Merge branch 'kral2:22-add-default-sl-lockdown-switch'

Author: hyder

CHANGELOG.adoc

@@ -9,6 +9,7 @@ The format is based on {uri-changelog}[Keep a Changelog].
 
 == unreleased
 * changed input region to be optional (fixes #18)
+* added a new parameter to lockdown the VCN Default Security List and option to revert to original state (fixes #22)
 
 == v1.0.3 (July 13,2020)
 

CONTRIBUTORS.adoc

@@ -9,3 +9,4 @@ CONTRIBUTORS
 
 - @karthicgit
 - @difu
+- @kral2

README.adoc

@@ -77,7 +77,7 @@ Learn how to {uri-contribute}[contribute].
 
 == License
 
-Copyright © 2019 Oracle and/or its associates. All rights reserved.
+Copyright © 2019, 2021, Oracle and/or its associates.
 
 Licensed under the {uri-license}[Universal Permissive License 1.0] as shown at 
 {uri-canonical-license}[https://oss.oracle.com/licenses/upl].

README.md

@@ -1,31 +1,5 @@
 # Terraform VCN for Oracle Cloud Infrastructure
 
-[changelog]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/CHANGELOG.adoc
-[contributing]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/CONTRIBUTING.adoc
-[contributors]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/CONTRIBUTORS.adoc
-[docs]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/tree/master/docs
-
-[license]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/LICENSE
-[canonical_license]: https://oss.oracle.com/licenses/upl/
-
-[oci]: https://cloud.oracle.com/cloud-infrastructure
-[oci_documentation]: https://docs.cloud.oracle.com/iaas/Content/home.htm
-
-[oracle]: https://www.oracle.com
-[prerequisites]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/docs/prerequisites.adoc
-
-[quickstart]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/docs/quickstart.adoc
-[repo]: https://github.com/oracle/terraform-oci-vcn
-[reuse]: https://github.com/oracle/terraform-oci-vcn/examples/db
-[subnets]: https://erikberg.com/notes/networks.html
-[terraform]: https://www.terraform.io
-[terraform_cidr_subnet]: http://blog.itsjustcode.net/blog/2017/11/18/terraform-cidrsubnet-deconstructed/
-[terraform_hashircorp_examples]: https://github.com/hashicorp/terraform-guides/tree/master/infrastructure-as-code/terraform-0.12-examples
-[terraform_oci]: https://www.terraform.io/docs/providers/oci/index.html
-[terraform_options]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/docs/terraformoptions.adoc
-[terraform_oci_examples]: https://github.com/terraform-providers/terraform-provider-oci/tree/master/examples
-[terraform_oci_oke]: https://github.com/oracle-terraform-modules/terraform-oci-oke
-
 The [Terraform VCN][repo] for [Oracle Cloud Infrastructure][OCI] provides a reusable [Terraform][terraform] module that provisions a minimal VCN on OCI.
 
 It creates the following resources:
@@ -35,22 +9,26 @@ It creates the following resources:
 * An optional NAT gateway
 * An optional service gateway
 
-This module is primarily meant to be reusable to create more advanced infrastructure on {uri-oci}[OCI] either manually in the OCI Console or by extending the Terraform code.
+It also controls the Default Security List, with a *Lockdown mode* that can be enabled or disabled.
+
+This module is primarily meant to be reusable to create more advanced infrastructure on [OCI][OCI] either manually in the OCI Console or by extending the Terraform code.
 
 ## [Documentation][docs]
 
 ### [Pre-requisites][prerequisites]
 
 #### Instructions
-- [Quickstart][quickstart]
-- [Reusing as a Terraform module][reuse]
-- [Terraform Options][terraform_options]
+
+* [Quickstart][quickstart]
+* [Reusing as a Terraform module][reuse]
+* [Terraform Options][terraform_options]
 
 ## Related Documentation, Blog
-- [Oracle Cloud Infrastructure Documentation][oci_documentation]
-- [Terraform OCI Provider Documentation][terraform_oci]
-- [Erik Berg on Networks, Subnets and CIDR][subnets]
-- [Lisa Hagemann on Terraform cidrsubnet Deconstructed][terraform_cidr_subnet]
+
+* [Oracle Cloud Infrastructure Documentation][oci_documentation]
+* [Terraform OCI Provider Documentation][terraform_oci]
+* [Erik Berg on Networks, Subnets and CIDR][subnets]
+* [Lisa Hagemann on Terraform cidrsubnet Deconstructed][terraform_cidr_subnet]
 
 ## Projects using this module
 
@@ -70,7 +48,35 @@ Learn how to [contribute][contributing].
 
 ## License
 
-Copyright (c) 2019, 2020 Oracle and/or its associates. All rights reserved.
+Copyright (c) 2019, 2021 Oracle and/or its associates.
+
+Licensed under the [Universal Permissive License 1.0][license] as shown at
+[https://oss.oracle.com/licenses/upl][canonical_license].
+
+<!-- Links reference section -->
+[changelog]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/CHANGELOG.adoc
+[contributing]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/CONTRIBUTING.adoc
+[contributors]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/CONTRIBUTORS.adoc
+[docs]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/tree/master/docs
+
+[license]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/LICENSE
+[canonical_license]: https://oss.oracle.com/licenses/upl/
 
-Licensed under the [Universal Permissive License 1.0][license] as shown at 
-[https://oss.oracle.com/licenses/upl][canonical_license].
+[oci]: https://cloud.oracle.com/cloud-infrastructure
+[oci_documentation]: https://docs.cloud.oracle.com/iaas/Content/home.htm
+
+[oracle]: https://www.oracle.com
+[prerequisites]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/docs/prerequisites.adoc
+
+[quickstart]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/docs/quickstart.adoc
+[repo]: https://github.com/oracle/terraform-oci-vcn
+[reuse]: https://github.com/oracle/terraform-oci-vcn/examples/db
+[subnets]: https://erikberg.com/notes/networks.html
+[terraform]: https://www.terraform.io
+[terraform_cidr_subnet]: http://blog.itsjustcode.net/blog/2017/11/18/terraform-cidrsubnet-deconstructed/
+[terraform_hashircorp_examples]: https://github.com/hashicorp/terraform-guides/tree/master/infrastructure-as-code/terraform-0.12-examples
+[terraform_oci]: https://www.terraform.io/docs/providers/oci/index.html
+[terraform_options]: https://github.com/oracle-terraform-modules/terraform-oci-vcn/blob/master/docs/terraformoptions.adoc
+[terraform_oci_examples]: https://github.com/terraform-providers/terraform-provider-oci/tree/master/examples
+[terraform_oci_oke]: https://github.com/oracle-terraform-modules/terraform-oci-oke
+<!-- Links reference section -->

docs/terraformoptions.adoc

@@ -86,6 +86,11 @@ tags = {
 |true/false
 |false
 
+|`lockdown_default_seclist`
+|whether to remove all default security rules from the VCN Default Security List
+|true/false
+|true
+
 |`nat_gateway_enabled`
 |Whether to create a NAT gateway. 
 |true/false

examples/README.md

@@ -78,6 +78,7 @@ module "vcn" {
   vcn_cidr                 = var.vcn_cidr
   vcn_dns_label            = var.vcn_dns_label
   vcn_name                 = var.vcn_name
+  lockdown_default_seclist = var.lockdown_default_seclist
 }
 ```
 

examples/main.tf

@@ -1,4 +1,4 @@
-# Copyright (c) 2019, 2020 Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright (c) 2019, 2021, Oracle Corporation and/or affiliates.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/
 
 module "vcn" {
@@ -15,6 +15,8 @@ module "vcn" {
   # vcn parameters
   internet_gateway_enabled = false
 
+  lockdown_default_seclist = true
+
   nat_gateway_enabled = false
 
   service_gateway_enabled = false

examples/variables.tf

@@ -1,4 +1,4 @@
-# Copyright (c) 2019, 2020 Oracle Corporation and/or affiliates.  All rights reserved.
+# Copyright (c) 2019, 2021, Oracle Corporation and/or affiliates.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl
 
 # provider identity parameters
@@ -82,3 +82,9 @@ variable "vcn_name" {
   description = "user-friendly name of to use for the vcn to be appended to the label_prefix"
   type        = string
 }
+
+variable "lockdown_default_seclist" {
+  description = "whether to remove all default security rules from the VCN Default Security List"
+  default     = true
+  type        = bool
+}

nat.tf

@@ -9,8 +9,8 @@ groupings:
     - vcn_cidr
     - vcn_name
     - vcn_dns_label
-    
- 
+    - lockdown_default_seclist
+
 variables:
   region:
     type: oci:identity:region:name
@@ -49,6 +49,12 @@ variables:
     required: true
     default: vcn
 
+  lockdown_default_seclist:
+    title: Enable VCN Default Security List Lockdown
+    type: string
+    required: false
+    default: true
+
   tags:
     type: map
     visible: false