@OscarB7

When reserving the public IP, you can assign it to a private IP (from the host).
So it works the other way around

example on how to attach a reserved public IP to the first private IP of a guest:

data "oci_core_private_ips" "bastion" {
  ip_address = oci_core_instance.bastion.private_ip
  subnet_id  = oci_core_subnet.bastion.id
}

resource "oci_core_public_ip" "bastion" {
  compartment_id = var.network_compartment_id != "" ? var.network_compartment_id : var.compartment_id
  display_name   = var.bastion_identifier != "" ? join("-", ["ip-bastion-pub", var.bastion_identifier]) : "ip-bastion-pub"
  lifetime       = "RESERVED"
  private_ip_id  = data.oci_core_private_ips.bastion.private_ips[0]["id"]

  defined_tags = var.defined_tags
}

thank you, @dhoogfr ! I appreciate it. I will try that

I really wish this didn't work like this. Attaching a static IP should be a stand-alone operation. The way this works now creates an unfortunate dependency from the IP to the instance, which in turn means there's no way to inject said public IP into the user data of the instance via Terraform reference.

@dhoogfr I implemented it and worked for my current use case.
This approach allows the instance to be re-created while keeping the same VNIC. Now if I destroy the instance, e.g., using terraform destroy --target oci_core_instance.bastion, the VNIC will be destroyed as well.
Is there a way to create the VNIC (reserved public IP) without this dependency on the instance it is attached to?

@OscarB7
When I need to destroy the instance, I need to first change the oci_core_public_ip configuration to remove the private_ip_id relation.
After that the instance can be destroyed / recreated without destroying the reserved public IP.

To prevent accidental destruction you could try to add a lifecycle clause with "prevent_destroy = true" attribute to the oci_core_public_ip resource

resource "oci_core_public_ip" "bastion" {
  compartment_id = var.network_compartment_id != "" ? var.network_compartment_id : var.compartment_id
  display_name   = var.bastion_identifier != "" ? join("-", ["ip-bastion-pub", var.bastion_identifier]) : "ip-bastion-pub"
  lifetime       = "RESERVED"
  private_ip_id  = data.oci_core_private_ips.bastion.private_ips[0]["id"]

  defined_tags = var.defined_tags

  lifecycle {
    prevent_destroy = true
  }
}

But, I have not actually tried this myself.

Thank you very much @dhoogfr !

resource "oci_core_public_ip" "bastion" {
compartment_id = var.network_compartment_id != "" ? var.network_compartment_id : var.compartment_id
display_name = var.bastion_identifier != "" ? join("-", ["ip-bastion-pub", var.bastion_identifier]) : "ip-bastion-pub"
lifetime = "RESERVED"
private_ip_id = data.oci_core_private_ips.bastion.private_ips[0]["id"]

defined_tags = var.defined_tags

lifecycle {
prevent_destroy = true
}
}

I you apply and destroy 5 times , you will probably not reuse the public IP that you prevented from being destroyed. It will be a clutter of public IPs at the end .

@dhoogfr , I can confirm that the destroy fails with prevent destroy clause .

│ Error: Instance cannot be destroyed
│
│   on compute.tf line 91:
│   91: resource "oci_core_public_ip" "untrust_public_ip" {
│
│ Resource oci_core_public_ip.untrust_public_ip has lifecycle.prevent_destroy set, but the plan calls for this resource to be destroyed. To
│ avoid this error and continue with the plan, either disable lifecycle.prevent_destroy or reduce the scope of the plan using the -target flag.

I am going to open an enhancement issue