Activation de la compatibilité FIPS

variable "tenancy_ocid" {
}
 
variable "user_ocid" {
}
 
variable "fingerprint" {
}
 
variable "private_key_path" {
}
 
variable "region" {
}
 
variable "compartment_ocid" {
}
 
variable "ssh_public_key" {
}
 
variable "ssh_private_key" {
}
 
locals {
  prefix    = "terraform"
  oel-image = "<Oracle_Linux_image_OCID>"
  vm-shape  = "<shape_name>"
 
  user-data = <<EOF
#!/bin/bash -x
echo "export TF_VAR_auth='InstancePrincipal'" >> ~/.bash_profile
echo "export TF_VAR_region='${var.region}'" >> ~/.bash_profile
yum install -y terraform terraform-provider-oci-fips
EOF
 
}
 
provider "oci" {
  tenancy_ocid     = var.tenancy_ocid
  user_ocid        = var.user_ocid
  fingerprint      = var.fingerprint
  private_key_path = var.private_key_path
  region           = var.region
}
 
resource "oci_core_vcn" "vcn1" {
  compartment_id = var.compartment_ocid
  display_name   = "${local.prefix}Vcn"
  cidr_block     = "10.0.0.0/16"
}
 
resource "oci_core_subnet" "subnet1" {
  compartment_id    = var.compartment_ocid
  vcn_id            = oci_core_vcn.vcn1.id
  cidr_block        = "10.0.0.0/24"
  display_name      = "${local.prefix}Subnet"
  security_list_ids = [oci_core_vcn.vcn1.default_security_list_id]
  route_table_id    = oci_core_vcn.vcn1.default_route_table_id
  dhcp_options_id   = oci_core_vcn.vcn1.default_dhcp_options_id
}
 
resource "oci_core_internet_gateway" "internet-gateway1" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.vcn1.id
  display_name   = "${local.prefix}InternetGateway"
}
 
resource "oci_core_default_route_table" "route-table1" {
  manage_default_resource_id = oci_core_vcn.vcn1.default_route_table_id
  display_name               = "${local.prefix}RouteTable"
 
  route_rules {
    destination       = "0.0.0.0/0"
    destination_type  = "CIDR_BLOCK"
    network_entity_id = oci_core_internet_gateway.internet-gateway1.id
  }
}
 
data "oci_core_services" "service-gateway-services" {
  filter {
    name   = "name"
    values = ["All .* Services In Oracle Services Network"]
    regex  = true
  }
}
 
resource "oci_core_service_gateway" "service-gateway1" {
  compartment_id = var.compartment_ocid
  vcn_id         = oci_core_vcn.vcn1.id
  display_name   = "${local.prefix}ServiceGateway"
 
  services {
    service_id = data.oci_core_services.service-gateway-services.services[0]["id"]
  }
}
 
resource "oci_core_default_security_list" "security-list1" {
  manage_default_resource_id = oci_core_vcn.vcn1.default_security_list_id
  display_name               = "${local.prefix}SecurityList"
 
  // inbound ssh traffic
  ingress_security_rules {
    protocol  = "6" // tcp
    source    = "0.0.0.0/0"
    stateless = false
 
    tcp_options {
      min = 22
      max = 22
    }
  }
 
  // outbound traffic to OCI services
  egress_security_rules {
    destination      = data.oci_core_services.service-gateway-services.services[0]["cidr_block"]
    destination_type = "SERVICE_CIDR_BLOCK"
    protocol         = "6"
 
    tcp_options {
      max = "443"
      min = "443"
    }
  }
 
  // outbound tcp traffic on all ports
  egress_security_rules {
    destination = "0.0.0.0/0"
    protocol    = "6"
  }
}
 
data "oci_identity_compartment" "compartment1" {
  id = var.compartment_ocid
}
 
resource "oci_identity_dynamic_group" "dynamic-group1" {
  compartment_id = var.tenancy_ocid
  name           = "${local.prefix}DynamicGroup"
  description    = "Dynamic Group for executing Terraform with Instance Principal authentication"
  matching_rule  = "ANY {instance.compartment.id = '${var.compartment_ocid}'}"
}
 
resource "oci_identity_policy" "instance-principal-policy1" {
  compartment_id = var.compartment_ocid
  name           = "${local.prefix}Policy"
  description    = "Policy to allow Instance Principal Terraform execution"
  statements     = ["ALLOW dynamic-group ${oci_identity_dynamic_group.dynamic-group1.name} to manage all-resources IN compartment ${data.oci_identity_compartment.compartment1.name}"]
}
 
data "oci_identity_availability_domain" "ad" {
  compartment_id = var.tenancy_ocid
  ad_number      = 1
}
 
resource "oci_core_instance" "instance1" {
  availability_domain = data.oci_identity_availability_domain.ad.name
  compartment_id      = var.compartment_ocid
  display_name        = "${local.prefix}Instance"
  shape               = local.vm-shape
 
  source_details {
    source_type = "image"
    source_id   = local.oel-image
  }
 
  metadata = {
    ssh_authorized_keys = var.ssh_public_key
    user_data           = base64encode(local.user-data)
    tenancy_ocid        = var.tenancy_ocid
  }
 
  create_vnic_details {
    subnet_id        = oci_core_subnet.subnet1.id
    assign_public_ip = true
  }
}
 
output "instance-ip" {
  value = [oci_core_instance.instance1.public_ip]
}