancy level for the OS Management service to emit metrics for instances in the tenancy.
• Dynamic group is created with name: $-"OCI-ELZ-DG".
• Matching rules are created with compartment OCIDs (where instances reside), such as L4-Security, Logging, Network, Workload, and Base compartment OCIDs.
• IAM policy for the dynamic group is created in the landing zone home compartment.

There are no input parameters required for the OS Management module.

The OCI Vault service is a key management service that stores and manages master encryption keys and secrets for secure access to resources.

Key Features

• A virtual vault is created for secure storage of cryptographic keys within L4-Security compartment of both production and non-production environments.
• A user-manageable master encryption key is also created, stored in the vault, and is usable for encryption of data in OCI storage services.
• Vault supports the bring your own key (BYOK) scenario and can store all user keys.
• IAM policies for storage services to use keys are created in the landing zone Base compartment.

Required Arguments and Parameters for the Vault and Key Management Module

Production Environment

Non-Production Environment

For a typical enterprise adopting OCI, Vault must be configured to address the most common enterprise use cases. For common enterprise scenarios and the corresponding recommended guidance, see Vault Best Practices After Landing Zone Implementation.

OELZ v2 sets up secure storage of all log data generated by resources and services in the landing zone. For both environments in L2-Prod and L2-NonProd compartments, a logging compartment “L3-Logging Compartment” is created. This compartment hosts the following three listed immutable storage buckets:

• AuditLogs_standard: Bucket for audit logs
• DefaultLogs_standard: Bucket for general logging
• ServiceEvents_standard: Bucket for service events

The buckets are encrypted with the master encryption key (MEK) stored in the vault. Retention policies are also applied to the buckets to manage data retention, disallowing deletion or modifications of data for a configurable time period.

The default log group (Name: Default_Group) is created in the L4-Security compartment. Service logs for all supported services (VCN Flow logs, Object Storage, and so on) are enabled and stored in the L3-Logging compartment.

All the events in the OELZ v2 environment are streamed to standard object storage. The stream pool is created in the L4-Security compartment and encrypted with the MEK. The service events are stored in the standard object storage bucket in the Logging compartment.

OCI Service Connector Hub is used to ship all the audit, service logs, and events in OELZ v2 to the buckets in the Logging compartment. All IAM policies for Service Connector Hub are created in the L2 level home compartment of each environment.

Required Arguments and Parameters for Bucket Retention Policies

Production Environment

Non-Production Environment

Archive Log