Pack of new modules for Oracle Cloud

[grzesjam]

Container-registry: creates CR and generates permissions
oci-config: parses oci cli config to be used in terraform
s3-compatible: module as drop in replacement of AWS's S3
user: creates user and manages policy in one place

[krzysztof-miemiec]

Can you add a sample resource that consumes the policy output to the example?

[krzysztof-miemiec]

1. That may be just me, but I'm not a fan of a lot of interpolation in outputs.tf and I'd keep it in main.tf in locals. You also may try to shorten it a bit by using extra locals.
2. Isn't it too narrow? I.e. what if I want to allow developers to manage the repo, but allow some application role to just pull fresh images?

Something like this:

#variables.tf

variable "policies" {
  type = map(list(string))
}

# main.tf
locals {
  repo_name = oci_artifacts_container_repository.terraform_container_registry.display_name
  repo_url = "${var.region}.ocir.io/${data.oci_objectstorage_namespace.namespace.namespace}/${local.repo_name}"

  policy_actions = ["read", "use", "manage"]
  
  policies = {
    for name, permissions in var.policies : name => flatten([
      for permission in permissions : [
        "Allow ${name} to ${permission} repos in compartment id ${var.compartment_id} where any { target.repo.name=/${local.repo_name}*/}"
      ]
    ])
  }
}

# outputs.tf

output "url" {
  value = local.repo_url
}

output "policies" {
  value = local.policies
}

output "policy" {
  # You can use flatten() to output everything in a single array as well
}

The above should accept something like:

module "container_registry_api_php" {
  policies = {
    "group foo" = ["read", "use", "manage"],
    "group bar" = ["read"]
  }
}

locals {
  resulting_policies = container_registry_api_php.policies
}

# resulting policies are as below:
{
  "group foo" = [
    "Allow group foo to read repos in compartment id some_id where any { target.repo.name=/repo_name*/}",
    "Allow group foo to use repos in compartment id some_id where any { target.repo.name=/repo_name*/}",
    "Allow group foo to manage repos in compartment id some_id where any { target.repo.name=/repo_name*/}",
  ],
  "group bar" = [
    "Allow group bar to read repos in compartment id some_id where any { target.repo.name=/repo_name*/}",
  ],
}

[michal-organek]

@grzesjam maybe stick (repo) convention output.tf ->outputs.tf and variable.tf ->variables.tf?

[grzesjam]

@krzysztof-miemiec

1. I prefer to have output in output, it's much easier to fix i something outputs incorrectly, I don't need to jump between all files. But I'm not sure which approach is more correct
2. I do understand you with your approach but with it, we expect someone already understanding how permissions in Oracle Cloud work, and what is needed which I don't like, it should "just work".
   How about just ask for "read" and "manage" group name and generate output with "read_permissions" and "full_permissions"?