Skip to content

Commit 323bcd8

Browse files
rrywhenshelby-willis-lzernagurogmackeig
authored
Release 1.0.2 (#3)
* Initial commit * Lanz-3565 * optional load balancer * Add compute instance and cloudinit shell script * updates to cloudinit.sh * use compatible compute image for GPU shapes * schema created * networking updates * schema update * update instance with new marketplace image * update instance with fault domain * update default name * update gpu image and hostname * LANZ-3568_doco complete * Corrected a typo in DEPLOYMENT-GUIDE.md * Release date is To Be Determined * update type * fix typo * LANZ-3568 doco for add-nsg-option * Update Documentation * Update Tagging * Release 1.0.1 * README.md update for Known Issues * Lanz 3807 * enable boot volume encryption with cis level 2 * Add CIS Level 2 Compliance * Update Documentation * fix merge conflicts --------- Co-authored-by: shelby_willis <shelby.willis@oracle.com> Co-authored-by: erna_guerrero <erna.guerrero@oracle.com> Co-authored-by: Gregg MacKeigan <gregg.mackeigan@oracle.com>
1 parent ec0eca6 commit 323bcd8

File tree

9 files changed

+145
-34
lines changed

9 files changed

+145
-34
lines changed

‎ai_transaction_monitoring_workload/README.md

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,14 +95,23 @@ Once you have the data in the right format, you can pass it through the model to
9595

9696
Please see the [Deployment Guide](DEPLOYMENT-GUIDE.md) for instructions on how to set up an OCI tenancy as a prerequisite. See also the details below on making GPU compute capacity available in that tenancy.
9797

98+
Within this module you will find the [examples](../ai_transaction_monitoring_workload/examples) folder. The folder contains an example that is a fully runnable Terraform configuration (without the public load balancer) that you can quickly test and put to use by modifying the input data according to your own needs.
99+
100+
After training your GNN model (like GraphSAGE) on transactional data, during inference, you can input a new transaction (or a batch of transactions) into the model. The model would then analyze the transaction's features (and potentially its connections in the graph, like related transactions or accounts) and output a prediction, such as a score or label that indicates whether the transaction is fraudulent or not.
101+
98102
### GPU Compute Capacity
99103

100104
Note that to use NVIDIA GPU compute instances in an OCI Availability Domain (AD), a prerequisite is to increase service limit counts for the GPU shape(s) you need to use. Before attempting to deploy this workload, please **open an OCI service request to make the necessary adjustments** under Tenancy Administration > Limits, Quotas and Usage.
101105

102-
![increased GPU service limts](../images/GPU_svc_lmts.png)
106+
![increased GPU service limits](../images/GPU_svc_lmts.png)
103107

104108
See [Known Issues](#known-issues) below for more details, including how to accept the "Oracle and Nvidia Terms of Use".
105109

110+
### CIS Level Benchmark
111+
112+
This workload provides the option to choose which [CIS OCI Benchmark Level](https://www.cisecurity.org/benchmark/oracle_cloud) to apply to resources with the input variable *cis_level*. The benchmark defines configuration profiles, relating to criticality levels of particular security controls. Items in Level 1 intend to be practical and prudent, providing security focused best-practice hardening of a technology. Level 2 extends level 1 and is intended for environments where security is more critical than manageability and usability, acting as defense-in-depth measure.
113+
114+
CIS Level 1 ensures Legacy IMDS Metadata V1 endpoints on compute instances are disabled. CIS Level 2 extends that and encrypts block volumes with a customer-managed key.
106115

107116
## CIS OCI Foundations Benchmark Modules Collection
108117

@@ -156,3 +165,7 @@ Released under the Universal Permissive License v1.0 as shown at <https://oss.or
156165
157166
Further Information: Out of capacity for shape VM.GPU.A10.1 in availability domain wxyz:US-ASHBURN-AD-1 and fault domain FAULT-DOMAIN-1. Try creating the instance without specifying fault domain or try again later.
158167
```
168+
169+
**3. Compute GPU Shapes Are Not Supported by Shielded Instances and Secure Boot**
170+
171+
* Be aware that UEFI Secure Boot is not available when using GPU shapes in OCI. See [Shielded Instances > Supported Shapes and Images](https://docs.oracle.com/en-us/iaas/Content/Compute/References/shielded-instances.htm#shielded-instances-supported-shapes).

‎ai_transaction_monitoring_workload/RELEASE-NOTES.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
# AI Transaction Monitoring Workload Release Notes
22

3+
## July 18, 2025 Release Notes - 1.0.2
4+
1. Added CIS Level toggle and support for CIS Level 1 and 2 benchmark.
5+
2. Added customer key input and ability to disable legacy Instance Metadata Service (IMDS) endpoints.
6+
37
## May 30, 2025 Release Notes - 1.0.1
48
1. Tag namespace updated to include ocilz prefix and tag default updated to include current release number.
59
2. General bug fixes.

‎ai_transaction_monitoring_workload/SPEC.md

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,15 +14,16 @@
1414

1515
| Name | Source | Version |
1616
|------|--------|---------|
17-
| <a name="module_workload_compute"></a> [workload\_compute](#module\_workload\_compute) | github.com/oci-landing-zones/terraform-oci-modules-workloads//cis-compute-storage | v0.1.9 |
18-
| <a name="module_workload_lb"></a> [workload\_lb](#module\_workload\_lb) | github.com/oci-landing-zones/terraform-oci-cis-landing-zone-networking.git | v0.7.3/modules/l7\_load\_balancers |
17+
| <a name="module_workload_compute"></a> [workload\_compute](#module\_workload\_compute) | github.com/oci-landing-zones/terraform-oci-modules-workloads//cis-compute-storage | v0.2.1 |
18+
| <a name="module_workload_lb"></a> [workload\_lb](#module\_workload\_lb) | github.com/oci-landing-zones/terraform-oci-cis-landing-zone-networking.git | v0.7.5/modules/l7_load_balancers |
19+
| <a name="module_workload_tags"></a> [workload\_tags](#module\_workload\_tags) | github.com/oci-landing-zones/terraform-oci-modules-governance//tags | v0.1.5 |
1920

2021
## Resources
2122

2223
| Name | Type |
2324
|------|------|
24-
| [oci\_core\_images.gpu_images](https://registry.terraform.io/providers/oracle/oci/latest/docs/data-sources/core\_images) | data source |
25-
| [oci\_core\_subnet.lb_subnet](https://registry.terraform.io/providers/oracle/oci/latest/docs/data-sources/core\_subnet) | data source |
25+
| [oci_core_images.gpu_images](https://registry.terraform.io/providers/oracle/oci/latest/docs/data-sources/core_images) | data source |
26+
| [oci_core_subnet.lb_subnet](https://registry.terraform.io/providers/oracle/oci/latest/docs/data-sources/core_subnet) | data source |
2627

2728
## Inputs
2829

@@ -32,19 +33,21 @@
3233
| <a name="input_app_nsg_ocid"></a> [app\_nsg\_ocid](#input\_app\_nsg\_ocid) | OCID of the existing Network Security Group (NSG). Required security rules should be set up prior to workload deployment. | `string` | `null` | no |
3334
| <a name="input_app_subnet_ocid"></a> [app\_subnet\_ocid](#input\_app\_subnet\_ocid) | OCID of the existing App Subnet. | `string` | `null` | no |
3435
| <a name="input_block_volume_size"></a> [block\_volume\_size](#input\_block\_volume\_size) | Block volume size (in GBs) to be attached to the compute instance. | `number` | `200` | no |
36+
| <a name="input_cis_level"></a> [cis\_level](#input\_cis\_level) | Determines CIS OCI Benchmark Level to apply on workload managed resources. Level 1 is be practical and prudent. Level 2 is intended for environments where security is more critical than manageability and usability. Level 2 drives the creation of block volume encryption with a customer managed key. | `string` | `"1"` | no |
3537
| <a name="input_compute_availability_domain"></a> [compute\_availability\_domain](#input\_compute\_availability\_domain) | Availability domain where the compute instance will be deployed. Default is AD-1. | `number` | `1` | no |
3638
| <a name="input_compute_boot_volume_size"></a> [compute\_boot\_volume\_size](#input\_compute\_boot\_volume\_size) | Boot volume size (in GBs) of the compute instance. | `number` | `250` | no |
3739
| <a name="input_compute_fault_domain"></a> [compute\_fault\_domain](#input\_compute\_fault\_domain) | Fault domain where the compute instance will be deployed. Default is FD-1. | `number` | `1` | no |
3840
| <a name="input_compute_shape"></a> [compute\_shape](#input\_compute\_shape) | GPU-based shape of the compute instance. | `string` | `"VM.GPU.A10.1"` | no |
3941
| <a name="input_compute_ssh_public_key"></a> [compute\_ssh\_public\_key](#input\_compute\_ssh\_public\_key) | Public SSH Key used to access the compute instance. | `string` | `null` | no |
42+
| <a name="input_customer_key_ocid"></a> [customer\_key\_ocid](#input\_customer\_key\_ocid) | OCID of the customer-managed encryption key. Required for CIS Level 2. | `string` | `null` | no |
4043
| <a name="input_fingerprint"></a> [fingerprint](#input\_fingerprint) | n/a | `string` | `""` | no |
4144
| <a name="input_lb_policy"></a> [lb\_policy](#input\_lb\_policy) | The load balancing policy for distributing incoming traffic to backend servers. | `string` | `"ROUND_ROBIN"` | no |
4245
| <a name="input_lb_subnet_ocid"></a> [lb\_subnet\_ocid](#input\_lb\_subnet\_ocid) | OCID of the Load Balancer Subnet. | `string` | `""` | no |
43-
| <a name="input_private_key_password"></a> [private\_key\_password](#input\_private\_key\_password) | n/a | `string` | `""` | no |
44-
| <a name="input_private_key_path"></a> [private\_key\_path](#input\_private\_key\_path) | n/a | `string` | `""` | no |
46+
| <a name="input_private_key_password"></a> [private\_key\_password](#input\_private\_key\_password) | Private key password | `string` | `""` | no |
47+
| <a name="input_private_key_path"></a> [private\_key\_path](#input\_private\_key\_path) | Private key path | `string` | `""` | no |
4548
| <a name="input_region"></a> [region](#input\_region) | The region where resources are deployed. | `string` | n/a | yes |
46-
| <a name="input_tenancy_ocid"></a> [tenancy\_ocid](#input\_tenancy\_ocid) | General | `string` | `""` | no |
47-
| <a name="input_user_ocid"></a> [user\_ocid](#input\_user\_ocid) | n/a | `string` | `""` | no |
49+
| <a name="input_tenancy_ocid"></a> [tenancy\_ocid](#input\_tenancy\_ocid) | Tenancy OCID | `string` | `""` | no |
50+
| <a name="input_user_ocid"></a> [user\_ocid](#input\_user\_ocid) | User OCID | `string` | `""` | no |
4851
| <a name="input_workload_compartment_ocid"></a> [workload\_compartment\_ocid](#input\_workload\_compartment\_ocid) | OCID of the existing Workload Compartment. | `string` | `null` | no |
4952
| <a name="input_workload_name"></a> [workload\_name](#input\_workload\_name) | Name of the workload. Default name is TMS | `string` | `"TMS"` | no |
5053

‎ai_transaction_monitoring_workload/examples/instance-without-public-load-balancer/variables.tf

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,11 @@ variable "app_nsg_ocid" {
5454
default = null
5555
}
5656

57+
variable "customer_key_ocid" {
58+
description = "OCID of the customer-managed encryption key. Required for CIS Level 2."
59+
type = string
60+
default = null
61+
}
5762
# ------------------------------------------------------
5863
# ----- Compute Instance
5964
#-------------------------------------------------------
@@ -88,6 +93,12 @@ variable "compute_fault_domain" {
8893
default = 1
8994
}
9095

96+
variable "compute_disable_legacy_imds_endpoints" {
97+
description = "Whether the compute instance legacy metadata service endpoints should be disabled. Legacy service endpoints such as IMDSv1 are disabled by default. Set to `true` to disable legacy service endpoints."
98+
type = bool
99+
default = true
100+
}
101+
91102
# ------------------------------------------------------
92103
# ----- Block Volume
93104
#-------------------------------------------------------

‎ai_transaction_monitoring_workload/mon_tags.tf

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,10 @@
33

44
locals {
55
# These values can be used in an override file.
6-
tag_namespace_name = ""
7-
all_tags_defined_tags = {}
8-
all_tags_freeform_tags = {}
9-
10-
tag_default_value = fileexists("${path.module}/release.txt") ? "${file("${path.module}/release.txt")}" : "undefined"
6+
tag_namespace_name = ""
7+
all_tags_defined_tags = {}
8+
all_tags_freeform_tags = {}
9+
tag_default_value = fileexists("${path.module}/release.txt") ? "${file("${path.module}/release.txt")}" : "undefined"
1110

1211
tags_configuration = {
1312
default_compartment_id = var.tenancy_ocid
@@ -27,7 +26,7 @@ locals {
2726
tag_defaults = {
2827
WORKLOAD-TAG-DEFAULT = {
2928
compartment_ids = [var.workload_compartment_ocid]
30-
default_value = local.tag_default_value
29+
default_value = local.tag_default_value
3130
}
3231
}
3332
}

‎ai_transaction_monitoring_workload/net_instance.tf

Lines changed: 26 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,9 @@ data "oci_core_images" "gpu_images" {
1515
values = ["NATIVE"]
1616
}
1717
filter {
18-
name = "display_name"
18+
name = "display_name"
1919
values = ["\\w*GPU\\w*"]
20-
regex = true
20+
regex = true
2121
}
2222
}
2323

@@ -26,10 +26,11 @@ locals {
2626
default_compartment_id = var.workload_compartment_ocid
2727
default_subnet_id = var.app_subnet_ocid
2828
default_ssh_public_key_path = var.compute_ssh_public_key
29-
instances = {
29+
instances = {
3030
WORKLOAD-INSTANCE = {
31-
shape = var.compute_shape
32-
name = "${var.workload_name}-instance"
31+
shape = var.compute_shape
32+
name = "${var.workload_name}-instance"
33+
disable_legacy_imds_endpoints = var.cis_level == "2" ? true : var.compute_disable_legacy_imds_endpoints
3334
placement = {
3435
availability_domain = var.compute_availability_domain
3536
fault_domain = var.compute_fault_domain
@@ -50,41 +51,49 @@ locals {
5051
disable_monitoring = false
5152
disable_management = false
5253
plugins = [
53-
{name = "Custom Logs Monitoring", enabled = true},
54-
{name = "Compute Instance Run Command", enabled = true},
55-
{name = "Compute Instance Monitoring", enabled = true}
54+
{ name = "Custom Logs Monitoring", enabled = true },
55+
{ name = "Compute Instance Run Command", enabled = true },
56+
{ name = "Compute Instance Monitoring", enabled = true }
5657
]
5758
}
5859
cloud_init = {
5960
script_file = "./cloudinit.sh"
6061
}
62+
encryption = {
63+
encrypt_in_transit_on_instance_create = true
64+
kms_key_id = var.cis_level == "2" ? var.customer_key_ocid : null
65+
}
6166
}
6267
}
6368
}
6469
storage_configuration = {
6570
default_compartment_id = var.workload_compartment_ocid
6671
block_volumes = {
6772
BLOCK-VOLUME = {
68-
display_name = "${var.workload_name}-block-volume"
69-
volume_size = var.block_volume_size
73+
display_name = "${var.workload_name}-block-volume"
74+
volume_size = var.block_volume_size
7075
availability_domain = var.compute_availability_domain
7176
attach_to_instances = [{
72-
device_name = null
73-
instance_id = "WORKLOAD-INSTANCE"
77+
device_name = null
78+
instance_id = "WORKLOAD-INSTANCE"
7479
attachment_type = "paravirtualized"
75-
}]
80+
}]
81+
encryption = {
82+
encrypt_in_transit = true
83+
kms_key_id = var.cis_level == "2" ? var.customer_key_ocid : null
84+
}
7685
}
7786
}
7887
}
7988
}
8089

8190
module "workload_compute" {
82-
source = "github.com/oci-landing-zones/terraform-oci-modules-workloads//cis-compute-storage?ref=v0.1.9"
91+
source = "github.com/oci-landing-zones/terraform-oci-modules-workloads//cis-compute-storage?ref=v0.2.1"
8392
providers = {
84-
oci = oci
93+
oci = oci
8594
oci.block_volumes_replication_region = oci
8695
}
8796
instances_configuration = local.instances_configuration
88-
tenancy_ocid = var.tenancy_ocid
89-
storage_configuration = local.storage_configuration
97+
tenancy_ocid = var.tenancy_ocid
98+
storage_configuration = local.storage_configuration
9099
}

‎ai_transaction_monitoring_workload/release.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.0.1
1+
1.0.2

‎ai_transaction_monitoring_workload/schema.yml

Lines changed: 56 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ variableGroups:
1515
- title: "General"
1616
variables:
1717
- "workload_name"
18+
- "cis_level"
1819
- "workload_compartment_ocid"
1920
- "app_subnet_compartment_ocid"
2021
- "app_subnet_ocid"
@@ -31,6 +32,10 @@ variableGroups:
3132
- "compute_availability_domain"
3233
- "compute_fault_domain"
3334
- "block_volume_size"
35+
- "customer_key_compartment_ocid"
36+
- "vault_ocid"
37+
- "customer_key_ocid"
38+
- "compute_disable_legacy_imds_endpoints"
3439

3540
- title: "Hidden Variables"
3641
variables:
@@ -56,6 +61,15 @@ variables:
5661
required: true
5762
default: "TMS"
5863

64+
cis_level:
65+
type: enum
66+
title: "CIS Level"
67+
description: "Choose the CIS OCI Benchmark Level to apply on workload managed resources. Level 1 (default) is be practical and prudent. Level 2 is intended for environments where security is more critical than manageability and usability. Level 2 drives the creation of block volume encryption with a customer managed key. More info: <a href=\"https://www.cisecurity.org/benchmark/oracle_cloud\">CIS OCI Benchmark</a>."
68+
required: true
69+
enum:
70+
- "1"
71+
- "2"
72+
5973
workload_compartment_ocid:
6074
type: oci:identity:compartment:id
6175
title: "Workload Compartment OCID"
@@ -176,12 +190,53 @@ variables:
176190
required: false
177191
default: 200
178192

193+
customer_key_compartment_ocid:
194+
type: oci:identity:compartment:id
195+
title: "Customer-Managed Key Compartment"
196+
description: "Choose the compartment where the customer-managed key and vault are contained. Required for CIS Level 2."
197+
required: false
198+
visible:
199+
eq:
200+
- ${cis_level}
201+
- "2"
202+
203+
vault_ocid:
204+
type: oci:kms:vault:id
205+
title: "Customer-Managed Vault"
206+
description: "Choose the vault that contains the customer-managed key. Required for CIS Level 2."
207+
required: false
208+
dependsOn:
209+
compartmentId: ${customer_key_compartment_ocid}
210+
visible:
211+
eq:
212+
- ${cis_level}
213+
- "2"
214+
215+
customer_key_ocid:
216+
type: oci:kms:key:id
217+
title: "Customer-Managed Key"
218+
description: "Choose the customer-managed key used to encrypt boot and block volumes. Required for CIS Level 2."
219+
required: false
220+
dependsOn:
221+
compartmentId: ${customer_key_compartment_ocid}
222+
vaultId: ${vault_ocid}
223+
visible:
224+
eq:
225+
- ${cis_level}
226+
- "2"
227+
228+
compute_disable_legacy_imds_endpoints:
229+
type: boolean
230+
title: "Disable the Legacy Metadata Service Endpoints?"
231+
description: "Check to disable the Legacy Metadata Service endpoints. Required for CIS Level 2."
232+
required: false
233+
179234
# ------------------------------------------------------
180235
# ------------ Hidden Vars --------------------------
181236
#-------------------------------------------------------
182237

183238
lb_policy:
184-
description: "The load balancing policy for distrubuting incoming traffic to backend servers."
239+
description: "The load balancing policy for distributing incoming traffic to backend servers."
185240
type: string
186241
default: "ROUND_ROBIN"
187242
visible: false

‎ai_transaction_monitoring_workload/variables.tf

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,17 @@ variable "app_nsg_ocid" {
5454
default = null
5555
}
5656

57+
variable "cis_level" {
58+
description = "Determines CIS OCI Benchmark Level to apply on workload managed resources. Level 1 is be practical and prudent. Level 2 is intended for environments where security is more critical than manageability and usability. Level 2 drives the creation of block volume encryption with a customer managed key."
59+
type = string
60+
default = "1"
61+
}
62+
63+
variable "customer_key_ocid" {
64+
description = "OCID of the customer-managed encryption key. Required for CIS Level 2."
65+
type = string
66+
default = null
67+
}
5768
# ------------------------------------------------------
5869
# ----- Compute Instance
5970
#-------------------------------------------------------
@@ -88,6 +99,12 @@ variable "compute_fault_domain" {
8899
default = 1
89100
}
90101

102+
variable "compute_disable_legacy_imds_endpoints" {
103+
description = "Whether the compute instance legacy metadata service endpoints should be disabled. Legacy service endpoints such as IMDSv1 are disabled by default. Set to `true` to disable legacy service endpoints."
104+
type = bool
105+
default = true
106+
}
107+
91108
# ------------------------------------------------------
92109
# ----- Block Volume
93110
#-------------------------------------------------------

0 commit comments

Comments
 (0)