Skip to content

one_oe_hub_e.md

Latest commit

 

History

History
129 lines (80 loc) · 11 KB

one_oe_hub_e.md

File metadata and controls

129 lines (80 loc) · 11 KB
Raw

One-OE + Hub E: One-Stack Deployment

Overview

This document provides a detailed overview of the One-OE Landing Zone with Hub E addon, including its components and deployment guidance.

 

Deployment diagram

The diagram provides a comprehensive visual representation of the key OCI resources - such as Identity Domains, groups, compartments, IP CIDR ranges, and route table configurations - including their exact naming conventions, as defined in the One-OE JSON configurations.

 

Note

In the JSON configurations, the default OCI region is set to Frankfurt, and this is reflected in the naming conventions (e.g., vcn-fra-lz-hub). For deployments in other regions, the JSON configurations must be updated accordingly to ensure that the resource names align with the target region.

 

Two deployment options are available: One-Stack deployment with CIS Level 1 and CIS Level 2 security controls.

  • CIS Level 1 is recommended in scenarios where:

    • CIS Level 1 Security Controls meet your security requirements.
    • You are exploring or testing configurations and need to deploy and tear down environments quickly.
    • You are creating a proof-of-concept (PoC) environment.

  • CIS Level 2 is recommended in scenarios where:

    • Your security requirements mandate CIS Level 2 Security Controls (for example, deploying a Vault to manage your encryption keys and force the encryption of all your data with them, block storage, object storage, etc.).

 

For details on the Security Zone policies included in each deployment option, see Security Zones - CIS Level 1 and Security Zones - CIS Level 2.

 

Input configurations for CIS Level 1

JSON configurations Configuration-defined components
IAM configuration
oneoe_iam.json		 • Compartments
• Identity Domain
• IAM groups and policies
Governance configuration
oneoe_governance.json		 • Tag namespace
• Tag key definition
Network configuration
oneoe_network_hub_e.json		 • Hub E VCN with associated subnets
• Internet, NAT and Service gateways
• Dynamic Routing Gateway (DRG)
• Route Tables with corresponding route rules
• Two Spoke VCNs (Prod and PreProd) with private-only subnets
• NAT and Service gateways in the Spoke VCNs
• Security Lists (SLs) and Network Security Groups (NSGs)
• Public Load Balancer (free tier LBaaS) with two example backend IP addresses from the production web tier: 10.0.64.10 and 10.0.64.20. The LBaaS and backend configurations are provided solely for example purposes and should be updated to reference actual workload instances
Security configuration for
Step 1: oneoe_security_cis1_pre.json
and
Step 2: oneoe_security_cis1.json

 • Cloud Guard
• Security Zones and recipes (CIS Level 1)
• Vulnerability Scanning
Observability configuration for
Step 1: oneoe_observability_cis1_pre.json
and
Step 2: oneoe_observability_cis1.json                                                		 • Events
• Alarms
• Logging
• Notifications

 

Deploy with OCI Resource Manager (ORM) - CIS Level 1

Step 1:

Click  

And follow these steps:

  1. Accept terms, wait for the configuration to load.
  2. Set the working directory to “rms-facade”.
  3. Set the stack name you prefer.
  4. Set the terraform version to 1.5.x. Click Next.
  5. Accept the default files. Click Next. Optionally, replace with your json/yaml config files.
  6. Un-check run apply. Click Create.

Step 2:

The following updates, or only those relevant to your deployment - should be performed after the Step 1 stack and all Landing Zone components have been deployed. This phase involves updating the Step 1 ORM stack to add additional Security Zone Recipes, and enable Network Flow Logs. All required updates can be applied in a single operation by replacing the corresponding configuration files as described below.

  1. Security - Security Zones, Vulnerability Scanning Service:

    Use the configuration oneoe_security_cis1.json to complete the security implementation by adding the following components:

    • Security Zone Targets to apply more restrictive Security Zone Recipes to the following compartments: Hub network compartment and Production compartment.
    • Vulnerability Scanning on all Host targets within the Landing Zone enclosing compartment.

  2. Observability - Flow Logs:

    • Use the configuration oneoe_observability_cis1.json to enable flow logs for your VCNs and Subnets.
      Note that by default, VCN and Subnet flow logs are not deployed. The first 10 GB of log storage per month is free. This configuration creates a log group for the shared network and for each network environment. Actual log storage usage will depend on the amount of traffic in your VCNs and subnets, which may exceed the free monthly quota.

 

Once all required updates are applied, rerun the ORM stack.

 

Input configurations for CIS Level 2

JSON configurations Configuration-defined components
IAM configuration
oneoe_iam.json		 • Compartments
• Identity Domain
• IAM groups and policies
Governance configuration
oneoe_governance.json		 • Tag namespace
• Tag key definition
Network configuration
oneoe_network_hub_e.json		 • Hub E VCN with associated subnets
• Internet, NAT and Service gateways
• Dynamic Routing Gateway (DRG)
• Route Tables with corresponding route rules
• Two Spoke VCNs (Prod and PreProd) with private-only subnets
• NAT and Service gateways in the Spoke VCNs
• Security Lists (SLs) and Network Security Groups (NSGs)
• Public Load Balancer (free tier LBaaS) with two example backend IP addresses from the production web tier: 10.0.64.10 and 10.0.64.20. The LBaaS and backend configurations are provided solely for example purposes and should be updated to reference actual workload instances
Security configuration for
Step 1: oneoe_security_cis2_pre.json
and
Step 2: oneoe_security_cis2.json

 • Cloud Guard
• Security Zones and recipes (CIS Level 2)
• Vulnerability Scanning
• Vault and Software Key
Observability configuration for
Step 1: oneoe_observability_cis2_pre.json
and
Step 2: oneoe_observability_cis2.json                                                		 • Events
• Alarms
• Logging
• Notifications

 

Deploy with OCI Resource Manager (ORM) - CIS Level 2

Step 1:

Click  

And follow these steps:

  1. Accept terms, wait for the configuration to load.
  2. Set the working directory to “rms-facade”.
  3. Set the stack name you prefer.
  4. Set the terraform version to 1.5.x. Click Next.
  5. Accept the default files. Click Next. Optionally, replace with your json/yaml config files.
  6. Un-check run apply. Click Create.

Step 2:

Follow the same procedure described in Deploy with OCI Resource Manager (ORM) - CIS Level 1: Step 2, using the JSON configuration files specific to CIS Level 2.

 

License

Copyright (c) 2026 Oracle and/or its affiliates.

Licensed under the Universal Permissive License (UPL), Version 1.0.

See LICENSE for more details.