Criar o Módulo IAM

O módulo IAM contém a configuração dos grupos e das políticas. Defina cada grupo e política como um recurso na configuração e declare as variáveis necessárias.

Sobre Políticas e Grupos

Para controlar o acesso de usuários aos recursos da sua topologia, crie grupos e atribua políticas para conceder as permissões necessárias a cada grupo.

A tabela a seguir lista os grupos e permissões necessários, geralmente para uma arquitetura de várias camadas:

Agrupar	Permissões
`DBAdmins`	Leia todos os recursos no tenancy. Gerenciar os recursos do banco de dados.
`IAMAdminManagers`	Gerenciar usuários. Gerencie os grupos `Administrators` e `NetSecAdmins`. Observação : A Oracle cria o grupo `Administrators` quando você assina o Oracle Cloud. Os usuários deste grupo têm acesso total a todos os recursos do tenancy, incluindo o gerenciamento de usuários e grupos. Limite a associação a este grupo.
`IAMManagers`	Gerenciar usuários. Gerencie todos os grupos, exceto `Administrators` e `NetSecAdmins`.
`NetworkAdmins`	Leia todos os recursos no tenancy. Gerencie todos os recursos de rede, exceto listas de segurança, gateways de internet, conexões do IPSec VPN e equipamento de preferências do cliente.
`NetSecAdmins`	Leia todos os recursos no tenancy. Gerencie listas de segurança, gateways da internet, equipamento de preferências do cliente, conexões do IPSec VPN e balanceadores de carga. Use todos os recursos de rede virtual.
`Somente para Leitura`	Exibir e inspecionar o tenancy. Este grupo é para usuários que não são esperados para criar ou gerenciar qualquer recurso (por exemplo, auditores e traços).
`StorageAdmins`	Leia todos os recursos no tenancy. Gerenciar os recursos de armazenamento de objetos e volume em blocos.
`SysAdmins`	Leia todos os recursos no tenancy. Gerenciar os recursos de computação e armazenamento. Gerencie compartimentos. Use balanceadores de carga, sub-redes e VNICs.

Definir os Grupos e as Políticas

Crie os arquivos de configuração do Terraform que definem as políticas e os grupos necessários do Oracle Cloud Infrastructure Identity and Access Management .

Conclua as seguintes etapas no subdiretório iam:

Crie um arquivo de texto chamado variables.tf e cole o código a seguir no arquivo.
Este código declara as variáveis usadas neste módulo.
```
variable "tenancy_ocid" {}
variable "app_tag" {}
variable "environment" {}
```

Crie um arquivo de texto chamado groups.tf e cole o código a seguir no arquivo.

resource "oci_identity_group" "db_admins" {
  description = "Group for users allowed to manage the databases in the tenancy."
  name        = "DBAdmins.grp"
}
resource "oci_identity_group" "iam_admin_managers" {
  description = "Group for users allowed to modify the Administrators and NetSecAdmins group."
  name        = "IAMAdminManagers.grp"
}

resource "oci_identity_group" "iam_managers" {
  description = "Group for users allowed to modify all users and groups except the Administrators and NetSecAdmin groups."
  name        = "IAMManagers.grp"
}

resource "oci_identity_group" "net_sec_admins" {
  description = "Administrators of the VCNs, but restricted from the following resources: vcns, subnets, route-tables, dhcp-options, drgs, drg-attachments, vnics, vnic-attachments"
  name        = "NetSecAdmins.grp"
}

resource "oci_identity_group" "network_admins" {
  description = "Administrators of the VCNs, but restricted from the following resources: security-lists, internet-gateways, cpes, ipsec-connections"
  name        = "NetworkAdmins.grp"
}

resource "oci_identity_group" "read_only" {
  description = "Groups for users allowed to view and inspect the tenancy configuration; for example, trainees"
  name        = "ReadOnly.grp"
}

resource "oci_identity_group" "storage_admins" {
  description = "Group for users allowed manage the Storage resources in the tenancy."
  name        = "StorageAdmins.grp"
}

resource "oci_identity_group" "sys_admins" {
  description = "Group for users allowed manage the Compute and Storage resources in the tenancy. Tenant administrators should be in this group."
  name        = "SysAdmins.grp"
}

Crie um arquivo de texto chamado policies.tf e cole o código a seguir no arquivo.

resource "oci_identity_policy" "iam_admin_managers" {
  name           = "IAMAdminManagers.pl"
  description    = "IAMAdminManagers.pl"
  compartment_id = "${var.tenancy_ocid}"

  statements = [
    "ALLOW GROUP ${oci_identity_group.iam_admin_managers.name} to read users IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.iam_admin_managers.name} to read groups IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.iam_admin_managers.name} to manage users IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.iam_admin_managers.name} to manage groups IN TENANCY where target.group.name = 'Administrators'",
    "ALLOW GROUP ${oci_identity_group.iam_admin_managers.name} to manage groups IN TENANCY where target.group.name = '${oci_identity_group.net_sec_admins.name}'",
  ]
}

resource "oci_identity_policy" "iam_managers" {
  name           = "IAMManagers.pl"
  description    = "IAMManagers.pl"
  compartment_id = "${var.tenancy_ocid}"

  statements = [
    "ALLOW GROUP ${oci_identity_group.iam_managers.name} to read users IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.iam_managers.name} to read groups IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.iam_managers.name} to manage users IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.iam_managers.name} to manage groups IN TENANCY where all {target.group.name ! = 'Administrators', target.group.name ! = '${oci_identity_group.net_sec_admins.name}'}",
  ]
}

resource "oci_identity_policy" "sys_admins" {
  name           = "SysAdmins.pl"
  description    = "SysAdmins.pl"
  compartment_id = "${var.tenancy_ocid}"

  statements = [
    "ALLOW GROUP ${oci_identity_group.sys_admins.name} to manage instance-family IN TENANCY where all {target.compartment.name=/*/, target.compartment.name!=/${var.app_tag}_${var.environment}_networks/}",
    "ALLOW GROUP ${oci_identity_group.sys_admins.name} to manage object-family IN TENANCY where all {target.compartment.name=/*/, target.compartment.name!=/${var.app_tag}_${var.environment}_networks/}",
    "ALLOW GROUP ${oci_identity_group.sys_admins.name} to manage volume-family IN TENANCY where all {target.compartment.name=/*/ , target.compartment.name!=/${var.app_tag}_${var.environment}_networks/}",
    "ALLOW GROUP ${oci_identity_group.sys_admins.name} to use load-balancers IN TENANCY where all {target.compartment.name=/*/ , target.compartment.name!=/${var.app_tag}_${var.environment}_networks/}",
    "ALLOW GROUP ${oci_identity_group.sys_admins.name} to use subnets IN TENANCY where target.compartment.name=/${var.app_tag}_${var.environment}_networks/",
    "ALLOW GROUP ${oci_identity_group.sys_admins.name} to use vnics IN TENANCY where target.compartment.name=/${var.app_tag}_${var.environment}_networks/",
    "ALLOW GROUP ${oci_identity_group.sys_admins.name} to use vnic-attachments IN TENANCY where target.compartment.name=/${var.app_tag}_${var.environment}_networks/",
    "ALLOW GROUP ${oci_identity_group.sys_admins.name} to manage compartments in Tenancy where all {target.compartment.name=/*/ , target.compartment.name!=/${var.app_tag}_${var.environment}_networks/, target.compartment.name!=/Shared-Infra-Services/}",
    "ALLOW GROUP ${oci_identity_group.sys_admins.name} to read all-resources IN TENANCY",
  ]
}

resource "oci_identity_policy" "storage_admins" {
  name           = "StorageAdmins.pl"
  description    = "StorageAdmins.pl"
  compartment_id = "${var.tenancy_ocid}"

  statements = [
    "ALLOW GROUP ${oci_identity_group.storage_admins.name} to manage object-family IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.storage_admins.name} to manage volume-family IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.storage_admins.name} to read all-resources IN TENANCY",
  ]
}

resource "oci_identity_policy" "db_admins" {
  name           = "DBAdmins.pl"
  description    = "DBAdmins.pl"
  compartment_id = "${var.tenancy_ocid}"

  statements = [
    "ALLOW GROUP ${oci_identity_group.db_admins.name} manage database-family IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.db_admins.name} read all-resources IN TENANCY",
  ]
}

resource "oci_identity_policy" "network_admins" {
  name           = "NetworkAdmins.pl"
  description    = "NetworkAdmins.pl"
  compartment_id = "${var.tenancy_ocid}"

  statements = [
    "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage vcns IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage subnets IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage route-tables IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage dhcp-options IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage drgs IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage cross-connects IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage cross-connect-groups IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage virtual-circuits IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage vnics IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage vnic-attachments IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage load-balancers IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.network_admins.name} to use virtual-network-family IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.network_admins.name} to read all-resources IN TENANCY",
  ]
}

resource "oci_identity_policy" "net_sec_admins" {
  name           = "NetSecAdmins.pl"
  description    = "NetSecAdmins.pl"
  compartment_id = "${var.tenancy_ocid}"

  statements = [
    "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to manage security-lists IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to manage internet-gateways IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to manage cpes IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to manage ipsec-connections IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to use virtual-network-family IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to manage load-balancers IN TENANCY",
    "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to read all-resources IN TENANCY",
  ]
}

resource "oci_identity_policy" "read_only" {
  name           = "ReadOnly.pl"
  description    = "ReadOnly.pl"
  compartment_id = "${var.tenancy_ocid}"

  statements = ["ALLOW GROUP ${oci_identity_group.read_only.name} to read all-resources IN TENANCY"]
}

Crie um arquivo chamado iam_outputs.tf e cole o código a seguir no arquivo.

Esse código faz com que o Terraform exiba os IDs dos recursos, depois que eles são criados.

output "db_admins_id" {
  value = "${oci_identity_group.db_admins.id}"
}

output "iam_admin_managers_id" {
  value = "${oci_identity_group.iam_admin_managers.id}"
}

output "iam_managers_id" {
  value = "${oci_identity_group.iam_managers.id}"
}

output "net_sec_admins_id" {
  value = "${oci_identity_group.net_sec_admins.id}"
}

output "network_admins_id" {
  value = "${oci_identity_group.network_admins.id}"
}

output "read_only_id" {
  value = "${oci_identity_group.read_only.id}"
}

output "storage_admins_id" {
  value = "${oci_identity_group.storage_admins.id}"
}

output "sys_admins_id" {
  value = "${oci_identity_group.sys_admins.id}"
}