diff --git a/ibm_catalog.json b/ibm_catalog.json index 5148499..b99a234 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -9,22 +9,27 @@ "support_ibm", "target_terraform", "security", - "ibm_created" + "logging_monitoring", + "ibm_created", + "terraform" ], "keywords": [ "kms", "scc", "secrets manager", - "security-compliance-center", "keyprotect", "IaC", "infrastructure as code", - "security and compliance center", + "security and compliance center workload protection", "terraform", "solution", "secrets", "key protect", - "compliance" + "compliance", + "cspm", + "cloud security posture management", + "config aggregator", + "app config" ], "short_description": "Deploy core security and other supporting services to get set up to manage the security compliance of the resources in your account.", "long_description": "Get IBM Cloud’s suite of core security services with a single deployment enabling you to securely manage keys and secrets and run security and compliance scans so that you always know the posture of the resources in your account. You can also take advantage of an event notification routing service that notifies you to critical events that occur in your IBM Cloud account and observability services that provide enterprise-grade monitoring and logging giving you operational visibility into the performance and health of your apps, services, and infrastructure.", @@ -42,12 +47,12 @@ "description": "Creates and configures an IBM Secrets Manager instance." }, { - "title": "Creates an IBM Security and Compliance Center instance", - "description": "Creates and configures an IBM Security Compliance Center instance." + "title": "Creates an App Configuration instance", + "description": "Creates and configures an IBM Cloud App Configuration instance with the config aggregator feature enabled." }, { "title": "Creates an Security and Compliance Center Workload Protection instance", - "description": "Creates and configures an Security and Compliance Center Workload Protection instance." + "description": "Creates and configures an Security and Compliance Center Workload Protection instance with Cloud Security Posture Management (CSPM) enabled." }, { "title": "Creates an IBM Cloud Object Storage instance", @@ -97,7 +102,15 @@ ] }, { - "service_name": "compliance", + "service_name": "sysdig-secure", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Manager", + "crn:v1:bluemix:public:iam::::role:Operator", + "crn:v1:bluemix:public:iam::::role:Editor" + ] + }, + { + "service_name": "apprapp", "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", "crn:v1:bluemix:public:iam::::role:Operator", @@ -128,12 +141,12 @@ "description": "Create, lease, and centrally manage secrets that are used in your apps and services using IBM Secrets Manager instance." }, { - "title": "Optionally configure an IBM Cloud Secrets Manager IAM credentials engine to an IBM Cloud Secrets Manager instance", - "description": "Optionally configure an IBM Secrets Manager IAM credentials engine to an IBM Cloud Secrets Manager instance." + "title": "Configures an IBM Cloud Secrets Manager IAM credentials engine to an IBM Cloud Secrets Manager instance", + "description": "Configures an IBM Secrets Manager IAM credentials engine to an IBM Cloud Secrets Manager instance." }, { - "title": "Creates an IBM Cloud Security and Compliance Center instance", - "description": "Manage your continuous compliance monitoring needs using IBM Security Compliance Center instance." + "title": "Creates an IBM Cloud App Configuration instance with Configuration Aggregator", + "description": "Facilitate a Cloud Governance SME with up-to-date configuration data of IBM Cloud resources in one place so that comprehensive information is available for goverance and compliance initiatives." }, { "title": "Creates a IBM Cloud Security and Compliance Center Workload Protection instance", @@ -160,7 +173,6 @@ { "key": "prefix", "type": "string", - "default_value": "", "description": "The prefix to add to all resources created by this solution. Used to make sure that names are unique when you deploy the solution more than one time. This should start with a lower case letter and not include '--' or end in '-'.", "required": true }, @@ -171,26 +183,46 @@ "description": "The region where the resources are created.", "required": true, "options": [ - { - "displayname": "us-south", - "value": "us-south" - }, - { - "displayname": "eu-de", - "value": "eu-de" - }, - { - "displayname": "eu-es", - "value": "eu-es" - } + { + "displayname": "Osaka (jp-osa)", + "value": "jp-osa" + }, + { + "displayname": "Tokyo (jp-tok)", + "value": "jp-tok" + }, + { + "displayname": "Frankfurt (eu-de)", + "value": "eu-de" + }, + { + "displayname": "London (eu-gb)", + "value": "eu-gb" + }, + { + "displayname": "Madrid (eu-es)", + "value": "eu-es" + }, + { + "displayname": "Dallas (us-south)", + "value": "us-south" + }, + { + "displayname": "Toronto (ca-tor)", + "value": "ca-tor" + }, + { + "displayname": "Sao Paulo (br-sao)", + "value": "br-sao" + } ] }, { + "display_name": "resource_group", "key": "existing_resource_group_name", "type": "string", "default_value": "Default", "description": "The name of an existing resource group to provision all resources to.", - "display_name": "Existing resource group name", "required": true, "custom_config": { "type": "resource_group", @@ -223,6 +255,7 @@ "required": false }, { + "display_name": "event_notifications_email_list", "key": "en_email_list", "type": "array", "default_value": [], @@ -230,6 +263,7 @@ "required": false }, { + "display_name": "existing_event_notifications_instance_crn", "key": "existing_en_instance_crn", "type": "string", "default_value": "__NULL__", @@ -244,6 +278,7 @@ "required": false }, { + "display_name": "secrets_manager_service_plan", "key": "sm_service_plan", "type": "string", "default_value": "standard", @@ -251,39 +286,81 @@ "required": false, "options": [ { - "displayname": "standard", + "displayname": "Standard", "value": "standard" }, { - "displayname": "trial", + "displayname": "Trial", "value": "trial" } ] }, { + "display_name": "disable_secrets_manager_iam_credentials_engine", "key": "skip_iam_authorization_policy", - "display_name": "Disable Secrets Manager IAM credentials engine auth policy creation?", "type": "boolean", "default_value": false, "description": "Whether to skip the creation of the IAM authorization policies required to enable the Secrets Manager IAM credentials engine. If set to false, policies will be created that grants the Secrets Manager instance 'Operator' access to the IAM identity service, and 'Groups Service Member Manage' access to the IAM groups service.", "required": false }, { - "key": "scc_service_plan", + "key": "app_config_service_plan", "type": "string", - "default_value": "security-compliance-center-standard-plan", - "description": "The pricing plan to use for the IBM Cloud Security and Compliance Center.", + "default_value": "basic", + "description": "The pricing plan to use for the IBM Cloud App Configuration instance.", "required": false, "options": [ { - "displayname": "standard", - "value": "security-compliance-center-standard-plan" + "displayname": "Basic", + "value": "basic" + }, + { + "displayname": "Standard", + "value": "standardv2" }, { - "displayname": "trial", - "value": "security-compliance-center-trial-plan" + "displayname": "Enterprise", + "value": "enterprise" } ] + }, + { + "key": "scc_workload_protection_service_plan", + "type": "string", + "default_value": "graduated-tier", + "description": "The pricing plan to use for the IBM Cloud Security and Compliance Center Workload Protection instance.", + "required": false, + "options": [ + { + "displayname": "Graduated Tier", + "value": "graduated-tier" + }, + { + "displayname": "Free Trial", + "value": "free-trial" + } + ] + }, + { + "key": "enterprise_id", + "type": "string", + "default_value": "__NULL__", + "description": "If the account is an enterprise account and you want to scan sub-accounts for compliance, this value should be set to the enterprise ID (this is different to the account ID).", + "required": false + }, + { + "key": "enterprise_account_group_ids_to_assign", + "type": "array", + "default_value": ["all"], + "description": "A list of enterprise account group IDs to assign the trusted profile template to in order for the accounts to be scanned for compliance. Supports passing the string 'all' in the list to assign to all account groups. Only applies if a value is being passed for `enterprise_id`.", + "required": false + }, + { + "key": "enterprise_account_ids_to_assign", + "type": "array", + "default_value": ["all"], + "description": "A list of enterprise account IDs to assign the trusted profile template to in order for the accounts to be scanned. Supports passing the string 'all' in the list to assign to all accounts. Only applies if a value is being passed for `enterprise_id`.", + "required": false } ], "outputs": [ @@ -296,8 +373,8 @@ "description": "The CRN of the Secrets Manager instance." }, { - "key": "scc_crn", - "description": "The CRN of the Security and Compliance Center instance." + "key": "app_config_crn", + "description": "The CRN of the App Configuration instance." }, { "key": "monitoring_crn", @@ -311,10 +388,6 @@ "key": "en_crn", "description": "The CRN of the Event Notifications instance." }, - { - "key": "log_analysis_crn", - "description": "The CRN of the provisioned Log Analysis instance." - }, { "key": "cloud_logs_crn", "description": "The CRN of the provisioned Cloud Logs instance." diff --git a/reference-architectures/core-security-services-architecture.svg b/reference-architectures/core-security-services-architecture.svg index c2d8c71..cf4a1de 100644 --- a/reference-architectures/core-security-services-architecture.svg +++ b/reference-architectures/core-security-services-architecture.svg @@ -1,4 +1,4 @@ -
IBM Cloud
IBM Cloud
Region
Region
Zone
Zone
%3CmxGraphModel%3E%3Croot%3E%3CmxCell%20id%3D%220%22%2F%3E%3CmxCell%20id%3D%221%22%20parent%3D%220%22%2F%3E%3CmxCell%20id%3D%222%22%20value%3D%22%22%20style%3D%22shape%3Dimage%3Baspect%3Dfixed%3Bimage%3Ddata%3Aimage%2Fsvg%2Bxml%2CPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHN2ZyB3aWR0aD0iMjlweCIgaGVpZ2h0PSIyOHB4IiB2aWV3Qm94PSIwIDAgMjkgMjgiIHZlcnNpb249IjEuMSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxuczp4bGluaz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94bGluayI%2BCiAgICA8IS0tIEdlbmVyYXRvcjogU2tldGNoIDUzICg3MjUyMCkgLSBodHRwczovL3NrZXRjaGFwcC5jb20gLS0%2BCiAgICA8dGl0bGU%2BUmVzb3VyY2UgR3JvdXAgQmxhY2s8L3RpdGxlPgogICAgPGRlc2M%2BQ3JlYXRlZCB3aXRoIFNrZXRjaC48L2Rlc2M%2BCiAgICA8ZGVmcz4KICAgICAgICA8cG9seWdvbiBpZD0icGF0aC0xIiBwb2ludHM9IjAgMCAyOCAwIDI4IDI4IDAgMjgiPjwvcG9seWdvbj4KICAgIDwvZGVmcz4KICAgIDxnIGlkPSJQYWdlLTEiIHN0cm9rZT0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxIiBmaWxsPSJub25lIiBmaWxsLXJ1bGU9ImV2ZW5vZGQiPgogICAgICAgIDxnIGlkPSJSZXNvdXJjZS1Hcm91cC1CbGFjayIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMC4zNzUwMDAsIDAuMDAwMDAwKSI%2BCiAgICAgICAgICAgIDxtYXNrIGlkPSJtYXNrLTIiIGZpbGw9IndoaXRlIj4KICAgICAgICAgICAgICAgIDx1c2UgeGxpbms6aHJlZj0iI3BhdGgtMSI%2BPC91c2U%2BCiAgICAgICAgICAgIDwvbWFzaz4KICAgICAgICAgICAgPGcgaWQ9IkNsaXAtMiI%2BPC9nPgogICAgICAgICAgICA8cGF0aCBkPSJNOCwyMCBMMjAsMjAgTDIwLDggTDgsOCBMOCwyMCBaIE0yMCwyMiBMOCwyMiBDNi44OTYsMjEuOTk5IDYuMDAxLDIxLjEwNCA2LDIwIEw2LDggQzYuMDAxLDYuODk2IDYuODk2LDYuMDAxIDgsNiBMMjAsNiBDMjEuMTA0LDYuMDAxIDIxLjk5OSw2Ljg5NiAyMiw4IEwyMiwyMCBDMjEuOTk5LDIxLjEwNCAyMS4xMDQsMjEuOTk5IDIwLDIyIEwyMCwyMiBaIiBpZD0iRmlsbC0xIiBmaWxsPSIjMDAwMDAwIiBtYXNrPSJ1cmwoI21hc2stMikiPjwvcGF0aD4KICAgICAgICAgICAgPHBhdGggZD0iTTUuOTk5OCwyOCBMMS45OTk4LDI4IEMwLjg5NTgsMjcuOTk5IDAuMDAwOCwyNy4xMDQgLTAuMDAwMiwyNiBMLTAuMDAwMiwyIEMwLjAwMDgsMC44OTYgMC44OTU4LDAuMDAxIDEuOTk5OCwwIEw1Ljk5OTgsMCBMNS45OTk4LDIgTDEuOTk5OCwyIEwxLjk5OTgsMjYgTDUuOTk5OCwyNiBMNS45OTk4LDI4IFoiIGlkPSJGaWxsLTMiIGZpbGw9IiMwMDAwMDAiIG1hc2s9InVybCgjbWFzay0yKSI%2BPC9wYXRoPgogICAgICAgICAgICA8cGF0aCBkPSJNMjYuMDAwMywyOCBMMjIuMDAwMywyOCBMMjIuMDAwMywyNiBMMjYuMDAwMywyNiBMMjYuMDAwMywyIEwyMi4wMDAzLDIgTDIyLjAwMDMsMCBMMjYuMDAwMywwIEMyNy4xMDQzLDAuMDAxIDI3Ljk5OTMsMC44OTYgMjguMDAwMywyIEwyOC4wMDAzLDI2IEMyNy45OTkzLDI3LjEwNCAyNy4xMDQzLDI3Ljk5OSAyNi4wMDAzLDI4IiBpZD0iRmlsbC00IiBmaWxsPSIjMDAwMDAwIiBtYXNrPSJ1cmwoI21hc2stMikiPjwvcGF0aD4KICAgICAgICA8L2c%2BCiAgICA8L2c%2BCjwvc3ZnPg%3D%3D%3B%22%20vertex%3D%221%22%20parent%3D%221%22%3E%3CmxGeometry%20x%3D%22778%22%20y%3D%22136.84000000000006%22%20width%3D%2224%22%20height%3D%2223.17%22%20as%3D%22geometry%22%2F%3E%3C%2FmxCell%3E%3C%2Froot%3E%3C%2FmxGraphModel%3E       Resource Group
%3CmxGraphModel%3E%3Croot%3E%3CmxCell%20id%3D%220%22%2F%3E%3CmxCell%20id%3D%221%22%20parent%3D%220%...
              Cloud Object Storage

              Cloud Object Storage EN bucketCloud Logs data bucketSCC bucketAT events bucket
Secrets Manager
Secrets Ma...
Key Protect
Key Protect
Event Notifications
Event Noti...
Activity Tracking Event Routing
Activity T...
Cloud Monitoring
Cloud Moni...
SCC Workload Protection
SCC Worklo...
Security Compliance Center
Security C...
IAM Engine
IAM EngineCloudLogsText is not SVG - cannot display \ No newline at end of file +
IBM Cloud
%3CmxGraphModel%3E%3Croot%3E%3CmxCell%20id%3D%220%22%2F%3E%3CmxCell%20id%3D%221%22%20parent%3D%220%22%2F%3E%3CmxCell%20id%3D%222%22%20value%3D%22%22%20style%3D%22shape%3Dimage%3Baspect%3Dfixed%3Bimage%3Ddata%3Aimage%2Fsvg%2Bxml%2CPD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz4KPHN2ZyB3aWR0aD0iMjlweCIgaGVpZ2h0PSIyOHB4IiB2aWV3Qm94PSIwIDAgMjkgMjgiIHZlcnNpb249IjEuMSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxuczp4bGluaz0iaHR0cDovL3d3dy53My5vcmcvMTk5OS94bGluayI%2BCiAgICA8IS0tIEdlbmVyYXRvcjogU2tldGNoIDUzICg3MjUyMCkgLSBodHRwczovL3NrZXRjaGFwcC5jb20gLS0%2BCiAgICA8dGl0bGU%2BUmVzb3VyY2UgR3JvdXAgQmxhY2s8L3RpdGxlPgogICAgPGRlc2M%2BQ3JlYXRlZCB3aXRoIFNrZXRjaC48L2Rlc2M%2BCiAgICA8ZGVmcz4KICAgICAgICA8cG9seWdvbiBpZD0icGF0aC0xIiBwb2ludHM9IjAgMCAyOCAwIDI4IDI4IDAgMjgiPjwvcG9seWdvbj4KICAgIDwvZGVmcz4KICAgIDxnIGlkPSJQYWdlLTEiIHN0cm9rZT0ibm9uZSIgc3Ryb2tlLXdpZHRoPSIxIiBmaWxsPSJub25lIiBmaWxsLXJ1bGU9ImV2ZW5vZGQiPgogICAgICAgIDxnIGlkPSJSZXNvdXJjZS1Hcm91cC1CbGFjayIgdHJhbnNmb3JtPSJ0cmFuc2xhdGUoMC4zNzUwMDAsIDAuMDAwMDAwKSI%2BCiAgICAgICAgICAgIDxtYXNrIGlkPSJtYXNrLTIiIGZpbGw9IndoaXRlIj4KICAgICAgICAgICAgICAgIDx1c2UgeGxpbms6aHJlZj0iI3BhdGgtMSI%2BPC91c2U%2BCiAgICAgICAgICAgIDwvbWFzaz4KICAgICAgICAgICAgPGcgaWQ9IkNsaXAtMiI%2BPC9nPgogICAgICAgICAgICA8cGF0aCBkPSJNOCwyMCBMMjAsMjAgTDIwLDggTDgsOCBMOCwyMCBaIE0yMCwyMiBMOCwyMiBDNi44OTYsMjEuOTk5IDYuMDAxLDIxLjEwNCA2LDIwIEw2LDggQzYuMDAxLDYuODk2IDYuODk2LDYuMDAxIDgsNiBMMjAsNiBDMjEuMTA0LDYuMDAxIDIxLjk5OSw2Ljg5NiAyMiw4IEwyMiwyMCBDMjEuOTk5LDIxLjEwNCAyMS4xMDQsMjEuOTk5IDIwLDIyIEwyMCwyMiBaIiBpZD0iRmlsbC0xIiBmaWxsPSIjMDAwMDAwIiBtYXNrPSJ1cmwoI21hc2stMikiPjwvcGF0aD4KICAgICAgICAgICAgPHBhdGggZD0iTTUuOTk5OCwyOCBMMS45OTk4LDI4IEMwLjg5NTgsMjcuOTk5IDAuMDAwOCwyNy4xMDQgLTAuMDAwMiwyNiBMLTAuMDAwMiwyIEMwLjAwMDgsMC44OTYgMC44OTU4LDAuMDAxIDEuOTk5OCwwIEw1Ljk5OTgsMCBMNS45OTk4LDIgTDEuOTk5OCwyIEwxLjk5OTgsMjYgTDUuOTk5OCwyNiBMNS45OTk4LDI4IFoiIGlkPSJGaWxsLTMiIGZpbGw9IiMwMDAwMDAiIG1hc2s9InVybCgjbWFzay0yKSI%2BPC9wYXRoPgogICAgICAgICAgICA8cGF0aCBkPSJNMjYuMDAwMywyOCBMMjIuMDAwMywyOCBMMjIuMDAwMywyNiBMMjYuMDAwMywyNiBMMjYuMDAwMywyIEwyMi4wMDAzLDIgTDIyLjAwMDMsMCBMMjYuMDAwMywwIEMyNy4xMDQzLDAuMDAxIDI3Ljk5OTMsMC44OTYgMjguMDAwMywyIEwyOC4wMDAzLDI2IEMyNy45OTkzLDI3LjEwNCAyNy4xMDQzLDI3Ljk5OSAyNi4wMDAzLDI4IiBpZD0iRmlsbC00IiBmaWxsPSIjMDAwMDAwIiBtYXNrPSJ1cmwoI21hc2stMikiPjwvcGF0aD4KICAgICAgICA8L2c%2BCiAgICA8L2c%2BCjwvc3ZnPg%3D%3D%3B%22%20vertex%3D%221%22%20parent%3D%221%22%3E%3CmxGeometry%20x%3D%22778%22%20y%3D%22136.84000000000006%22%20width%3D%2224%22%20height%3D%2223.17%22%20as%3D%22geometry%22%2F%3E%3C%2FmxCell%3E%3C%2Froot%3E%3C%2FmxGraphModel%3E       Resource Group
              Object Storage

Event Notifications bucketCloud Logs bucketCloud LogsMetrics bucketAT events bucket
Secrets Manager
Key Protect
Event Notifications
Activity Tracking Event Routing
Cloud Monitoring
App
configuration
SCC Workload Protection
IAM Engine
CloudLogs
Region
 \ No newline at end of file diff --git a/reference-architectures/reference-architecture-css.md b/reference-architectures/reference-architecture-css.md index 4f1e13b..3fbd408 100644 --- a/reference-architectures/reference-architecture-css.md +++ b/reference-architectures/reference-architecture-css.md @@ -11,7 +11,7 @@ authors: email: bhakta@ibm.com # The release that the reference architecture describes -version: 2.1.0 +version: 3.0.0 # Use if the reference architecture has deployable code. # Value is the URL to land the user in the IBM Cloud catalog details page for the deployable architecture. @@ -52,7 +52,7 @@ https://test.cloud.ibm.com/docs/solution-as-code?topic=solution-as-code-naming-g # IBM Cloud Essential Security and Observability Services {: #core-security-services-pattern} {: toc-content-type="reference-architecture"} -{: toc-version="2.1.0"} +{: toc-version="3.0.0"}