diff --git a/.catalog-onboard-pipeline.yaml b/.catalog-onboard-pipeline.yaml index 3763bec7..fbcfc416 100644 --- a/.catalog-onboard-pipeline.yaml +++ b/.catalog-onboard-pipeline.yaml @@ -12,3 +12,6 @@ offerings: scc: instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37 region: us-south + - name: event-routing-account-settings + mark_ready: true + install_type: fullstack diff --git a/ibm_catalog.json b/ibm_catalog.json index 8b590ab3..28404dd2 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -493,7 +493,7 @@ "features": [ { "title": " ", - "description": "Configured to use IBM secure by default standards, but can be edited to fit your use case." + "description": "Configures the Activity Tracker Event Routing service to route auditing events to an Object Storage bucket and Cloud Logs target" } ], "diagrams": [ @@ -507,6 +507,97 @@ } ] } + }, + { + "label": "Event Routing account settings", + "name": "event-routing-account-settings", + "index": 2, + "install_type": "fullstack", + "working_directory": "solutions/event-routing-account-settings", + "configuration": [ + { + "key": "ibmcloud_api_key" + }, + { + "key": "default_targets", + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "primary_metadata_region" + }, + { + "key": "backup_metadata_region" + }, + { + "key": "permitted_target_regions", + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, + { + "key": "private_api_endpoint_only" + }, + { + "key": "provider_visibility", + "hidden": true, + "options": [ + { + "displayname": "private", + "value": "private" + }, + { + "displayname": "public", + "value": "public" + }, + { + "displayname": "public-and-private", + "value": "public-and-private" + } + ] + } + ], + "iam_permissions": [ + { + "service_name": "All account management services", + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ] + }, + { + "service_name": "atracker", + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ] + } + ], + "architecture": { + "features": [ + { + "title": " ", + "description": "Configures account settings for Activity Tracker Event Routing." + } + ], + "diagrams": [ + { + "diagram": { + "caption": "Event Routing Account Settings", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-activity-tracker/main/reference-architecture/deployable-architecture-account-settings.svg", + "type": "image/svg+xml" + }, + "description": "This architecture supports configuring the Activity Tracker Event Routing Account Settings." + } + ] + } } ] } diff --git a/reference-architecture/deployable-architecture-account-settings.svg b/reference-architecture/deployable-architecture-account-settings.svg new file mode 100644 index 00000000..d8d16632 --- /dev/null +++ b/reference-architecture/deployable-architecture-account-settings.svg @@ -0,0 +1,4 @@ + + + +IBM Cloud
IBM Cloud Event Routing Account Setting
 \ No newline at end of file diff --git a/solutions/event-routing-account-settings/README.md b/solutions/event-routing-account-settings/README.md new file mode 100644 index 00000000..d1fca3c9 --- /dev/null +++ b/solutions/event-routing-account-settings/README.md @@ -0,0 +1,3 @@ +# Cloud automation for Cloud Monitoring (Event Routing Account Settings) + +:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). diff --git a/solutions/event-routing-account-settings/catalogValidationValues.json.template b/solutions/event-routing-account-settings/catalogValidationValues.json.template new file mode 100644 index 00000000..17aac76b --- /dev/null +++ b/solutions/event-routing-account-settings/catalogValidationValues.json.template @@ -0,0 +1,3 @@ +{ + "ibmcloud_api_key": $VALIDATION_APIKEY" +} diff --git a/solutions/event-routing-account-settings/main.tf b/solutions/event-routing-account-settings/main.tf new file mode 100644 index 00000000..acb7bfac --- /dev/null +++ b/solutions/event-routing-account-settings/main.tf @@ -0,0 +1,15 @@ +####################################################################################################################### +# IBM Cloud Activity Tracker Event Routing +####################################################################################################################### + +module "account_routing_settings" { + source = "../.." + + global_event_routing_settings = { + default_targets = var.default_targets + metadata_region_primary = var.primary_metadata_region + metadata_region_backup = var.backup_metadata_region + permitted_target_regions = var.permitted_target_regions + private_api_endpoint_only = var.private_api_endpoint_only + } +} diff --git a/solutions/event-routing-account-settings/outputs.tf b/solutions/event-routing-account-settings/outputs.tf new file mode 100644 index 00000000..b16a1a35 --- /dev/null +++ b/solutions/event-routing-account-settings/outputs.tf @@ -0,0 +1,3 @@ +############################################################################## +# Outputs +############################################################################## diff --git a/solutions/event-routing-account-settings/provider.tf b/solutions/event-routing-account-settings/provider.tf new file mode 100644 index 00000000..00a4fd25 --- /dev/null +++ b/solutions/event-routing-account-settings/provider.tf @@ -0,0 +1,4 @@ +provider "ibm" { + ibmcloud_api_key = var.ibmcloud_api_key + visibility = var.provider_visibility +} diff --git a/solutions/event-routing-account-settings/variables.tf b/solutions/event-routing-account-settings/variables.tf new file mode 100644 index 00000000..18f5b070 --- /dev/null +++ b/solutions/event-routing-account-settings/variables.tf @@ -0,0 +1,57 @@ +######################################################################################################################## +# Common variables +######################################################################################################################## + +variable "ibmcloud_api_key" { + type = string + description = "The IBM Cloud API key with access to configure Activity Tracker Event Routing account settings." + sensitive = true +} + +variable "provider_visibility" { + description = "Set the visibility value for the IBM terraform provider. Supported values are `public`, `private`, `public-and-private`. [Learn more](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/guides/custom-service-endpoints)." + type = string + default = "public" + + validation { + condition = contains(["public", "private", "public-and-private"], var.provider_visibility) + error_message = "Invalid visibility option. Allowed values are 'public', 'private', or 'public-and-private'." + } +} +######################################################################################################################## +# IBM Cloud Activity Tracker Event Routing +######################################################################################################################## + +variable "default_targets" { + description = "Where activity events that are not explicitly managed in the account's routing rules are routed. You can define up to 2 default targets per account. Consider defining a second default target when you want to collect the data in a backup location." + type = list(string) + default = [] +} + +variable "primary_metadata_region" { + description = "Storage location for target, route, and settings metadata in your IBM Cloud account. To store all configuration metadata in a single region, set this value explicitly." + type = string + default = "us-south" +} + +variable "backup_metadata_region" { + description = "You can also configure a backup location where the metadata is stored for recovery purposes. The `backup_metadata_region` can't be the same as `primary_metadata_region`." + type = string + default = null + validation { + error_message = "`metadata_region_backup` cannot be the same as `metadata_region_primary`." + condition = var.backup_metadata_region == null || var.primary_metadata_region != var.backup_metadata_region + } +} + +variable "permitted_target_regions" { + description = "Control where targets collecting audit events can be located. To allow targets in any region (i.e., No restrictions), configure this field as an empty list `[]`." + type = list(string) + default = [] +} + +variable "private_api_endpoint_only" { + description = "Public endpoints can be disabled for managing Activity Tracker Event Routing configuration via the CLI or REST API. When public endpoints are disabled, the Activity Tracker Event Routing UI will be inaccessible." + type = bool + default = false +} diff --git a/solutions/event-routing-account-settings/version.tf b/solutions/event-routing-account-settings/version.tf new file mode 100644 index 00000000..6005afd3 --- /dev/null +++ b/solutions/event-routing-account-settings/version.tf @@ -0,0 +1,10 @@ +terraform { + required_version = ">= 1.9.0" + required_providers { + # Lock DA into an exact provider version - renovate automation will keep it updated + ibm = { + source = "ibm-cloud/ibm" + version = "1.80.4" + } + } +} diff --git a/tests/pr_test.go b/tests/pr_test.go index d934b457..51963948 100644 --- a/tests/pr_test.go +++ b/tests/pr_test.go @@ -16,6 +16,7 @@ import ( "github.com/stretchr/testify/assert" "github.com/stretchr/testify/require" "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/common" + "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/testhelper" "github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper/testschematic" ) @@ -23,8 +24,10 @@ import ( const resourceGroup = "geretain-test-resources" const yamlLocation = "../common-dev-assets/common-go-assets/common-permanent-resources.yaml" const fullyConfigurableTerraformDir = "solutions/fully-configurable" +const AccountSettingsDADir = "solutions/event-routing-account-settings" var validRegions = []string{ + "in-che", "au-syd", "br-sao", "ca-tor", @@ -36,6 +39,9 @@ var validRegions = []string{ "us-south", "us-east", } +var IgnoreUpdates = []string{ + "module.account_routing_settings.ibm_atracker_settings.atracker_settings[0]", +} var permanentResources map[string]interface{} @@ -91,6 +97,7 @@ func TestFullyConfigurableInSchematics(t *testing.T) { options := testschematic.TestSchematicOptionsDefault(&testschematic.TestSchematicOptions{ Testing: t, Prefix: "at-fc", + Region: "eu-de", // Hardcoding region to avoid jp-osa, as jp-osa does not support COS association with HPCS. TarIncludePatterns: []string{ "*.tf", fullyConfigurableTerraformDir + "/*.tf", @@ -134,7 +141,7 @@ func TestFullyConfigurableInSchematics(t *testing.T) { {Name: "existing_cloud_logs_instance_crn", Value: terraform.Output(t, existingTerraformOptions, "icl_crn"), DataType: "string"}, {Name: "kms_encryption_enabled_buckets", Value: true, DataType: "bool"}, {Name: "prefix", Value: options.Prefix, DataType: "string"}, - {Name: "region", Value: validRegions[rand.Intn(len(validRegions))], DataType: "string"}, + {Name: "region", Value: options.Region, DataType: "string"}, } err = options.RunSchematicTest() @@ -147,6 +154,7 @@ func TestFullyConfigurableUpgradeInSchematics(t *testing.T) { options := testschematic.TestSchematicOptionsDefault(&testschematic.TestSchematicOptions{ Testing: t, Prefix: "at-fc-upg", + Region: "eu-de", // Hardcoding region to avoid jp-osa, as jp-osa does not support COS association with HPCS. TarIncludePatterns: []string{ "*.tf", fullyConfigurableTerraformDir + "/*.tf", @@ -191,7 +199,7 @@ func TestFullyConfigurableUpgradeInSchematics(t *testing.T) { {Name: "existing_cloud_logs_instance_crn", Value: terraform.Output(t, existingTerraformOptions, "icl_crn"), DataType: "string"}, {Name: "kms_encryption_enabled_buckets", Value: true, DataType: "bool"}, {Name: "prefix", Value: options.Prefix, DataType: "string"}, - {Name: "region", Value: validRegions[rand.Intn(len(validRegions))], DataType: "string"}, + {Name: "region", Value: options.Region, DataType: "string"}, } err = options.RunSchematicUpgradeTest() @@ -199,3 +207,42 @@ func TestFullyConfigurableUpgradeInSchematics(t *testing.T) { assert.Nil(t, err, "This should not have errored") } } + +func TestRunAccountSettings(t *testing.T) { + t.Parallel() + + region := validRegions[rand.Intn(len(validRegions))] + prefix := "er" + + // Verify ibmcloud_api_key variable is set + checkVariable := "TF_VAR_ibmcloud_api_key" + val, present := os.LookupEnv(checkVariable) + require.True(t, present, checkVariable+" environment variable not set") + require.NotEqual(t, "", val, checkVariable+" environment variable is empty") + + options := testschematic.TestSchematicOptionsDefault(&testschematic.TestSchematicOptions{ + Testing: t, + Region: region, + Prefix: prefix, + TarIncludePatterns: []string{ + "*.tf", + "modules/metrics_routing" + "/*.tf", + AccountSettingsDADir + "/*.tf", + }, + TemplateFolder: AccountSettingsDADir, + Tags: []string{"er-da-test"}, + DeleteWorkspaceOnFail: false, + WaitJobCompleteMinutes: 60, + IgnoreUpdates: testhelper.Exemptions{ // Ignore for consistency check + List: IgnoreUpdates, + }, + }) + + options.TerraformVars = []testschematic.TestSchematicTerraformVar{ + {Name: "ibmcloud_api_key", Value: options.RequiredEnvironmentVars["TF_VAR_ibmcloud_api_key"], DataType: "string", Secure: true}, + {Name: "primary_metadata_region", Value: "eu-de", DataType: "string"}, + } + + err := options.RunSchematicTest() + assert.Nil(t, err, "This should not have errored") +}