前提条件

define tenancy orpServiceProdTenancy as <ORP_SERVICE_TENANCY_OCID>

endorse group odbaa-db-systems-administrators, odbaa-db-family-administrators to use cluster-placement-groups in tenancy orpServiceProdTenancy

#!/bin/bash
#
# Usage:
# ./goldengate_iam_cloud_shell.sh
#
# Example:
# ./goldengate_iam_cloud_shell.sh
#

# Enable strict mode to exit on any error.
set -euo pipefail

# input OCI profile name, default is DEFAULT

function get_home_region_name() {
    local OCI_TENANCY=$1

    local cli_output=$(oci iam tenancy get --tenancy-id ${OCI_TENANCY} | jq -r '.data."home-region-key"')

    local VAR_HOME_REGION_KEY=${cli_output}

    cli_output=$(oci iam region list --all | jq -r --arg VAR_HOME_REGION_KEY ${VAR_HOME_REGION_KEY} '.data[] | select(.key == $VAR_HOME_REGION_KEY) | .name')

    echo $cli_output
}

function get_iam_compartment_name() {
    local OCI_TENANCY=$1

    local cli_output=$(oci iam compartment list --compartment-id ${OCI_TENANCY} --all | jq -r '[.data[] | select(.name | startswith("MulticloudLink_ODBAA_"))] | sort_by(.name) | reverse | .[0].name')

    echo ${cli_output}
}

function get_iam_group_info_by_name() {
    local OCI_TENANCY=$1
    local VAR_GROUP_NAME=$2

    local cli_output=$(oci iam group list --compartment-id ${OCI_TENANCY} --all | jq -r --arg VAR_GROUP_NAME ${VAR_GROUP_NAME} '.data[] | select(.name == $VAR_GROUP_NAME) | {name: .name, id: .id}')

    echo ${cli_output}
}

function create_iam_group() {
    local VAR_OCI_HOME_REGION=$1
    local OCI_TENANCY=$2
    local VAR_IAM_GROUP_NAME=$3
    local VAR_IAM_GROUP_DESCRIPTION=$4

    # Create the policy
    local cli_output=$(oci iam group create --region ${VAR_OCI_HOME_REGION} --compartment-id ${OCI_TENANCY} --name ${VAR_IAM_GROUP_NAME} --description ${VAR_IAM_GROUP_DESCRIPTION} | jq -r '.data | {name: .name, id: .id}')
    
    echo ${cli_output}
}

function check_if_goldengateDB_policy_exist() {
    local OCI_TENANCY=$1
    local VAR_POLICY_NAME=$2

    echo "Checking whether POLICY $VAR_POLICY_NAME exists in $OCI_TENANCY..."
    
    local VAR_FOUND_POLICY_NAME=$(oci iam policy list --compartment-id ${OCI_TENANCY} --all | jq -r --arg VAR_POLICY_NAME ${VAR_POLICY_NAME} '.data[] | select(.name == $VAR_POLICY_NAME) | .name')

    if [ "$VAR_FOUND_POLICY_NAME" == "$VAR_POLICY_NAME" ]; then
        return 0
    fi

    return -1
}

function create_goldengate_policy() {
    local VAR_OCI_HOME_REGION=$1
    local OCI_TENANCY=$2
    local VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT=$3
    local VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_OCID=$4

    local VAR_ORP_SERVICE_PROD_OCID="ocid1.tenancy.oc1..aaaaaaaayjet4no5xjbjbvedmylzosti4ifmyrqatm6li77t3lpzmufqeagq"
    local VAR_POLICY_NAME="MulticloudLink_ODBAA_GoldenGate_System_Policy"
    local VAR_POLICY_DESCRIPTION="Policies to grant execution rights for all operations on GoldenGate resources"

    if check_if_goldengateDB_policy_exist $OCI_TENANCY $VAR_POLICY_NAME; then
        echo "INFO: Policy with name $VAR_POLICY_NAME already exist, skipped creation"
        return 0
    fi

    echo ""
    echo "Creating policy ${VAR_POLICY_NAME} for: "
    echo "    Tenancy OCID:                               ${OCI_TENANCY}"
    echo "    MulticloudLink_ODBAA_YYYYMMDD compartment:  ${VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}"
    echo "    odbaa-goldengate-administrators group OCID: ${VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_OCID}"
    echo ""

    local VAR_ORACLEDBATAZURE="'ORACLEDBATAZURE'"
    local VAR_POLICY_STATEMENTS='[
    "Define group odbaa-goldengate-administrators as {VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_OCID}",
    "Define tenancy orp_service_prod as {VAR_ORP_SERVICE_PROD_OCID}",
    "Endorse group odbaa-goldengate-administrators to use cluster-placement-groups in tenancy orp_service_prod",

    "Allow group odbaa-goldengate-administrators to use organizations-assigned-subscription in tenancy WHERE ALL {target.subscription.serviceName = {VAR_ORACLEDBATAZURE}}",
    "Allow group odbaa-goldengate-administrators to read organizations-assigned-subscription in tenancy",
    "Allow group odbaa-goldengate-administrators to read limits in tenancy",
    "Allow group odbaa-goldengate-administrators to { MULTICLOUD_CONFIGURATION_READ } in tenancy",
    "Allow group odbaa-goldengate-administrators to { ORGANIZATIONS_SUBSCRIPTION_READ, ORGANIZATIONS_SUBSCRIPTION_INSPECT } in tenancy",

    "Allow group odbaa-goldengate-administrators to manage goldengate-family in compartment {VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}",

    "Allow group odbaa-goldengate-administrators to manage virtual-network-family in compartment {VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}",
    "Allow group odbaa-goldengate-administrators to { COMPARTMENT_INSPECT } in compartment {VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}",
    "Allow group odbaa-goldengate-administrators to { MULTICLOUD_CONFIGURATION_INSPECT } in compartment {VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}",

    "Allow group odbaa-goldengate-administrators to { MULTICLOUD_RESOURCE_ANCHOR_INSPECT, MULTICLOUD_RESOURCE_ANCHOR_READ } in compartment {VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}",
    "Allow group odbaa-goldengate-administrators to { MULTICLOUD_NETWORK_ANCHOR_INSPECT, MULTICLOUD_NETWORK_ANCHOR_READ, ODBAA_NETWORK_ANCHOR_INSPECT, ODBAA_NETWORK_ANCHOR_UPDATE } in compartment {VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}",
    "Allow group odbaa-goldengate-administrators to { MULTICLOUDLINK_INSPECT, MULTICLOUDLINK_READ } in compartment {VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}",
    "Allow group odbaa-goldengate-administrators to { MULTICLOUD_NETWORK_LINK_INSPECT, MULTICLOUD_NETWORK_LINK_READ } in compartment {VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}",
    "Allow group odbaa-goldengate-administrators to { MULTICLOUD_NETWORK_LINK_ATTACHMENT_INSPECT, MULTICLOUD_NETWORK_LINK_ATTACHMENT_READ, MULTICLOUD_NETWORK_LINK_ATTACHMENT_CREATE, MULTICLOUD_NETWORK_LINK_ATTACHMENT_UPDATE } in compartment {VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}",
    "Allow group odbaa-goldengate-administrators to read autonomous-database-family in compartment {VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}",
    "Allow service goldengate to manage tagnamespace in compartment {VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}"
    ]'

    VAR_POLICY_STATEMENTS=$(
      echo "${VAR_POLICY_STATEMENTS}" | \
      sed "s/{VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_OCID}/${VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_OCID}/" | \
      sed "s/{VAR_ORP_SERVICE_PROD_OCID}/${VAR_ORP_SERVICE_PROD_OCID}/" | \
      sed "s/{VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}/${VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT}/" | \
      sed "s/{VAR_ORACLEDBATAZURE}/${VAR_ORACLEDBATAZURE}/"
    )

    echo "Rendering policy: $VAR_POLICY_STATEMENTS"

    # Create the policy
    local cli_output=$(oci iam policy create \
      --region ${VAR_OCI_HOME_REGION} \
      --compartment-id ${OCI_TENANCY} \
      --name ${VAR_POLICY_NAME} \
      --description "${VAR_POLICY_DESCRIPTION}" \
      --statements "${VAR_POLICY_STATEMENTS}" \
    | jq -r '.data | {name: .name, id: .id}')
    
    echo "Policy created: ${cli_output}"
}

function main() {
    echo "Started"

    local VAR_OCI_HOME_REGION=$(get_home_region_name $OCI_TENANCY)

    echo "Home region: $VAR_OCI_HOME_REGION"

    # check if multicloud linked compartment exists
    local VAR_FOUND_COMPARTMENT_NAME=$(get_iam_compartment_name $OCI_TENANCY)
    if [[ "$VAR_FOUND_COMPARTMENT_NAME" == "MulticloudLink_ODBAA_"* ]]; then
        echo "Found compartment with name $VAR_FOUND_COMPARTMENT_NAME"
    else
        echo "Compartment with name matching MulticloudLink_ODBAA_* can't be found. Check if cloud linking succeeded"
        return -1
    fi
    VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT=$VAR_FOUND_COMPARTMENT_NAME
    
    # check if group exists
    local VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_NAME="odbaa-goldengate-administrators"
    local VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_DESC="Oracle GoldenGate Systems Administrators"

    local VAR_FOUND_GROUP_INFO=$(get_iam_group_info_by_name $OCI_TENANCY $VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_NAME)

    if [ "$(echo ${VAR_FOUND_GROUP_INFO} | jq -r '.name')" == "$VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_NAME" ]; then
        # skip creation
        echo "Found group info $VAR_FOUND_GROUP_INFO, skipped creation"
    else
        echo "Creating IAM group ${VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_NAME} in tenancy: ${OCI_TENANCY}"
        # group does not exist so create new
        local VAR_CREATED_GROUP_INFO=$(create_iam_group $VAR_OCI_HOME_REGION $OCI_TENANCY $VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_NAME $VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_DESC)
        if [ "$(echo ${VAR_CREATED_GROUP_INFO} | jq -r '.name')" == "$VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_NAME" ]; then
          echo "Group created $VAR_CREATED_GROUP_INFO"
          VAR_FOUND_GROUP_INFO=$VAR_CREATED_GROUP_INFO
        else
          echo "Can't create group $VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_NAME. Check permissions."
          return -1
        fi
    fi

    local VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_OCID=$(echo ${VAR_FOUND_GROUP_INFO} | jq -r '.id')

    create_goldengate_policy $VAR_OCI_HOME_REGION $OCI_TENANCY $VAR_MULTICLOUDLINK_ODBAA_COMPARTMENT $VAR_ODBAA_GOLDENGATE_ADMINISTRATORS_GROUP_OCID

    echo "DONE!"
}
main

allow group odbaa-goldengate-administrators to manage secret-family in compartment BASE_COMPARTMENT_GOES_HERE
allow group odbaa-goldengate-administrators to manage vaults in compartment BASE_COMPARTMENT_GOES_HERE
allow group odbaa-goldengate-administrators to manage keys in compartment BASE_COMPARTMENT_GOES_HERE

name: goldengate-deployments
Matching rule: ALL {resource.type = 'goldengatedeployment', resource.compartment.id = '<location>'}

allow dynamic-group goldengate-deployments to use keys in tenancy
allow dynamic-group goldengate-deployments to use vaults in tenancy
allow dynamic-group goldengate-deployments to read secret-bundles in tenancy