Skip to content

Commit f9a99fb

Browse files
Vipin KumarVipin Kumar
Vipin Kumar
authored and
Vipin Kumar
committed
best practices
1 parent 9572a85 commit f9a99fb

File tree

6 files changed

+186
-65
lines changed

6 files changed

+186
-65
lines changed

‎ibm_catalog.json‎

Lines changed: 134 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,28 @@
2525
"provider_name": "IBM",
2626
"features": [
2727
{
28-
"title": "Configures IBM Cloud Activity Tracker Event Routing",
29-
"description": "Configures an IBM Cloud Activity Tracker route with a Cloud Object Storage and Cloud Logs target."
28+
"title": "Event Routing",
29+
"description": "Configures an IBM Cloud Activity Tracker route with Cloud Object Storage and Cloud Logs target."
30+
},
31+
{
32+
"title": "Object Storage buckets",
33+
"description": "Creates buckets required for storing events."
34+
},
35+
{
36+
"title": "Cloud Logs",
37+
"description": "Supports creating a new cloud logs instance as well as using an existing one."
38+
},
39+
{
40+
"title": "Enable KMS encryption",
41+
"description": "Supports creating a new key, or using an existing one to encrypt the Object Storage bucket. For more details on KMS encryption, refer [this](https://cloud.ibm.com/docs/key-protect?topic=key-protect-about)."
3042
}
3143
],
3244
"support_details": "This product is in the community registry and support is handled in the source repo. You can open an issue at [https://github.com/terraform-ibm-modules/terraform-ibm-activity-tracker/issues](https://github.com/terraform-ibm-modules/terraform-ibm-activity-tracker/issues). Support is not offered through IBM Cloud Support.",
3345
"flavors": [
3446
{
3547
"label": "Fully configurable",
3648
"name": "fully-configurable",
49+
"index": 1,
3750
"install_type": "fullstack",
3851
"working_directory": "solutions/fully-configurable",
3952
"iam_permissions": [
@@ -45,25 +58,25 @@
4558
]
4659
},
4760
{
61+
"service_name": "hs-crypto",
4862
"role_crns": [
4963
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
5064
"crn:v1:bluemix:public:iam::::role:Editor"
51-
],
52-
"service_name": "hs-crypto"
65+
]
5366
},
5467
{
68+
"service_name": "kms",
5569
"role_crns": [
5670
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
5771
"crn:v1:bluemix:public:iam::::role:Editor"
58-
],
59-
"service_name": "kms"
72+
]
6073
},
6174
{
75+
"service_name": "cloud-object-storage",
6276
"role_crns": [
6377
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
6478
"crn:v1:bluemix:public:iam::::role:Editor"
65-
],
66-
"service_name": "cloud-object-storage"
79+
]
6780
}
6881
],
6982
"compliance": {
@@ -81,6 +94,7 @@
8194
},
8295
{
8396
"key": "provider_visibility",
97+
"hidden": true,
8498
"options": [
8599
{
86100
"displayname": "private",
@@ -104,6 +118,8 @@
104118
"key": "existing_resource_group_name"
105119
},
106120
{
121+
"key": "region",
122+
"required": true,
107123
"custom_config": {
108124
"type": "region",
109125
"grouping": "deployment",
@@ -113,18 +129,34 @@
113129
"region"
114130
]
115131
}
116-
},
117-
"key": "region",
118-
"required": true
132+
}
119133
},
120134
{
121-
"key": "enable_at_event_routing_to_cos_bucket"
135+
"key": "existing_cloud_logs_instance_crn"
122136
},
123137
{
124138
"key": "enable_at_event_routing_to_cloud_logs"
125139
},
126140
{
127-
"key": "existing_cloud_logs_crn"
141+
"key": "cloud_logs_target_name"
142+
},
143+
{
144+
"key": "at_cloud_logs_route_name"
145+
},
146+
{
147+
"key": "existing_cos_instance_crn"
148+
},
149+
{
150+
"key": "ibmcloud_cos_api_key"
151+
},
152+
{
153+
"key": "enable_at_event_routing_to_cos_bucket"
154+
},
155+
{
156+
"key": "cos_target_name"
157+
},
158+
{
159+
"key": "at_cos_route_name"
128160
},
129161
{
130162
"key": "cos_region"
@@ -168,6 +200,7 @@
168200
},
169201
{
170202
"key": "management_endpoint_type_for_bucket",
203+
"hidden": true,
171204
"options": [
172205
{
173206
"displayname": "public",
@@ -183,9 +216,6 @@
183216
}
184217
]
185218
},
186-
{
187-
"key": "existing_cos_instance_crn"
188-
},
189219
{
190220
"key": "existing_at_cos_target_bucket_name"
191221
},
@@ -205,23 +235,20 @@
205235
"key": "existing_cos_kms_key_crn"
206236
},
207237
{
208-
"key": "existing_kms_instance_crn",
209-
"required": true
238+
"key": "existing_kms_instance_crn"
210239
},
211240
{
212241
"key": "cos_key_name"
213242
},
214243
{
215244
"key": "cos_key_ring_name"
216245
},
217-
{
218-
"key": "ibmcloud_cos_api_key"
219-
},
220246
{
221247
"key": "ibmcloud_kms_api_key"
222248
},
223249
{
224250
"key": "kms_endpoint_type",
251+
"hidden": true,
225252
"options": [
226253
{
227254
"displayname": "public",
@@ -232,23 +259,97 @@
232259
"value": "private"
233260
}
234261
]
235-
},
262+
}
263+
],
264+
"dependencies": [
236265
{
237-
"key": "at_cloud_logs_route_name"
266+
"name": "deploy-arch-ibm-cos",
267+
"description": "Enable this to create an IBM Cloud Object Storage(COS) instance. The buckets to store events will be created by the Cloud Logs deployable architecture.",
268+
"id": "68921490-2778-4930-ac6d-bae7be6cd958-global",
269+
"version": "v9.0.2",
270+
"flavors": [
271+
"instance"
272+
],
273+
"catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3",
274+
"optional": true,
275+
"on_by_default": true,
276+
"input_mapping": [
277+
{
278+
"dependency_input": "existing_resource_group_name",
279+
"version_input": "existing_resource_group_name",
280+
"reference_version": true
281+
},
282+
{
283+
"dependency_output": "cos_instance_crn",
284+
"version_input": "existing_cos_instance_crn"
285+
},
286+
{
287+
"dependency_input": "prefix",
288+
"version_input": "prefix",
289+
"reference_version": true
290+
}
291+
]
238292
},
239293
{
240-
"key": "at_cos_route_name"
294+
"name": "deploy-arch-ibm-kms",
295+
"description": "Enable when you want to create your own root keys to encrypt the buckets.",
296+
"id": "2cad4789-fa90-4886-9c9e-857081c273ee-global",
297+
"version": "v5.1.4",
298+
"flavors": [
299+
"fully-configurable"
300+
],
301+
"catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3",
302+
"optional": true,
303+
"on_by_default": true,
304+
"input_mapping": [
305+
{
306+
"dependency_output": "kms_instance_crn",
307+
"version_input": "existing_kms_instance_crn"
308+
},
309+
{
310+
"version_input": "kms_encryption_enabled_buckets",
311+
"value": true
312+
},
313+
{
314+
"dependency_input": "prefix",
315+
"version_input": "prefix",
316+
"reference_version": true
317+
},
318+
{
319+
"dependency_input": "region",
320+
"version_input": "region",
321+
"reference_version": true
322+
}
323+
]
241324
},
242325
{
243-
"key": "cloud_logs_target_name"
326+
"name": "deploy-arch-ibm-account-infra-base",
327+
"description": "Enable to create a resource groups by default where all the resources will be provisioned and, when you enable the “with Account Settings” option, it also applies baseline security and governance settings. When disabled, provide your own resource group via the `existing_resource_group_name` input.",
328+
"id": "63641cec-6093-4b4f-b7b0-98d2f4185cd6-global",
329+
"version": "v3.0.7",
330+
"flavors": [
331+
"resource-group-only",
332+
"resource-groups-with-account-settings"
333+
],
334+
"default_flavor": "resource-group-only",
335+
"catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3",
336+
"optional": true,
337+
"on_by_default": false,
338+
"input_mapping": [
339+
{
340+
"dependency_input": "prefix",
341+
"version_input": "prefix",
342+
"reference_version": true
343+
},
344+
{
345+
"dependency_output": "observability_resource_group_name",
346+
"version_input": "existing_resource_group_name"
347+
}
348+
]
244349
},
245-
{
246-
"key": "cos_target_name"
247-
}
248-
],
249-
"dependencies": [
250350
{
251351
"name": "deploy-arch-ibm-cloud-logs",
352+
"description": "Enable this to create an IBM Cloud Logs (ICL) Instance which can be used for storage and analysis of events ingested by activity tracker.",
252353
"catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3",
253354
"flavors": [
254355
"fully-configurable"
@@ -303,16 +404,12 @@
303404
}
304405
],
305406
"dependency_version_2": true,
407+
"terraform_version": "1.10.5",
306408
"architecture": {
307-
"descriptions": "This architecture supports the deployment of IBM Cloud Activity Tracker Event Routing to an Object Storage bucket and Cloud Logs target.",
308409
"features": [
309410
{
310-
"title": "Creates KMS-encrypted Object Storage buckets for log files and Activity Tracker events",
311-
"description": "Creates and configures the IBM Cloud Object Storage buckets with archiving and expiration enabled."
312-
},
313-
{
314-
"title": "Creates an IBM Cloud Activity Tracker event route to an Object Storage bucket and Cloud Logs target",
315-
"description": "Creates and configures the IBM Cloud Activity Tracker Event Routing to an IBM Cloud Object Storage bucket and IBM Cloud Logs target."
411+
"title": " ",
412+
"description": "Configured to use IBM secure by default standards, but can be edited to fit your use case."
316413
}
317414
],
318415
"diagrams": [

‎reference-architecture/deployable-architecture-activity-tracker.svg‎

Lines changed: 1 addition & 1 deletion
Loading

‎solutions/fully-configurable/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Cloud automation for <service name> (Fully configurable)
2+
3+
:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers).

‎solutions/fully-configurable/main.tf‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ locals {
1414
cos_key_name = try("${local.prefix}-${var.cos_key_name}", var.cos_key_name)
1515
at_cos_target_bucket_name = try("${local.prefix}-${var.at_cos_target_bucket_name}", var.at_cos_target_bucket_name)
1616

17-
cos_instance_crn = var.existing_cos_instance_crn
1817
cos_instance_guid = element(split(":", var.existing_cos_instance_crn), length(split(":", var.existing_cos_instance_crn)) - 3)
1918

2019
use_kms_module = var.kms_encryption_enabled_buckets && var.existing_cos_kms_key_crn == null
@@ -66,7 +65,7 @@ locals {
6665
target_ids = [module.activity_tracker.activity_tracker_targets[local.cos_target_name].id]
6766
}] : []
6867

69-
at_cloud_logs_route = var.enable_at_event_routing_to_cloud_logs && var.existing_cloud_logs_crn != null ? [{
68+
at_cloud_logs_route = var.enable_at_event_routing_to_cloud_logs && var.existing_cloud_logs_instance_crn != null ? [{
7069
route_name = local.at_cloud_logs_route_name
7170
locations = ["*", "global"]
7271
target_ids = [module.activity_tracker.activity_tracker_targets[local.cloud_logs_target_name].id]
@@ -105,17 +104,17 @@ module "activity_tracker" {
105104
{
106105
bucket_name = local.cos_target_bucket_name
107106
endpoint = local.cos_target_bucket_endpoint
108-
instance_id = local.cos_instance_crn
107+
instance_id = var.existing_cos_instance_crn
109108
target_region = local.default_cos_region
110109
target_name = local.cos_target_name
111110
skip_atracker_cos_iam_auth_policy = var.ibmcloud_cos_api_key != null ? true : var.skip_at_cos_auth_policy
112111
service_to_service_enabled = true
113112
}
114113
] : []
115114

116-
cloud_logs_targets = var.enable_at_event_routing_to_cloud_logs && var.existing_cloud_logs_crn != null ? [
115+
cloud_logs_targets = var.enable_at_event_routing_to_cloud_logs && var.existing_cloud_logs_instance_crn != null ? [
117116
{
118-
instance_id = var.existing_cloud_logs_crn
117+
instance_id = var.existing_cloud_logs_instance_crn
119118
target_region = var.region
120119
target_name = local.cloud_logs_target_name
121120
}
@@ -137,9 +136,9 @@ resource "ibm_iam_authorization_policy" "atracker_cos" {
137136
source_service_account = data.ibm_iam_account_settings.iam_account_settings.account_id
138137
source_service_name = "atracker"
139138
target_service_name = "cloud-object-storage"
140-
target_resource_instance_id = regex(".*:(.*)::", local.cos_instance_crn)[0]
139+
target_resource_instance_id = regex(".*:(.*)::", var.existing_cos_instance_crn)[0]
141140
roles = ["Object Writer"]
142-
description = "Permit AT service Object Writer access to COS instance ${local.cos_instance_crn}"
141+
description = "Permit AT service Object Writer access to COS instance ${var.existing_cos_instance_crn}"
143142
}
144143

145144
#######################################################################################################################
@@ -271,7 +270,7 @@ module "cos_bucket" {
271270
skip_iam_authorization_policy = false
272271
management_endpoint_type = var.management_endpoint_type_for_bucket
273272
storage_class = value.class
274-
resource_instance_id = local.cos_instance_crn
273+
resource_instance_id = var.existing_cos_instance_crn
275274
region_location = local.default_cos_region
276275
force_delete = true
277276
archive_rule = local.archive_rule

‎solutions/fully-configurable/provider.tf‎

Lines changed: 14 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -3,22 +3,25 @@
33
########################################################################################################################
44

55
provider "ibm" {
6-
ibmcloud_api_key = var.ibmcloud_api_key
7-
region = var.region
8-
visibility = var.provider_visibility
6+
ibmcloud_api_key = var.ibmcloud_api_key
7+
region = var.region
8+
visibility = var.provider_visibility
9+
private_endpoint_type = (var.provider_visibility == "private" && var.region == "ca-mon") ? "vpe" : null
910
}
1011

1112
provider "ibm" {
12-
alias = "cos"
13-
ibmcloud_api_key = var.ibmcloud_cos_api_key != null ? var.ibmcloud_cos_api_key : var.ibmcloud_api_key
14-
region = local.default_cos_region
15-
visibility = var.provider_visibility
13+
alias = "cos"
14+
ibmcloud_api_key = var.ibmcloud_cos_api_key != null ? var.ibmcloud_cos_api_key : var.ibmcloud_api_key
15+
region = local.default_cos_region
16+
visibility = var.provider_visibility
17+
private_endpoint_type = (var.provider_visibility == "private" && local.default_cos_region == "ca-mon") ? "vpe" : null
1618
}
1719

1820

1921
provider "ibm" {
20-
alias = "kms"
21-
ibmcloud_api_key = var.ibmcloud_kms_api_key != null ? var.ibmcloud_kms_api_key : var.ibmcloud_api_key
22-
region = local.kms_region
23-
visibility = var.provider_visibility
22+
alias = "kms"
23+
ibmcloud_api_key = var.ibmcloud_kms_api_key != null ? var.ibmcloud_kms_api_key : var.ibmcloud_api_key
24+
region = local.kms_region
25+
visibility = var.provider_visibility
26+
private_endpoint_type = (var.provider_visibility == "private" && local.kms_region == "ca-mon") ? "vpe" : null
2427
}

0 commit comments

Comments
 (0)