Skip to content

Commit b2be2a7

Browse files
github-actions[bot]shanye997
github-actions[bot]
authored and
shanye997
committed
Update TestRecord
Create access point Create KMS access point
1 parent 8071d1d commit b2be2a7

File tree

3 files changed

+191
-0
lines changed

3 files changed

+191
-0
lines changed

‎quickstarts/KMS/201-use-case-create-kms-access-point/README.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
## Introduction
2+
3+
<!-- DOCS_DESCRIPTION_CN -->
4+
本示例用于在阿里云上创建KMS应用接入点，涉及到网络控制规则,应用接入点的资源定义,应用身份凭证资源定义,访问控制策略等资源的创建。
5+
详情可查看[通过Terraform创建KMS应用接入点](http://help.aliyun.com/document_detail/2572878.htm)。
6+
<!-- DOCS_DESCRIPTION_CN -->
7+
8+
<!-- DOCS_DESCRIPTION_EN -->
9+
This example is used to create an KMS AAP on Alibaba Cloud, which involves the creation of resources such as network rule, application access point, client key and access control policy.
10+
More details in [Create an KMS AAP](http://help.aliyun.com/document_detail/2572878.htm).
11+
<!-- DOCS_DESCRIPTION_EN -->
12+
13+
<!-- BEGIN_TF_DOCS -->
14+
## Providers
15+
16+
| Name | Version |
17+
|------|---------|
18+
| <a name="provider_alicloud"></a> [alicloud](#provider\_alicloud) | n/a |
19+
| <a name="provider_local"></a> [local](#provider\_local) | n/a |
20+
21+
## Modules
22+
23+
No modules.
24+
25+
## Resources
26+
27+
| Name | Type |
28+
|------|------|
29+
| [alicloud_kms_application_access_point.application_access_point_example](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/kms_application_access_point) | resource |
30+
| [alicloud_kms_client_key.client_key](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/kms_client_key) | resource |
31+
| [alicloud_kms_instance.default](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/kms_instance) | resource |
32+
| [alicloud_kms_network_rule.network_rule_example](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/kms_network_rule) | resource |
33+
| [alicloud_kms_policy.policy_example](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/kms_policy) | resource |
34+
| [alicloud_vpc.vpc](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/vpc) | resource |
35+
| [alicloud_vswitch.vsw](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/vswitch) | resource |
36+
| [alicloud_vswitch.vsw1](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/resources/vswitch) | resource |
37+
| [local_file.ca_certificate_chain_pem](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource |
38+
| [alicloud_zones.default](https://registry.terraform.io/providers/aliyun/alicloud/latest/docs/data-sources/zones) | data source |
39+
40+
## Inputs
41+
42+
| Name | Description | Type | Default | Required |
43+
|------|-------------|------|---------|:--------:|
44+
| <a name="input_instance_name"></a> [instance\_name](#input\_instance\_name) | n/a | `string` | `"tf-kms-vpc-172-16"` | no |
45+
| <a name="input_instance_type"></a> [instance\_type](#input\_instance\_type) | n/a | `string` | `"ecs.n1.tiny"` | no |
46+
| <a name="input_region"></a> [region](#input\_region) | n/a | `string` | `"cn-heyuan"` | no |
47+
<!-- END_TF_DOCS -->
48+
## Documentation
49+
<!-- docs-link -->
50+
51+
The template is based on Aliyun document: [Create KMS access point](http://help.aliyun.com/document_detail/2572878.htm)
52+
53+
<!-- docs-link -->

‎quickstarts/KMS/201-use-case-create-kms-access-point/main.tf‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
variable "region" {
2+
default = "cn-heyuan"
3+
}
4+
provider "alicloud" {
5+
region = var.region
6+
}
7+
variable "instance_name" {
8+
default = "tf-kms-vpc-172-16"
9+
}
10+
variable "instance_type" {
11+
default = "ecs.n1.tiny"
12+
}
13+
# 使用数据源来获取可用的可用区信息。资源只能在指定的可用区内创建。
14+
data "alicloud_zones" "default" {
15+
available_disk_category = "cloud_efficiency"
16+
available_resource_creation = "VSwitch"
17+
available_instance_type = var.instance_type
18+
}
19+
# 创建VPC
20+
resource "alicloud_vpc" "vpc" {
21+
vpc_name = var.instance_name
22+
cidr_block = "192.168.0.0/16"
23+
}
24+
# 创建一个Vswitch CIDR 块为 192.168.10.0.24
25+
resource "alicloud_vswitch" "vsw" {
26+
vpc_id = alicloud_vpc.vpc.id
27+
cidr_block = "192.168.10.0/24"
28+
zone_id = data.alicloud_zones.default.zones.0.id
29+
vswitch_name = "terraform-example-1"
30+
}
31+
# 创建另一个Vswitch CIDR 块为 192.168.20.0/24
32+
resource "alicloud_vswitch" "vsw1" {
33+
vpc_id = alicloud_vpc.vpc.id
34+
cidr_block = "192.168.20.0/24"
35+
zone_id = data.alicloud_zones.default.zones.0.id
36+
vswitch_name = "terraform-example-2"
37+
}
38+
# 创建KMS软件密钥管理实例，并使用网络参数启动
39+
resource "alicloud_kms_instance" "default" {
40+
# 软件密钥管理实例
41+
product_version = "3"
42+
vpc_id = alicloud_vpc.vpc.id
43+
# 规定 KMS 实例所在的可用区，使用前面获取的可用区 ID
44+
zone_ids = [
45+
"cn-heyuan-a",
46+
"cn-heyuan-b",
47+
]
48+
# 交换机id
49+
vswitch_ids = [
50+
alicloud_vswitch.vsw.id, alicloud_vswitch.vsw1.id
51+
]
52+
# 计算性能、密钥数量、凭据数量、访问管理数量
53+
vpc_num = "1"
54+
key_num = "1000"
55+
secret_num = "100"
56+
spec = "1000"
57+
# 为KMS实例关联其他VPC，可选参数
58+
# 如果VPC与KMS实例的VPC属于不同阿里云账号，您需要先共享交换机。
59+
#bind_vpcs {
60+
#vpc_id = "vpc-j6cy0l32yz9ttxfy6****"
61+
#vswitch_id = "vsw-j6cv7rd1nz8x13ram****"
62+
#region_id = "cn-shanghai"
63+
#vpc_owner_id = "119285303511****"
64+
#}
65+
#bind_vpcs {
66+
#vpc_id = "vpc-j6cy0l32yz9ttd7g3****"
67+
#vswitch_id = "vsw-3h4yrd1nz8x13ram****"
68+
#region_id = "cn-shanghai"
69+
#vpc_owner_id = "119285303511****"
70+
#}
71+
}
72+
# 保存KMS实例CA证书到本地文件
73+
resource "local_file" "ca_certificate_chain_pem" {
74+
content = alicloud_kms_instance.default.ca_certificate_chain_pem
75+
filename = "ca.pem"
76+
}
77+
# 创建网络控制规则
78+
resource "alicloud_kms_network_rule" "network_rule_example" {
79+
# 网络规则的名称
80+
network_rule_name = "sample_network_rule"
81+
# 描述
82+
description = "description_test_module"
83+
# 允许的源私有IP地址范围
84+
source_private_ip = ["172.16.0.0/12"]
85+
}
86+
87+
# 创建访问控制策略
88+
resource "alicloud_kms_policy" "policy_example" {
89+
# 策略名称
90+
policy_name = "sample_policy"
91+
# 描述
92+
description = "description_test_module"
93+
# 定义的权限列表，包括加密服务密钥和加密服务密钥的访问权限
94+
permissions = ["RbacPermission/Template/CryptoServiceKeyUser", "RbacPermission/Template/CryptoServiceSecretUser"]
95+
# 资源列表，指向所有密钥和凭据
96+
resources = ["key/*", "secret/*"]
97+
# KMS实例的ID
98+
kms_instance_id = alicloud_kms_instance.default.id
99+
# 访问控制规则，以JSON格式提供，引用先前定义的网络规则
100+
access_control_rules = <<EOF
101+
{
102+
"NetworkRules":[
103+
"alicloud_kms_network_rule.network_rule_example.network_rule_name"
104+
]
105+
}
106+
EOF
107+
}
108+
109+
# 创建应用接入点的资源定义
110+
resource "alicloud_kms_application_access_point" "application_access_point_example" {
111+
# 应用接入点的名称
112+
application_access_point_name = "sample_aap"
113+
# 关联的策略列表，引用之前创建的访问控制策略名称
114+
policies = [alicloud_kms_policy.policy_example.policy_name]
115+
# 应用接入点的描述
116+
description = "aap_description"
117+
}
118+
119+
# 创建应用身份凭证的资源定义
120+
resource "alicloud_kms_client_key" "client_key" {
121+
# 指定应用接入点的名称
122+
aap_name = alicloud_kms_application_access_point.application_access_point_example.application_access_point_name
123+
# 身份凭证的密码,替换为您的密码
124+
password = "P@ssw0rd***"
125+
# 身份凭证的有效开始时间
126+
not_before = "2023-09-01T14:11:22Z"
127+
not_after = "2032-09-01T14:11:22Z"
128+
# 设置保存应用身份凭证的本地文件地址
129+
private_key_data_file = "./client_key.json"
130+
131+
}

‎quickstarts/KMS/201-use-case-create-kms-access-point/provider.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
terraform {
2+
required_providers {
3+
alicloud = {
4+
source = "aliyun/alicloud"
5+
}
6+
}
7+
}

0 commit comments

Comments
 (0)