Destroying the Migrated Stack

If you need to remove the migrated environment, you can destroy the ORM stack. However, before running the destroy operation, specific cleanup steps are required depending on your domain type: JRF or non JRF.

For JRF Domains

If the migrated stack includes VCN peering and the Add Rule for WLS to Access DB option was selected during stack creation, you must first execute the cleanup script to remove some networking configurations before destroying the stack.

These resources are created dynamically through API calls during migration and are not managed by Terraform, so Terraform cannot automatically identify or remove them. Running the cleanup script ensures these configurations are deleted before executing terraform destroy otherwise, residual networking configurations may remain in your tenancy and terraform destroy may fail.

Example:

cd /opt/scripts 
python3 cleanup_resources.py

Sample output:

Cleaning up security list... 
Updated subnet ocid1.subnet.oc1.<tenancy>: set security_list_ids = [...] 
Removed security list: wls-to-db-seclist-0 from subnet: subnet 
Deleted Security List: wls-to-db-seclist-0 
Cleaning up Route Rules... 
Removed route to <IP> via ocid1.localpeeringgateway.oc1.<gateway> 
Removed route to <IP> via ocid1.localpeeringgateway.oc1.<gateway> 
Cleanup complete. You can now safely run 'terraform destroy'.

The cleanup script performs operations such as deleting security lists and modifying route tables and subnets. To allow these actions, ensure the dynamic group used for migration has the following IAM policies in place:

Policy Statement	Policy Location
Allow dynamic-group <dynamic-group> to manage virtual-network-family in compartment MyDBNetworkCompartment	DB Network Compartment
Allow dynamic-group <dynamic-group> to manage virtual-network-family in compartment MyNetworkCompartment	WebLogic Network Compartment

These permissions enable the cleanup script to manage network resources that were created outside of Terraform before running the terraform destroy operation.

Caution:

If you run terraform destroy without first executing the cleanup script, the destroy operation may fail with errors such as:

Error: 409-IncorrectState, Local Peering Gateway ocid1.localpeeringgateway.oc1... is associated with one or more entities that are in use

In that case, the destroy process will not remove certain dynamically created networking resources (for example, route rules or security lists). If this issue occurs, run the cleanup script in the Cloud Shell before retrying the destroy operation.

This script requires proper execution permissions in Cloud Shell and specific IAM policies to be granted to your user group.

The cleanup script is located in the tool repository at:

$toolHome/bin/cloud_shell_cleanup.py

Copy the script and save the file in Cloud Shell, for example, as "cloud_shell_cleanup.py".

Before executing the script, ensure it has execution permission: chmod +x cloud_shell_cleanup.py

Run the following command in OCI Cloud Shell:

python3 cloud_shell_cleanup.py --stack-id <your_stack_ocid>

The following IAM policies must be granted at the compartment level:

Policy Statement	Purpose	Policy Location
Allow group Non-Admin to read orm-family in compartment MyCompartment	To read stack, job, and Terraform state data.	Stack Compartment
Allow group Non-Admin to manage virtual-network-family in compartment MyNetworkCompartment	To delete networking resources (Route rules).	WebLogic Network Compartment
Allow group Non-Admin to manage virtual-network-family in compartment MyDatabaseNetworkCompartment	To delete networking resources (Security Lists, Route rules).	Database Network Compartment
Allow group Non-Admin to read database-family in compartment MyDBNetworkCompartment	Allows the script to fetch details for DB Systems.	Database Compartment
Allow group Non-Admin to read autonomous-database-family in compartment MyDBNetworkCompartment	Allows the script to fetch details for Autonomous Databases.	Autonomous Database Compartment

Note:

These permissions enables the script to successfully read and modify networking and database-related resources during cleanup.

For Non-JRF Domains

If your stack is non-JRF, you can directly run the terraform destroy command to remove all resources — no additional cleanup is required.