|
| 1 | +resource "oci_identity_dynamic_group" "aqua-dynamic-group" { |
| 2 | + count = local.is_admin_policies_only ? 0 : 1 |
| 3 | + compartment_id = var.tenancy_ocid |
| 4 | + description = "Data Science Aqua Dynamic Group" |
| 5 | + name = var.aqua_dg_name |
| 6 | + matching_rule = local.is_resource_policy_required? local.aqua_dg_match: local.aqua_admin_only_dg_match |
| 7 | +} |
| 8 | + |
| 9 | +resource "oci_identity_dynamic_group" "distributed_training_job_runs" { |
| 10 | + count = local.is_resource_policy_required ? 1 : 0 |
| 11 | + compartment_id = var.tenancy_ocid |
| 12 | + description = "Data Science Distributed Training Job Runs Group" |
| 13 | + name = var.distributed_training_dg_name |
| 14 | + matching_rule = "any {all {resource.type='datasciencejobrun',resource.compartment.id='${var.compartment_ocid}'}}" |
| 15 | +} |
| 16 | + |
| 17 | + |
| 18 | +locals { |
| 19 | + is_admin_policies_only = var.deployment_type == "Only admin policies" |
| 20 | + is_resource_policy_only = var.deployment_type == "Only resource policies" |
| 21 | + is_all_policies = var.deployment_type == "All policies" |
| 22 | + is_resource_policy_required = var.deployment_type != "Only admin policies" |
| 23 | + // Aqua dg matching rules |
| 24 | + aqua_admin_only_dg_match = "all {resource.type='datasciencenotebooksession'}" |
| 25 | + aqua_dg_match = "any {all {resource.type='datasciencenotebooksession',resource.compartment.id='${var.compartment_ocid}'}, all {resource.type='datasciencemodeldeployment',resource.compartment.id='${var.compartment_ocid}'}, all {resource.type='datasciencejobrun',resource.compartment.id='${var.compartment_ocid}'}}" |
| 26 | + is_compartment_tenancy = length(regexall(".*tenancy.*", var.compartment_ocid)) > 0 |
| 27 | + compartment_policy_string = local.is_compartment_tenancy ? "tenancy" : "compartment id ${var.compartment_ocid}" |
| 28 | + policy_tenancy = local.is_resource_policy_only? var.compartment_ocid : var.tenancy_ocid |
| 29 | + // Contains only necessary admin policies. These policies will be created in the tenancy. When the user selects "Only admin policies" these policies will be created. |
| 30 | + aqua_admin_only_policies = local.is_admin_policies_only?[ |
| 31 | + "Define tenancy datascience as ocid1.tenancy.oc1..aaaaaaaax5hdic7ya6r5rxsgpifff4l6xdxzltnrncdzp3m75ubbvzqqzn3q", |
| 32 | + "Endorse any-user to read data-science-models in tenancy datascience where ALL {target.compartment.name='service-managed-models'}", |
| 33 | + "Endorse any-user to inspect data-science-models in tenancy datascience where ALL {target.compartment.name='service-managed-models'}", |
| 34 | + "Endorse any-user to read object in tenancy datascience where ALL {target.compartment.name='service-managed-models', target.bucket.name='service-managed-models'}", |
| 35 | + ]:[] |
| 36 | + |
| 37 | + tenancy_map = ({ |
| 38 | + oc1: "ocid1.tenancy.oc1..aaaaaaaax5hdic7ya6r5rxsgpifff4l6xdxzltnrncdzp3m75ubbvzqqzn3q" |
| 39 | + oc8: "ocid1.tenancy.oc8..aaaaaaaa2nxkxxix6ngdcifswvrezlmuylejvse4x6oa2ub4wfaduyz547wa" |
| 40 | + }) |
| 41 | + user_realm = element(split(".", var.tenancy_ocid), 2) |
| 42 | + service_tenancy_ocid = lookup(local.tenancy_map, local.user_realm, "UNKNOWN") |
| 43 | + |
| 44 | + // These are encompassing policies that will be created in the tenancy. When the user selects "All policies" these policies will be created. |
| 45 | + aqua_all_policies = local.is_all_policies? [ |
| 46 | + "Define tenancy datascience as ${local.service_tenancy_ocid}", |
| 47 | + "Endorse any-user to read data-science-models in tenancy datascience where ALL {target.compartment.name='service-managed-models'}", |
| 48 | + "Endorse any-user to inspect data-science-models in tenancy datascience where ALL {target.compartment.name='service-managed-models'}", |
| 49 | + "Endorse any-user to read object in tenancy datascience where ALL {target.compartment.name='service-managed-models', target.bucket.name='service-managed-models'}", |
| 50 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-model-deployments in ${local.compartment_policy_string}", |
| 51 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-models in ${local.compartment_policy_string}", |
| 52 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to use logging-family in ${local.compartment_policy_string}", |
| 53 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-jobs in ${local.compartment_policy_string}", |
| 54 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-job-runs in ${local.compartment_policy_string}", |
| 55 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to use virtual-network-family in ${local.compartment_policy_string}", |
| 56 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to read resource-availability in ${local.compartment_policy_string}", |
| 57 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-projects in ${local.compartment_policy_string}", |
| 58 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-notebook-sessions in ${local.compartment_policy_string}", |
| 59 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-modelversionsets in ${local.compartment_policy_string}", |
| 60 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to read buckets in ${local.compartment_policy_string}", |
| 61 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to read objectstorage-namespaces in ${local.compartment_policy_string}", |
| 62 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to inspect compartments in tenancy" |
| 63 | + ]:[] |
| 64 | + |
| 65 | + // Aqua resource only policies. These policies will be created in a specific compartment. When the user selects "Only resource policies" these policies will be created. |
| 66 | + aqua_resource_only_policies = local.is_resource_policy_only? [ |
| 67 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-model-deployments in ${local.compartment_policy_string}", |
| 68 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-models in ${local.compartment_policy_string}", |
| 69 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to use logging-family in ${local.compartment_policy_string}", |
| 70 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-jobs in ${local.compartment_policy_string}", |
| 71 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-job-runs in ${local.compartment_policy_string}", |
| 72 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to use virtual-network-family in ${local.compartment_policy_string}", |
| 73 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to read resource-availability in ${local.compartment_policy_string}", |
| 74 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-projects in ${local.compartment_policy_string}", |
| 75 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-notebook-sessions in ${local.compartment_policy_string}", |
| 76 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage data-science-modelversionsets in ${local.compartment_policy_string}", |
| 77 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to read buckets in ${local.compartment_policy_string}", |
| 78 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to read objectstorage-namespaces in ${local.compartment_policy_string}", |
| 79 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to inspect compartments in ${local.compartment_policy_string}" |
| 80 | + ]:[] |
| 81 | + |
| 82 | + policies_to_use = local.is_admin_policies_only ? local.aqua_admin_only_policies : local.is_resource_policy_only ? local.aqua_resource_only_policies : local.aqua_all_policies |
| 83 | + |
| 84 | + all_buckets = concat(var.user_model_buckets, var.user_data_buckets) |
| 85 | + bucket_names = join(", ", formatlist("target.bucket.name='%s'", local.all_buckets)) |
| 86 | + bucket_names_oss = join(", ", formatlist("all{target.bucket.name='%s', any {request.permission='OBJECT_CREATE', request.permission='OBJECT_INSPECT'}}", local.all_buckets)) |
| 87 | + dt_jr_policies = local.is_resource_policy_required?[ |
| 88 | + "Allow dynamic-group id ${oci_identity_dynamic_group.distributed_training_job_runs[0].id} to use logging-family in ${local.compartment_policy_string}", |
| 89 | + "Allow dynamic-group id ${oci_identity_dynamic_group.distributed_training_job_runs[0].id} to manage data-science-models in ${local.compartment_policy_string}", |
| 90 | + "Allow dynamic-group id ${oci_identity_dynamic_group.distributed_training_job_runs[0].id} to read data-science-jobs in ${local.compartment_policy_string}" |
| 91 | + ]: [] |
| 92 | + dt_jr_policies_target_buckets = local.is_resource_policy_required? [ |
| 93 | + "Allow dynamic-group id ${oci_identity_dynamic_group.distributed_training_job_runs[0].id} to manage objects in ${local.compartment_policy_string} where any {${local.bucket_names}}", |
| 94 | + "Allow dynamic-group id ${oci_identity_dynamic_group.distributed_training_job_runs[0].id} to read buckets in ${local.compartment_policy_string} where any {${local.bucket_names}}" |
| 95 | + ]: [] |
| 96 | + aqua_policies_target_buckets = local.is_resource_policy_required?[ |
| 97 | + "Allow dynamic-group id ${oci_identity_dynamic_group.aqua-dynamic-group[0].id} to manage object-family in ${local.compartment_policy_string} where any {${local.bucket_names_oss}}" |
| 98 | + ]:[] |
| 99 | + |
| 100 | +} |
| 101 | + |
| 102 | +resource "oci_identity_policy" "aqua-policy" { |
| 103 | + compartment_id = local.policy_tenancy |
| 104 | + description = "Data Science Aqua Policies" |
| 105 | + name = var.aqua_policy_name |
| 106 | + statements = length(local.bucket_names) > 0 ? concat(local.policies_to_use, local.aqua_policies_target_buckets): local.policies_to_use |
| 107 | +} |
| 108 | + |
| 109 | +resource "oci_identity_policy" "distributed_training_job_runs_policy" { |
| 110 | + count = local.is_resource_policy_required ? 1 : 0 |
| 111 | + compartment_id = local.policy_tenancy |
| 112 | + description = "Distributed Training Job Runs Policies" |
| 113 | + name = var.distributed_training_policy_name |
| 114 | + statements = length(local.bucket_names) > 0 ? concat(local.dt_jr_policies, local.dt_jr_policies_target_buckets) : local.dt_jr_policies |
| 115 | +} |
| 116 | + |
| 117 | + |
0 commit comments