Migrating Oracle Cloud (OCI) Terraform to Frostmoln

To run a conversion, see the migration guide.

This matrix lists how the converter handles each supported resource type and attribute.

oci_containerengine_cluster → frostmoln_kubernetes_cluster — partially supported

OKE clusters map to frostmoln_kubernetes_cluster; vcn_id becomes vpc_id, the endpoint_config becomes subnet_id, and the required initial node pool is an FM-TODO placeholder (the real pools convert to frostmoln_kubernetes_node_pool).

The API endpoint's exposure does NOT carry over — it is not a per-cluster setting on the platform, and nothing is made public by the conversion: a private OKE endpoint (is_public_ip_enabled = false, the OCI default) converts faithfully, while a public one needs kubectl access planned from inside the VPC. Public WORKLOAD traffic has no cluster-level equivalent either: a managed cluster is NOT given an ingress load balancer, so there is no attribute for an OKE public entrypoint to convert into and none is emitted. Expose a workload the standard Kubernetes way instead — a Service of type=LoadBalancer inside the cluster, which the platform provisions a load balancer for. That is an in-cluster step (kubectl/Helm), not Terraform, so this conversion cannot do it for you. And it is only half a replacement today: such a Service can be given an INTERNAL address only, because a per-Service PUBLIC address is not built yet, so a publicly reachable workload entrypoint is an open GAP. Do not assume the converted configuration exposes anything — carry the source's public entrypoint forward on your migration checklist and plan it by hand. kubernetes_version becomes version (verify it is offered, fm kubernetes version list). frostmoln_kubernetes_cluster requires an initial_node_pool that OKE defines as separate oci_containerengine_node_pool resources, so a placeholder is emitted — set flavor_id (the node pools convert to frostmoln_kubernetes_node_pool). Add-ons, network policy, image policy, and KMS have no equivalent. compartment_id is dropped (tenant-scoped).

Attribute	Outcome	Notes
name	Mapped to name
kubernetes_version	Converted to version	Verify the version is offered on the platform (fm kubernetes version list) — OCI reports a v-prefixed patch version.
vcn_id	Mapped to vpc_id	The parent VCN reference is rewritten to the converted frostmoln_vpc id.
endpoint_config	Converted to subnet_id	The endpoint subnet becomes subnet_id. is_public_ip_enabled does NOT carry over: the API endpoint's exposure is not configurable on the platform (it is private on the managed control-plane architecture). Public WORKLOAD traffic has no setting here either: a managed cluster is not given an ingress load balancer, and a workload is exposed with a Kubernetes Service of type=LoadBalancer inside the cluster. Only INTERNAL addresses are available for such a Service today, so a PUBLIC workload entrypoint is an open GAP — plan it as manual work.
type	Not carried over
options	Not carried over
cluster_pod_network_options	Not carried over
image_policy_config	Not carried over
kms_key_id	Manual action required
compartment_id	Not needed on Frostmoln
freeform_tags	Not carried over
defined_tags	Not carried over

• The converter adds initial_node_pool automatically. frostmoln_kubernetes_cluster requires an initial node pool; set flavor_id to a platform flavor (see fm kubernetes flavor list) — the real pools convert to frostmoln_kubernetes_node_pool.
• The converter adds version automatically. frostmoln_kubernetes_cluster requires a version; set it to an offered version (fm kubernetes version list).
• The converter adds vpc_id automatically. frostmoln_kubernetes_cluster requires a VPC; set vpc_id to the converted frostmoln_vpc id.
• The converter adds subnet_id automatically. frostmoln_kubernetes_cluster requires a subnet; set subnet_id to the converted frostmoln_subnet id.

oci_containerengine_node_pool → frostmoln_kubernetes_node_pool — partially supported

OKE node pools map to frostmoln_kubernetes_node_pool; node_shape (with node_shape_config for flex shapes) has its size reported and flavor_id left for you to set, and node_config_details.size becomes node_count.

A node pool draws flavor_id from the Kubernetes node-flavor catalog, which is separate from the compute one — so the converter reports the source shape's vCPUs and RAM and leaves flavor_id as an FM-TODO for you to set from fm kubernetes flavor list. cluster_id references the parent cluster — the converted cluster id is substituted automatically. node_config_details.size becomes node_count; per-availability-domain placement_configs and subnet_ids are dropped (the platform picks placement). The node kubernetes_version follows the cluster. Node labels, node images, and cloud-init have no equivalent. The pool name must be a lowercase DNS label of at most 18 characters.

Attribute	Outcome	Notes
name	Mapped to name	The pool name must be a lowercase DNS label of at most 18 characters.
cluster_id	Mapped to cluster_id	The parent cluster reference is rewritten to the converted frostmoln_kubernetes_cluster id.
node_shape	Converted to flavor_id	node_shape (with node_shape_config for flex shapes) is parsed for its vCPUs and RAM and reported; flavor_id is left as an FM-TODO to set from fm kubernetes flavor list.
node_shape_config	Not needed on Frostmoln
node_config_details	Converted to node_count	node_config_details.size becomes node_count; per-availability-domain placement_configs are dropped.
kubernetes_version	Not carried over
subnet_ids	Not carried over
network_launch_type	Not carried over
primary_vnic	Not carried over
secondary_vnics	Manual action required
node_source_details	Not carried over
node_image_id	Not carried over
node_image_name	Not carried over
node_metadata	Not carried over
ssh_public_key	Not carried over
initial_node_labels	Not carried over
node_eviction_node_pool_settings	Not carried over
node_pool_cycling_details	Not carried over
compartment_id	Not needed on Frostmoln
freeform_tags	Not carried over
defined_tags	Not carried over

• The converter adds flavor_id automatically. frostmoln_kubernetes_node_pool requires a flavor; set flavor_id to a platform flavor (see fm kubernetes flavor list).

oci_core_instance → frostmoln_instance — partially supported

Compute instances map to frostmoln_instance: the shape (with its shape_config for flex shapes) is capability-matched to a flavor, the image OCID becomes a frostmoln_image lookup, create_vnic_details becomes subnet_id (and, with assign_public_ip, a frostmoln_public_ip), and metadata SSH keys/user_data are extracted.

A FLEX shape (VM.Standard.E4.Flex) is sized from shape_config.ocpus/memory_in_gbs — ocpus × 2 for x86 or × 1 for Ampere Arm gives the vCPUs (1 OCPU = 2 hardware threads on x86; 1 OCPU = 1 core on Arm), and memory_in_gbs is the RAM — then capability-matched against the platform flavor catalog; a known fixed shape uses its published size, and an unknown shape or offline catalog emits a reviewed placeholder. source_details.source_id is an image OCID, which cannot be mapped to a platform image name, so image_id is a reviewed frostmoln_image lookup (booting from an existing boot volume blocks). metadata.ssh_authorized_keys becomes frostmoln_ssh_key resources; a base64 metadata.user_data is decoded onto user_data. compartment_id has no equivalent (Frostmoln resources are tenant-scoped) and is dropped everywhere; availability_domain becomes the platform zone (per-AD/fault-domain placement is lost); defined_tags are dropped and freeform_tags become tags.

Attribute	Outcome	Notes
display_name	Mapped to name
shape	Converted to flavor_id	The shape (with shape_config for flex shapes) is capability-matched against the platform flavor catalog, emitted as a frostmoln_flavor data source lookup.
shape_config	Not needed on Frostmoln
source_details	Converted to image_id	An image source becomes a frostmoln_image lookup (the image OCID has no derivable name — review it); booting from an existing boot volume blocks.
create_vnic_details	Converted to subnet_id	subnet_id carries over, and assign_public_ip = true becomes a generated frostmoln_public_ip bound to the instance.
metadata	Converted to ssh_key_names	ssh_authorized_keys becomes generated frostmoln_ssh_key resources; a base64 user_data is decoded onto user_data.
freeform_tags	Converted to tags	Freeform tags become frostmoln tags.
availability_domain	Converted	The platform picks the zone; set zone to a zone id to pin one (per-availability-domain and fault-domain placement is lost).
compartment_id	Not needed on Frostmoln
defined_tags	Not carried over
fault_domain	Not carried over
hostname_label	Not carried over
extended_metadata	Not carried over
ipxe_script	Not carried over
launch_options	Not carried over
instance_options	Not carried over
availability_config	Not carried over
preemptible_instance_config	Not carried over
platform_config	Not carried over
agent_config	Not carried over
is_pv_encryption_in_transit_enabled	Not needed on Frostmoln
preserve_boot_volume	Not carried over
dedicated_vm_host_id	Manual action required
compute_cluster_id	Manual action required
capacity_reservation_id	Manual action required
launch_volume_attachments	Manual action required

• The converter adds name automatically. frostmoln_instance requires a name; when display_name is absent it is taken from the Name tag or the resource address.
• The converter adds flavor_id automatically. frostmoln_instance requires a flavor; set flavor_id to a platform flavor (see fm compute flavor list).
• The converter adds image_id automatically. frostmoln_instance requires an image; set image_id to a platform image (see fm compute image list).

oci_core_network_security_group → frostmoln_security_group — partially supported

Network security groups map to frostmoln_security_group — the closer model, since NSGs (like Frostmoln groups) attach to VNICs/instances rather than subnets. display_name becomes the name and vcn_id becomes vpc_id; the rules convert separately as oci_core_network_security_group_security_rule.

NSG rules are standalone oci_core_network_security_group_security_rule resources and convert to frostmoln_security_group_rule. compartment_id has no equivalent (tenant-scoped); defined_tags dropped, freeform_tags become tags. EGRESS IS WIDENED BY CONVERSION: an OCI network security group's EGRESS rules are an allow-list and everything unlisted is denied, and every Frostmoln security group is created with allow-all egress (Neutron adds one IPv4 and one IPv6 allow-any egress rule to every new group, and Frostmoln removes neither), and converted egress rules ADD to those defaults rather than replacing them. An NSG whose egress rules restricted outbound traffic is therefore widened by conversion. The converted configuration does not manage the defaults, so no terraform apply removes them, and Neutron re-creates them whenever the group is replaced (changing vpc_id forces replacement). Deleting them restores the source posture but makes the converted rules the group's ENTIRE egress policy: confirm they cover everything the instances need outbound, including DNS and the instance metadata service; note that no converted rule is IPv6, because frostmoln_security_group_rule has no ether_type, so deleting the IPv6 default denies all IPv6 egress with no replacement expressible in Terraform; and remember egress is the UNION of every security group on the instance's ports, including the tenant's implicit default group, which has allow-all egress of its own.

Attribute	Outcome	Notes
display_name	Mapped to name
vcn_id	Mapped to vpc_id	The parent VCN reference is rewritten to the converted frostmoln_vpc id.
freeform_tags	Converted to tags	Freeform tags become frostmoln tags.
compartment_id	Not needed on Frostmoln
defined_tags	Not carried over

• The converter adds name automatically. frostmoln_security_group requires a name; when display_name is absent it is taken from the Name tag or the resource address.

oci_core_network_security_group_security_rule → frostmoln_security_group_rule — partially supported

NSG security rules map to frostmoln_security_group_rule; direction carries over, the IANA protocol number becomes the protocol name, source/destination become remote_cidr, and tcp_options/udp_options become the port range.

protocol is an IANA number: 6 → tcp, 17 → udp, 1 → icmp, all → any (an unsupported number blocks). A rule's source (ingress) or destination (egress) becomes remote_cidr ONLY when its type is CIDR_BLOCK — a NETWORK_SECURITY_GROUP remote (set remote_group_id manually) or a SERVICE_CIDR_BLOCK remote (a service gateway; no equivalent) BLOCKS THE WHOLE RULE (fatal), because emitting the rule without its remote would leave it matching every source (0.0.0.0/0) — a silent open-to-internet. tcp_options/udp_options.destination_port_range becomes port_range_min/max. A source_port_range has no target field, because a frostmoln security-group rule filters the DESTINATION port: alongside a destination_port_range it is dropped with a review note (the destination range still constrains the rule), but a rule whose ONLY port constraint is the source port BLOCKS THE WHOLE RULE (fatal) — converting it would drop every port restriction on that rule. Frostmoln security groups are STATEFUL (Neutron/OVN conntrack), so a rule that only re-admitted the replies of an already-allowed connection is unnecessary here — but that covers replies only, not a NEW connection opened from a fixed source port (active-mode FTP data, TFTP data), for which no conntrack helper is enabled. Decide which the rule was: delete it if it only re-admitted replies, otherwise rewrite it against the DESTINATION port the traffic actually reaches — the source-port numbers are NOT reusable as destination ports. ICMP: frostmoln_security_group_rule has NO ICMP type or code field, so a converted ICMP rule is all-ICMP or nothing — a rule with an icmp_options block therefore BLOCKS THE WHOLE RULE (fatal); decide whether allowing all ICMP from that remote is acceptable and add the rule manually. A rule with NO icmp_options converts, because that already means every ICMP type and code in OCI. ADDRESS FAMILY: a frostmoln_security_group_rule has no ether_type field, so every rule the platform creates is IPv4 and no converted rule can be IPv6. A rule whose source or destination is an IPv6 CIDR therefore BLOCKS THE WHOLE RULE (fatal) rather than emitting a rule that is rejected when it is applied — do NOT translate an IPv6 range to an IPv4 one, it selects different hosts. Protocol 58 (ICMPv6) BLOCKS THE WHOLE RULE (fatal) for the same reason: ICMPv6 is a different protocol from ICMP, not an address-family variant of it (neighbour discovery, router advertisement and Path MTU Discovery have no ICMPv4 counterpart), so converting it to icmp would produce a rule allowing traffic the source rule did not and blocking traffic it did. Recreate IPv6 and ICMPv6 rules once the platform supports them.

Attribute	Outcome	Notes
network_security_group_id	Mapped to security_group_id
direction	Converted
protocol	Converted
source	Converted to remote_cidr	A CIDR_BLOCK source becomes remote_cidr; a NETWORK_SECURITY_GROUP or SERVICE_CIDR_BLOCK source blocks the whole rule (emitting it without a remote would match every source).
destination	Converted to remote_cidr	A CIDR_BLOCK destination becomes remote_cidr; a NETWORK_SECURITY_GROUP or SERVICE_CIDR_BLOCK destination blocks the whole rule (emitting it without a remote would match every source).
source_type	Not needed on Frostmoln
destination_type	Not needed on Frostmoln
tcp_options	Converted	destination_port_range becomes port_range_min/port_range_max; alongside one, a source_port_range is dropped with a review note. A source_port_range that is the rule's ONLY port constraint blocks the whole rule (emitting it would drop every port restriction).
udp_options	Converted	destination_port_range becomes port_range_min/port_range_max; alongside one, a source_port_range is dropped with a review note. A source_port_range that is the rule's ONLY port constraint blocks the whole rule (emitting it would drop every port restriction).
icmp_options	Manual action required	An ICMP type/code restriction blocks the whole rule: frostmoln_security_group_rule has no ICMP type or code field, so a converted rule would allow every ICMP type. A rule with NO icmp_options converts (that already means every type and code in OCI).
description	Mapped to description
stateless	Converted	A stateful rule (stateless = false) drops the flag; a stateless rule blocks the whole rule (it cannot be expressed by a stateful Frostmoln security group without widening access).

oci_core_public_ip → frostmoln_public_ip — partially supported

Public IPs map to frostmoln_public_ip; the reserved/ephemeral lifetime is dropped (public IPs are allocated on create) and the private-IP binding needs manual review.

OCI binds a public IP to a PRIVATE IP OCID (private_ip_id), not to an instance directly, so it cannot be resolved to an instance automatically — set instance_id to the converted frostmoln_instance to associate the public IP. lifetime (RESERVED vs EPHEMERAL) has no equivalent. compartment_id is dropped (tenant-scoped); defined_tags dropped, freeform_tags become tags.

Attribute	Outcome	Notes
freeform_tags	Converted to tags	Freeform tags become frostmoln tags.
private_ip_id	Not carried over
lifetime	Not carried over
display_name	Not carried over
compartment_id	Not needed on Frostmoln
defined_tags	Not carried over
public_ip_pool_id	Manual action required

oci_core_security_list → frostmoln_security_group — partially supported

Security lists become a frostmoln_security_group plus one frostmoln_security_group_rule per convertible rule. This is the key OCI semantic mismatch: security lists are SUBNET-scoped and can be STATELESS, whereas Frostmoln security groups attach to instances directly and are always stateful.

A STATELESS rule (stateless = true, or a non-static stateless flag) BLOCKS the whole list — Frostmoln security groups are stateful, so converting a stateless rule to a stateful one would auto-allow the return traffic the stateless rule required to be declared explicitly, WIDENING access. A dynamic ingress_security_rules or egress_security_rules block also blocks the whole list: the converter cannot enumerate generated rules, so it cannot see their remotes, their ports, or whether any of them is stateless. Rules written in ATTRIBUTE form (ingress_security_rules = [...]) block the whole list for the same reason — the converter reads the block form only, so an attribute-form rule set is invisible to it, stateless flag included. The list applied to a SUBNET (every VNIC in it); Frostmoln has no subnet-wide security group, so the converter emits a review action telling you to attach the generated group to the subnet's instances (frostmoln_instance.security_groups). Only CIDR-block remotes convert — a SERVICE_CIDR_BLOCK remote, a source_type/destination_type the converter cannot resolve statically (it may be SERVICE_CIDR_BLOCK at apply time), an unsupported protocol, or a dynamic or non-static port skips that rule with a review note (skipping narrows access, never widens it). The destination port range is tcp_options/udp_options min and max DIRECTLY (this resource flattens them; the nested destination_port_range block belongs to oci_core_network_security_group_security_rule and is not accepted here — one written anyway skips the rule, since there is no way to tell what was meant). Ports must be 1-65535 with min <= max; anything else skips, because the platform silently drops a port of 0 and the rule would land with no port restriction at all. A source_port_range has no target field, because a frostmoln security-group rule filters the DESTINATION port: alongside a static min/max it is dropped with a review note (the destination constraint still narrows the rule), but a rule whose ONLY port constraint is the source port is skipped instead — converting it would drop every port restriction on that rule. Every rule that reaches conversion is STATEFUL in OCI (a stateless one blocks the whole list), so OCI already admitted the return traffic and such a source port was a real filter, not return-traffic plumbing: rewrite the rule against the DESTINATION port the traffic actually reaches — the source-port numbers are NOT reusable as destination ports. ICMP: frostmoln_security_group_rule has NO ICMP type or code field, so a converted ICMP rule is all-ICMP or nothing. A rule with an icmp_options block therefore SKIPS — decide per rule whether allowing all ICMP from that remote is acceptable and add the rule manually. A rule with NO icmp_options converts, because that already means every ICMP type and code in OCI. If every rule skips, the whole security list blocks: there is nothing left to attach. Protocol is an IANA number: 6 → tcp, 17 → udp, 1 → icmp, all → any. ADDRESS FAMILY: a frostmoln_security_group_rule has no ether_type field, so every rule the platform creates is IPv4 and no converted rule can be IPv6. A rule whose source or destination is an IPv6 CIDR is REFUSED — no rule is generated for it, and the refusal is reported as a blocker naming the exact remote, because a rule emitted with an IPv6 remote is rejected when it is applied. Do NOT translate an IPv6 range to an IPv4 one, it selects different hosts. Protocol 58 (ICMPv6) is REFUSED for the same reason: ICMPv6 is a different protocol from ICMP, not an address-family variant of it (neighbour discovery, router advertisement and Path MTU Discovery have no ICMPv4 counterpart), so converting it to icmp would produce a rule allowing traffic the source rule did not and blocking traffic it did. The list's IPv4 rules still convert; only the refused ones are missing, and if every rule is refused the whole list blocks. EGRESS IS WIDENED BY CONVERSION: an OCI security list's egress_security_rules are an allow-list and everything unlisted is denied, and every Frostmoln security group is created with allow-all egress (Neutron adds one IPv4 and one IPv6 allow-any egress rule to every new group, and Frostmoln removes neither), and converted egress rules ADD to those defaults rather than replacing them. A security list whose egress rules restricted outbound traffic is therefore widened by conversion. The converted configuration does not manage the defaults, so no terraform apply removes them, and Neutron re-creates them whenever the group is replaced (changing vpc_id forces replacement). Deleting them restores the source posture but makes the converted rules the group's ENTIRE egress policy: confirm they cover everything the instances need outbound, including DNS and the instance metadata service; note that no converted rule is IPv6, because frostmoln_security_group_rule has no ether_type, so deleting the IPv6 default denies all IPv6 egress with no replacement expressible in Terraform; and remember egress is the UNION of every security group on the instance's ports, including the tenant's implicit default group, which has allow-all egress of its own.

Attribute	Outcome	Notes
display_name	Converted	becomes the generated frostmoln_security_group name; a non-static display_name falls back to the Terraform label with a review note.
vcn_id	Converted	a direct oci_core_vcn reference becomes vpc_id on the generated security group.
ingress_security_rules	Converted	each ingress rule becomes one frostmoln_security_group_rule (direction ingress); source becomes remote_cidr, tcp_options/udp_options become the port range.
egress_security_rules	Converted	each egress rule becomes one frostmoln_security_group_rule (direction egress); destination becomes remote_cidr.
compartment_id	Not needed on Frostmoln
defined_tags	Not carried over
freeform_tags	Not carried over

oci_core_subnet → frostmoln_subnet — partially supported

Subnets map to frostmoln_subnet; cidr_block becomes cidr, vcn_id becomes vpc_id, and the availability_domain becomes the platform zone.

vcn_id references the parent VCN — the converted frostmoln_vpc id is substituted automatically. route_table_id, dhcp_options_id, and security_list_ids are dropped: routing and DHCP are platform-managed, and OCI security lists convert separately to frostmoln_security_group (attach them to the subnet's instances). prohibit_public_ip_on_vnic / prohibit_internet_ingress have no equivalent. compartment_id is dropped (tenant-scoped); defined_tags dropped, freeform_tags become tags.

Attribute	Outcome	Notes
display_name	Mapped to name
cidr_block	Mapped to cidr
vcn_id	Mapped to vpc_id	The parent VCN reference is rewritten to the converted frostmoln_vpc id.
availability_domain	Converted	The platform picks the zone; set zone to a zone id to pin one (a regional subnet spans all zones).
freeform_tags	Converted to tags	Freeform tags become frostmoln tags.
compartment_id	Not needed on Frostmoln
defined_tags	Not carried over
dns_label	Not carried over
route_table_id	Not carried over
dhcp_options_id	Not carried over
security_list_ids	Not carried over
prohibit_public_ip_on_vnic	Not carried over
prohibit_internet_ingress	Not carried over
ipv6cidr_block	Manual action required
ipv6cidr_blocks	Manual action required

• The converter adds name automatically. frostmoln_subnet requires a name; when display_name is absent it is taken from the Name tag or the resource address.
• The converter adds vpc_id automatically. frostmoln_subnet requires a VPC; set vpc_id to the converted frostmoln_vpc id.

oci_core_vcn → frostmoln_vpc — partially supported

VCNs map to frostmoln_vpc; the first cidr_blocks entry becomes cidr, display_name becomes the name, and dns_label/DNS resolver settings are dropped.

A VCN may carry several CIDR blocks; frostmoln_vpc has a single supernet, so only the first block becomes cidr and the rest are flagged for review (recreate the extra ranges manually). compartment_id has no equivalent (tenant-scoped) and is dropped. dns_label and IPv6 (is_ipv6enabled / BYOIPv6) have no equivalent. defined_tags are dropped; freeform_tags become tags. The converted VPC has NO outbound internet access on its own: outbound is an explicit frostmoln_gateway (one per VPC, egressing from an address the platform draws for it; name a Public IP of your own with public_ip_id where a partner allow-lists your source address, and that address is billed as a Public IP), and without it the VPC also has no DNS resolution and no managed-service connectivity, because those are reached over routes that exist only while the egress path does. The VCN's internet, NAT and service gateways do not convert into one — see their entries.

Attribute	Outcome	Notes
cidr_blocks	Converted to cidr	The first cidr_blocks entry becomes the VPC cidr; additional blocks are flagged for review.
cidr_block	Mapped to cidr	The legacy single cidr_block becomes the VPC cidr (use cidr_blocks on newer VCNs).
display_name	Mapped to name
freeform_tags	Converted to tags	Freeform tags become frostmoln tags.
compartment_id	Not needed on Frostmoln
defined_tags	Not carried over
dns_label	Not carried over
is_ipv6enabled	Manual action required
ipv6private_cidr_blocks	Manual action required
byoipv6cidr_details	Manual action required
is_oracle_gua_allocation_enabled	Not carried over
security_attributes	Not carried over

• The converter adds name automatically. frostmoln_vpc requires a name; when display_name is absent it is taken from the Name tag or the resource address.
• The converter adds cidr automatically. frostmoln_vpc requires a cidr; set it to the VCN supernet when the source has no static CIDR block.

oci_core_volume → frostmoln_volume — partially supported

Block volumes map to frostmoln_volume; size_in_gbs becomes size_gb, the availability_domain becomes the platform zone, and vpus_per_gb is dropped (volume tiers are a platform catalog).

vpus_per_gb (the OCI performance tier) is dropped — pick a volume_type from the volume tiers catalog (frostmoln_volume_tiers data source) after the conversion. A volume restored from a backup keeps the backup as snapshot_id; cloning from an existing volume or a cross-region replica blocks (never a silent blank volume). kms_key_id (customer-managed keys) has no equivalent — volumes are encrypted with platform-managed keys. compartment_id is dropped (tenant-scoped); defined_tags dropped, freeform_tags become tags.

Attribute	Outcome	Notes
display_name	Mapped to name
size_in_gbs	Mapped to size_gb
availability_domain	Converted	The platform picks the zone; set zone to a zone id to pin one.
source_details	Converted to snapshot_id	A volumeBackup source becomes snapshot_id; cloning from a volume/replica blocks.
freeform_tags	Converted to tags	Freeform tags become frostmoln tags.
vpus_per_gb	Not carried over
size_in_mbs	Not carried over
compartment_id	Not needed on Frostmoln
defined_tags	Not carried over
kms_key_id	Manual action required
backup_policy_id	Not carried over
block_volume_replicas	Not carried over
autotune_policies	Not carried over
is_auto_tune_enabled	Not carried over

• The converter adds name automatically. frostmoln_volume requires a name; when display_name is absent it is taken from the Name tag or the resource address.

oci_core_volume_attachment → frostmoln_volume_attachment — partially supported

Volume attachments map to frostmoln_volume_attachment; instance_id and volume_id carry over and device becomes device_path.

attachment_type (iscsi / paravirtualized) is dropped — the attachment protocol is platform-managed. Read-only, shareable (multi-attach), and CHAP settings have no equivalent.

Attribute	Outcome	Notes
instance_id	Mapped to instance_id
volume_id	Mapped to volume_id
device	Mapped to device_path
attachment_type	Not carried over
display_name	Not carried over
is_read_only	Not carried over
is_shareable	Manual action required
use_chap	Not carried over
is_pv_encryption_in_transit_enabled	Not needed on Frostmoln
encryption_in_transit_type	Not needed on Frostmoln

oci_core_volume_backup → frostmoln_snapshot — partially supported

Volume backups map to frostmoln_snapshot; volume_id carries over and display_name becomes the required name.

The backup type (FULL / INCREMENTAL) has no equivalent — Frostmoln snapshots are managed by the platform. An ENABLED protection flag (retention lock, indefinite retention, prevent-deletion) BLOCKS the conversion — a snapshot emitted without the lock its source carried would state a compliance posture the platform cannot keep; the same flags set to false are dropped silently. compartment_id is dropped (tenant-scoped); defined_tags dropped, freeform_tags become tags.

Attribute	Outcome	Notes
volume_id	Mapped to volume_id
display_name	Mapped to name
freeform_tags	Converted to tags	Freeform tags become frostmoln tags.
type	Not carried over
compartment_id	Not needed on Frostmoln
defined_tags	Not carried over
kms_key_id	Manual action required
is_retention_lock_enabled	Converted	A disabled lock is dropped; an enabled retention lock blocks (a converted snapshot can be deleted at any time).
is_indefinite_retention_enabled	Converted	A disabled hold is dropped; an enabled legal hold blocks (a converted snapshot can be deleted at any time).
is_prevent_deletion_enabled	Converted	A disabled flag is dropped; enabled deletion protection blocks (a converted snapshot can be deleted at any time).
retention_period	Manual action required

• The converter adds name automatically. frostmoln_snapshot requires a name; when display_name is absent it is taken from the Name tag or the resource address.

oci_dns_rrset → frostmoln_dns_record — partially supported

DNS record sets map to frostmoln_dns_record; the items rdata collapse into the records set and the domain becomes a zone-relative name.

Record names are zone-relative on Frostmoln. When zone_name_or_id references an in-config oci_dns_zone with a static name, the fully qualified domain has that suffix stripped automatically; otherwise a fully qualified name blocks — strip the zone suffix, or use "@" for the apex. The items blocks collapse into the records set (their rdata values), with the first item's ttl carried onto ttl. Supported types: A, AAAA, CNAME, MX, TXT, NS, SRV, CAA, PTR.

Attribute	Outcome	Notes
domain	Converted to name	Record names are zone-relative; a name referencing an in-config zone's name is stripped automatically.
zone_name_or_id	Mapped to zone_id	A direct oci_dns_zone reference is rewritten to the converted frostmoln_dns_zone id.
rtype	Converted to type	Supported types carry over; SOA and other types have no equivalent (SOA is platform-managed).
items	Converted	The items rdata collapse into the records set; the first item's ttl becomes ttl.
compartment_id	Not needed on Frostmoln
scope	Not carried over
view_id	Not carried over

oci_dns_zone → frostmoln_dns_zone — partially supported

Public DNS zones map to frostmoln_dns_zone; the zone name is normalized to a lowercase FQDN and a required SOA email is synthesized as a placeholder.

Only GLOBAL (public) zones convert — a PRIVATE zone (scope = PRIVATE) BLOCKS the conversion (converting it to a public zone would expose it). A SECONDARY zone (external_masters) also blocks. The required SOA admin email cannot come from OCI — an FM-TODO placeholder is emitted. compartment_id is dropped (tenant-scoped); defined_tags dropped, freeform_tags become tags.

Attribute	Outcome	Notes
name	Converted	Normalized to a lowercase fully qualified domain with a trailing dot, e.g. "example.com."
scope	Converted	GLOBAL (public) zones convert; a PRIVATE zone blocks the conversion.
freeform_tags	Converted to tags	Freeform tags become frostmoln tags.
zone_type	Not carried over
external_masters	Manual action required
view_id	Not carried over
resolution_mode	Not carried over
dnssec_state	Not carried over
compartment_id	Not needed on Frostmoln
defined_tags	Not carried over

• The converter adds email automatically. the SOA admin email is required; replace the placeholder with a real contact address.

oci_identity_customer_secret_key → frostmoln_s3_credential — partially supported

Customer secret keys map to frostmoln_s3_credential — the closest S3-compatible analog; display_name becomes the name.

OCI ties a customer secret key to an IAM user; Frostmoln S3 credentials are tenant-scoped, so user_id is dropped. Scope the converted credential with allowed_buckets / allowed_actions / ip_whitelist after conversion. The secret access key is issued by the platform on create (secret_access_key), not carried from OCI.

Attribute	Outcome	Notes
display_name	Mapped to name
user_id	Not carried over

• The converter adds name automatically. frostmoln_s3_credential requires a name; when display_name is absent it is taken from the resource address.

oci_load_balancer_backend → frostmoln_lb_member — partially supported

Backends map to frostmoln_lb_member; ip_address becomes address and port becomes protocol_port.

backendset_name references the backend set by NAME, so pool_id needs review (set it to the converted frostmoln_lb_pool id). Backend backup/drain/offline flags have no equivalent.

Attribute	Outcome	Notes
load_balancer_id	Mapped to load_balancer_id
ip_address	Mapped to address
port	Mapped to protocol_port
weight	Mapped to weight
backendset_name	Converted to pool_id	OCI references the backend set by name — set pool_id to the converted pool's id.
backup	Not carried over
drain	Not carried over
offline	Not carried over

oci_load_balancer_backend_set → frostmoln_lb_pool — partially supported

Backend sets map to frostmoln_lb_pool; the policy becomes lb_algorithm and the inline health_checker splits into a frostmoln_lb_health_monitor.

A backend set has no protocol of its own (the listener carries it), so the required protocol is an FM-TODO placeholder — set it to match the listener. policy ROUND_ROBIN → round_robin, LEAST_CONNECTIONS → least_connections, IP_HASH → source_ip. The health_checker becomes a frostmoln_lb_health_monitor: its OCI timings are in MILLISECONDS and are dropped (frostmoln uses seconds — set delay/timeout manually). Cookie session persistence and backend TLS block.

Attribute	Outcome	Notes
name	Mapped to name
load_balancer_id	Mapped to load_balancer_id
policy	Converted to lb_algorithm
session_persistence_configuration	Manual action required
lb_cookie_session_persistence_configuration	Manual action required
ssl_configuration	Manual action required

Inline health_checker blocks are split into frostmoln_lb_health_monitor resources:

Block attribute	Outcome	Notes
protocol	Converted to type
url_path	Mapped to url_path
return_code	Mapped to expected_codes
retries	Mapped to max_retries
interval_ms	Not carried over
timeout_in_millis	Not carried over
port	Not carried over
response_body_regex	Not carried over

• The converter adds protocol automatically. frostmoln_lb_pool requires a protocol; a backend set has none — set it to match the listener (see frostmoln_lb_listener.protocol).
• The converter adds lb_algorithm automatically. frostmoln_lb_pool requires lb_algorithm; round_robin matches the OCI default.
• The converter adds name automatically. frostmoln_lb_pool requires a name; when the source omits one it is taken from the resource address.

oci_load_balancer_listener → frostmoln_lb_listener — partially supported

Load-balancer listeners map to frostmoln_lb_listener; port becomes protocol_port and default_backend_set_name becomes default_pool_id.

Frostmoln listeners are deny-by-default: a required allowed_cidrs list is synthesized as ["0.0.0.0/0"] with an FM-TODO — restrict it. default_backend_set_name references the backend set by NAME, so default_pool_id needs review (set it to the converted frostmoln_lb_pool id). TLS termination (ssl_configuration) blocks — upload the certificate and set protocol to terminated_https with tls_certificate_id. Path/host/rule-based L7 routing has no equivalent.

Attribute	Outcome	Notes
load_balancer_id	Mapped to load_balancer_id
name	Mapped to name
port	Mapped to protocol_port
protocol	Converted
default_backend_set_name	Converted to default_pool_id	OCI references the backend set by name — set default_pool_id to the converted pool's id.
ssl_configuration	Manual action required
connection_configuration	Not carried over
hostname_names	Not carried over
path_route_set_name	Manual action required
routing_policy_name	Manual action required
rule_set_names	Not carried over

• The converter adds name automatically. frostmoln_lb_listener requires a name; when the source omits one it is taken from the resource address.
• The converter adds allowed_cidrs automatically. frostmoln_lb_listener is deny-by-default and requires allowed_cidrs; the placeholder allows all sources — restrict it to the intended source ranges (OCI controls listener access via security lists/NSGs).

oci_load_balancer_load_balancer → frostmoln_load_balancer — partially supported

Load balancers map to frostmoln_load_balancer; the first subnet becomes subnet_id and is_private becomes the scheme. Frostmoln load balancers attach to a single subnet.

is_private = true/false becomes scheme = "internal"/"public" — note that a PUBLIC scheme requires a public_ip_id (create a frostmoln_public_ip for the load balancer). The OCI bandwidth shape (100Mbps/400Mbps/flexible) has no equivalent and is dropped; the platform sizes the load balancer. The required vpc_id cannot be derived from the source and is an FM-TODO placeholder (set it to the VPC of the load balancer's subnet). compartment_id is dropped (tenant-scoped); defined_tags dropped, freeform_tags become tags.

Attribute	Outcome	Notes
display_name	Mapped to name
subnet_ids	Converted to subnet_id
is_private	Converted to scheme	A public scheme requires a public_ip_id — create a frostmoln_public_ip for the load balancer.
freeform_tags	Converted to tags	Freeform tags become frostmoln tags.
shape	Not carried over
shape_details	Not carried over
network_security_group_ids	Not carried over
ip_mode	Not carried over
reserved_ips	Manual action required
is_delete_protection_enabled	Not carried over
is_request_id_enabled	Not carried over
compartment_id	Not needed on Frostmoln
defined_tags	Not carried over

• The converter adds scheme automatically. an OCI load balancer defaults to public (is_private false), so an absent is_private becomes scheme = "public"; a public scheme requires a public_ip_id — create a frostmoln_public_ip or set scheme to "internal".
• The converter adds vpc_id automatically. frostmoln_load_balancer requires vpc_id; set it to the VPC of the load balancer's subnet.
• The converter adds name automatically. frostmoln_load_balancer requires a name; when display_name is absent it is taken from the Name tag or the resource address.

oci_mysql_mysql_db_system → frostmoln_mysql_instance — partially supported

MySQL DB systems map to frostmoln_mysql_instance; shape_name's size is reported and flavor_id is left for you to set, data_storage_size_in_gb becomes storage_gb, and is_highly_available becomes ha_enabled.

A managed database draws flavor_id from the managed-database flavor catalog, which is separate from the compute one — so flavor_id is left as an FM-TODO for you to set from fm database flavor list. MySQL shape names (MySQL.VM.Standard.E4.1.8GB) are not compute shapes either, so the converter often cannot report a size for them at all. mysql_version is the full OCI version (8.0.x); set version to an offered major version (fm database mysql version list). Administrator credentials are platform-issued and dropped. frostmoln_mysql_instance requires a VPC — vpc_id is an FM-TODO placeholder (set it to the subnet's VPC). compartment_id is dropped (tenant-scoped).

Attribute	Outcome	Notes
display_name	Mapped to name
shape_name	Converted to flavor_id	The shape's vCPUs and RAM are reported when the converter recognizes it; flavor_id is left as an FM-TODO to set from fm database flavor list.
mysql_version	Converted to version	Verify the version is offered on the platform (fm database mysql version list).
data_storage_size_in_gb	Mapped to storage_gb
is_highly_available	Mapped to ha_enabled
subnet_id	Mapped to subnet_id	The subnet reference is rewritten to the converted frostmoln_subnet id.
admin_username	Not carried over
admin_password	Not carried over
availability_domain	Not carried over
fault_domain	Not carried over
configuration_id	Not carried over
data_storage	Not carried over
backup_policy	Not carried over
crash_recovery	Not carried over
database_console	Not carried over
database_management	Not carried over
deletion_policy	Not carried over
maintenance	Not carried over
port	Not carried over
port_x	Not carried over
telemetry_configuration	Not carried over
is_ipv6enabled	Converted	A disabled flag is dropped; an IPv6-enabled DB system blocks the attribute (IPv6 addressing is not supported yet).
ipv6address_ipv6subnet_cidr_pair_details	Manual action required
compartment_id	Not needed on Frostmoln
freeform_tags	Not carried over
defined_tags	Not carried over

• The converter adds version automatically. frostmoln_mysql_instance requires a version; set it to an offered version (fm database mysql version list).
• The converter adds flavor_id automatically. frostmoln_mysql_instance requires a flavor; set flavor_id to a platform flavor (see fm database flavor list).
• The converter adds vpc_id automatically. frostmoln_mysql_instance requires a VPC; set vpc_id to the converted frostmoln_vpc id.

oci_network_load_balancer_backend → frostmoln_lb_member — partially supported

Network-load-balancer backends map to frostmoln_lb_member; ip_address becomes address and port becomes protocol_port.

backend_set_name references the backend set by NAME, so pool_id needs review (set it to the converted frostmoln_lb_pool id). A target_id (an instance/VNIC OCID) must be replaced with the backend's IP address. Backup/drain/offline flags have no equivalent.

Attribute	Outcome	Notes
network_load_balancer_id	Mapped to load_balancer_id
ip_address	Mapped to address
port	Mapped to protocol_port
weight	Mapped to weight
backend_set_name	Converted to pool_id	OCI references the backend set by name — set pool_id to the converted pool's id.
target_id	Manual action required
is_backup	Not carried over
is_drain	Not carried over
is_offline	Not carried over

oci_network_load_balancer_backend_set → frostmoln_lb_pool — partially supported

Network-load-balancer backend sets map to frostmoln_lb_pool; the policy becomes lb_algorithm and the inline health_checker splits into a frostmoln_lb_health_monitor.

L4 policy: FIVE_TUPLE → source_ip_port, THREE_TUPLE/TWO_TUPLE → source_ip (note that OVN load balancers only support source_ip_port). The required protocol is an FM-TODO placeholder — set it to match the listener (tcp/udp). The health_checker becomes a frostmoln_lb_health_monitor; its OCI timings are in MILLISECONDS and are dropped (set delay/timeout in seconds manually).

Attribute	Outcome	Notes
name	Mapped to name
network_load_balancer_id	Mapped to load_balancer_id
policy	Converted to lb_algorithm
is_preserve_source	Not carried over
ip_version	Not carried over

Inline health_checker blocks are split into frostmoln_lb_health_monitor resources:

Block attribute	Outcome	Notes
protocol	Converted to type
url_path	Mapped to url_path
return_code	Mapped to expected_codes
retries	Mapped to max_retries
interval_in_millis	Not carried over
timeout_in_millis	Not carried over
port	Not carried over
response_body_regex	Not carried over
request_data	Not carried over
response_data	Not carried over

• The converter adds protocol automatically. frostmoln_lb_pool requires a protocol; a backend set has none — set it to match the listener (tcp/udp).
• The converter adds lb_algorithm automatically. frostmoln_lb_pool requires lb_algorithm; ovn (L4) load balancers support source_ip_port.
• The converter adds name automatically. frostmoln_lb_pool requires a name; when the source omits one it is taken from the resource address.

oci_network_load_balancer_listener → frostmoln_lb_listener — partially supported

Network-load-balancer listeners map to frostmoln_lb_listener; port becomes protocol_port and default_backend_set_name becomes default_pool_id.

L4 protocols: TCP → tcp, UDP → udp (TCP_AND_UDP has no single-listener equivalent and blocks). Frostmoln listeners are deny-by-default: a required allowed_cidrs list is synthesized as ["0.0.0.0/0"] with an FM-TODO — restrict it. default_backend_set_name references the backend set by name, so default_pool_id needs review.

Attribute	Outcome	Notes
network_load_balancer_id	Mapped to load_balancer_id
name	Mapped to name
port	Mapped to protocol_port
protocol	Converted
default_backend_set_name	Converted to default_pool_id	OCI references the backend set by name — set default_pool_id to the converted pool's id.
ip_version	Not carried over
is_ppv2enabled	Not carried over
l3ip_idle_timeout	Not carried over
tcp_idle_timeout	Not carried over
udp_idle_timeout	Not carried over

• The converter adds name automatically. frostmoln_lb_listener requires a name; when the source omits one it is taken from the resource address.
• The converter adds allowed_cidrs automatically. frostmoln_lb_listener is deny-by-default and requires allowed_cidrs; the placeholder allows all sources — restrict it to the intended source ranges.

oci_network_load_balancer_network_load_balancer → frostmoln_load_balancer — partially supported

Network load balancers map to frostmoln_load_balancer with provider_type = ovn (the L4 OVN driver); subnet_id carries over and is_private becomes the scheme.

provider_type is fixed to ovn (the L4 driver). is_private = true/false becomes scheme = "internal"/"public" — a PUBLIC scheme requires a public_ip_id. The required vpc_id is an FM-TODO placeholder. compartment_id is dropped (tenant-scoped); defined_tags dropped, freeform_tags become tags.

Attribute	Outcome	Notes
display_name	Mapped to name
subnet_id	Mapped to subnet_id
is_private	Converted to scheme	A public scheme requires a public_ip_id — create a frostmoln_public_ip for the load balancer.
freeform_tags	Converted to tags	Freeform tags become frostmoln tags.
nlb_ip_version	Not carried over
network_security_group_ids	Not carried over
is_preserve_source_destination	Not carried over
is_symmetric_hash_enabled	Not carried over
compartment_id	Not needed on Frostmoln
defined_tags	Not carried over

• The converter adds provider_type automatically. a network load balancer maps to the L4 OVN driver (provider_type = ovn).
• The converter adds scheme automatically. an OCI network load balancer defaults to public (is_private false); a public scheme requires a public_ip_id.
• The converter adds vpc_id automatically. frostmoln_load_balancer requires vpc_id; set it to the VPC of the load balancer's subnet.
• The converter adds name automatically. frostmoln_load_balancer requires a name; when display_name is absent it is taken from the resource address.

oci_objectstorage_bucket → frostmoln_bucket — partially supported

Object-storage buckets map to frostmoln_bucket (name, versioning, tags); the namespace is dropped and public access is flagged (Frostmoln buckets are always private).

versioning Enabled becomes "enabled"; Suspended/Disabled become "suspended". The OCI namespace has no equivalent (a bucket is addressed by name within the tenant). access_type is dropped: a private bucket (NoPublicAccess) matches the platform silently, but a PUBLIC bucket (ObjectRead/ObjectReadWithoutList) is flagged — Frostmoln buckets are always private, so re-grant read access with a frostmoln_s3_credential or presigned URLs (a private bucket never silently becomes public). Storage tiers, retention (WORM), and object events have no equivalent. compartment_id is dropped (tenant-scoped); defined_tags dropped, freeform_tags become tags.

Attribute	Outcome	Notes
name	Mapped to name
versioning	Converted
freeform_tags	Converted to tags	Freeform tags become frostmoln tags.
access_type	Converted	A private bucket drops the flag silently; a public bucket is flagged (Frostmoln buckets are always private).
namespace	Not needed on Frostmoln
storage_tier	Not carried over
object_events_enabled	Not carried over
auto_tiering	Not carried over
retention_rules	Manual action required
metadata	Not carried over
kms_key_id	Manual action required
is_bucket_key_enabled	Not carried over
bucket_scope	Not needed on Frostmoln
compartment_id	Not needed on Frostmoln
defined_tags	Not carried over

oci_psql_db_system → frostmoln_postgres_instance — partially supported

PostgreSQL DB systems map to frostmoln_postgres_instance; the shape's size is reported with flavor_id left for you to set, and db_version becomes the engine version. (Low confidence — verify the mapping.)

A DB system whose target state is INACTIVE BLOCKS the conversion (state = ACTIVE is dropped) — frostmoln_postgres_instance has no target-state attribute, so a stopped system would convert into a running, billed instance. This is a newer OCI service, so several inputs map to FM-TODO placeholders. A managed database draws flavor_id from the managed-database flavor catalog, which is separate from the compute one — so the shape's vCPUs and RAM are reported and flavor_id is left as an FM-TODO for you to set from fm database flavor list. db_version needs review against the offered versions (fm database postgres version list). storage_details (system type / IOPS) has no simple size, so storage_gb is a placeholder; network_details (subnet_id / NSGs) is not extracted, so vpc_id and subnet_id are placeholders. instance_count > 1 (HA / read replicas) is not represented on a single instance. Administrator credentials are dropped.

Attribute	Outcome	Notes
display_name	Mapped to name
shape	Converted to flavor_id	The shape's vCPUs and RAM are reported when the converter recognizes it; flavor_id is left as an FM-TODO to set from fm database flavor list.
db_version	Converted to version	Verify the version is offered on the platform (fm database postgres version list).
storage_details	Manual action required
network_details	Manual action required
credentials	Not carried over
instance_count	Not carried over
management_policy	Not carried over
system_type	Not carried over
config_id	Not carried over
source	Manual action required
kerberos_auth_details	Manual action required
replication_config	Not carried over
odsp_insight_details	Not carried over
apply_change_mode_to_stand_alone	Not carried over
state	Converted	state = ACTIVE is dropped; INACTIVE blocks — the converted instance would be created running.
compartment_id	Not needed on Frostmoln
freeform_tags	Not carried over
defined_tags	Not carried over

• The converter adds version automatically. frostmoln_postgres_instance requires a version; set it to an offered version (fm database postgres version list).
• The converter adds flavor_id automatically. frostmoln_postgres_instance requires a flavor; set flavor_id to a platform flavor (see fm database flavor list).
• The converter adds storage_gb automatically. frostmoln_postgres_instance requires storage_gb; set it to the intended size in GB.
• The converter adds vpc_id automatically. frostmoln_postgres_instance requires a VPC; set vpc_id to the converted frostmoln_vpc id.
• The converter adds subnet_id automatically. frostmoln_postgres_instance requires a subnet; set subnet_id to the converted frostmoln_subnet id (from network_details).

oci_redis_redis_cluster → frostmoln_redis_instance — partially supported

Redis clusters map to frostmoln_redis_instance; a single-node cluster carries over and its memory does not map to a platform flavor, so flavor_id is a placeholder.

The managed cache serves the cache protocol in PLAINTEXT on port 6379 at its private address in your VPC and has no TLS listener, whatever the source configuration asked for — the AUTH password therefore also crosses the wire in cleartext, as do the keys and values themselves; and with no TLS there is no integrity protection either, so anything on the network path inside your VPC can read and modify the traffic. OCI Redis clusters are reached over TLS, so this differs from the source even though the source resource has no transport toggle to carry over. frostmoln_redis_instance is single-node, so node_count > 1 BLOCKS the conversion (recreate a single-node instance, or run multiple instances). OCI sizes Redis by node_memory_in_gbs rather than vCPU/RAM, so flavor_id, vpc_id, and version are FM-TODO placeholders — set flavor_id to the platform flavor whose memory tier matches. compartment_id is dropped (tenant-scoped).

Attribute	Outcome	Notes
display_name	Mapped to name
software_version	Converted to version	Verify the version is offered on the platform (fm cache redis version list).
node_count	Converted	A single-node cluster drops the count; node_count > 1 blocks (frostmoln_redis_instance is single-node).
subnet_id	Mapped to subnet_id	The subnet reference is rewritten to the converted frostmoln_subnet id.
node_memory_in_gbs	Not carried over
cluster_mode	Not carried over
shard_count	Not carried over
nsg_ids	Not carried over
backup_id	Manual action required
import_from_object_storage_details	Manual action required
compartment_id	Not needed on Frostmoln
freeform_tags	Not carried over
defined_tags	Not carried over

• The converter adds version automatically. frostmoln_redis_instance requires a version; set it to an offered version (fm cache redis version list).
• The converter adds flavor_id automatically. frostmoln_redis_instance requires a flavor; the OCI memory size does not map — set flavor_id (see fm cache flavor list).
• The converter adds vpc_id automatically. frostmoln_redis_instance requires a VPC; set vpc_id to the converted frostmoln_vpc id.

oci_vault_secret → frostmoln_secret — partially supported

Vault secrets map to frostmoln_secret; secret_name becomes the name and the base64 secret_content is decoded onto secret_value.

secret_content.content is base64 on OCI and is decoded onto secret_value (verify the value — secrets are sensitive). The Vault and KMS key that stored the secret are platform-managed on Frostmoln and dropped. Rotation schedules and secret rules have no equivalent — rotate secrets explicitly. compartment_id is dropped (tenant-scoped); defined_tags dropped, freeform_tags become tags.

Attribute	Outcome	Notes
secret_name	Mapped to name
secret_content	Converted to secret_value	secret_content.content is base64-decoded onto secret_value.
description	Mapped to description
freeform_tags	Converted to tags	Freeform tags become frostmoln tags.
vault_id	Not needed on Frostmoln
key_id	Not needed on Frostmoln
secret_generation_context	Manual action required
enable_auto_generation	Manual action required
rotation_config	Not carried over
secret_rules	Not carried over
metadata	Not carried over
compartment_id	Not needed on Frostmoln
defined_tags	Not carried over

• The converter adds secret_value automatically. frostmoln_secret requires the value inline; set secret_value from the source secret_content.

Resources without an equivalent

Resource	What happens
oci_apigateway_gateway	API Gateway has no equivalent; there is no managed API-gateway offering.
oci_core_boot_volume	The boot volume is implicit in the instance image and flavor; standalone boot volumes are removed.
oci_core_drg	Dynamic routing gateways (hybrid/multi-VCN routing) have no equivalent.
oci_core_internet_gateway	Frostmoln splits the two directions an internet gateway carries — outbound is the VPC's frostmoln_gateway, inbound is a Public IP or a load balancer — and a converted VPC has neither until you ask for them. The VCN's converted VPC may have at most ONE gateway, so every gateway serving it collapses into that one.
oci_core_nat_gateway	A Frostmoln VPC reaches the internet only while a frostmoln_gateway is attached to it, and the converter must not decide for you whether that path egresses from a platform-drawn address or from a Public IP you own. A VPC may have at most ONE, so several NAT gateways serving one VCN collapse into a single gateway.
oci_core_route_table	Routing inside a VPC is platform-managed and route tables are removed; the internet route rule one usually carries is not replaced — outbound comes from the VPC's gateway, a separate resource you must add.
oci_core_service_gateway	Private access to Oracle services is OCI-specific; service gateways are removed — but note that a Frostmoln VPC reaches platform services over its gateway, which is a separate resource you must add.
oci_database_autonomous_database	Oracle Autonomous Database has no equivalent; Frostmoln offers managed PostgreSQL and MySQL only.
oci_database_db_system	Oracle Database / Exadata DB systems have no equivalent; Frostmoln offers managed PostgreSQL and MySQL only.
oci_file_storage_file_system	File Storage (NFS) has no equivalent; there is no managed shared-filesystem offering.
oci_functions_function	Serverless Functions have no equivalent; there is no function-as-a-service offering.
oci_identity_compartment	Compartments have no equivalent; Frostmoln resources are tenant-scoped.
oci_identity_policy	IAM policies have no equivalent; Frostmoln access control is tenant-scoped and managed separately.
oci_kms_vault	KMS vaults (customer key management) have no equivalent; encryption keys are platform-managed.
oci_load_balancer_certificate	TLS certificates are uploaded to the platform manually; load-balancer certificate resources have no equivalent.
oci_nosql_table	NoSQL Database tables have no equivalent; there is no managed NoSQL offering.
oci_objectstorage_object	Individual objects are not managed as Terraform resources; only the bucket converts.
oci_streaming_stream	Streaming (Kafka-compatible) has no equivalent; the managed message broker is AMQP (LavinMQ), not a Kafka/streaming service.

oci_apigateway_gateway

Front your services with a frostmoln_load_balancer, or run an ingress/API gateway on frostmoln_kubernetes_cluster.

oci_core_boot_volume

Frostmoln instances boot from a platform image (image_id); there is no separate boot-volume resource. Attach extra storage as frostmoln_volume.

oci_core_drg

Frostmoln has no DRG, local/remote VCN peering, IPSec VPN, or FastConnect. Recreate hybrid connectivity outside the platform.

oci_core_internet_gateway

An internet gateway is not a one-to-one concept, and it is not a resource the platform makes unnecessary. It carries BOTH directions; Frostmoln separates them, and neither follows from the VPC alone.

OUTBOUND is the VPC's gateway — one explicit resource per VPC. A VPC without one is an isolated network: no outbound internet, and — because the platform DNS resolver and the managed-service control plane are reached over routes that exist only while that path does — no name resolution and no managed-service connectivity either. Attach one to the converted VPC:

resource "frostmoln_gateway" "main" {
  vpc_id = frostmoln_vpc.main.id
  mode   = "public_ip"
}

The gateway's source address is drawn by the platform, and you do not choose which one you get, so it is not an address to publish. Where a partner allow-lists your source address, or DNS points at it, allocate the address yourself and name it — the gateway then egresses from that one:

resource "frostmoln_public_ip" "egress" {}

resource "frostmoln_gateway" "main" {
  vpc_id       = frostmoln_vpc.main.id
  mode         = "public_ip"
  public_ip_id = frostmoln_public_ip.egress.id
}

That address is one of yours: listed among your Public IPs, drawn from the same public IPv4 quota your customer-facing addresses use, and billed as a Public IP. There is no shared-outbound-address option — a VPC egresses through its own gateway, never through an address held in common with other tenants. The converter writes no gateway: connectivity is a stated choice, so that a VPC cannot acquire an outbound path — or a billable public address — because a field was omitted.

INBOUND is per workload, not per VPC. There is no switch that makes a VPC's private addresses routable from the internet, and no public-versus-private subnet distinction: attach a frostmoln_public_ip to the instance that must be reachable, or put a public frostmoln_load_balancer in front of it.

The same gateway can be created outside Terraform with fm network gateway create.

It adopts rather than duplicates. If the VPC already has a gateway — one the platform attached implicitly because a public IP was associated with an instance in it, or one created outside Terraform later — import that one rather than creating a second; the platform refuses the second with GATEWAY_EXISTS. The resource is one-to-one with its VPC, so the VPC's own id is the import id:

terraform import frostmoln_gateway.main <vpc-id>

oci_core_nat_gateway

This is not a resource the platform makes unnecessary — it is one you have to replace. A Frostmoln VPC's outbound path is an explicit resource, and a VPC without one is an isolated network: no outbound internet, and — because the platform DNS resolver and the managed-service control plane are reached over routes that exist only while that path does — no name resolution and no managed-service connectivity either. Attach one to the converted VPC (the frostmoln_vpc this gateway's VCN became):

resource "frostmoln_gateway" "main" {
  vpc_id = frostmoln_vpc.main.id
  mode   = "public_ip"
}

That gateway IS the translation this NAT gateway performed: every instance in the VPC egresses through it. Its source address is drawn by the platform, and you do not choose which one you get, so it is not an address to publish — which is what the NAT gateway's own nat_ip gave you. Where a remote peer allow-lists your source address, allocate the address yourself and name it:

resource "frostmoln_public_ip" "egress" {}

resource "frostmoln_gateway" "main" {
  vpc_id       = frostmoln_vpc.main.id
  mode         = "public_ip"
  public_ip_id = frostmoln_public_ip.egress.id
}

That address is one of yours: listed among your Public IPs, drawn from the same public IPv4 quota your customer-facing addresses use, and billed as a Public IP. There is no shared-outbound-address option — a VPC egresses through its own gateway, never through an address held in common with other tenants.

The converter does not write the gateway for you, deliberately: connectivity is a stated choice, so that a VPC cannot acquire an outbound path — or a billable public address — because a field was omitted.

Two shapes do not carry over. A VPC has AT MOST ONE gateway, while a VCN may hold several NAT gateways; a single frostmoln_gateway replaces all of them, and that many-to-one collapse is left to you to make rather than performed quietly. And block_traffic = true — a NAT gateway kept in place with its traffic paused — has no equivalent: the way to have no outbound path is to have no gateway, and removing it costs DNS and managed-service connectivity as well.

The same gateway can be created outside Terraform with fm network gateway create.

It adopts rather than duplicates. If the VPC already has a gateway — one the platform attached implicitly because a public IP was associated with an instance in it, or one created outside Terraform later — import that one rather than creating a second; the platform refuses the second with GATEWAY_EXISTS. The resource is one-to-one with its VPC, so the VPC's own id is the import id:

terraform import frostmoln_gateway.main <vpc-id>

oci_core_route_table

Subnet-to-subnet routing within a Frostmoln VPC is automatic, so the table itself has nothing to convert to. A route rule whose network_entity_id points at an internet or NAT gateway does not survive either, and nothing replaces it implicitly: a Frostmoln VPC has no outbound path until a frostmoln_gateway is attached to it, and a VPC without one is an isolated network — no outbound internet, no name resolution and no managed-service connectivity. See the oci_core_internet_gateway or oci_core_nat_gateway entry for what to add, and how to give it a source address you can publish.

oci_core_service_gateway

Frostmoln has no Oracle Services Network and no private service endpoint, so there is no equivalent service-gateway concept to convert to.

What replaces it is worth stating, because the shape is different. Frostmoln managed services are created inside your VPC and subnet and are reached at their private address, so they need no gateway at all. Everything the VPC reaches OUTSIDE itself — including the platform DNS resolver and the managed-service control plane, which travel over routes that exist only while the outbound path does — depends on a frostmoln_gateway being attached to the VPC. Without one the VPC is an isolated network. See the oci_core_nat_gateway entry for what to add, and how to give it a source address you can publish.

oci_database_autonomous_database

Migrate the schema and data to a frostmoln_postgres_instance or frostmoln_mysql_instance; the Oracle engine and its autonomous features are not available.

oci_database_db_system

Migrate the schema and data to a frostmoln_postgres_instance or frostmoln_mysql_instance; the Oracle engine and Exadata infrastructure are not available.

oci_file_storage_file_system

Use frostmoln_volume (block storage) for per-instance disks, or frostmoln_bucket (object storage) for shared data.

oci_functions_function

Run the workload as a container on frostmoln_kubernetes_cluster, or as a service on a frostmoln_instance.

oci_identity_compartment

OCI organizes resources into compartments; on Frostmoln everything belongs to the tenant directly. Drop compartment_id from every converted resource (the converter does this automatically) and organize with tags.

oci_identity_policy

OCI IAM policies (compartment-scoped statements) do not carry over. Grant access with scoped API keys and S3 credentials (frostmoln_s3_credential) via the platform's own identity model.

oci_kms_vault

Frostmoln encrypts volumes, objects, and databases with platform-managed keys. For application secrets, use frostmoln_secret.

oci_load_balancer_certificate

Upload the certificate to Frostmoln and set tls_certificate_id on the frostmoln_lb_listener (a terminated_https listener).

oci_nosql_table

Use frostmoln_postgres_instance (with JSONB) or run a NoSQL engine on frostmoln_kubernetes_cluster.

oci_objectstorage_object

Upload object content out of band (S3-compatible client or presigned URLs) after creating the frostmoln_bucket.

oci_streaming_stream

For messaging, use the platform's managed broker offering; there is no Streaming/Kafka, Queue, ONS, or Events equivalent.

---

Trademarks. Frostmoln is an independent cloud provider and a competing alternative to Amazon Web Services, Microsoft Azure, Google Cloud, and Oracle Cloud. Frostmoln is not affiliated with, endorsed by, or sponsored by any of them. AWS, Azure, Google Cloud, and Oracle Cloud are trademarks of their respective owners; all references are nominative and for interoperability only.