建立 IAM 模組

IAM 模組包含群組和原則的組態。將每個群組和原則定義為組態中的資源，並宣告必要的變數。

關於原則和群組

若要控制使用者對拓樸中資源的存取，請建立群組並指派原則，以將必要的權限授予每個群組。

下表列出多層架構的需要群組和權限：

群組	許可權
DBAdmins	讀取租用中的所有資源。 管理資料庫資源。
IAMAdminManagers	管理使用者。 管理 Administrators 和 NetSecAdmins 群組。 注意：當您訂閱 Oracle Cloud 時，Oracle 會建立 Administrators 群組。此群組中的使用者具有租用中所有資源的完整存取權，包括管理使用者和群組。將成員身分限制在此群組。
IAMManagers	管理使用者。 管理 Administrators 和 NetSecAdmins 以外的所有群組。
NetworkAdmins	讀取租用中的所有資源。 管理所有網路資源，安全清單、網際網路閘道、IPSec VPN 連線及客戶優先順序設備除外。
NetSecAdmins	讀取租用中的所有資源。 管理安全清單、網際網路閘道、客戶預備設備、IPSec VPN 連線以及負載平衡器。 使用所有虛擬網路資源。
ReadOnly	檢視並檢查租用。此群組是供不預期建立或管理任何資源 (例如，稽核員和受訓者) 的使用者使用。
StorageAdmins	讀取租用中的所有資源。 管理物件儲存與區塊磁碟區資源。
SysAdmins	讀取租用中的所有資源。 管理運算和儲存體資源。 管理區間。 請使用負載平衡器、子網路與 Vnic。

定義群組和原則

建立定義所需 Oracle Cloud Infrastructure Identity and Access Management 原則與群組的「終端」組態檔。

完成 iam 子目錄中的下列步驟：

1. 建立名為 variables.tf 的文字檔，然後將下列程式碼貼到檔案中。
   此代碼會宣告此模組中使用的變數。

   variable "tenancy_ocid" {}
   variable "app_tag" {}
   variable "environment" {}

2. 建立名為 groups.tf 的文字檔，然後將下列程式碼貼到檔案中。

   resource "oci_identity_group" "db_admins" {
     description = "Group for users allowed to manage the databases in the tenancy."
     name        = "DBAdmins.grp"
   }
   resource "oci_identity_group" "iam_admin_managers" {
     description = "Group for users allowed to modify the Administrators and NetSecAdmins group."
     name        = "IAMAdminManagers.grp"
   }
   
   resource "oci_identity_group" "iam_managers" {
     description = "Group for users allowed to modify all users and groups except the Administrators and NetSecAdmin groups."
     name        = "IAMManagers.grp"
   }
   
   resource "oci_identity_group" "net_sec_admins" {
     description = "Administrators of the VCNs, but restricted from the following resources: vcns, subnets, route-tables, dhcp-options, drgs, drg-attachments, vnics, vnic-attachments"
     name        = "NetSecAdmins.grp"
   }
   
   resource "oci_identity_group" "network_admins" {
     description = "Administrators of the VCNs, but restricted from the following resources: security-lists, internet-gateways, cpes, ipsec-connections"
     name        = "NetworkAdmins.grp"
   }
   
   resource "oci_identity_group" "read_only" {
     description = "Groups for users allowed to view and inspect the tenancy configuration; for example, trainees"
     name        = "ReadOnly.grp"
   }
   
   resource "oci_identity_group" "storage_admins" {
     description = "Group for users allowed manage the Storage resources in the tenancy."
     name        = "StorageAdmins.grp"
   }
   
   resource "oci_identity_group" "sys_admins" {
     description = "Group for users allowed manage the Compute and Storage resources in the tenancy. Tenant administrators should be in this group."
     name        = "SysAdmins.grp"
   }

3. 建立名為 policies.tf 的文字檔，然後將下列程式碼貼到檔案中。

   resource "oci_identity_policy" "iam_admin_managers" {
     name           = "IAMAdminManagers.pl"
     description    = "IAMAdminManagers.pl"
     compartment_id = "${var.tenancy_ocid}"
   
     statements = [
       "ALLOW GROUP ${oci_identity_group.iam_admin_managers.name} to read users IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.iam_admin_managers.name} to read groups IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.iam_admin_managers.name} to manage users IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.iam_admin_managers.name} to manage groups IN TENANCY where target.group.name = 'Administrators'",
       "ALLOW GROUP ${oci_identity_group.iam_admin_managers.name} to manage groups IN TENANCY where target.group.name = '${oci_identity_group.net_sec_admins.name}'",
     ]
   }
   
   resource "oci_identity_policy" "iam_managers" {
     name           = "IAMManagers.pl"
     description    = "IAMManagers.pl"
     compartment_id = "${var.tenancy_ocid}"
   
     statements = [
       "ALLOW GROUP ${oci_identity_group.iam_managers.name} to read users IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.iam_managers.name} to read groups IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.iam_managers.name} to manage users IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.iam_managers.name} to manage groups IN TENANCY where all {target.group.name ! = 'Administrators', target.group.name ! = '${oci_identity_group.net_sec_admins.name}'}",
     ]
   }
   
   resource "oci_identity_policy" "sys_admins" {
     name           = "SysAdmins.pl"
     description    = "SysAdmins.pl"
     compartment_id = "${var.tenancy_ocid}"
   
     statements = [
       "ALLOW GROUP ${oci_identity_group.sys_admins.name} to manage instance-family IN TENANCY where all {target.compartment.name=/*/, target.compartment.name!=/${var.app_tag}_${var.environment}_networks/}",
       "ALLOW GROUP ${oci_identity_group.sys_admins.name} to manage object-family IN TENANCY where all {target.compartment.name=/*/, target.compartment.name!=/${var.app_tag}_${var.environment}_networks/}",
       "ALLOW GROUP ${oci_identity_group.sys_admins.name} to manage volume-family IN TENANCY where all {target.compartment.name=/*/ , target.compartment.name!=/${var.app_tag}_${var.environment}_networks/}",
       "ALLOW GROUP ${oci_identity_group.sys_admins.name} to use load-balancers IN TENANCY where all {target.compartment.name=/*/ , target.compartment.name!=/${var.app_tag}_${var.environment}_networks/}",
       "ALLOW GROUP ${oci_identity_group.sys_admins.name} to use subnets IN TENANCY where target.compartment.name=/${var.app_tag}_${var.environment}_networks/",
       "ALLOW GROUP ${oci_identity_group.sys_admins.name} to use vnics IN TENANCY where target.compartment.name=/${var.app_tag}_${var.environment}_networks/",
       "ALLOW GROUP ${oci_identity_group.sys_admins.name} to use vnic-attachments IN TENANCY where target.compartment.name=/${var.app_tag}_${var.environment}_networks/",
       "ALLOW GROUP ${oci_identity_group.sys_admins.name} to manage compartments in Tenancy where all {target.compartment.name=/*/ , target.compartment.name!=/${var.app_tag}_${var.environment}_networks/, target.compartment.name!=/Shared-Infra-Services/}",
       "ALLOW GROUP ${oci_identity_group.sys_admins.name} to read all-resources IN TENANCY",
     ]
   }
   
   resource "oci_identity_policy" "storage_admins" {
     name           = "StorageAdmins.pl"
     description    = "StorageAdmins.pl"
     compartment_id = "${var.tenancy_ocid}"
   
     statements = [
       "ALLOW GROUP ${oci_identity_group.storage_admins.name} to manage object-family IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.storage_admins.name} to manage volume-family IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.storage_admins.name} to read all-resources IN TENANCY",
     ]
   }
   
   resource "oci_identity_policy" "db_admins" {
     name           = "DBAdmins.pl"
     description    = "DBAdmins.pl"
     compartment_id = "${var.tenancy_ocid}"
   
     statements = [
       "ALLOW GROUP ${oci_identity_group.db_admins.name} manage database-family IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.db_admins.name} read all-resources IN TENANCY",
     ]
   }
   
   resource "oci_identity_policy" "network_admins" {
     name           = "NetworkAdmins.pl"
     description    = "NetworkAdmins.pl"
     compartment_id = "${var.tenancy_ocid}"
   
     statements = [
       "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage vcns IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage subnets IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage route-tables IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage dhcp-options IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage drgs IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage cross-connects IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage cross-connect-groups IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage virtual-circuits IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage vnics IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage vnic-attachments IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.network_admins.name} to manage load-balancers IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.network_admins.name} to use virtual-network-family IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.network_admins.name} to read all-resources IN TENANCY",
     ]
   }
   
   resource "oci_identity_policy" "net_sec_admins" {
     name           = "NetSecAdmins.pl"
     description    = "NetSecAdmins.pl"
     compartment_id = "${var.tenancy_ocid}"
   
     statements = [
       "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to manage security-lists IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to manage internet-gateways IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to manage cpes IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to manage ipsec-connections IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to use virtual-network-family IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to manage load-balancers IN TENANCY",
       "ALLOW GROUP ${oci_identity_group.net_sec_admins.name} to read all-resources IN TENANCY",
     ]
   }
   
   resource "oci_identity_policy" "read_only" {
     name           = "ReadOnly.pl"
     description    = "ReadOnly.pl"
     compartment_id = "${var.tenancy_ocid}"
   
     statements = ["ALLOW GROUP ${oci_identity_group.read_only.name} to read all-resources IN TENANCY"]
   }

4. 建立名為 iam_outputs.tf 的檔案，然後將下列程式碼貼到檔案中。
   此代碼會使 Terraform 在建立後顯示資源 ID。

   output "db_admins_id" {
     value = "${oci_identity_group.db_admins.id}"
   }
   
   output "iam_admin_managers_id" {
     value = "${oci_identity_group.iam_admin_managers.id}"
   }
   
   output "iam_managers_id" {
     value = "${oci_identity_group.iam_managers.id}"
   }
   
   output "net_sec_admins_id" {
     value = "${oci_identity_group.net_sec_admins.id}"
   }
   
   output "network_admins_id" {
     value = "${oci_identity_group.network_admins.id}"
   }
   
   output "read_only_id" {
     value = "${oci_identity_group.read_only.id}"
   }
   
   output "storage_admins_id" {
     value = "${oci_identity_group.storage_admins.id}"
   }
   
   output "sys_admins_id" {
     value = "${oci_identity_group.sys_admins.id}"
   }