From 6d75fe3ffaa9ec475f9d4ce8fad25c077f35f3c2 Mon Sep 17 00:00:00 2001 From: Yu Hu Date: Thu, 30 Apr 2026 18:39:49 +0000 Subject: [PATCH] fix: drop lockdown_default_seclist to eliminate security-list race (#109) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two Terraform resources both called UpdateSecurityList on the same VCN default security list: 1. The upstream oracle-terraform-modules/vcn/oci lockdown resource (enabled by lockdown_default_seclist = true) — zeroes all rules, has ignore_changes on egress/ingress. 2. oci_core_default_security_list.dd_default — sets egress-all + ICMP ingress only. Both fired within ~150 ms on terraform apply. When lockdown won the race it wiped egress rules, blocking Functions from reaching OCIR and causing FunctionInvokeImageNotAvailable (502) on every invocation. Fix: set lockdown_default_seclist = false so the upstream module never creates the conflicting resource. dd_default becomes the sole owner of the default security list and already provides the intended locked-down rule set (no SSH ingress, egress-all for OCIR reachability). Co-Authored-By: Claude Sonnet 4.6 --- datadog-integration/modules/regional-stacks/main.tf | 2 +- datadog-terraform-onboarding/modules/regional-stacks/main.tf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/datadog-integration/modules/regional-stacks/main.tf b/datadog-integration/modules/regional-stacks/main.tf index 93944572..826e5e1c 100644 --- a/datadog-integration/modules/regional-stacks/main.tf +++ b/datadog-integration/modules/regional-stacks/main.tf @@ -43,7 +43,7 @@ module "vcn" { vcn_cidrs = ["10.0.0.0/16"] vcn_dns_label = "ddvcnmodule" vcn_name = local.vcn_name - lockdown_default_seclist = true + lockdown_default_seclist = false subnets = {} create_nat_gateway = true diff --git a/datadog-terraform-onboarding/modules/regional-stacks/main.tf b/datadog-terraform-onboarding/modules/regional-stacks/main.tf index b726a58a..b1f1d0c4 100644 --- a/datadog-terraform-onboarding/modules/regional-stacks/main.tf +++ b/datadog-terraform-onboarding/modules/regional-stacks/main.tf @@ -45,7 +45,7 @@ module "vcn" { vcn_cidrs = ["10.0.0.0/16"] vcn_dns_label = "ddvcnmodule" vcn_name = local.vcn_name - lockdown_default_seclist = true + lockdown_default_seclist = false subnets = {} create_nat_gateway = true